Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
28/11/2024, 02:53
General
-
Target
2024-11-28_2ba4231eed5377cd8e45a86fa7636aee_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2ba4231eed5377cd8e45a86fa7636aee
-
SHA1
489281ba612c709d404900d043fec4eef2541065
-
SHA256
65ace0cf8021d667fb9a5c17d61c220ae4d1d2d340c725d29668adcad432959a
-
SHA512
8ae0db5492c00445cf00ec8d47e7763f12a07c0958a152515a986f0c26bbe55abbf332e766603bf1d47541e35c87a1a9ae82db552f79980f7546519bed26783b
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibd56utgpPFotBER/mQ32lUV
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-28_2ba4231eed5377cd8e45a86fa7636aee_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-28_2ba4231eed5377cd8e45a86fa7636aee_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gVkbjYu.exeC:\Windows\System\gVkbjYu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jTERRfY.exeC:\Windows\System\jTERRfY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nnFsYph.exeC:\Windows\System\nnFsYph.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VMUPblG.exeC:\Windows\System\VMUPblG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FdaqLwA.exeC:\Windows\System\FdaqLwA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ruaApTG.exeC:\Windows\System\ruaApTG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UcQYUZV.exeC:\Windows\System\UcQYUZV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fwXWezS.exeC:\Windows\System\fwXWezS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DnIgKmx.exeC:\Windows\System\DnIgKmx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ICaylXY.exeC:\Windows\System\ICaylXY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RzQPuaf.exeC:\Windows\System\RzQPuaf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xzDfsrZ.exeC:\Windows\System\xzDfsrZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zJzESTQ.exeC:\Windows\System\zJzESTQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KfivRmu.exeC:\Windows\System\KfivRmu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bpCEfiY.exeC:\Windows\System\bpCEfiY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWYKuIc.exeC:\Windows\System\tWYKuIc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NcNYhhl.exeC:\Windows\System\NcNYhhl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mqVWTTl.exeC:\Windows\System\mqVWTTl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\znsOPMC.exeC:\Windows\System\znsOPMC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\stbSAXk.exeC:\Windows\System\stbSAXk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RvbVIJQ.exeC:\Windows\System\RvbVIJQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d9a58849633fa1000026a47f4c8e4b08
SHA15b3cd65dced8a07401834b83935225897a0f9259
SHA2563780e5ef4f7d4dbe5044395f7129dd8591bc4c711c42a6f8619db5c4947a2657
SHA512e28c64e170f0e08ef78b3990c65d6ad94279a657e18eb23c42b805c11542cb9adac2d6b617952288778f7cb6fb50650adc9ac3e31cc4d55dccaf53fa28b31442
-
Filesize
5.2MB
MD5ff8451939b8f2ec76ae4bcc8c658f5d3
SHA168c017820fc9c6bc5af25ac36d6ce46bf75db606
SHA25635fac6c277ea00874cd9e9d22d698f594ea1d71bbcfb21fae990c9b3473061ff
SHA512a0f2d1614654c791a90cb14b7dc775b659327df6a9b80a3a8667c719e6a4d14f0c48273ee48885a89b160ff1ad00c22ebf3a2270ea9e6ee115985b305171cd50
-
Filesize
5.2MB
MD54d111091fa8e7f74593490a621f2bb18
SHA15a827c726ea47f4cc42b561ab567986fb81bf14d
SHA256fccc9de1ef1bf5761d384f21808a1ffa10808941c40eaf1b2a45a9e3049bac61
SHA512afb566ec1a71ac78cacb01f53d6d6e736dc973e80d101f5043b32e4868e7a2c2e68ccd8c51a5f9c05db77edc8ec45032e651afcedec5d82d73348bccbb3ba17d
-
Filesize
5.2MB
MD5d5169bc3f1eaea8ed208653cdc7cb293
SHA1ac0702aabe24a41b25bde80c41798807d3d6e9e7
SHA25651e1c08fd347c58b9d25398e41d18b823420d7581dda6333917f0040cb0be997
SHA512afafb6d359196245e3502e4dd12dde32bb023b40fa0c40879dc1b862d52848601d4a704ae02b0d185d4a112bc898894fea85c987dd0d8cf119f272391ef2151e
-
Filesize
5.2MB
MD5b59fda96994345d34d9f510a5d3b07d0
SHA1f905176ba74a63052da79c360312221d7dff532c
SHA25651d853a94e443d4327c5a1a93ed5d4a4c8508df462fdd3a7118ad121f1742bfd
SHA51275d39781e974493af1c9f40f6300f1535d257711376898fb3dc04290a9a8db32468c3d9533c8d18330bee6949288b8929d4da4e1c58e64906f8e3f4f2de6b1aa
-
Filesize
5.2MB
MD5aab64e109f9ea7ba204e0df646e828aa
SHA1c1797ead489644695368f2721d67d5eb8936e8a3
SHA2569e3c60120ec4367699fa6bc7457c950df86f0742a19d3a4276cee69ccd61829b
SHA512c47b114a9d54b13fae37c31775c44e34f31ac3e6e40f18ea5d27d870d40744a2bf14b64a27a05e74d5e47af95b63be0bab40ce2ae1a63421d5f02b7b312f7444
-
Filesize
5.2MB
MD5efcdef11ca5ffc014734d465777dd3aa
SHA16d869422f12519a700da04b117cf25c6f6b75d5d
SHA25617758ba3a43c6e41267ad76261d9f03ccb4155d3b1e41fcdd0e387c6b282a531
SHA512b38c28bab0347b9c47182b6391fd21d704a9e32558d2aa007f39cd9c082f7087bdd74a323d7dd7fbafbac4c229f630a52e24b1c21e1b645669b7d5641822cad3
-
Filesize
5.2MB
MD55cdc62f9c2d48035e1b129601c2459d8
SHA17466ccf073456139c0f851fa43a29bd977a7e4b6
SHA25603cbfdc37abc11037d9ec155b1e9b60019e96ed84ead7b04b130dbfff2a36c93
SHA5123c498e87e5e0bc9e167c707326b296901306cbc74dd249c58488868f3cf74361d27714299df3ff852f5cd107d6adea5dbc5350190530ba494e3a0baf6d6bf7c1
-
Filesize
5.2MB
MD5eb24cb4648eb064b4456c2084b7ad47b
SHA187f29c9451e02dd7a59178c8f848cf10d293a9e4
SHA256c6bd4df1b40f2d911de61a411579d6a21fd160562ac8b65a5eda7a80a8d9a77a
SHA5127f35178575ad0837765f34e2ef1b604e52fc76f7bfbf569ce8b8db55bd7e2ffe02e64b67eb80848c2a4e29b2f6b379366dbcef0baccbcad735889adf22048aeb
-
Filesize
5.2MB
MD50207ae76dd4f663d085baf70572c87f4
SHA12ea1065fbc712a913083d8caea0bfd375e18e85d
SHA256f25151e01264d56ced529754e439db4b2abe653d0ef76bfe04b43e6e7d28667e
SHA512485252f9bf0c7e057be582063a8ba78cf004f74a5e862b976e28d981c02b1a6125084168406fb6bb90e3a60c7d3d4806704ece069201d2b8f269ca1852078bdf
-
Filesize
5.2MB
MD55b75f5ecc188c09e43a1ab059040c7a4
SHA1600dc7b69db80f6bedfd7fa8600ad0a48950914d
SHA25695cc75995c7bf60da0fe48700fb1e80fb2444951bae2522277c6b017afd2ba4b
SHA512994a33c7103b9d9ed970a05d684cd54b27c31e551e2d6b13f7513ff5c6411dba9e224d5685a2606af46d5532f7a0a4107a06ea025280af2bf77a4ce28f215c99
-
Filesize
5.2MB
MD554fb3e2ef14798656016dbca39dd8ea3
SHA1be97fe365cf984e6a1e13b26f17492e30d24a7d8
SHA256794102d289ac6203f049658695988f736b546f18dfd037e379f4d9574da8c20d
SHA5124b687581554a2b8b2feb0c94950fe5d98ef571caa33c4feb3965984a618e7c8da3242d2c97e677cd7753075bfeea1713d571b88fb10fa6364d0a086dfd1c42ef
-
Filesize
5.2MB
MD502a08c72dd9bf5b804be338687245c21
SHA1c35727603ca52fd5a1513ec4a7724312f13a7177
SHA256b79de9d8e8d27699b79e8ac026dbf43783296c5e238d0f7f646778641efc8216
SHA5122b4f9bba3fe5cd1366686cc4dea939aa9bf74d471ade284d7cbee1739680c568267b0e24dd456f8b8e4fa60ae4d90ddced9ef19548f630924bb6f33033205b87
-
Filesize
5.2MB
MD5c14bcb534f552fcf42d78ff808a48139
SHA185b8b19c35c55305915c5a2d2d7a412137bd1aa4
SHA25688dec95e101a2ede54758847d2edcfda54b66e9d7848f525d5a6485b5cce37d4
SHA5124120097c9090c740b0d9ddcd7026bfc1b8b3c0665538d508bba6f599968db29903b5482b088ea751ab3195d8efa832929cd4d0f845ffea27f2820ec49a7be05c
-
Filesize
5.2MB
MD5649f997086586afed290133315abe82b
SHA11d50bcbe2138b0b2508487279d05ddd35f8d6418
SHA2561f09cd2ed625b19243634e8a9e31b816fe5ccaf33d7013b80992ce2d40842ce5
SHA51287eb7052447aefb1ad3bc8cdb732d1d9e8f05e48907354645de82b965a2f06afe70484c0064661b211925d4a3b28d20f61ec086124ec193c1fc51d2c9dd6f90a
-
Filesize
5.2MB
MD5ad97c68738bd4bc47cf50699b24a392a
SHA1b270b820f66ff6b49327648e64c53fea2c5a38a4
SHA256fdd75ddb1a459997078f84d58eae2900d546a73c681d80ca7488e9732fdb3a33
SHA512854e90436de0ab7bbcd8f74157bf06aeffa2139b9e861d2cb08e88676b4e1d6a082ec50a9d3c52539a438109236b7baeb28ec483a74365a207cf0928c0918988
-
Filesize
5.2MB
MD5cfd308a6d1cf18e83e86bc6a115479fc
SHA1c238928471a45dee89db3d0bd5929ddb73179826
SHA256ded29553488c5f3d3751d8e7cbad0a6270cc134899d0802bf02979ceab16ca2a
SHA512f5893d97eba83d92c77f3196d575a165e63a4c6dc2cfb4e8743c9c671fc737e4d503c1966ad72c5e651407383e9856bfdaf2633956a0e5c420faab80e3b60c30
-
Filesize
5.2MB
MD52b82f5b4ca96c12608dabe10e6528519
SHA15394037fdddd920ed8dc9b1878eb4e21af993723
SHA25666533a5179f10a1287f69d9c472c4c6e9a6fb4ca5c9ea172d789bf1a3dc1c87c
SHA512806863279b27fa52973eb7feef842485de683e417973076c3614ba651fb99c379d1689a3b433c8cff88f529ac9d730016b5fd6e5edf43a1a7e4aae999d965ff5
-
Filesize
5.2MB
MD536ccbcd5e290dbb1c2d7902ca8398dc3
SHA1907b7de7c4346948b12ed4663417464a69a41952
SHA2569616ade7bce757d1895c3e9b7cc8b4c21def824cb0d50b081cc14a889b54b473
SHA5128a90036ed51d1c5a2af463e898fa8424035d8a7aa689ba182a65f5c8135d4ac82a469bde9bc4f3639daeaac535c4fab6c237f163e6efbe49fa6c952cd051af80
-
Filesize
5.2MB
MD5f8ec8a12961e17dc533d81f046dd820a
SHA1fb8fa87d1ffe6745ee3cdd551a3eecc36145a0eb
SHA256e82066bfb32f01f0c43bb25bb3e6521e4086ddc2bb851a204fd614fa4936e7db
SHA5128bc0c11b3a85d37abe586fcd081232e6a6fbb8d460aa96961bd596bf0dc9f873046e3ae6806ac9c510a307152eca350d0d147491e056fa3fc883488ba993d288
-
Filesize
5.2MB
MD5f2277ad2c89a7ee146342c27edef8fc2
SHA1878c0b40b30f451c4a46734f4068a54d4d82d034
SHA25630242672a226be654a66c9f3a94f39dedc0e11e8e887183650c24f380e50b707
SHA5121d5a5936c78bfb8d67afe09ef49b2f17209ef3e9788b436f103a1f781bc1996d33d84f1e1fa49333600784b06e2b13f180d0930824be4a41f45fee8cd89d9362
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB