Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-11-2024 09:50
General
-
Target
2024-11-25_8c25628119774509ffcbf6bedbc7bd34_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8c25628119774509ffcbf6bedbc7bd34
-
SHA1
0959b1d94cd15a7e8e427df4839a167d3aae020f
-
SHA256
bd49895f9b6bc3c2c3024915d989bd974f54e8e06c61d38d831c2e4aeb360f09
-
SHA512
2baad64370891799962521bbbbaec757a6b8e4e02eae791870227858a28703e8b165c867599d73868aac2a2a1168a0e0017b30eb2a255191f0e721ada4988962
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_8c25628119774509ffcbf6bedbc7bd34_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_8c25628119774509ffcbf6bedbc7bd34_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dUanSSw.exeC:\Windows\System\dUanSSw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HVUQHKI.exeC:\Windows\System\HVUQHKI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QJeMUkH.exeC:\Windows\System\QJeMUkH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MMFGIzL.exeC:\Windows\System\MMFGIzL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bLpPxgz.exeC:\Windows\System\bLpPxgz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rkplGRx.exeC:\Windows\System\rkplGRx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mNJlxFD.exeC:\Windows\System\mNJlxFD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dfOhqrO.exeC:\Windows\System\dfOhqrO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\voDBaTC.exeC:\Windows\System\voDBaTC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eBNbkcc.exeC:\Windows\System\eBNbkcc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xADDbkk.exeC:\Windows\System\xADDbkk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lRWgDSa.exeC:\Windows\System\lRWgDSa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NdaAXGy.exeC:\Windows\System\NdaAXGy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JSCVQHq.exeC:\Windows\System\JSCVQHq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rcMDUAV.exeC:\Windows\System\rcMDUAV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JNMzRev.exeC:\Windows\System\JNMzRev.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dKWCWwe.exeC:\Windows\System\dKWCWwe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\daMZeCo.exeC:\Windows\System\daMZeCo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LxVdTAZ.exeC:\Windows\System\LxVdTAZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tbrSYGE.exeC:\Windows\System\tbrSYGE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xHVpIwX.exeC:\Windows\System\xHVpIwX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a79fb36ff8c5f8f5425a13bf330902d8
SHA120ef4331d3bb6614e9ee196c3f7b928593072e93
SHA2561e4ed9fe7df6c8110cc803bf7661eef4e1ffa51e714662cba2922243ac76ebb9
SHA512642b3788a0a53aaa998c3e03ee80da363469f26efeb205a5773a237a437d023fe1415c43f3656625c135b16aeae1f734c224320d0dca784a9812e49a88b00331
-
Filesize
5.2MB
MD5e3c3be3415094492dc9ef3c5cb819647
SHA103be8717b0db7ce387e888351b9afb7078affbf9
SHA256ca73c2e45ac0d8cdb1c9d3d27929ceb9ccaa23b0c1e210e3eb3a07643eca4f05
SHA5127d7956d952ac649a4bf1557981134edaa6985e6fdd16af4516edc9bba938f233d58ebf0e97c0021846c84768974d43c01f55a7a241257c21f61e09b2897f9adf
-
Filesize
5.2MB
MD597c3851600f79618e29361d2d4cd5238
SHA1eb4200f3020f9e4ede4eb57d7fd7fc37556cc067
SHA256a541aa67ee8b78cae03383879dc559724ff89ce9d78ee46f1896f850b2cef9da
SHA512ec8ef03b9ebe9060ac19288e1fe92accc8dfec075a8f542b4767d213e8c9a7ad176babc038b347401abd08a2601aab2921ae9786dc7e68d53c8cb3bb4b502293
-
Filesize
5.2MB
MD5393b2bede37394f6870d3cd753ce4b6a
SHA19991ffcbb08238f22a1c1b3fc14e8a302ab16db2
SHA2563aff05fcf75d1cf92e087e9f35e49c633b94cbc2e4768dbe33b91fcd3a4e2a2b
SHA51274c09e0ab378b773b10dbae9739e284c33f4a80af6ba9c20a41f0ee2aac002e0a6e9550efa17e90164d41b895e770a7c1eafb8057617560819d261a3d3366268
-
Filesize
5.2MB
MD56320f5795939137c42b5f95d692b7187
SHA18e3c9e27489b3d61ef7b6bd003a25516f9d235e5
SHA256b479994a4a05391ec8e933d3dba2d7903849f8f2c7d9c6481beff23fec7135e6
SHA512fc4eaa021014655acb7e53f05790ed18aad5064c1667c3d5e2bcfdf7d057fe40ba50af985e2ad7f2cdbf2330be5ab73e9485d4ed5b0c11b8c5fb3a937876d46a
-
Filesize
5.2MB
MD5a79db946269c40844cb2d818313bfb9b
SHA190637f135cf4e29ac87752008359ee679dfeddaf
SHA25645e67671510fee3c8db63b95e82b5a466d0c0d62a3fe12ee05e804a9d36c1b46
SHA5124de8056a7036a3d0323655d221ad95f9b02bd46e22020651aa8391ff30ae73d6aa2a14eb225d03f277b44dadd48f6d754249fc8e798f5c94a7a019564875a5db
-
Filesize
5.2MB
MD501a841b9b60222360e71520d91107281
SHA1bed248a01a22155b00a4a614326805a54165f1fb
SHA2566b8276dafed8ab955803b8f5029c425123c0bc3afeb299d7cb7b7625a02d3f8e
SHA51288fa475b75d0603043b66fb5d919c91e374bfbafa2ba9295ba91cdcb75ac59e39cab602a463c0f0bca4693f2de619cdab7a55ad3a3ace9f0cf2d6516b8644655
-
Filesize
5.2MB
MD52c5f1da121dd8cb07ff5833558ba4744
SHA1519b50077311c6037278616d0f49ef811e0f9fbc
SHA25613987dcef33629ab09795c3ce85b04a15a29c19d3cf18cdcab993f2ac709934f
SHA51262fc893bcde80f1f909476dd2e365ae8ae6173b41f3b919cda17df0a17fa4d901b2b2df8e1f1649de4b23938a01c6bb0de9c735e36042a79929ef67c5a3f1269
-
Filesize
5.2MB
MD59ab7a4cc071bcd915b1a0a8a3f0d7d73
SHA1258c320e0fe1c925e2b94564863c42be47c09bb8
SHA256b1479576e89ea5b3bb529bdade19716bf1d561158bea1726eba95e7fca6cff1d
SHA512f650042862743e3b6f232855c4e9b7424f5f3ecfe66b87e714398e042baf2429d880330e66e94ee512181d2978e1a74157565fb9056ee60a17aea14bf17e4906
-
Filesize
5.2MB
MD58775655c9bfad6ad524deb091b76d4fa
SHA1444a6596c4b48b1a0b5df0d487e649ade99e1350
SHA256b0468cc79a6426629d7cc098678b5a82220f31cb117f9716ab6d48727eaf6366
SHA512b2a5e1e75c1cec96802385880fa56fbd6b40db2d0db75b8da8b12c6286ac07ecb241f11a786f9b05c05f859f99a6a3d7c069edcad2ed43dbcdd8fb866f4d4e95
-
Filesize
5.2MB
MD5217a28a926e52b43840eb17f7d696f8a
SHA1b2218da235ffaf1af8fa2c26f05c8ccbf87e9fe7
SHA2565f4de69a0b1694d7840257b2d05694da7c3e96b01a1019bb28a1d483bb5ffd8d
SHA512bd9e4e0b840bbf2b93a7aaae818274b4d7dba9db3eb7e94c00107da32fc2c6f60a966d5edf12cf7b9d8512f11a165621cd9c642441871dc06e7a2dca3a957008
-
Filesize
5.2MB
MD56803e3996f85880ef523d7aa2e397af2
SHA10be6624a4dd377b305b22d112ebebc30b86318f1
SHA2563c5061b4e3296d032f785bbca47c9f69544e0c4ef3ca73b9edb43a696a4fba63
SHA51225e7ebb5af95264f25224f02595220ade8a956736634558d7966974dcb4489a792bc80602ec304e4514439db77f40cc348ae8ab77c8ccc874b4625af028cb245
-
Filesize
5.2MB
MD5f43029a42226416e8578b6cf0902e215
SHA153ffb2a0dc0cc052adb968ddb3356d096f565a11
SHA2566f52adcddc2438933da80358b9f6e3498f01e5f9ca173b6570520ff5a62c4976
SHA51264991c52295d738d5ef9ce54d2c0651f4ca59bd144d1f64fda2a10a9e30a01eabdf7b35d10a2b7588eef0776df208c1091ab50ac105a66f4e3e72b79d91cd09e
-
Filesize
5.2MB
MD58861b92abcf15adba9798c7f695f05b8
SHA16ddc2eb02c4a790ef877744b1d803b239f30ee25
SHA256a853f889a47d3fb2d6b5c3fd01311ab7971fa2369b580263e32551a0839a4e73
SHA51288a54aa607f1755d61825388c421c6ef7359de250ec32f021f9dffb4d24dec44634d982ad2d060787266e60df39729ba19719f334e11371dbcba8979e8222240
-
Filesize
5.2MB
MD54642af4914dbcdd332858a24067b1e41
SHA18191ad0b598f6ee0f4a4ee1db4b4d4c5328b1c96
SHA2561d5effd93ab3cbddb238a6a01eea5c2f9b600287ebfb38f9ed64af0e67ac99a8
SHA51212041da16e975bf732b5378995861d49c9780501527cc5f8156933f3bcc423d14dbe1c30191dc66d71f98534213eb147b4ca511ec8eeb5b696e98c03fe5cb316
-
Filesize
5.2MB
MD526b88ab354a55b680e25152c71e63967
SHA1268c9213984ce83bec6bfe3d31fa01dbe83479eb
SHA25652f9ad536495dc7eb387b568953de3245d0cbe14180c3cdf30f81a26406e4c32
SHA51279905b51a6d008690ff4876a0f7df038da148b136e4cd0e26cad8da0dd52e237f3aaf18cef85516de705595fd6d7841150945c03fba11c80ed33bb38c3267f5a
-
Filesize
5.2MB
MD53bb277916a0b6868cd6120122e3dcaec
SHA11dc04c797072aae38491f852f22f3cdba3ff79cd
SHA256dccf58d5121e9eef69fe2f90b3b410e739d54a8e6356e07f55f459b377b0f518
SHA512744c202f34cf0f7cddf45fbe6cfa85904b956aaa80019668fcf42fabe50619f8469a9b074d7691ffdf0b392fe53c24fb6836dd0742b3f6e852f9e6cb91ff1f30
-
Filesize
5.2MB
MD5e9df2da0ed8ff8c916597d440cf04f4e
SHA1b2217d82a4651cd3e9767437f274d6b8e5300646
SHA2566c20c37264d9fe3eac5d1a95ff8a3c83e0f6796ca883a65d90607709aa32eb39
SHA51253aa6acb97113ff20fc91395833e8139b67411bb94388406c4369d7b212e8ecbef3225d3d84f0997feb04a49d799bc3502be76b6e0d1c668ec09a92728a95451
-
Filesize
5.2MB
MD55763e135dbfacc90b4c8a59be8b2eff2
SHA12b0845f9b9133df35738bdf4ddfff81e1db16820
SHA256ac79055dbe6fb9961716c30dbb143cb7d9c0d1dc9c09c7303c480b88405881f6
SHA512e201db5e438751d93177dff015be69125c7905be3a62f8ac7e5c61e542d07863ec434001c65b2d684fa3cb0c5a3ad87edea92f8b8fedfff9939a29da5ae51d1d
-
Filesize
5.2MB
MD59aaadbb864655d31a0d7ac763989cd45
SHA184fd988b03f90b85f6d09a510eb02e25306b94a0
SHA256e87b2b9bbc1bd3da8047848cf74d04616916c77a49651479c709279efca15fbe
SHA512c2243b1a7ba90228b7531eca352db054ceba6efacb7dbf126f5ec94c91f8bc5088f8cc36efa533105c60b8b9b5a772add248edb8e83e8eb72349f4283136d402
-
Filesize
5.2MB
MD5156964c088e61eaa8989437e12b6e4b8
SHA13bea035e1b0f5331a1cb0ef6020ec5fd55f457dd
SHA256488a5477e84617629f3a2ebca2a61cf350957ea1f968ea1d60d34e424dd7351a
SHA5129eae59bcbb49b7a09af1d6e7d956a61a4b59b45e8a380050ea06903a8b93fe3e4af536479fb2babc947400db1125413fcf28d7bcd03d8859c788f3c51b6f0317
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB