Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
27/11/2024, 05:50
General
-
Target
2024-11-27_d31fb6c2cf82b4e857decd78bcef96d2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d31fb6c2cf82b4e857decd78bcef96d2
-
SHA1
184c68738f7fad8f8525ca08754d481ca506178d
-
SHA256
3af20af6b5aeca5f6458725934eced4bc92c875295ac4b71cd95f7b722365d4d
-
SHA512
e00b9ff7a147a30c775c3b941724a8cb11c04f8b457a696599dbf9c000324418137a45ae2207cc0337ce353c14a96845ed016cbf68f5d3d42fd685e0521285e5
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-27_d31fb6c2cf82b4e857decd78bcef96d2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-27_d31fb6c2cf82b4e857decd78bcef96d2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GtdGgiS.exeC:\Windows\System\GtdGgiS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LpGdZvf.exeC:\Windows\System\LpGdZvf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JXzLjdt.exeC:\Windows\System\JXzLjdt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Vlbkbkc.exeC:\Windows\System\Vlbkbkc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tCuMzfK.exeC:\Windows\System\tCuMzfK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WLGNZpV.exeC:\Windows\System\WLGNZpV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZtSurpQ.exeC:\Windows\System\ZtSurpQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IMmDaNQ.exeC:\Windows\System\IMmDaNQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tQgqhRK.exeC:\Windows\System\tQgqhRK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UJIrrQG.exeC:\Windows\System\UJIrrQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bEIeUqF.exeC:\Windows\System\bEIeUqF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FmjtTVw.exeC:\Windows\System\FmjtTVw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uJIOApu.exeC:\Windows\System\uJIOApu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pyEGVkR.exeC:\Windows\System\pyEGVkR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ArVoGHe.exeC:\Windows\System\ArVoGHe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lUqZvqO.exeC:\Windows\System\lUqZvqO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OdPFRRH.exeC:\Windows\System\OdPFRRH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zxyxLfA.exeC:\Windows\System\zxyxLfA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DBitGVF.exeC:\Windows\System\DBitGVF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XXBLoIY.exeC:\Windows\System\XXBLoIY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FrOHaQH.exeC:\Windows\System\FrOHaQH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e131b4d5a67c211a5a7887c068995d7e
SHA10af86ffa374409f5737e1a48e7b1e571dba08380
SHA2565ff4095dd678d4ce592fe9ca8dcdc5c522c1faabd61ac1cf5114c133882e7837
SHA512fdd0688d49b4a63a3ddefe5b0ca4a297d3788853a2d95ac09501afa72b2e65b8cffa1ad4be8246401ce5911865262ee834f42cf3e1f111194d4b70af2e6eabdc
-
Filesize
5.2MB
MD5076327262fc1a84fd3ee3da10d702f38
SHA1a45562160d033c4922f9d33547dc15627b372a37
SHA25686046e0fd0cb058109e100255e898fcb7f3deaafbefe6c9c8e282c129c3442fd
SHA5125d64c4a0dd9094c1d0a39e6b27e5157ec0079c2ba04d9bd430496157f42031f6138ff9798b86ab3f1adab778734f3e05f7a8f842513ad97081a17bdfc4e5a14c
-
Filesize
5.2MB
MD53dfa2dcf77e94ca79d8d5b65810b3145
SHA19163e93e9f09ecb8887f920934769275e785d80b
SHA25662562d949f46b439bd9e0c163ca3d590bc89b831e8bc3d71ded938907e16d2ee
SHA512fa2b4410118b31d5f71e3d647bfe18e8aaaa48142fd3dd42b15ea423871e95b79d7aeeb4223377db98a03195131af1328aa25be763713058e941b40b078a4367
-
Filesize
5.2MB
MD5aade44883e046c4604c7fbe68d95a8dd
SHA18b0b8fadf4a42a82aec56dece0d4828f4457cc7d
SHA2563862136119567acfdfde9c383e02c13fe489160db8f52e96b7b713adaa2716b5
SHA5124c1a3cd280461279edb6221990549d67f6b6119546958ee5a39e6b722a014479466449074792dc41df6d8c48dafde30ae402087b3143a7ec45934f9c72799b8c
-
Filesize
5.2MB
MD558f3e63fd9c165e3764e5c0a29bfb680
SHA108ca7b061dfddcfccb215cb4b5817a80fd5c0c62
SHA25659159b3b2ce82ca3292cab117123fb57953ae3a6352bc9f273862c6797f8391d
SHA51236151dd832b4c0cac6221a393d4bc8c2d70b7af2ed3ee6e3bd337dd25c398bfad207f3dfe67c3d6b6167dfbdb0c6a5efb68e20a0663409088772d880ac614c3f
-
Filesize
5.2MB
MD59fcfe26a3144bcf0d20033c6f303cdfa
SHA19925665025c511d473e58c3fd2b24bb5e01e9ea7
SHA256bb9b5aaebe487ddf622efe8e871b1d9c3465445cb0b6e5ae7d3b4b808c25e2e5
SHA512510b5a2661cf3f2a949d3cecbecb67b4ea7676e5441513f152fdf2964b36fcb6a5d9f9f437875334d1d6cdd83c99bfa838a0796e09cc5740adf1d3f173ceb7c6
-
Filesize
5.2MB
MD5b59a8286349519296918396b14190fd8
SHA1942370a2a8aae4254759d9198a4ba7d90b69991b
SHA256ba598090cc5116836b9182d99d88fdb53bbce0465b6db71361f56e66cce53a6d
SHA51296838a482b1f4ff089c591c055b5d441c4b9be710e89d4b7e32c9856255122c45a68c2a373a3ed15471b2893e1c3308dbaff24bcf62244f3a34bbc361f3da5c8
-
Filesize
5.2MB
MD5d8fa11b59bb08365122ca638a1be511c
SHA14e25a8b9ccd1789af02b7b0852631eda8df57680
SHA2562503b55ab94c87f549d5cacb46cb11487436bb84cdfefae89a716bb2d99409e1
SHA5125d2060090cdda7e7bea342fe5299a845feb86e3533b61582e7ea028331fd0876b9411e82821a1c01b26318566c52ecab2986dcee5bc6275157f44171e9d1f56f
-
Filesize
5.2MB
MD5f4658ed21e4b72becfa99c3315fe0460
SHA19e2890fe6494a77686e4f066de43efe5cf459abd
SHA256c32997a0f289e28019d7e375583595c562be3e3b6452022ad09fd45c1f18bb0f
SHA512facb4801e17d560f866d9bc788bdc127658c42b5f8a0dcd3bee1488bd0644af2b33fe78c0073a53d4f8a8d3604c9234539831e677e04ca626f5c53b89c1ceea6
-
Filesize
5.2MB
MD5188c10f484b40226d11236556196dd1d
SHA1268dbf4710d4581d1b8ae492b39dac8105d16541
SHA256dbcfa2a2c696e7349cba3977592843f7081dcc99e96abac9e07de299bb22cbdd
SHA512d7bc9fb6a6db39c696018020ae4da8f0755e0abdae99bc38192b2f7f3bba60eba29c115eb7932791d171d300ce1824955f7ec8d6308c7a751055221f5783c648
-
Filesize
5.2MB
MD524167294371cba9ce3a135353b985422
SHA18279b642b00b0c6efbea585eae1b7a611fca3d98
SHA256e5aaa2f7b61febefb2e5d5a69acad912462f08a01fc5eb13c4ed5de38b1d0af0
SHA5128ecb77bc068f64ae76c20a4b8bf14ec4dfc22c3fac0c4b75f8a16570ccd0a2280902a1250c4a07d43c513ab50906846487b777abaab905cdaef987b383c08002
-
Filesize
5.2MB
MD5d7ea278636ed77be71b46962d60f3699
SHA1ba6f687eda20730f56f9d396982726f541a6bd4e
SHA25677014bd39d39c5e07d75f00b74f7833b43ccc5e629ec614539dad04f067d0d3d
SHA5124e98a4b9b2bd07a5d3118cbdcf86e337adcb35dc78cd718b9ddf16f68f6891e158e05abb43c25e981927ab946a866fd995cc6228d0d4e1ef8fbdbb260a1a6082
-
Filesize
5.2MB
MD5964ac7e68fbf3a94d78dfb532543375d
SHA1936083de1561a70004ee068506b57c6fe0ae9b02
SHA2563c3808ef512a4b6fe9114d74b95aee69805bc4827ca199d3152f8afad1b44da2
SHA5123e0eec73d0ad8fdb1ff6f620b0050f014dc08b04b86c89a361657e5127f487cc3d3750fddfb48a61dad162d7021f492e02e74775f1a2b4fa301fae3bfc0e6ba9
-
Filesize
5.2MB
MD5e91313df9df4a5300db459252d7a1098
SHA1daf8184736624f676348041adad732329d6724c8
SHA25650690faca7d5de0a8d05cafa0d6a565910d4bd5f8263cee2f005909325586e94
SHA512f6e469631d5ace6f816b3c807096bdf9e25cc2dd456a77ee89ca2f635876122bf1ee776bc35bb8c4be1e68b388c7e65249a6948ad1284a4509a73efa37e59dca
-
Filesize
5.2MB
MD53aa5c0ed67319b5d52db677f676fbc76
SHA1fc8a91cf7a389f599163d42abb1e7cd73a4da5fe
SHA25661b8db76573c1595db6ae1988da75de9d2776b1807c7b8a82cfd9039bdf9d59d
SHA51223443fafcb8bd67f31c2c6976fe9a45a745ff7fbc7263ac02a175bd5b99fb0c52854f54b5a33cc3f084158d533b432bdc70d723535bb36a30e2f0efdb216c65a
-
Filesize
5.2MB
MD54732919c3bf3f4cb1716a07561932e3b
SHA1b34243803f73735fd03ccc82223c3efb0528bb43
SHA256b7bbb2ca23a9bb81e0d344469f42e8d1be64d13cbc4ed1422e65795b87018d1d
SHA5129e9786c481fd40b34d6218852578dbda875bd1e39f7a1e0200c40d8fbc038ab5336502612ec5c1ec368d326aefafdc9b1e5a85f7cbbe52ca982095041416c91c
-
Filesize
5.2MB
MD5ba88132ac0830322087bb0b21c02f96b
SHA117fcd86690e959059b973d27c6afe8d58a745d04
SHA2567f658dc9aede555e2ac0af6e6a6f9411fd6d19888423250766726398bbd13fe4
SHA5128ff2b30eb7b508bf0ced871a851fd05a7bc1598a026c99b0310dbd4bc4054166e0e2929af786ea2b237c4233738a63c204b8f9c65d49826c2d6d28cade0180fb
-
Filesize
5.2MB
MD559ee41a557a04d6bd18280f29b30428d
SHA1a9d49e5630b1c0aa0ca73729dbf01c102f1dfec0
SHA256e49b28837048b4c1bc640828ad680d35b0ce0eac7fa8971d8877c75cbdaad824
SHA5124616f8754f050c5794b39ac0116b382712c2421493643dd873929f3de14ccda9c4b9141290c575d2e8c26554f7df95a2b3a34b4d533baf15b07b8a593a752f01
-
Filesize
5.2MB
MD51a00ddb9b3be303da1cb6d7b44f4d71a
SHA1ac01d284753e6c689270588c92f2e8b392a0762a
SHA256678fa3ad298dbd3b1d14b9f53cdfb58f2dcd7273c77a1a7145b976747d66aa19
SHA5123888a56b9db67128594185c4836f04d81e7c0a1b2fc408bce909e1a1807bb4ee6f8a707a1e87ef3d9845d5ce13112bc4d77616666e1e352531221fd49d5af921
-
Filesize
5.2MB
MD557feb9f985c74a96e440f0ce176634b5
SHA1ff7d3dc6b8b8d9070adc793d8de4f8cf2d058623
SHA256fdd32f6469368794205a69eaffe7b1bb580143b2fd26e4d8acc077504648facd
SHA512b848761e6ca62f527fab041ced4bb13e515a1bfb0b57d38806764884f48276a13696a6ec0c142b006d407e2d5da407ebc133b496fec5193294599ff6d06beaae
-
Filesize
5.2MB
MD53d181736ed05a595ac7e6ef9c79b3510
SHA137a433c184ae58720ea59a9627f5461026ba0c42
SHA256f5e3281ab25d4906724a71d35c374e1f0dd6e596f1c0f1b05a3efe298da2c3a2
SHA512747e992ff7e0e7c5b12d8cc6d2414db1e707eab72f92858ed4118fda0699eec38a25184f41385ecbc3947a5a6244078cae957cec1d30888f4eb8fc566e343bce
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB