Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-12-2024 02:23
General
-
Target
2024-12-07_05fbb3385fd40548ab690e1a73ef5dcd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
05fbb3385fd40548ab690e1a73ef5dcd
-
SHA1
2c34e6321aceee4a768b6e366b5d77eef8101102
-
SHA256
b9dba7cb67d2f945e5350b7d2116dbc797e9a6577a6cf2c28a61080615b70dcd
-
SHA512
86a52a6829b8325207c0151e9092d4a10a60431cb28619704a046d8a4c66d67c3dbd129e70bdbe5bf916d34f793f83fc6cdeb2ed8083619dd4b17e49c073facc
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:T+856utgpPF8u/7E
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 48 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 45 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-07_05fbb3385fd40548ab690e1a73ef5dcd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-07_05fbb3385fd40548ab690e1a73ef5dcd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\JFILAjJ.exeC:\Windows\System\JFILAjJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eHZeSDg.exeC:\Windows\System\eHZeSDg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bWmscxe.exeC:\Windows\System\bWmscxe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QyOAjxb.exeC:\Windows\System\QyOAjxb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RCUnyUR.exeC:\Windows\System\RCUnyUR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nzFsnPc.exeC:\Windows\System\nzFsnPc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MYUhDhW.exeC:\Windows\System\MYUhDhW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RTHcSSF.exeC:\Windows\System\RTHcSSF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DMZEkIM.exeC:\Windows\System\DMZEkIM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\efRUKZw.exeC:\Windows\System\efRUKZw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HEmZXPK.exeC:\Windows\System\HEmZXPK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OsJRdde.exeC:\Windows\System\OsJRdde.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FjEanSJ.exeC:\Windows\System\FjEanSJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CcqgHKC.exeC:\Windows\System\CcqgHKC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\purkqhZ.exeC:\Windows\System\purkqhZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xwuoxVm.exeC:\Windows\System\xwuoxVm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AtTdJqO.exeC:\Windows\System\AtTdJqO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gzNCxOh.exeC:\Windows\System\gzNCxOh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zgcPsum.exeC:\Windows\System\zgcPsum.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bMjoAYl.exeC:\Windows\System\bMjoAYl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kTOQKqa.exeC:\Windows\System\kTOQKqa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD506058bd726307976e94e42c3755978fc
SHA1c219e6bc148340d3e8c36c81925089c2289c4b12
SHA256b766d453ad0195d67c887b5f818d49a480e6de4437c19b881c6c8289524bed51
SHA5127772140a9841e246df83da2e6bddbf557120e3eafcf8668db4b59970d955c97fa3074b98b362b7e9934f90b261bc62e1723b5743c773243b8928e31c990aaed2
-
Filesize
5.9MB
MD521728043bd77c15c448ad547dccfde35
SHA166fbf6d58c585e73d4fa128d1009ababb7b26356
SHA256dda29e846048dd60d18e0de0137f352c7b5234fbe547db3f62d11be11d1c0558
SHA51276be25398f35fa29c82c56af96ee274275c831304dd7ffafec3a90da698e701c8266f37c7888720a2cb6afa1a7013b895cf064d492b71e4ded1290f065a79da6
-
Filesize
5.9MB
MD5506fcea5ae7793a1e9b1e0681e36938b
SHA1fa353443a5fa2235a4df951bce58cdd977d3d48c
SHA256310e55783537c9494d29f34e23a16fcb3161a4b63e3d3a47e624e39bbdff6ba9
SHA512b2469e6bde7bd5fdeb71c67b7e3c000985acc3229dfcda26851be395c2456187eb7f32960da6d509416c9fa4fe9dafa63d07ec9818c7c88a99b0733ef4d7be63
-
Filesize
5.9MB
MD583c7744f3659ef9914d74edd863eca21
SHA1e493adb1ed4aecd254718e801816df0d16783343
SHA256140bfc3fb8f55f06fe89602a9098192239802416d7822db3054e5f9098c04964
SHA5129efffd7c6e57650b338ff93728400d8baa82a13dc83f4f74b40b2fdd6426019ed3bd02e1d21c3c5c7a972976e1c6d9b37173863363715102619ddfef2c54c739
-
Filesize
5.9MB
MD54c68452219dd4b36d7accd38fa98ac85
SHA117f6a1b0b8c3f0a96e0c68a7658539a924268b2f
SHA256f1f18a1a15fac46744efbc579c2e3fec7af900491f9047757db7e672a2cfed39
SHA512aa1796b7a201a8b032dec805387df926bcd757b85df97a312da012e8990a982c60ab6a5fb07c534025352ee63b761c7c80c2bc9a51761ea411478d5afe21ac65
-
Filesize
5.9MB
MD5355bfd36b2e7f0714de42526d8fed596
SHA1932398fb979b2332639d4f31ac3c300017548800
SHA2562952fa2ef1e5fd6821b0916132d8dc70b892c43dcdc17295366c98460ab55286
SHA512fb4aea0972c74acae95d58f6ebb53da27448304f0c4c62534ef3c4da1f744e4873d4dca9f048694a1a8520f8dc87e67d716b0682d36d5bb3154a175dcb2505e8
-
Filesize
5.9MB
MD533c88573d38581e3d4e43c80438306a7
SHA16e18acc635a07eedeee3cb2921b77e244d7a801d
SHA256be5a36d14da28bf0e5482dc7d62b75916722deb4fb9b6aa89cf68726f0231ed1
SHA512a46c276a408c8c2ea0c3e86db46aefb5197a67244ef3c371991d760b16a99734a8d13667994ee62c64d79254a4722a3ed76208b3e799f8bf503834ad261cc89e
-
Filesize
5.9MB
MD5a54d70e8a1bf77fc3f33ed6691e1a1ca
SHA1b7c5dc0b90bf528ce131acaee11ccdc61cecc174
SHA256c6aa1bcc1ab528bcb3173a2cac351d9203213521a83f45cd7487816bcb42a44f
SHA512690deb7d572dd513ce09a773c2a72a32dd069de8719b3a32c4a5110fea9ba28de7ec86355ff68f5d180531cc053f10a82c32724041207bc38039ce9939ad9ae6
-
Filesize
5.9MB
MD5fe3b62bf36fe4ebca214ea5289b9fc8e
SHA1c0c5c93a8b4798859aa6af97ba236d7ae10aa1f9
SHA256adc1cfcdc3b8e9e501a0c6a4ab8a44cbd3ddee1f04628a119b092a5846fce5e9
SHA5128311db2e4d01326b2d3f221210b9bd29a4096797b32f84ee4f12a4fdbf8858fd9a93f3da283ce4e81ab4f97105a42fef78e274ca2105cb250502129c8a96904f
-
Filesize
5.9MB
MD5e463d5fbefff0cdd74b3f6b61f2a43af
SHA1d09f202e073c62cb49382bb435b6ca6f0e7889d9
SHA25653cd905008f3056a310d4f6504eb7832925c4a74f830b8b2851511c3c4d51dbc
SHA5120a086b8d11537fba4ffd1c68019bfed3789b9be0bac634c8b78170607e082a3147077e5cfda6a657b94187ea3f619e16bab6a9c916054901d2cd5db0e8930560
-
Filesize
5.9MB
MD55bd6768ae489c766a293ea4dbff4f6af
SHA1e3a1283c1c7ded9c34fa576651909f82495d815a
SHA256c22b9139bc855ab3beba748c5a0a21621f04b7b88e4602aee6206a4de680bb8c
SHA512fe201d25c73417620be7ab51ffef48c42d43982833e774e11c26c0a407aa88794c6f3010a226aafb6f806d27544e79001166a4e72e56abc122bd5077418d2d5c
-
Filesize
5.9MB
MD5f989e8be601cbd26d8532866998d18c2
SHA1db170fabc02be9f6422958093acd0606ab2bf28a
SHA256c1c4dc0b6500a8b56c6b56521380340e91184e9214667397eb9de6b2c81b4b12
SHA5121a471ad42b8e25ff0e17bc415d88ebff1a338c1065d080085d2551a478ac93fed6ea1d5cfc8750f810639e2a3d0226593f57e0b946e027752b656e44b6974465
-
Filesize
5.9MB
MD59fb2713ad08209db4e2fc762155907fd
SHA192c6b0a80b2cc1feb5726b05c8ea4e4fed5e6512
SHA25617a1fc13e71faddeff67b2e7dd78fd32b585713443c39a956a652d97ce9bf09a
SHA512de50854261533ebdd32b31437e4cc440616751e0c4aa32e9da9bc746bb2e98a242b208228a2d3360ee1528400c386da6da856a3169c68c1e50e8f4bb76679ccf
-
Filesize
5.9MB
MD5aa1f3a8ede3c74b67894250e6bcc4403
SHA1bdabebd5169b582128d5ba36640c6272ec05dc17
SHA2563d088af66407126bece42148b8c6c80766bc637b0cec2ae691ba49aeac6adc7a
SHA5125bd0a7178509768a6228d12a5cdeb9e6c6b679384dfa391bb7dfbc73741383c148a16df189a8b99d7aac5c4a1dafb339081d5e021b41ab15848029c5286ad32a
-
Filesize
5.9MB
MD512da4c6e7fb7f5e71c79db45ba71d781
SHA1a59d24e426cf23df5b72f80e0a9d561f9e99bcc2
SHA2563432d8aa49c2856896511c04900eaf73fbfbb84403e3964cf24e405627f6a91b
SHA512efd99cb6cafcc1930b39e77d3c89a94d30807341d8391bc362bc0d57b4696c47033476c26b8a010f3dfdd17d6f6764d3dcb3e131727fd475d9667ba308bafaf5
-
Filesize
5.9MB
MD555ebfa8cb9fcb90e91b78a04cda7dc56
SHA1087caf377325342c91eea166c714f311e1ea2427
SHA256519ffc84da2d076ed8f78dc085d35acf1c5b75fea4ce303aa0016541bcd4283b
SHA512870661ba8974c35c1ab61cf725b01bf74fa3d6f3bb37b4469fee67ac5fa3c7a659d25b39698bc4c1e968f09253ea44e0f5bddf2c1b98ffaafd60162bf29761ca
-
Filesize
5.9MB
MD5fce3e58a562e3fe5cd611e81f28bdbbd
SHA1e6cb1ad0b93fec90404911e68e139c28fb46bcca
SHA2563adb531772b2ebdd739fbbd122000fdf830a1728b884a943d9d13aed9b4ca5d6
SHA5121e536674acb9328cb187493aa0715a5de605ab97ab5164c481415e2f5943cda189e0d30aa7a505173ffb35548ff74e582690846c023e4763607330a0836646f1
-
Filesize
5.9MB
MD5a73e9c3c07cab7d9ee13554bba82cf51
SHA11abef093f117e8350aaa1d36e65b0b029f69efc2
SHA2562c1ff75ceaaf1aaa59cf3cb1f92a2f8dd6f5b2297bf759342631b0b3a20bdc43
SHA51237befb0f18df143db4abfde3c4eecee2151cda6815af2a1bda7c3cb86790633c44fe0b5df23eb533f4effc2505690cdb2bb4d2890ca0ac4b6a04b2b4c996a91d
-
Filesize
5.9MB
MD5c81e195eacab97e0af15a4a5f6d5bac8
SHA1139218f194cd8db189dc86493005fc6ee8a35783
SHA256d985e820ba4401feab7ababf86a2bd1b314474cf9081d96440e007dc5eda960e
SHA51208fb61b1bd5ac1a37e195301c56e448dda073d182ea33e8c10d5368028bf78e93c20c9f7390df38e80bb7427e3eea700a627a4f9f26d871fb8afe0f587149a2c
-
Filesize
5.9MB
MD5cce1724fa588643da8a2fc7e0b007060
SHA1635dddff5c7c62a01597ad6cc5f38ee14f0ae392
SHA25629230eda5d37c9ae1cfa37732c51f04550d6cdd6d3ee409cbfc7a9143fe10777
SHA512def3bfd7cc70fa6cc9d5f0b4f894af310c9104e3443a6f7b354a603b7e3ab350daf0c9f947c2f235b8dcacb114ab5c8bc31acd14dee0f1a738fe3cdce12b93f6
-
Filesize
5.9MB
MD5e92b0ba525a7249de269fb4f6cdbb43b
SHA1318a082798b41212870e0aebab5f17e34b806501
SHA2565f0f033c60d69c13da652ef9606deb4b11e4d17f315187b46f48242c2e40815f
SHA5125ee117fd7e8ba267207f895807eb3d81f520599ddc1381543a18b2918b49afa30f3e9c9ccd541f3653b724613121d06e0c586901520e5227d43c3617602fcc9b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB