Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-12-2024 18:16
General
-
Target
2024-12-05_e36ea141005366e1f95af91d89136d63_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e36ea141005366e1f95af91d89136d63
-
SHA1
31c151e452fe12b16a5778932501559ceef6de1a
-
SHA256
31152e5ee43a38e24745b0aab6a6876a1c579dd1cc5ee6c6fd778185c8ab308f
-
SHA512
5ea1032775c2244b1b2a5a4f4664beecf1cb1047d41a6e6de84acf9fffe131b9f1bbc5bd62020da76e1699bf5133e96fe788ecc60fd0e5e676f4eec4e654c529
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibf56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-05_e36ea141005366e1f95af91d89136d63_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-05_e36ea141005366e1f95af91d89136d63_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UmxVvab.exeC:\Windows\System\UmxVvab.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wybNIPH.exeC:\Windows\System\wybNIPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CykuqLR.exeC:\Windows\System\CykuqLR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GkXMSKE.exeC:\Windows\System\GkXMSKE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eWOxcxA.exeC:\Windows\System\eWOxcxA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\apVQujS.exeC:\Windows\System\apVQujS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CxJZgGl.exeC:\Windows\System\CxJZgGl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MXykEHf.exeC:\Windows\System\MXykEHf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IImFhkU.exeC:\Windows\System\IImFhkU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DRIeJON.exeC:\Windows\System\DRIeJON.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lvaRRuX.exeC:\Windows\System\lvaRRuX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yrMlIPH.exeC:\Windows\System\yrMlIPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xZrFJAG.exeC:\Windows\System\xZrFJAG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWiuFZH.exeC:\Windows\System\SWiuFZH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\veRyuDT.exeC:\Windows\System\veRyuDT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NlrkLpM.exeC:\Windows\System\NlrkLpM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iwUflkw.exeC:\Windows\System\iwUflkw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\imoHpZG.exeC:\Windows\System\imoHpZG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zytNKLf.exeC:\Windows\System\zytNKLf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mDWObZu.exeC:\Windows\System\mDWObZu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NlNjYMC.exeC:\Windows\System\NlNjYMC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57e1866397e5e957a961a317339d51051
SHA18ba892eaa5b78a1e588b465524aaf822bfaa2073
SHA256f75b4244eae63bcb5f8afe85e88d5e50dcc928d3f78b7f8bd825ca025c547a3a
SHA51251c5509a0be3c5644a65bd91f6da29a684dda94d0641a687e462831c5879b7739c0ce152548c7b52fedafb03e93f8cd3cd29dc7348532fdd5ee54303e3944186
-
Filesize
5.2MB
MD5f64cfbe2ef4a0f65a281dffbf2569a14
SHA15e2ec253943f22de7654e1fa36fd13fa9a6ecb50
SHA25626e7c4f134c968f61b66610cdb054b8de3091dc03774946873cf2355018d7454
SHA51269ccfc15bf06e65dc02aa3553ff2b41a47b859a9e8656949ef40bf620cc0f79e955c2580c35f6638410fbf58434403d2277f066b33ac4080b6defdcbd5ba2236
-
Filesize
5.2MB
MD5081bb63ef2169760ffb1db56630bd1ab
SHA1cd89f25a15d4fad16c70ad866c5cebd77f10d5e6
SHA256171e11561ba44246d46c3a3af09c84272fb0a2b057bf8a1812cbcb74f86903f6
SHA512cfd1129b92deb725eb35c04e148dd8395ec391cdbd394c28504618251e54091d3b6658a339f9c594834406b3221b89012ecb17e75cef5c53971de0221608fe60
-
Filesize
5.2MB
MD599bc3be57dd99a0a7af376803f1e5aec
SHA188d159431322ed65319e336560e6271d893cb954
SHA2560e1305e35b3af57dab208745f84b01baecb7db4003cf8f435801ae5a7f2aaa74
SHA51295db3f670dc409606b1d225d28b05c4d8c0100f4d3b9f756c3b61c5dcb7cf7ba913af1272a099eeef36b65102a277247b41dd3f96c7d3e6815b25f20ae135994
-
Filesize
5.2MB
MD5f459068f899e442077a6b3fd9fb173b3
SHA1d43f3b76409961dd447e0e056a14772ace2d71f4
SHA25662bca262949ff29ddc238a6dcb02e5429d1315c7486d01956dc86388a1ed3cb7
SHA512525f8d02ddc2adeec5f00932e4652c15741f7554c337885fe8cb97cbce906f115a3aa7036c5be69dbaf06864bdd5fa2bb880f365bcadc4b1af2d2881b8bfc277
-
Filesize
5.2MB
MD5e155360a0e709f781f7be6a5a58925dd
SHA1e6d11f1695d62f28923fb1923f1e25d69e129359
SHA2565cf6a3452487c2cb0eaddf220216d2bebcc41a6a83a5160b11b26d655b33abe8
SHA512aa48ce4224aff502458b1d4c7cdc7fc470a0c614dccb7c43539a4e0cc725403d42730b4eb480e2002d9ac88df5aa40812acc5e96e56ddb04ff41ba6a53ce0610
-
Filesize
5.2MB
MD5636a62512011995ce88d5d99d26c6a7b
SHA1484ec177ec9c193d01652aeecc633492aa54b49b
SHA2562360ade7aab0a1f0da653b1d24490bc74e2d615c1660d906efcd6fca72a0b31b
SHA512e928064f58e875a1294910ce7444d89ef92fe8bc635fc3919640d1da1446426ccafb17253ed7a842b82e2d9ec939769b30c8e7366da760da59d696f7e21b4ea7
-
Filesize
5.2MB
MD5a25f977755784ac220336c279cd1fc97
SHA1b5abda5586c7fb719c0ef1c17c5ffb04fd8df312
SHA25699bda53ef30509d28499dba2433954205b0f03f81cf065e3bba16a8d533ccab3
SHA51275cae4f49c1b4821f21061675c3d899ef573183f3b9cb832289ac9f6e6b8a707199f2b5d77c2aefbf93b258dfba2e139372fca65ee90e0c3969f24ad3add2a19
-
Filesize
5.2MB
MD5a81121334bb43fc11ff9223c4d3192aa
SHA1f67906c79176014c85736ae4851f39dcdd6b339e
SHA25653a8e6796d54a9e1c9d448f8ab71f9fb31d05a48b492f61b64b5c86d6110c85f
SHA512948509bda9e7219d1ce9b78f6bea69cbd646f5829b6c8e05c2fad8e614b1028a444a95f7218d38a543b2025d5b2dfd73c0c78acd59cfc221e399df9daa9246f7
-
Filesize
5.2MB
MD5b235f103ee0170a764ac9089d6b9dcff
SHA1323554c91a2d70402fd160623a1c47ef75af6f2a
SHA256073f1f6637f90c3409d17bd17af5e1a517cdb7a12cb1e6520d9ecfcf30b30c49
SHA512b6532c2229613453d4db451fa3364e10508a37eae30060825395a04bee8db432060e3ec49bb501e8f622876afd9e0158486a9e7d2404b36958a1561ff52a95a4
-
Filesize
5.2MB
MD5585a12ec35c8c14f7659e689bdf67a9c
SHA103398ba3179be6fba5c1d6b3c3aa927b9acdfc85
SHA256e3f88c273ccd5a52293550ff0267b72418e8ef6756d45a4f7f576e6130552f68
SHA512119a2e58d212991985e7f673146a9fa303ab57d228e7ecfd2f7e6b1d45c6f9b26a63f7e9bf86b1db8ccd53e6e434a5a4f9d20010939f424ae1f1769cec8eec33
-
Filesize
5.2MB
MD56c85947f3f79e40c231fa7370c2ea798
SHA18f48be2f698bf2fdea7ad7368c69436168f828b6
SHA256838a3dbe4969129c257bfeab2fd8f609469a657cc50e92375a205149ab62f876
SHA512e08050aaf35ede8c796e8ae75e9f4d9c063a26d284bad394aa865748adf0c616d5de7f7c987d192d64dcee0d8d2ebe744db72ec46fe35602f0f75060bea28260
-
Filesize
5.2MB
MD5e3c7a1ea8b4ea560ac1af56a2a536626
SHA1c362331e72a3a6ad864a767ddb281152418b2686
SHA256c5dab763ca79f5f982703f761265a2fcf0170c649a3ad0c3980eefa98cc2f407
SHA5126997428cbc724563c186f44c937de15231c0ef05bd7ed61c99ae62d2db5140d96e524ad797da151a6f483eac6146264a09ae7d0f8da8e7fc29adb351e6dc8bfb
-
Filesize
5.2MB
MD5ac3c7e2874c8ba26c1df64ded504500d
SHA1310bc9c0a7d3eac9e305ac9f0db058ec7a54ed64
SHA256a10d754c681f753fd80db4323062370b2ab9956b805746a3e2ac6b89b430443f
SHA5127b77a4dc7e7e765e2eb738a3d9628d47c3bac4b8d238c7184565a3ab6b9208d30244ff900fe90a06190ab9f513f1c4b7490e163b52a69e9eb60297e7f740a06b
-
Filesize
5.2MB
MD51f7c3b835be338426b24be5d2d970649
SHA1b89a92f343b15a24b811314b56fe7cb27ab4046f
SHA256ab7d558e5f59e12e9ae6dc9cdf0b5e072cb7a19374c0ed8c3898a732f4dbd3ab
SHA512d5d44e03b644a01b879a314348c7d2088b46410417102a4b48c5c6658b8481eecf35da8e28b4d733fe05ae9dbf7e1a68769d581201581f8c1a25436e20cf45f9
-
Filesize
5.2MB
MD56288bdc9fbed59e6eeaeb10732436610
SHA134ac5c3ef19eed58ae329212d6c40cdb4cb09cf3
SHA256136a73884a5157a19b29e3cd63123db8c49191c4388631bbcb4b56905408ed9b
SHA512f250f9a26feeaf23dfee0267b49eb2e04824e85b0d2b94df0fef1d690f3d56e2dac9b6d62fdd59773f13b94cac7758aa5c810e946cdd7efa55cd362f79da5154
-
Filesize
5.2MB
MD5401e9b1a0ccfb73b1b646b6975e56b5a
SHA1b62aa973b8d2cdbc234966aa758d440d68e29c8c
SHA25692c952f30fd62c3ba276345648f0e3d90013e20e324fddd8e361b9e8db677cba
SHA51267ffd9de19294efe38b54e5a16455c3de9f1e64cbfb29e9b8aa83a9657a9e3bcc491e5cc0398b26bf7b3635d0685f638dd4a650e97a9039b6df7c7f2817f390d
-
Filesize
5.2MB
MD58db686a48fd48aa52f26d6464f4adfd5
SHA1cde08eb68f0f8c66102816a5630eb25de5201cba
SHA256fbfcda875c24cbbe0cfbec669246ac8226e41aa8dd589e7d01dd9d2582fa7079
SHA51269cc8f32c46e5adfd0082ac7ff74642d32d53b4e64a4afaa93da2a55d8407d478b4fa4a06a3e4d99cb446f7367130fdd5a568c14c7b051266b2366a89b778e91
-
Filesize
5.2MB
MD51dcb43e839904c455b8477ca0a133d1a
SHA1fae505eaa3714bc4c22d511b765fe52fc3f6843f
SHA256003dbdfe60691da73f0cd9ff8d27728650977e0810ec29f6ed9c02e3ff02f80a
SHA5121ba88c804b3e9c8232398d73cd1f7a36f6031b67af6ee5cff1729b45269535f6bdf18942916820037eb7e643b217d413926f3a28eadda372f09e338eeb7f45cc
-
Filesize
5.2MB
MD50aa81d5dc2d9a27b08b89eb739ee6b53
SHA17679ed9e28b8fa16a67cbb7c925d6843b7f6d405
SHA256cdb77f0c95f2935ba46d43c118ca17d31380b88eab9982169ed98050a00786a0
SHA5124d5e89ee241ba0ebb4e748a1649bc35ea4a8b11ebc6d47718c11cd82fd98aa412af444f5de61b10405a7dd42c17e60b7204aa3e617baf6b9053390e2b5130668
-
Filesize
5.2MB
MD575e4a2f30a3b46241bc503686e1cba37
SHA1906bc15e06d43b5047f0644b48d4c69ef8119aeb
SHA2561d7bfedaf63c3819e552b715bf4d48e6aa278a99f232753479898d5599a0e14a
SHA512a04bd53bd8768fa0cbc2dcfd4047b7e7c56b76e987e7a41e19159fc07d7e2acbe1e28ed7e2e1132cd10dcb8a2c962e18cf3449557b39a158f7d92eaf335e64b0
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB