Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
10-12-2024 02:47
General
-
Target
2024-12-10_b27ecb5bd0521d38709794b643ab8d9d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b27ecb5bd0521d38709794b643ab8d9d
-
SHA1
0138a7883649f4ad97ebd024213addd8ac6237e1
-
SHA256
c1426d00121846e991343dc085502ab8e9bc7b5b70bc33bcaa8eea4e78b1036d
-
SHA512
f9e3c792e9ad51689ba9c274fee59743c17e25b3c8aa7eb39eae6814b4e96345ec59d3cbf441f2cd534247103c54bf63c47f145d4cf4de48423aa97845337521
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibd56utgpPFotBER/mQ32lUK
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-10_b27ecb5bd0521d38709794b643ab8d9d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-10_b27ecb5bd0521d38709794b643ab8d9d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aztSEBC.exeC:\Windows\System\aztSEBC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GxmSdGc.exeC:\Windows\System\GxmSdGc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ByWYqxT.exeC:\Windows\System\ByWYqxT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YheQdvx.exeC:\Windows\System\YheQdvx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vCNiXCQ.exeC:\Windows\System\vCNiXCQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bzVPCez.exeC:\Windows\System\bzVPCez.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NOCiXKD.exeC:\Windows\System\NOCiXKD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LQRmaeu.exeC:\Windows\System\LQRmaeu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DitpZai.exeC:\Windows\System\DitpZai.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bpjqWfo.exeC:\Windows\System\bpjqWfo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LHHrQcp.exeC:\Windows\System\LHHrQcp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SzMaFyp.exeC:\Windows\System\SzMaFyp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrMDLOV.exeC:\Windows\System\OrMDLOV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XfOtFdQ.exeC:\Windows\System\XfOtFdQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OxzHmRO.exeC:\Windows\System\OxzHmRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nAfbTov.exeC:\Windows\System\nAfbTov.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GOcUGsj.exeC:\Windows\System\GOcUGsj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iuXGLHc.exeC:\Windows\System\iuXGLHc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vEfoeGC.exeC:\Windows\System\vEfoeGC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gHGZpWT.exeC:\Windows\System\gHGZpWT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qIPTQQe.exeC:\Windows\System\qIPTQQe.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5dcedb1f048c19b2fb46d573606cb89b4
SHA1d5284777f4e244d39836ee880aacd08a224a385c
SHA25636625b384bb574aa2cef8ee2ab2523b5e1c158c8a813d5e4966d9d03d2eb543b
SHA512876945b29c01c6579e9694a6963636a8161bfe80801153dfec6c7f6922a165bb2b3ab013366980ba3fec738051f2814ab8cdb7e9e50e41ec70f09372491a63c7
-
Filesize
5.2MB
MD52efca3a501e4d30898f106598bbb1957
SHA1a97bbb869464fb3faae3ee88785fb359ff740a52
SHA2562b0be9ab6a899f943fe43b9302704cbba13da8e20820d3d8740e03d93d8ad511
SHA512a951204dec67b0a8515ef4c9ff0dfbc8402336f3c859a9bcd4366b3d71357f2e45ab78a20be0d1b3a71923569ce9d9a1e4ee894891f45a87ee42c80382122892
-
Filesize
5.2MB
MD5a05f1547a2d4fbd1d9a99ea85cc5da27
SHA1de14d6fb8bad809e97dc58443d495c899df05fc7
SHA25605d9f71462e78d667a5c71f8bfaef4f399f5983ee032d4f10bb39e40121dec84
SHA5126c07dbca6d9589cc69419bbf26dd7f3bec24bb15b0d92f3711d6915bced7fc92d10d24b730e042a6a8253c7ce21d3d18a78dd86573a45976e094653686e2afcc
-
Filesize
5.2MB
MD515e5065ec7bcba27e58ab01ee4993758
SHA1c676a3bf09ef102267a39eeec30aa1bf723256fe
SHA256b6cd5e9704b11559c88fc49845ca470eae7992d25062c9183f0d6541725b4d3b
SHA5121cfc4dc251b001305e100a810995af59833e017a215b2a78c9edea55069ec5cdce6f66d1dec8335e682dc5bbdd374a8a2d164a5a030c501c7717ccf1b946711a
-
Filesize
5.2MB
MD5afdaa74c66cf627d14430d6c6ae453ab
SHA164beb426963fe23e7cf244637d6532c7f639276f
SHA2562d84e6a9ca4ac8cc6d4db50e6e0da256db1243a318833564c006ccaa4e5eb306
SHA5122b22b0362ac957f61f88e0a81a41abc694028ce96149f75cce8b0fac7ddeab4a67ef612ab7c9e91c6740b6e0162dfcf990b5ed6fe3ad7e6d433a26b4ebc8b2f9
-
Filesize
5.2MB
MD5ddc3efa2a7652802ad0c11a7925c8ba6
SHA1d72b269c1e8a5b572ee106a9ebcee30730fe435f
SHA256b33d9f0e50ba4f2fba454a903b2d57768d90f0226745ac86cfba61c5be0346c6
SHA512a0d145f306afb248439c9d196fa02789ae626b1858010f85ead21d22b19c5a0d2b61ada9efcbc89520fa2af10f0b804af35e699de820d554f6b2ae69384a04f2
-
Filesize
5.2MB
MD511594f777a42fe26ff397f09c52f75ad
SHA185e7e3b0022d2753bdb7227d88bc48195d38f1cc
SHA256058e020c69783db3b3ee79dd4b013af6dddd72cf71d181d3a560dc9e98555eb0
SHA51254dee67cd00fd83fc88c98611f072bb4f761c03d88e9f6568d6ecdddf52237007307cd472424beedc5f48ac3fe2414b13169a936dcf9d07e056dcc37d76f7841
-
Filesize
5.2MB
MD599f830ccb0c9488acdb97be23da1d021
SHA12aff481861fe439a1e6ac0266d505b52c41a4b75
SHA2563fa5ee0a45183a1435fe6595160c6bfcbf61272c491c80b957e0e2e64e714f4f
SHA5124a541d034b77f2d1e360651e70f5c62e775b8cacb5c57a37ccb945f0e212a9bba0b3fad1888671fd03a79b1b9d2af963b6459c24b766738288b7dd03ab95b076
-
Filesize
5.2MB
MD533afe84c9a17bd4b941517641f1d67a4
SHA1064fc552b42e19cba96f48a6a5f73425fe938b42
SHA256dab1470ed70c995c566c689a8f60ef28b30874e3308351fb1ad463c105bce9bf
SHA512c6cb015a02e78e47dfbff199bbdf352ddea1a861bd975055ab9aac2365a4958b8cab0807eb7740f289237392bee6d2477dd58def1b9d7624484b64caf03e9ac9
-
Filesize
5.2MB
MD5105e44f03137e1f58adb0d94cfc48922
SHA17e10aadef1075cdb0417ef786fc71ebca9eed728
SHA2568667284cae1a19b7c3085867fca56e88fb5cf09954805cf72c1ed8861abcc140
SHA51267445c2e0e11e9350af72fd6a9317ed90132e0cd13adc2fa228955935bf77d202c5e9f491267644c3bce25d13699130607163a442bc1709d908efa45902322bf
-
Filesize
5.2MB
MD5df9cd5167ec1f22376a27c364dd27c63
SHA1aabbca86aa6be26d74b9f3925673b7511cc43900
SHA2561c8b22c184ebaab32acf5def02beb08485b1b16967b75749a422423605aea60a
SHA51236ec6239ee82b26e7da148d292304a827f8a1b1e0d46af4c7733d367277adb96bfc364f952d9bff5867cff75526891b86655cfa1fa3f2cce8dc1b8986ce76260
-
Filesize
5.2MB
MD5130438713ecadd97d432d222e7afe06f
SHA1217577378ea07c80950a5f8a249ecfb752be1d4d
SHA256b22738bee44390921ad1c0c0a3eee24ad56048f38f5c19b48279dd57d2964bf9
SHA5122dd842148ee41b2b8208aac1a80907bee0bff346befa8e0436c36a438b019e7a0b22cda4626c0aa0b328c9802159a1c851109395c3b5b854c9c615655854be36
-
Filesize
5.2MB
MD56971a52d83399e9d5bb35b6f8c02197f
SHA17036a92464824c34529479d592bdb146a41ae42d
SHA2569673d3f0a7e9bb73f958220ea3f66b5952f88e63731713fa0163b84c4d86ccb0
SHA512dcdb80d5b30f4fea4fd43d1dc2a11c79ba8c4245a3159cd942bb4423b43f9183651f621ed1bd37f0b6b31842cb8de43e00fccc2ffe5b7904ebfae4aae2fae4eb
-
Filesize
5.2MB
MD5935aefc282750074c583072c65e3d293
SHA145ed9e0cd6bbe0073bde488c1db9c64516c6db6b
SHA25629daf07994e475610bb0376c0d719b3f85430cf6f4316e72b7ceff1001f2ce4c
SHA5129c73d516b21671fc9e0cd4f664aa2f7678fdfc56b956be310c5f636677cc3a3c37fe7e413a08fa009aeea49d3848ee23297317c92ecf58781a1b8cfcce96eeb4
-
Filesize
5.2MB
MD50c8f64e22f0a17757132cf164d9f0e8a
SHA1b2be33a3df759a889f380adf0c136ae00eb744d7
SHA25649ef73e869865151c6e9a04fdc415caa2f620595222d93141bd2a0fd309d08df
SHA5123c35cb3afc6321501f58947281830ed6a1f5f9898f0581a007ac4006683e4d83958d7ad52d859d2ce40ab11e0bb71d7c32882e889ebb131cd73fab51352e12f9
-
Filesize
5.2MB
MD5ee6f103858017e2812cbd85d31b08f25
SHA181654fa485661d36a45962e8b24ef92977f09450
SHA2561603f99bcfc392b242d179a76858c8d0ea5716c638851ee71be69829b4af0c38
SHA5121e0f3c26634254b59f6fffc1e346d79eac931147687399633dc9b92706685a7a3298fe7751e4fdd853ed96368636dc36f7dcf68deaa0735ca6def74d8d3215d0
-
Filesize
5.2MB
MD55e9fdde63f01641089b0928566ea4e75
SHA18df0b7d5d8434d142f456220c58e992a1df9dea0
SHA2566f332529e356432a9ef943ec82f5720380a3138b3479d8c841aa312908f1fb8c
SHA512bb6b96e9520da1539ebb16135b7eb6e40fe4376f271b6618fd8c9970b8871c36ba0be9293834a2a4cbd7d08dcfaef3f62f864c8d61ea4df27f5e85c573f0a5df
-
Filesize
5.2MB
MD5f2a47f83a603b381115e15131984dd23
SHA11bccd6d69212aad70075f3ec62c469313b701665
SHA256cdacd4240ab5a0039b39835755514cd7e1401ccef9af51888907ad9520176ca7
SHA512a680af8523460fcb4c7b9211c45fec4014ac467c3acdda87bb30518108070ff8e0f78c9f15645f5c44e149a480ae8a81741fbac32487c02d0fa8883090c887f4
-
Filesize
5.2MB
MD5d1aa7ab2184d78c5bb7a2167e648754e
SHA1e766d3c5278f25780d64f69ad81db189f784c6f4
SHA2560aabf89a4cb267a585f91b51d8de56060161a57300e5ec5451d6f4a9e7a1ec09
SHA512c5bfacf67dee2f0789f88490757ac1acf2776d9f1cc0c4af12cbca34e4fbc3c6a824cee36ea832d8f64ab8975844a4a05a2ab8f30d5e8ab1f7bd7b689acb9bb1
-
Filesize
5.2MB
MD59d28c5c572cfe2cb35a2cac9840e5343
SHA1f43f91ff49f492b7afbacbdb2372b7940cbcd2ae
SHA256056eb0eeecd96880d6a28c82e4fc9b9d2a780e7e26aa2cd1d5a85b79ea958bb2
SHA512fcd59f82e8b7a9b7746d04a69c8487aa91bd8be0cb435f60adc91cf723d7e34e4e34206b0dea2716f602dc6da8b09b9538628c3993a10cde57d77ce1b7c39539
-
Filesize
5.2MB
MD5ca2b9acb5615353a13d47e7efa987d2c
SHA12886c1d1b5262ca4bb786e1c548229f9ca35b386
SHA2560c1e361ffe15c09af7f2fa396c49903aae3a5fac49f0860137a133234780cdde
SHA51281fad9cf66ea9050316fc863a80f78bbfb4a70237e787c3fe776fa16a03798d3de7022204c04c81e03d76f8b163e1f4777c3a827a78087cd59bf9a520604d311
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB