Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
10-12-2024 02:46
General
-
Target
2024-12-10_8546c1ad5f416a817e69a0ae6cfb0f0e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8546c1ad5f416a817e69a0ae6cfb0f0e
-
SHA1
7352327f0cdc858eac5cd965e11f9086ffadc7f7
-
SHA256
64aeea6446689c574d67693cfc3fc12d5e8daf08e09f9986cf2ba0aa6423b6c8
-
SHA512
423728ded30ce690b8a8c874ef865f2af0e42f266ec6762ce40d18e673ccec53a076364df35fa29703276a137a15db333a45329bb1d7505706d75b1eac1b094d
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibd56utgpPFotBER/mQ32lUT
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-10_8546c1ad5f416a817e69a0ae6cfb0f0e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-10_8546c1ad5f416a817e69a0ae6cfb0f0e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QucZRmD.exeC:\Windows\System\QucZRmD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nWDvOBt.exeC:\Windows\System\nWDvOBt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UrKvLVJ.exeC:\Windows\System\UrKvLVJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pYAbiqa.exeC:\Windows\System\pYAbiqa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lJVMGkw.exeC:\Windows\System\lJVMGkw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tuWEHjU.exeC:\Windows\System\tuWEHjU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JtmHrLo.exeC:\Windows\System\JtmHrLo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IaOtVGp.exeC:\Windows\System\IaOtVGp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fhoDghe.exeC:\Windows\System\fhoDghe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JaeVeSm.exeC:\Windows\System\JaeVeSm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ylVnuzv.exeC:\Windows\System\ylVnuzv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pumbyim.exeC:\Windows\System\pumbyim.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DcFnKoP.exeC:\Windows\System\DcFnKoP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qexvSVi.exeC:\Windows\System\qexvSVi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JUmanKo.exeC:\Windows\System\JUmanKo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yUUEJyz.exeC:\Windows\System\yUUEJyz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UmzxRfg.exeC:\Windows\System\UmzxRfg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\siOIHoi.exeC:\Windows\System\siOIHoi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Zbrhhlw.exeC:\Windows\System\Zbrhhlw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BtpbLZG.exeC:\Windows\System\BtpbLZG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MAUnUFf.exeC:\Windows\System\MAUnUFf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56989c5a5d514dca7f1e99019dd71d884
SHA12e9375509f178a6491879900d86030a62fccb68b
SHA2562e941e6838102572b0f7c817e67577e451cb1a58a4b38f2c092d2d00049d95a2
SHA512e27dc4272175506e436b2419cd4f6e80a54a1aff94ddbb1cf3e714b35a8215d212c7c642dbf3ec7ea79dfd207af5a0f5079009329e66b9e1417e80a7db650bbd
-
Filesize
5.2MB
MD5468240bde218917a6082f6ea46982c72
SHA1480c342577b7cae59c1a0e888280677762b1b780
SHA256827a8cc64bb68ef68fed3839426bcc9619e45fd5d1f271eb042a3583acb358e2
SHA512db70342b00e81fb07ac92947844d77c5661b0789e79be2baae253abee031ff9ed5717b16f4733ccd6f889ae6282d723741456cebe88982d8ea4e4fe9e4330fb4
-
Filesize
5.2MB
MD51b9fbf769cf12de2a8f873b87bbb451a
SHA1ccbd5b5739a1b84e80b6f7fe40cd504885baeeab
SHA25691d3712824703d275cee788d237f24921352ee930909b303566122c6d0bd8c70
SHA51289ec8f91276b8b59c4a962db740b7cb19e03e3e9259878492951cce11f523c10c7d51bdf635df190201a3f91022541305265f59b6b91bfbdc6a624fa264d40c7
-
Filesize
5.2MB
MD5b13fff8e7c9663c4116aa12ae010c6b2
SHA1f41693ad560a0a15fc9df709b78f8f74ba58d024
SHA25688de46b40bb76e04dd0a7408b2c5ca48d813fb586238b63559baf30cfed646ca
SHA5128832525bfa52e11b5db147de3aa54b8e0cbc4a7b74f94113097c5b71866334775352e6e5464b183703224ccaf9d8169d419d3c1ef1e5aa8680faf36ff1225dc6
-
Filesize
5.2MB
MD5eebab6f546e3c74a67ede092de20f3b5
SHA1faa76742b157de7c9f09476e0cf87ddee462541b
SHA2568aa8e82a4f8afad8a1cf6d70ac9ca0c329b003655efa52c8af3ef6d150379dcd
SHA512e2cb69251d11becce9d1551ad0c19bae5da431741de3c6d29eb4bb4a1b96ba109ad8b8fb364ca524847aa0357d1d91caefe8e56dc4a4eb44d2edfecf722b5325
-
Filesize
5.2MB
MD562e7bb8f88ea127848ceea242bb5614d
SHA19998bb1c6433a90da58b13300391103cfdbe2404
SHA256660fbb0e5cafd67d88c3f25b991d6ca45be15852f7f467d1c9cabfbf801c614d
SHA512e8078a146ce82270769d17adb8d8087ab2cca16c8b7f294c6880eb69b888a4b094f99a33bbcf60e2f029123d671b4f187fe39838fb9a8a57002307390125ff15
-
Filesize
5.2MB
MD5dd0d0cc2a26a74744dc564e39695283b
SHA1de7ae8999355a6255ed2df74ccbd4109a53abd9e
SHA256319ada3f49d8ca4247d0ba24d6b0527a94348d96d54e50ed6d67ff8a92077934
SHA5120c601c12444c8e889d9bc97c7dff47307c4e5131cc8f5508dc821280adfc84e75d252d860e73c9cd4646dd841cf25c13b802987b0bb2b45eded48c85c4e8c320
-
Filesize
5.2MB
MD50d415527108221b0247540f8165aea11
SHA1464876317362ce63cddc076f9b5662441d0387b1
SHA256661a4566386ca1dd25ace495865ecd510eb16ab40566b31c30f6dd0e6ed66791
SHA5123ea06efb2ec84f8c39fc2f048fb56e4553b545a4d068fc348c6780283e40b6a787ddc5324389e7966e54c349b44d5bc7c7cfef1836781a1a4b8dcf66c3c48e87
-
Filesize
5.2MB
MD5992048782fa4ab12ee6e04298ba2eba0
SHA17791a25b125b2edbba8a481bca31a5780a8e5e95
SHA25613229b406e59e4a449d3bc7a659e181575b56ccf3c894569e490776eb89c5621
SHA51274cd714fa1392b7fc1ed741137ae907f2b115ff7a3d22124d196459428c23da34cdd3c903c3e8ef14f7006344c84697c7f4786f825771611d412f9d0380a275c
-
Filesize
5.2MB
MD5f510e7a115c088fef23513a1276096bb
SHA18d7fc829c2c87f736c0d071321737ace75a01a6e
SHA2565804e77bc531b487be1c5ab2707cc36fd298e941fdad01aff30ddf5c8c9e8508
SHA5123d40adc039727a67a88ebec568aac530fd30e59ebd3114adbbfc72ab4ba1c8100fe2a47ac4042f4bc12fc81e8cd2f99b02025aac152f74da4931842576a3083d
-
Filesize
5.2MB
MD5edfd2b94bcb43b26fe7121d0a8b9afeb
SHA182399b25172aa9223f20ea4ecb715d8f74dfc21e
SHA2565afbfccd7aab84695a07b87d5ad0cbb61305339368e373ab6e1c3401d5b9bac1
SHA5121b0ed3eb5f2de7c852c3baf478b810574070ba5f7f2d5971cda7870973c5f3416ee3cdcca1de8953068e7be2faf94fd4b3b53f1a19bf64d603d8f55ef5b7023e
-
Filesize
5.2MB
MD53d93adf15538b423662955f20a89f505
SHA18035bb29438315eac8535f7dc8da9b456990187e
SHA256cff2232e6dedcd587b5a9c9bcb840b344561c7e96a48cc7c27a08a185cc20a19
SHA512bc53bd3f6a4ee1ca59a90eb0a0c48bce7c9d6dee034239e89d9121227ffc923e4b75d2ae7771164ab429d6d9b1e595d24c8d325bc90523098c6ba1b5163b57ba
-
Filesize
5.2MB
MD501c336c56e4c9c9b1ad9f287dcd7af84
SHA1c04c23645c717ebf2eb0b2ed2f807f5512bea54d
SHA256bf5ad0b4ec8cb4c27e2e453f32afcbd47d12d6f9cbd6618dfd19d0b0489d5d6b
SHA5121476ed602ba0b7ffc573b9a6e1d05adecd5eb4069949f28ce47ac161c46d13c1383145c4e15d3173aa1901f0bc40f04049bb5637c7e9a413ee10f7c7cbc92171
-
Filesize
5.2MB
MD545c2f662583cca22f69a1a64b3d23d5e
SHA1b21c5d332a735c829c05983168947fb66cc70698
SHA256e53e4c70a4c80da33d96fc24583b68e5fe6c9b092f5821e5920323db56aefa8f
SHA5126f610fd546b28dbfce647474e89c79d50d35505df074a9b36ea722c5492d9a19c7df92d1f37e8f557ef3f59f2e584d58704c13317cdd2555635d536aacedaa2e
-
Filesize
5.2MB
MD5900366dc378564f2921d56591d0f78cf
SHA1876ab12db3590eb2d0554c6122b3698d61cbcd92
SHA256e337021175ecab17bdf5c0f1b5a0f741456283c9172ea96971814d6106c0a360
SHA51244b3f3c8c54bd101e0cad3f1ac99521421fe0f7b42c97af3ccf2440f6fd4dcb619f1463a211dc82a37b8e205925e231010ce52737eb0c3abc5ebcfded2fe5468
-
Filesize
5.2MB
MD5b271b495c20549ca493f1b61ff0bdc7a
SHA10a66d27dfbcf32d3b439a6c9589d4bba674e0c68
SHA25665877e5904f60124b86cc6c010492f6583eac33f553f64c820a187abe8036f05
SHA51274d680f39bb9b67847c77a5f5bdcba28ca33fe88f930d2c140561dd803a40229abb96945420ad44f46cef1b6dbe5eff29dfd98c66a2662b7ac57f4637d466450
-
Filesize
5.2MB
MD5737a4226b0ab81b194d6bd46410db469
SHA1fd860ce49c60f85821871ad4118d8d70fc0d760a
SHA256eb5f05353bda7367c289e6842ac06432a75904dd8e70bcde79951df1faa399b7
SHA5124a4ff58b511dba4256b953c76118ca6539fb03a05e1f316842c1eaadeff5658fa626bb5c6d6c7cdc64d655e0fd499f4242e1d61fa9036e4ba44835f1c7d8124f
-
Filesize
5.2MB
MD584ca6d1245e988c02a494131467009e7
SHA11e77fa9ed59fe0dc5db9e603df3a2d24732bda63
SHA256f1845dc806bd56797baee5b3826e1069ffc2e2016021b14d574e4f0279874e52
SHA5120ab9e78ac75ec8ae95a67bb0eb6861be171dc71e8eb6a1d44a1b65e44731976cf8a2c76188c7478f5225d810d29af7a7e2cb08329f1a88cbc6a391f934da225d
-
Filesize
5.2MB
MD5d0adbebbf73a7ec653a3576703da5b87
SHA1949d95f03f36d28d2a6ae2415020721cd4446e02
SHA2567e811799029342f6d0beaa28c08cbc596e9c3b385b97592c14564a07827b9eb1
SHA51222ea6eeddacaddb59f5202a4db204aa9f17f6abe13ee1fc0ed6c1623c280b8d359252482deeafcc2e30f8bf02460e44deeb04f011e45c572744c8e4cb5da2252
-
Filesize
5.2MB
MD5f829bd82cac80bf7f0ba2c35f69b3155
SHA1eba2a0c1b528d573609641dff3e7664a4657b7b1
SHA256d342352effd32db3b325589285583434e718656d853e20305f6523781d7e0482
SHA51241e6b84f05accad5b743f38217c752eab490d043f32b6bd44963f9fb5d75474a2c2f248736d34c2ab58e72cc64ae2783f43782faeb8ac34b922ba963054499ac
-
Filesize
5.2MB
MD5c1d9dc7768b057c79529e634cdb6854e
SHA1c969bd7d7ffcec65d0043e17d7a8faa4dbb66d29
SHA25610d10e28734f9da96fa199508eefc76bc76ccc16f8920b00375f853fe8eec5a9
SHA512c3c756762311d373cfac92ad85388f4863f9b3940969914ac1fd94645956048d62b70f921dde474781a1d67bd99383048dea93fdab014e2f0eafd1ad0e28e77f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB