Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10-12-2024 02:45
General
-
Target
2024-12-10_6c2751406ed2bbb6949e691245ab0cc2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6c2751406ed2bbb6949e691245ab0cc2
-
SHA1
4cad312aee8d7e3ed09d536e25d8f7b980e18a56
-
SHA256
8a4eedfc71c8ca99c52ff3e61bcaa3e8e79d456b9c5fb4ce06be6ee60e4a23a1
-
SHA512
dd5dcefcafaeb2d40a668bcda45d93a24c410559349bb50462230783b30879e1da30b36743924ec46125bbfc0c0324b29763d4a6d98533a0d696be7c7485f816
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibd56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 36 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-10_6c2751406ed2bbb6949e691245ab0cc2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-10_6c2751406ed2bbb6949e691245ab0cc2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cyGuqyk.exeC:\Windows\System\cyGuqyk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QcZBXHE.exeC:\Windows\System\QcZBXHE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JPZrOuP.exeC:\Windows\System\JPZrOuP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GzyfPgF.exeC:\Windows\System\GzyfPgF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntdcNIz.exeC:\Windows\System\ntdcNIz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RVQzjGj.exeC:\Windows\System\RVQzjGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bbDqwhT.exeC:\Windows\System\bbDqwhT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\msWUSaU.exeC:\Windows\System\msWUSaU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NhiUmLY.exeC:\Windows\System\NhiUmLY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JIqCPTl.exeC:\Windows\System\JIqCPTl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\doztWvC.exeC:\Windows\System\doztWvC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VerZrmU.exeC:\Windows\System\VerZrmU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DyAWUQP.exeC:\Windows\System\DyAWUQP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eJZgOAm.exeC:\Windows\System\eJZgOAm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fuNXszc.exeC:\Windows\System\fuNXszc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XCioPSC.exeC:\Windows\System\XCioPSC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oYxqYRA.exeC:\Windows\System\oYxqYRA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EnLnTWR.exeC:\Windows\System\EnLnTWR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZfaYmwT.exeC:\Windows\System\ZfaYmwT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ykXVkAA.exeC:\Windows\System\ykXVkAA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yyXoVWV.exeC:\Windows\System\yyXoVWV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58f5525ce27ccfbd9e781ac8a20019a5a
SHA1ce75064518f933699cb258b3ed958cd10a4b203a
SHA2560bd3b423803ba0e36ba8415d6a436658d0cd6f3c23eb225e221b87f2a0603d9d
SHA51275dfad9862b7e3f660dec7f78997cbf79679ef49295fab149c66dba0b34dad83f0a6891f0c7254d4911ffd0673e889230115e6a0dd21086531039a4e8efa5316
-
Filesize
5.2MB
MD534bb0f97de2ca2402dbd2b5d13ce6fbd
SHA1e9e9657f452e8e4a1080497e8b572042cf6907a9
SHA25600a37355268190c5d8608ea570fa67b1f8af24cd1093e9499dc6e4aba6bbff53
SHA51215c540fc189797c626f404f195cb11f21f97d56170dacff8fa5f1183b636b65fba12855d4a2034f0f3a854125630f3bbe01f676a4dae49e576a3c33dc206669d
-
Filesize
5.2MB
MD5920f56293c9333b4082dfbd7773622fc
SHA1255e96579b4b562ae9ea04594158834aa305461d
SHA25638bfa0653b2cd57b8aee182437fd5f024b5ca1a3f0a1c1fa9f8b7974bf3f8a8d
SHA51292e8dfd2ac7190a0c9bc6004a8086a455a5a16e92813b728ab61e1bf118f9951a9c146547fff6f7c8cca943c08fa6192855f11c6ecc9f57ce95111996d606342
-
Filesize
5.2MB
MD5375171a871107616816302337602a85e
SHA1f5bd964e355667c84ea0bf2a47dc6b9104b2ba0a
SHA2564088b58633c9a00d27e2f1ac1afcc654ba2c8362bc9d5377f6eadc5ccb81704c
SHA51281c3a121363fb6174bb4a1533b6cfc5f12fb01d778fed110251c0b2ca0512f83557ad5798c2efc301da2f561c7ad94378ab9fd3266394581c378395991c21804
-
Filesize
5.2MB
MD53584bfbfca2abfb81b8c7fe3f09811d3
SHA1a00cda67c223e3378d2a69584136649e63e3f93d
SHA256e44a668c0b5231e9456811e2e2c33121bfaf1a8e5b18c5fe7458e5d9a53cb768
SHA512099b2a49a2fcea6eb44de01c75eee5ef4984b85bf7ad1dbd8072b20eec100472efdd8eaf8decce9a02cb1c1e050c5a3d94f03c4185b25aab1b639238df22bf8e
-
Filesize
5.2MB
MD54a111a27972768195569cf5de67af966
SHA15591a032c09b0d6ead0754de9c4293befd28ebc8
SHA256ad39fb24792b92a0c30e8e76dbb7e43b881c0e09642df0d79e1457bc4370501c
SHA51233035e887479ba04feefc954c5c8a6b7c33239142120e8ff3f44e5b2f08968c7fd664143495d97704592392beff89011de9e121dec536dffd967159720f878a8
-
Filesize
5.2MB
MD59655f47ff719679664204b1b6f89a7a6
SHA1e1d0f77c361aa8bb0af1a973fca3d8d2c8763e1f
SHA2569dee1877edeee5e8c5e4018f864de5d2f3dfa8fcdb0b8cbf9432fd715e57697f
SHA512c8b0f4cbe7907c61627e5927dc14cee99862a7b3b3f10df510318332b17e1454a1751664a6bfb19b78830eede2ad435c71e6ccd7a7851c72456d2661e1dad8ee
-
Filesize
5.2MB
MD56abf44bc2dcbbd18f36804b7362e2f83
SHA15c648740af69d46166a80911dea1c2f4af23aa11
SHA256a9d6782f1f87671deee8a034dcf6bf242b5387e5703c6b5885d9ea779413431e
SHA5127b4f896b52b52535df03f4ff3d12d66b56e4923a2cc53a65ec05157bb12cb71c5b7c24fd1a55b0c7b820d11aa6901f3a8e557edc718185a5a4d6363b614f8fbd
-
Filesize
5.2MB
MD541c863960098b79579101f1f995360da
SHA1ced6b9fc0f677d3c41c7318b2a89593c3442b285
SHA2569d9107dc088030beda726d7b2969c1581968be736bc7377ce5d4f184cc803081
SHA5126f4567b679c8127957c4c3b7ebe02f77ae916fb1cce8141d19c8823b8c380c45567d604d2aa84459ba937e2fa47acdf82e28968cf558f0754f7dd669ef32c145
-
Filesize
5.2MB
MD52fe5b9fb6eeacf1c57601bc125008768
SHA1028da0c62e950297da1db2407d1810430c2aab1e
SHA256bf9b27eb768b7b24590b60e82d24b74821234832b4567db273b1dd05dca463ac
SHA5128b3c9c6008e5a2213c5d9187a9e1ecd06be94312a5d94a6e9cb947a9a4045f762f6a3b913bee227fe4af6657c7b552c3c6c8caaff8697db16fb69037ef1eb8b5
-
Filesize
5.2MB
MD53c685958eff958d88ea0e114a4c51f7c
SHA17bfdce6bf527ba59a455c905e409bb5c4011858e
SHA256601c554e57669ef62de4048709fc7cc175e9d4864de9a1c56ab0fea3e7768c1d
SHA51251d56bc0c3e2a830a8be54ddbd18e3d508c285a668d69c8297bdb9a0b5ff05841f84eac805fe5efc985cfbee879b4ea983247751d13ba3081593967903b7c9fc
-
Filesize
5.2MB
MD541ef8fa380f20b0d3898751326de24e4
SHA140ea543660fe06f413e5ce459719e9392bb2290c
SHA25630d5c75959447e5338814f52f3b592f2ab4c07078a3a713551b93a340604eb77
SHA51261f8f561b5a03592dbcbc05b9aeaad8d5868cffe81e0679f53f29d495da13e177b56e8a21f4847f1dedf50b903c9849dddf815020e93ed34381579af002402bc
-
Filesize
5.2MB
MD52a49e7a0238f84eea59b0375f4a22028
SHA104e336df5f029d3f98996ee305bbd3f236ed61f7
SHA25611f290531f9b1d108d79563bc2734566609bf39074bb471a261aa0b8519383f1
SHA512dab2fed8494a1834b986f23d64e8a3d57df737296fb66b2f19f69fcb746b1bc6454ed00b39a2b36bb069973d063c998fcbe667b6098e4cddc5a56456ce50d055
-
Filesize
5.2MB
MD5ca18e76e7e598dcfa2d4581b55a308a6
SHA190b099587c81ab34a4874771212cfe73acc9b33f
SHA2560ddac30022cc74df73d64b1c8851372b0f4b5ddb7583f2518c0e36079c356592
SHA5126bc6f3341672b394984fdfc032bb2c596c387b4496a043f719dc947b3a88b27eaf82a8e6ab49307fc33424d45e63ce8540df0ce89c5dbcf51623ce260b648f8b
-
Filesize
5.2MB
MD59ad0891dbe169bc010f74d112852cff4
SHA1d284d5a11f6ca56f12be94c5f6cff61b1c53ddc1
SHA2568b1e1914f75a87cc8a8fcd5130b9b98985e467d320f6fb52d33262012d6afefd
SHA512e2b7d2ae0ab87961620d65f373246f06e7de92427d7da5b8991dbc72cfcdadafca99041dffa71447731a20e32d630ad7db283727db8abb178d26290ca25b7f0f
-
Filesize
5.2MB
MD5fd98736d6e6fd0a23c4d5398a41ae680
SHA1d18deb711b3e7cb35bbe05c29cad9efe298cf675
SHA25686ea1480c8beb6612ad5d71dfe8265c0fefc1ac2426a420b1b4e977cf84b3bc1
SHA51256559a06f7319405b0d4da4e666e806674e0f797eca6c4d9c8607aadfc5f93ba28b099f5f21e4cb6bd006e531288ad1e0a28fcef9b32cd8327f31d3762bcd1b3
-
Filesize
5.2MB
MD5f270242d63dd029b2d5adadd788c3bda
SHA18dce827f13bf64c5c76925aa98b17151ec284904
SHA256ba1c6455ad8da831ce89a5249caaae3eff9be9731a090e3553c64f758fe854b7
SHA512436120a451541d9213a955e32f7153dd9ec41778a014a46d16b5681525b06795202dbe5e91fcf43cce8c5bf192cfe092b23f565449ed9be6f82f6f8ced3a4806
-
Filesize
5.2MB
MD5fba9cfc1e9e149c0eed9dbcc05d8c1b2
SHA16c0f60caece29e53a48b53a5849524b7786f5496
SHA2569615737448e2c023ccdbb2571053bbc82ee865a042b9acb334634f14073be99c
SHA512cfe8c1bf72f5b55e455ae33974467c6f1f5bb7da6eb7f1d847ca6b6d7a9f2477eae128110246fcf32a178b859fa392e77aaf8f49e9833ee4499ea93933356dad
-
Filesize
5.2MB
MD5b179e3e7895bdc77528ed9fe94ccfc68
SHA1e8dece57dd4b2403a87c92302d6e9ad2cd3c0057
SHA2567767ed62dbecd613b9249160da727b2f1977ddf6650473f68d2decd3c49bd596
SHA5122d07172c46bd32dc774ede5361b88c60d202205356f89a2aed772164d54121d9d8f190fc84096d10fc40909f60bdced7d4a5aeeee96de5bcc37bf2f02048f1f8
-
Filesize
5.2MB
MD53c6d6d819a9fea3eb74c588c81ba8135
SHA18f334be1143c1ce1f1828d73411f92f62b5ff1ae
SHA256d131ad4987d063c4f229a9e8a28c28ee09aadc05f7f073125da4441854ec8f83
SHA5127589142fa01384ea1957716f60c56fc8ccf007fcd466806fb5c55866e59a8e89e29f5fa43aefeaa33de88e66afcc4cad35a2007f2c19146778eb6b4d8fb8aa3e
-
Filesize
5.2MB
MD5afd4a1138f4362703b3ae0ec4a82ed38
SHA1b539b47640f1505e429c78985377846c9a9440bc
SHA2569b372a94e7aba129e6d12d957e5d04aef492e10be64326688509558192160ef1
SHA512b4a9ac54ab0f054074b49520f9a069336805c1fb61a9c4f293afc629600ac8365a49d941526490c7d80edeaad3489a5312e056500a28293e24005042afa8f417
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB