Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08-12-2024 15:49
General
-
Target
2024-12-08_dd47318a1e6598df84bfd3fca5b6d7fa_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
dd47318a1e6598df84bfd3fca5b6d7fa
-
SHA1
019e473700cb7b1b9996f52129d9af018556c77c
-
SHA256
39dff7f4ba5e7f8eab4fe78649b7496b0af2859f8dc982fa728ff5001c0fb049
-
SHA512
4b82dd4af676f6af051776375e952b5363d34ab8ed3b1ff3acdf0017d0c53dec168183eacbd5305bce77f633525f951113b24e1b38d8bd7ea89e502c0d16cc81
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBib+56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-08_dd47318a1e6598df84bfd3fca5b6d7fa_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-08_dd47318a1e6598df84bfd3fca5b6d7fa_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SbiIvXj.exeC:\Windows\System\SbiIvXj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UgzKGuh.exeC:\Windows\System\UgzKGuh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\znvWIEx.exeC:\Windows\System\znvWIEx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\InfmLcV.exeC:\Windows\System\InfmLcV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sFPKKIx.exeC:\Windows\System\sFPKKIx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TdMLqHk.exeC:\Windows\System\TdMLqHk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sSlwsDn.exeC:\Windows\System\sSlwsDn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DnWnOgd.exeC:\Windows\System\DnWnOgd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LqqLHpA.exeC:\Windows\System\LqqLHpA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LjaTXHb.exeC:\Windows\System\LjaTXHb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yVyrNWR.exeC:\Windows\System\yVyrNWR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KarOFnx.exeC:\Windows\System\KarOFnx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AiGXgky.exeC:\Windows\System\AiGXgky.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pDDQPiT.exeC:\Windows\System\pDDQPiT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iREqnDI.exeC:\Windows\System\iREqnDI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\StJyadY.exeC:\Windows\System\StJyadY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PNTjZub.exeC:\Windows\System\PNTjZub.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gVHDNIo.exeC:\Windows\System\gVHDNIo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZUkVszk.exeC:\Windows\System\ZUkVszk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fjlTnTg.exeC:\Windows\System\fjlTnTg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oaSXSMk.exeC:\Windows\System\oaSXSMk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51c1ebf14c1de14d54e8fb28a9ecbd9df
SHA1ecc980ff768f04865440c27b7d9115b8342a67b5
SHA2566bc189239c01ee4b35b0c52c6ccbb7092d55c3ce89dad943b6f85c62682a9202
SHA512b0de77ac2df3ee675a75f292918c7184ff0c8da8e36cf5e81bb8ac5fe156fb8ca0343ffbcf7194e77bdabe14ebcbc41acde8292d65b6bf36c99282f19e6be8fe
-
Filesize
5.2MB
MD5ba4509b6151cfa70be385f7f382bddcf
SHA18cbde2a76f796f2d44b480e618842f6385f911ed
SHA2564f726f0651aa4d1d7f3a4ab56c0f83852dea18b24ce93c5e9f75e9ad6a438641
SHA512358e9664af3095caeea2910c2ac94f11cef6abac53a0242969617e09147cc58ca31c8303414443e5480bc6a1bc377c060db635649de17498b6637bd5807c907b
-
Filesize
5.2MB
MD55aaede9d2d861823ff0c5d03c081dd8c
SHA1a9ee0451c8d2a70105a56b78710a9ab11a1025f1
SHA25658eb251bc34dafa0056df66e712506bf583781288bfa1b224d39bd811c70a3b2
SHA512f72aa2242c00ff9b6b30dff38a90a9453a7264bf7ce4bba5ca2213b2865312509e5ca82279aa73a78a60a44a1234e82c268c5661bd8be6d7312ba19cb3a508d1
-
Filesize
5.2MB
MD5bc8550966a60e8b3175012debff7118c
SHA13a086af7fe01fe79685faee49dff5d6a6dc4a781
SHA256b2c234946e92c2a1df7d8f38c3144472dfc7a0a91816d0dd2555c97ee4fdc9c1
SHA512d630a67264b9f3b31ce18d388b8c837003ca4ef6cfaa66a64ed158b748b12a9d95f5fddeb1742b985e7cf6e372aeaa57a8e22fe2aafca5cebda8e9c996f50aac
-
Filesize
5.2MB
MD5e88cfd84ac8353a27812fc1d48f1d824
SHA1527cb7c747422b421888b06140107417078c6a01
SHA256be4d6c7ff84a981e501eda7e267a526ebb45ec579f47e1eebc312998e2f0c0c4
SHA512c5033fc04882cb3752ddd0bd3ebedbe3d809cc118ff6726fa21ab887c5939b8cc7278b7d4f9c4df82d742af42b667074437e8409247c2d99ce24a7dac2b19cf7
-
Filesize
5.2MB
MD5b14ad9c700b1c4b70927bc39c411f5bd
SHA1a968d3c742b5826d08f59cb8803b2bbbc61b8971
SHA256cd8b484413227a867e8434f9c7968d896e370ccb0219d2c980dd6afcb06638a3
SHA512ec7e272299bb2546f7d07746d57971cb11c80bcf18fb41d75dabc637f007befc62f0041daad56547e8af3f5c1df7e5750870cf4e68d559f09da77b7a4e9ca2f7
-
Filesize
5.2MB
MD508966f623cb4299fe85b7313d6e77e10
SHA13cca030699b88efa9b946e828a2a4a582fdbffc9
SHA2561971c5ecf52a43bcbd805a55db3169e89ca41e8f2449598cdcf764c8edd9fc32
SHA512ca7bd3cb22dd93ced373319bbf0d2d27fbb78fe039ec64d394e898c37300587f9549e0c0fdb8ac51658a2035ade0f2f030d8e2cbdc3f1011dff19a30adf553dd
-
Filesize
5.2MB
MD5e205d1a306f407a7ecb735665f3dce34
SHA134cf2747a31607ff6ac52f76e38249157f562ac0
SHA256808bd87f5fc285e3f83606c77137bb2fce6af138ed9a988778e7fb476f12c592
SHA5123587b4dc27872963488f6607c30ad3e20a701d660b2639106d9b8fe9c3e717f269d909a9dc31f31044553cd3e43feb59a541eb323d6774861c01d934c4ae0d5f
-
Filesize
5.2MB
MD5ae7fffa8374e9da887d3fc92fa589ef5
SHA1f4ca8dd74b73a2b119693153b145cf0fc268a713
SHA2569b17b347873472ee97d7cb8c412ba22d4819940f73c308f94110788675558002
SHA512ab0115178e52903f085aebf8bccb926a8f2a70cc6897ce60fd454f5982c00a5b03be373cde39d84f38f6b3ad256d2bfe1f536ee0a80a4adc4c086e4557bc0103
-
Filesize
5.2MB
MD5165d2817c3b532919934dc7c5dba9a7a
SHA19482acdd1e86ba5aca042984bc965e6228e3ff43
SHA256903283b16caee200badf8c01cc555a2e2057d647d79ae51cf63654a0aaf58a6c
SHA5125950a1ccfb4994779ebe2164bdaacf806828d1f59a01fd8bb37347ed0eddfc0d573f2ec97e231306ed843514076a8b14b542e8256f90a8670ecf5e6ab2651db3
-
Filesize
5.2MB
MD5bac403b4bf06dfba265c780e0010a0e4
SHA1e9104ac6ff9487d311e289a9c9284a8f758f84b1
SHA2565db9889281b51ed85bba70496abe1f6c7020b7118eaf7e5714926faac34b126d
SHA5128a805f8ca5f1f5fb6fdfd7efe04a3147bb5c80f73840519c702c281f70de13f0dc2359251197757cfd677692362058ae126b66c3a9cf133a93a332eb522d3d1b
-
Filesize
5.2MB
MD5d07aa7a262472ef41032bf690235d2a1
SHA1f19c5c003dc47a9ec37030d031d34131cab2c34c
SHA256a2c0fe7cd030d216e361849b69984ef96d9c5a3fdd98c349914971297fff7533
SHA512f4945f3bad7eaacabf07f335970f27a57b7c37fbb1846e8fa7e76ca62c29f264b52020f1b8bf4093c7780739d51c22a1e283e030559df0b1f7e00af60eb0151b
-
Filesize
5.2MB
MD564cb2c9a933798bbe89407792d223613
SHA161e0e4d6f66d46bfcbf3ccc82d60fc0750f5e323
SHA2561eb3825ad358d2657a97cc3d6dd70da8b67b44f737e8f0d340142060f07c080c
SHA512ca581732fd27f3f817c28adba77c306a12b207fa6fdddb23dc3a5a324564cddc88a3d1d1e852365ffdfcc8d45d2ca2947fffcc95cc9ee5b3e42dd58338af32af
-
Filesize
5.2MB
MD5894d5c31eff69ed44c2e5c09e8f17af5
SHA17c6f06169bb603b25e78e98233af5b9b5c661640
SHA25686531057427d78f04e74667a46a25a03ca9384d97d69f955bc8ef503adc862bf
SHA512c8e9d33d7dfd75e9692a1d6b7f8e0d9f577bf6f03516307c246413aa8ec5a6811768a4e6d95d911d538971c827e1f16e385a54bc26d17c9788ecb6ce3f84cf9c
-
Filesize
5.2MB
MD564026ea4e003d616441ee45eac226b85
SHA1e34acf32883045c75f3d2cb0f3a3c3696b33d118
SHA256ebacb7b0e260525b4db7cbce246d089ca6c50d6da452a01d38f0794b0bfafc77
SHA512adec7cc49fd16beacdc224f98882d090bfeccf07d42941e0b52d9e827311725e86cd035e7ee92deb3eef34bdd3c055f7b509c256e1b5b6bb45981db9e2f81ead
-
Filesize
5.2MB
MD51a5888072cba3a470386741c204f8a94
SHA133ba6c0d8cf0462a02fd64af80e4564c45a93453
SHA256517434680b22a36438c9aaa7357b8d06d3db9371b85c721e834da8f430b440d6
SHA51219c09c449f601f01c9e7e7e1eb53a38221ce5eb7d244e4b4f4596f0661012edaec73cd32738243b8950e7e46a7d2958ae200cfa06068f14c4abf98565f3c220c
-
Filesize
5.2MB
MD57293fa72b1f701a94d0dfa635ec29d8e
SHA1591b5f00aa310fb83522dd6b6046910deb081eb1
SHA256353c5e19da049a332db1dcca63a95aac9a75adff5901835e6173ed54f5242829
SHA5126a6abb08667205f2d7256b5947a6f6c9948ad8f7166e48b02924ad94eb53429aaec9ff6ed337d93020ae93d4d5cbcbd22181e0a017686db1dab670768b9316be
-
Filesize
5.2MB
MD594d2eacd6c3eaaa120c89fc1270bc743
SHA19e4b809bf883de650b2bd61fe6b3be6df7a3505f
SHA256f183043dd01a49c8234de3dd307280818269bad7ba1b8819671cc612b71422a9
SHA512c531f2f6596c8648e9311e032e1a8147f44f12eba843cc0496dc93ff5596462baecfb2b854fc41cfc63234e6c8b63363f346766a437ba95ebe6c1e0810c628fb
-
Filesize
5.2MB
MD5e9dc35bd89673f8931eda19b53c3d69b
SHA14a5aae9fb2b60198c4328dbb015f35760d79c58a
SHA256c4ed77a33682d2f1a501244343685642608096fae9c69d356f2a2ba0983a1496
SHA512f6a8687d5bdb6d10ab2b06c137dfbfad84120f2e17727b77abdc45643993caf279fd35ea60d3711cd3f9c2f13c05eb9c5f20bd4b335638eede7717f80409e859
-
Filesize
5.2MB
MD512eb00667aed939b4065e0d548aa0b42
SHA1dde5bb86600563939a7c3647b3a89eacba1aa2f4
SHA256929c81a4f8e6b15a8717467f129fc3d1fdf5b394a15fc81467fd8177bf972dc9
SHA51281ce16f0d4868dd493542876ec2cdcf9344ffd00ad4dc835ba3e4419139c97f0490ce87e1e8ed29893c07db87f14dca6ecf9c3c39ace7a869a91b0b30fb43b17
-
Filesize
5.2MB
MD5e2b8693f46b9158e0c45e06fe28d1682
SHA183c42dea193c4aaa83c09805bd8b05fee0b40365
SHA256cc953d38ff43775cffe0aeb406d0be960cb7b25408a4a478a079210a4f55dad1
SHA51287aae57dba15a40d275cbb903be728913f23f75553d37a56eef9d16e947773fb44f617d7e891c79959bf457813a62257eb784c7aea0ece07150663ac2ae92b6c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB