Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
08-12-2024 15:47
General
-
Target
2024-12-08_93d64b7ebe3c363e67ddc39a765af469_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
93d64b7ebe3c363e67ddc39a765af469
-
SHA1
11aa2a776845a2bd9439750040cfffcae7a50ba1
-
SHA256
1c1f1a74206043e8336868d4d19a541431e808eaa26e1cffc1482d10839132ef
-
SHA512
e2c03afa7df78ac9bfb01064b6137182ae5eea8d22c9d9074d4e12d95f8f38e64009cef0a79c9db384241cacf83ba92faec9d55641c1479182ebfd6128241743
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBib+56utgpPFotBER/mQ32lUP
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-08_93d64b7ebe3c363e67ddc39a765af469_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-08_93d64b7ebe3c363e67ddc39a765af469_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NFyaESo.exeC:\Windows\System\NFyaESo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\plzmEdX.exeC:\Windows\System\plzmEdX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUwfxhv.exeC:\Windows\System\pUwfxhv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iprXPKy.exeC:\Windows\System\iprXPKy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EulHKzj.exeC:\Windows\System\EulHKzj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wZGMwbw.exeC:\Windows\System\wZGMwbw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vRsshDs.exeC:\Windows\System\vRsshDs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\utFcMQE.exeC:\Windows\System\utFcMQE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RkvEHiu.exeC:\Windows\System\RkvEHiu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NAyOxeS.exeC:\Windows\System\NAyOxeS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PVWDlzo.exeC:\Windows\System\PVWDlzo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NEgnXSC.exeC:\Windows\System\NEgnXSC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kYGaBbN.exeC:\Windows\System\kYGaBbN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zODmMvx.exeC:\Windows\System\zODmMvx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KJxSvJD.exeC:\Windows\System\KJxSvJD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\csjwHoZ.exeC:\Windows\System\csjwHoZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QVcfsci.exeC:\Windows\System\QVcfsci.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HNllxhJ.exeC:\Windows\System\HNllxhJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YgmgSwK.exeC:\Windows\System\YgmgSwK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TkmHpEE.exeC:\Windows\System\TkmHpEE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZdRzHwl.exeC:\Windows\System\ZdRzHwl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53d07d45dd82354a418a80c698715d9a5
SHA1ac09fcf4eb4b3502ffd26ca46848744f6343db0e
SHA256c7ae2e64a926ff4ba3ede43778efe13c7f013bb4cc04f5dc6e60b0b8cecee93e
SHA5126ee8aca2698ea57ecf56744673392f55c1a8b575bc69597f450f8d4f83135f4c9f1108d97cb13c29c4e46597ab31550e6b2a51f8848af3083a612a8e796fb0ab
-
Filesize
5.2MB
MD58eb59f4e2d5d39d30aa1bb763b65fc34
SHA1ebefc1d81b1afb09bc7a5fe7a63ad7dad0625ac2
SHA256bddfcaf923bc8f9ccacc1fd9787583d5baee095b1dba1a7934a187be5cbf9eb7
SHA5121a857dca26f48b6a3e9a854c68b72f4d82c4fab2a87d9b1fee280eb05a3b1d0605091df21015660f1bd98707b3ab32e36aa6a28c0e9c7ca771ce8d5eb0fb567a
-
Filesize
5.2MB
MD5c4ff247c96aed2cbf9ef753baeb02a3c
SHA186dfffffa476b3fdabc8b421304b0d3ce45a8f74
SHA256dd3ddd9847bd1d4bf63f16d2b2620eef884858ad462033d55e07cf49b6b43486
SHA512b9ec7fe682917ea6bf8cb076bd341d51664c89fcf0758cb7878e860ddb43515ccca4ba6f19dd51059e94f5d129c7685937ecbdffdaccc0e1e66acd10a2739f34
-
Filesize
5.2MB
MD57fa2ee1163e2dea32fa7f761e39f3b20
SHA11b98d3730b3bfa0175843d614089cef5daebba60
SHA256ddcddc7e698a1ff1714f24f9cb9055889a4515b4f76faac1d23c570f171cf76e
SHA512b09b67f8cae999e3948c49bc7ee1f0057b55e9d27c5c2aed487d8878ec5d51affbf9c9918da20bde36f6e62d6a84667c015ee9e4ea7d1191d3dc7e14bb170d19
-
Filesize
5.2MB
MD570f77b0ac3c7390122c0c7274568d4e4
SHA1dbf9b59dda8695898d4916f355960133b378e54a
SHA2563392ce1aa9b5a223171aa99552b9372ed7be0ca1449a37c95d79d2c71fe8080d
SHA512546395901e5eadb8b43823c87d4abe6f947a3d939d7ce50dfb06df2ad362f12c95e0eec57a0f425a691a59b42e98a07ded7560b750b8d23611bc4429422d3f18
-
Filesize
5.2MB
MD5b8b4ca617d2c5e1071a097fcd9d455e3
SHA18ad1a255dd1b781069080c8cae680442a8c1f64c
SHA25607f9c8cbb1ea975ad201e48564468e99e8d19ee827cacebe80f5d4faecdbccb6
SHA5124c38b74c92ed8a6808c3f681bd45f9460cb8a61f80bd04c0b7e84af32430791c85c82577a683ef6a2c6fbd426fe324f59b0d4a45babe81b7a00af769803313e2
-
Filesize
5.2MB
MD5d05589de8979929005fa7f1adb302f1d
SHA166351da1a8535080bf5723e75b53f916be7289fb
SHA2561e6e5c5b8154345a20fcd9ec76ea1c51b8b2cd4592baef34197de0d99d3380d8
SHA512a3c2bcb7c7f84fa4eb571010d026f6814484fdbb89fda16d14a665af2487eec48f5f845a32078fe3e60d6dd1f8b45b0942d8762db1e84ca9a8a14d6d53102301
-
Filesize
5.2MB
MD5d2f8528f51c6ce33de9f321674477980
SHA18d678f20a7c35c368dacf87e8c002bc71ef6d5a5
SHA256aece0e6368c040d36787860f2b23576b88cd7d3069b7df3aa3ad3db47824bdc4
SHA51258a733bb6fbbcea1a024bc2510c28bfaa6ead9c2334fb72ad73cb2264142a17910cff01ae0883c888abd03dd8ae3246cd03f45d189fa6cb62627ae4d0f51c98f
-
Filesize
5.2MB
MD5625d6e382910cd3066769cc100635308
SHA1a5463ea27f22fa9585f761e24f98ca28ce8736cb
SHA256edd8053a4b459bdd6e4b17b341f5fc3831586bfd57635a5a5afabc36988b2130
SHA512942d6e84ce2e56c4340006e72667d247fa8de9e6e348bd253255f8c91cfc6eb188b5d3e6543b50d9c0452ac0f66c7fb3e30c0c7b259a68958303b0af96ff2891
-
Filesize
5.2MB
MD5d796f862b5c7f15160016b0c16d2da46
SHA1b053b170423fdb6a0e7363c04de8bb826db4c57d
SHA2564b36f2d8d204eec97df170fa4e71c660623b1ba898c09177211348528a36e079
SHA512a9294052233e8b5878838a1cb7ccbd7bf1932f5b9693ea9bae9c2a526ad19801adda208c2f6eba8bd05c89ff85b3dcb08e22b8c75680151511370107f3eb546d
-
Filesize
5.2MB
MD5929a64f2b2db4155dfbff73ed93ff994
SHA101dd64d08c33dc1b49b538307bc6d4463948f1db
SHA2567d349bbd3f69d7551013cc67f0ef573c4e9522100701f438d3f93f137dabfe91
SHA5122ea3e4ba2697210c8d9e78e90859fb64e5a1db01b49d8cb827b182b8873c2aae7d5da89cef9a2c588c4f68a3f1dfc69c23b6f906b93bb373a246cae07f768ad6
-
Filesize
5.2MB
MD592f322c7ae6bec24c769a2690f76cca4
SHA11e47530f66949d58b84bb6746f43eb34afcbcd59
SHA2568081fb409013ebdd6e4660bc4a0164a24539534068facb68f857dedcb95f4df9
SHA51226cefb9bbe0194e73b884ffdd6e1878adccc3e8755cb559eed7f2ee17a0433bf2e6c1e18deba381d8ffe9a60e1c9fbe6474e6c85769a10d73ae6597eb6d6e8da
-
Filesize
5.2MB
MD5a0ff112f32e3dd6b5cb6a4cedd070488
SHA1b3fcdf12fea2337315b7be323b4bfa0cf48087dd
SHA256be1f6be2e6b4d5c340a05e18aeb81e0c50cedd2a567e38bdf3a6d50150e452be
SHA5129c796421a849dce5b6952e01ac8f77efd6e28e8e77ae8bf8fd54af29ece3ca778c5295775e9ae2098070451ee073e5bdd5e6c887fa878e9c386716e008c0d9c2
-
Filesize
5.2MB
MD5edb1f7f2e4dabd7bebf9cb5d0c2c80ce
SHA1e3477a8bb27a5df6fd9409a06adf98be37f9e2a4
SHA256d2f36f0835873f9f7cc10e4736f8324cbcc395e1f8d4a05f7dd14963d754cdb9
SHA51232d6eda8ca2f5808355ba6682cc0be1b26f4a83a22c6d6dea96ec52185a417eff41e2590a52c5ffa35885c47bf367dc8ad805830e40c93b6381d8ce188962e45
-
Filesize
5.2MB
MD53bbaedd76de9ba6a8d1568b3a2bead87
SHA1f7f37a3e26eb9167f5c2fdb8006bdd311428635b
SHA2567586c6bf209d023bcb3437053b41ca8056bf52de6c7850d946e4da447ee87dd6
SHA5120ea2d44fac0689625f95ff113e3baf28618b46aab353affdfa9ebe63cf500199093f610be2e6171adf219c5d4ef22f6dc74df4a348fa7acfd21e16990e34ec36
-
Filesize
5.2MB
MD5efabcf2abb61317a8107f1bc964be94a
SHA1aeace5d9ebf79618ae605b15e80c5453c4aa0d89
SHA256bf08c269f630ffbe73caf8b475efdfcc42746a45dfc3697ff5f929a9968b7396
SHA512bd8b8cb4c84e24d3639c15642d9b5c57c214aa2b1ed3c2768eeb61061830d561ba2310c9dfd88ac93fed7fafe0751a884a829bfd6c05d736b37768b0f4c4fdb6
-
Filesize
5.2MB
MD5cefb8d4d6f075484613059d190e153a9
SHA154af9a01d468b3d01dc767cad4c02019e614fda3
SHA25691fe47914906ba596548980798756939aa4133c534457505d4ec3f44f239eefd
SHA512ac3c99a52290b222a30020d181c04cb8a8b6f119108a0e09ff628a98248ecb7631521364e08035d9fe5b6bdfac0d59b7f4f7552168f3e9c6156b7f10e589b3f4
-
Filesize
5.2MB
MD5aeb67bc834d9fb417bc384d5463d3c63
SHA12269f1c310e911cdf0387e5683438ef4ba5054e9
SHA256f965bf8d4696dd306cd9435771dafa05df3d04d7ce5bd9796dc500cc3b7f2626
SHA512ea3b12afb07874b434ba2e14d2ff904d8587844d6b6aff01b991ac2d05485b2dee0a473ea0a57ea9d572ba5bc27046aec9c70ef1b887036971e5e6307f257cfa
-
Filesize
5.2MB
MD5e66abc3383ed4366e99c1d3809467fbc
SHA18467978782c81c8b819a5ce3a83470e9837e8b13
SHA2563ef6b1563ff7e08d10870c75a44834cbd52ef59527f16ac8cef5b5aada8fb280
SHA512ef8e3562e5ba310e63daf78acbe7a969ba54fdcecb85fb303e01f81ddb55b09e56596dacdb1e669f064839b0c44dadccdcb62023220be946e81480b22135ce0f
-
Filesize
5.2MB
MD5433ddb0a7b143a3a62d98e00acfcd7a6
SHA1a420bd4e35006f0c986219f3faeff4946ef72cf2
SHA256302cf0b85c0d8971f29c5f75732b173a46bebf600d8fc7b107c593c4c7b2cd6e
SHA5122cbe77643971d990e74fb58700a2f3e62e0c4b9b71336af2e16fc60f18db22f653a565c6866c1fd98cb97071dfd0f3d2144130a95ff4d1e5290d1cb0ceb12ad0
-
Filesize
5.2MB
MD519757f820614b4e63b8224558644a0b1
SHA1b018273dd3007e4a69daf9eda57c034ec599d91d
SHA2564a8fed9b16d81821550b4a915ee8519e26a844c70a0dd63cd00d768260f53659
SHA512588a4eb6bec66767154100397787379e1236707918d3a4e23deb5e2d6706dbd5879e02f74145ea4a5b1b209644686bac86b59ab09db591477fcdbee8c00f8714
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB