Analysis
-
max time kernel
140s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-12-2024 18:08
General
-
Target
2024-12-05_8eaddb3daf30a3c0aba8b19d798cf8ea_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8eaddb3daf30a3c0aba8b19d798cf8ea
-
SHA1
edfba34fc8228455d412846c809b8e26a88629d2
-
SHA256
9525f2e61ae4121173c0a320994316d941a95ba3687a19945f300a5e47934778
-
SHA512
20a7daf4a03c44e06660c1ea9439b0ce1520827ebe8c4d56d7d9248a2cc2f66dfe3f054a2dd5c35909cc46cbafb5fe6ae04999151f954302b2daff2c6dce84ab
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-05_8eaddb3daf30a3c0aba8b19d798cf8ea_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-05_8eaddb3daf30a3c0aba8b19d798cf8ea_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vwNAQPG.exeC:\Windows\System\vwNAQPG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hpVaaAw.exeC:\Windows\System\hpVaaAw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PmOUtUk.exeC:\Windows\System\PmOUtUk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PVKLzhC.exeC:\Windows\System\PVKLzhC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iJlOexT.exeC:\Windows\System\iJlOexT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BvWnkQU.exeC:\Windows\System\BvWnkQU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YWNaLaI.exeC:\Windows\System\YWNaLaI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xUvLQEl.exeC:\Windows\System\xUvLQEl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JCDIbqx.exeC:\Windows\System\JCDIbqx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YGuKDqM.exeC:\Windows\System\YGuKDqM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\glyBrrT.exeC:\Windows\System\glyBrrT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PYjlogv.exeC:\Windows\System\PYjlogv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IQQLCcX.exeC:\Windows\System\IQQLCcX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uTsiRDo.exeC:\Windows\System\uTsiRDo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sQLBdCL.exeC:\Windows\System\sQLBdCL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pELElvk.exeC:\Windows\System\pELElvk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\itJCBIS.exeC:\Windows\System\itJCBIS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qzdIzzc.exeC:\Windows\System\qzdIzzc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KPmjgig.exeC:\Windows\System\KPmjgig.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XxDNqsp.exeC:\Windows\System\XxDNqsp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wlkTeWH.exeC:\Windows\System\wlkTeWH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51724732d175be298410be07fe7a4a588
SHA1cf064dd848f347f6b7cf11f909cfcab8e9ef5320
SHA256318a78f353a91bbbadee81b146551b93813ff8ca284c00038f4bc7aa0a7643fb
SHA51233e53460c93f4ac99da1b3d178d2ff7351599fba528688c9721d67f88296db7b31b2b3e2a3a85f69786540e5b90dcd3486050671b01c5a14dbd654cf11643ad4
-
Filesize
5.2MB
MD546a5375e36c8f8fd196f6aec151fd988
SHA1ae3d58b19f0dcc158882e526486ce449be2e9ac9
SHA256cc3df302bbd1a299f61802a2342ac1598ccbeaaefa7970c3d743f0849f29b10a
SHA5121f0f1e96b62822c2ab8b2a006fc9c2187bf97349751ff6df205e987a83c148bcd0fa42fc26ea76e66bec89f2b668644f2ff9b6e88d3e18362a1c550336eab33f
-
Filesize
5.2MB
MD5a0a6630d76756d3e60e97c621685e709
SHA1c8410e91329b2f14e2538483fe5dbb1901ad4700
SHA2564e31f75e9b84ae2f288136d48d592485b1dcab317f3484dedb627fb0023c8ee4
SHA512054aab8a8c44feef92471309155159c9767c9e574e89de644a8ba6dd84ffcb417751436f2effc36aac1f11fd80ff642b1917af6690a022f7e20e93f38d365a7c
-
Filesize
5.2MB
MD56931612609b9d8537eb589e8789ee3bd
SHA157d41fea8543380ecc562c7e168bce112a596519
SHA256e93419c82181ef54bb505110711507fd9419ee7c301306b425ba645b0b2434f6
SHA5123deb455016f019cd92dc00df76834e47aeb23f6368f334bf44eaa5112b764a545abca8cc830fba810fba548878e91c994f3cd08c39313bccbab541779f0d03cf
-
Filesize
5.2MB
MD56274e72e23ca63d622c35e5c13e4bb07
SHA152d3e6929307ae857462ed0d361af7d0ebe34282
SHA25624b541dcbbab7dfb91841e2cb41af92a6f1d10c38c7cab0f45cc53253062c100
SHA512f94f1e15f64fd79765e2440f7de13a51c138d760dbdefa9ef4fdb91f854f21cb2a81e575195d145fb9e5718c03172783118baa701cc8f8971aa62a4230c57a2f
-
Filesize
5.2MB
MD5c29ba6e4763549b40360b3131f3efda1
SHA1ba65d402f48d58624292275d4307dd6b7abd3eb3
SHA2569a0da19a0fe515cff61fcd3ed11f2075a43a3d02c731bab5b3e26b8cfbea98ab
SHA51296227e6f8f9222e284cb9516dc63120cab4afb049a442a18cc7231389229d0bebd7df1cf8294edb4506687ab2bd56524d17ab2186a5dc3273dea5259031be608
-
Filesize
5.2MB
MD5dd7406b8b775f1ba92b9bb17eacb4029
SHA15520c75f347c276d9c05603e09d5c1c7c657d4f9
SHA2563dab58ba89c214edb29a0002edf5de1066f900f70e886b73d4597e03c94f2fc3
SHA512b6c97302a796d2f859ee0a07f3703f77749bf248b1dfdb45b5dcf1212492b830d65a9133bc1a64b5b42a67ea6984c5bd4bd3839e95acaa8320b81c9ee3654c31
-
Filesize
5.2MB
MD53e26dbcad961297aaa979244ae5ce7ae
SHA110e2471879c7a15783d8d7ccf9131e65dcf59e18
SHA2561e621d87cdce780018bc601518156dd95ca760e33843ed2d54cf62f154156ed5
SHA5123d566eb4c6862cb3158c5eb85d9fb9492ed09c2241d425da3b10e55cc93ea55650a231cb2756001bda2e40d7630140b41a63274f91b82f2b0d7850653bf67383
-
Filesize
5.2MB
MD5dffd407ea13be83dbb03f8280683f789
SHA1f0a4d7605a5d924f24c4e0b917b54d1072f322d2
SHA2565bf4f180c4e73c9ecab978e6046e8d73df9accf54576eae34b2743d8ceb2c509
SHA5126411ec45aae7b76416ebb840e5dfb93b1ac57eac4f13f6360ca53d97636de9e4adc63b5a4dcbda3e0588fcb14513cc10287f7a5765d155f22319973cc60b0945
-
Filesize
5.2MB
MD59a48108927b5bd7031508e58b082df08
SHA1c9eb00cc2d5942ef87f5d005caa2e03db9b1cc30
SHA2565230add9a48a9c3d581a7d439d383b18b08409ef9f6e8db98cc3939b6ad7e89f
SHA5121817f7d6ff1d95b52464c436521ce29d50258a1fa40d1724a2e1fd9258228dedd6a9cea83d00db4d62fef171ee9fc11cac02277fdd2447b4df1f91ac1b1b0759
-
Filesize
5.2MB
MD57cafe824a0bb7afe4e9c44dfa50c4cab
SHA10dcb48999b9864d64d7ade4f68dbddaad9711d8c
SHA256e467e900320981817ce2b673decb0a76fbf36d96bec6c66d2d58638856ad9a69
SHA512005b21fd98a79cdec330835e34b8e7490c9a3a059630459fc284b48486931801ceb112a8d3c992117fccc3e1202802bf2c25e7a4f165df8917967330c05ea3c9
-
Filesize
5.2MB
MD5d41db549cadbfbda92fb03a5bfe66bdd
SHA190b6862bcffc00dbba5d10c7f656c9be604ed356
SHA2568a1cd3cb0dda075d647a14dcb4f0b260012889459c71f850a3904e592a42db94
SHA512b0dafc6b718e1916e4a88c59d5d1ba9be0dccc94798c0c71d6fec15bb6eb990e633de91699513c89536cf549957ab41c70348468098f45be62cb75fd56c43231
-
Filesize
5.2MB
MD589c6b5e6041bcc3f80f02443e51fc96b
SHA12e90ee30b2421600bb097544466d74990263e76a
SHA2563e9ec6251be6ca3dae9e955ab3dd6fe1ccce5e2a80ab6c3b992c144e91d41b50
SHA5123479e1831c5515eccd6e2f9b53e86f952bae76933482ae8ff0f3b7457ec20203f505f8e4ad30a4b3bfeb2ea1825720c0f1909b7ed60af0ae0415a24b5aab6d34
-
Filesize
5.2MB
MD53ce726438292a8e29cd450b0c007e489
SHA1060df1585a751e2868921c67839f1f31b278f296
SHA2564f0b5de2790502353c77c29a36a3e5e80b341b87e13d33d04d8ccb1117fe4df3
SHA512b1d4f22177da9b2420212ba7de3faf5ef3de0a668c8c70fca90474944813a97bbbbadced4fd0657828dfa3a37c5943aaaea258d838008b7bacb52abf251c09ba
-
Filesize
5.2MB
MD561a06ccffb10e865108a4e5c25694973
SHA14e0cccb9203332c5fa10e027a038a7ef908d4d02
SHA256fe708a3f1da286fe06e38ffe99fca26a2243ca04da55a09fa699428612741759
SHA512eb0ae72a1b48a28bbda5b20f5542251c7b4ae68138a8c9420f65606e078dbd57c42b1c5cc4932462128db90459f4e8658f18f21227e2637e49ad5598f1502a2b
-
Filesize
5.2MB
MD54de90508acae442026a35ab668209333
SHA1a7d17745bbc494954d14663cff30762dff2b1d65
SHA2569ab6c087d8450d7c5a92c5f8e06c8de0399174731eaee0b1ac723d95148bcaa4
SHA512787fd29062efdd8196abd10fcb743442de713967a1bf15ee6110f689a07341aa994fad8046b5023a1f381ca6897347c58a9c2abc14fb73365743d7556ae6fc9c
-
Filesize
5.2MB
MD5c639618568635e869b81cb37c626ccb0
SHA11ce6ca6e05d807a4028a17a55b9d637bf4c37196
SHA2563fc671a8cdee1d83610b300f98c8c00e2309a2b1654605348a47f0c78f5f2613
SHA51278a73a330303dc5a2e02e78f9bd683e4e3dfce599f87f3446db161d6185e201cf6a64aef50c5451b3f3e9e4519de361097fb40cb39bfb78687714ebc1ee6d422
-
Filesize
5.2MB
MD556d87351fefcb5e1066bf484a5042e5a
SHA1b362d580c0c7675ee1d01d917ba2527640aeff35
SHA25615bf233a48c4704316e2d20cbd848ee2fbdbc92808cd715280955224f360bc2c
SHA512aef0cc3600acb3b7be547223f542344e32777564e8e1ffd8c4813731db7b0c431be61ff9ad900e9d11c5d2fa2aae6e74ca5bd8edce896a5d1ab3e9150efa2556
-
Filesize
5.2MB
MD58bf1672cad5db14f634c1c0190f8e66f
SHA146c9654348debad8447232519d3f049916044a7b
SHA256c6ef8da80c83f9a482fdaa9c166f60b29b29681a7c9811e2353e8f9722902e28
SHA5127676200afe3a8e6962e97b139fc2ab9771a6313207b9d96b0dc9c5da9a2556a4b8e9558e06e0709f58d3c5db923a84ccb9ed7ec867d403efe35f051bde74f98f
-
Filesize
5.2MB
MD535f81a010f12d424320a3a19910e0dd3
SHA13de1221c745944705bee6233a242db86b0e98972
SHA2566a98e3edb7596acf7a72bc2d7c97e8ed41c21452243f1df6576252b0cd3d6501
SHA5129008373b8714f5c645bc8b34eaaf71c589bf533183ee114d70904700fb00d85624163df631ae9d6d387e7ae95bad84513114a4245185277f880e83ff72b1da14
-
Filesize
5.2MB
MD5c396327326639f625243085321f3cf36
SHA10b021bb0432062bd200096f168927f6763e0b4dc
SHA2564c82f5e764c71bfb97e5aba615cf73da7dcfaf8c53103dc447485226967303e1
SHA5126683e338026d764f8a9924f4d030e0a19ca188d59e4fc3d0203adcfee58380513ba9f3fb7fd413aae18d58c3f5ad37c89481805fcc31b1a4aab5af3f4bddd361
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB