Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
10-12-2024 02:31
General
-
Target
2024-12-10_b0c258d05c152a721d67e8c37e8962bf_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b0c258d05c152a721d67e8c37e8962bf
-
SHA1
d271a9f0b19c206b2f1d1d69f26780b11355fdee
-
SHA256
9b45bab72bece536271556f53fc381f25ae2beee9cba2fe05a1e1a4523c3f6e7
-
SHA512
34345143176824efd4aeccaf8398b936dc20d81977f07279f1204b97ce766bcd531f0ba998b1d356484bb35d519e5e5eed4eef6022090338550c22e41fadfb57
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibd56utgpPFotBER/mQ32lUg
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-10_b0c258d05c152a721d67e8c37e8962bf_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-10_b0c258d05c152a721d67e8c37e8962bf_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LRVBhMW.exeC:\Windows\System\LRVBhMW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\maLiiYO.exeC:\Windows\System\maLiiYO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LqMCtxH.exeC:\Windows\System\LqMCtxH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XVXhboO.exeC:\Windows\System\XVXhboO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qvBYIsP.exeC:\Windows\System\qvBYIsP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JzpssJL.exeC:\Windows\System\JzpssJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FgyRyBD.exeC:\Windows\System\FgyRyBD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dUcnceU.exeC:\Windows\System\dUcnceU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mYQFIyY.exeC:\Windows\System\mYQFIyY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YjxspwL.exeC:\Windows\System\YjxspwL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ejOrvbP.exeC:\Windows\System\ejOrvbP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CQsKPAe.exeC:\Windows\System\CQsKPAe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EBDyYoK.exeC:\Windows\System\EBDyYoK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TFnqGTY.exeC:\Windows\System\TFnqGTY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sTaTnyn.exeC:\Windows\System\sTaTnyn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LkcJqsg.exeC:\Windows\System\LkcJqsg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ENZvGFC.exeC:\Windows\System\ENZvGFC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OaurmeC.exeC:\Windows\System\OaurmeC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GwFDdHs.exeC:\Windows\System\GwFDdHs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AgAYaAy.exeC:\Windows\System\AgAYaAy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RWwOrAA.exeC:\Windows\System\RWwOrAA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5773dbd3685f65c87edc9aa03e125574d
SHA1d89164cce6a84d43eaec15012c6af25930e316a3
SHA256e427726308e16b3ddc396ea89f7f16892ce73c0c1cf88932a698ac2ccb0f4f01
SHA512b2e948a44f189b02315a16a89d38d439bad8a10bba8ddba58de1e92c4e0e797d23f555d366dca7b19b6c2e9e66f5d75d7fa13412a733efc101e82ed85fa8b2c5
-
Filesize
5.2MB
MD52bdb4029d41a6771567a82bf150adab7
SHA14bd5ede8230cd385b5ffd4f0338a66f51b1fc135
SHA2564a60c9098aeb8d8b3590176f8049c3481a12253405c116eca206e6491224e4bf
SHA5122ef37b1530f5b9ace1ab6dbe8243b99d18f49f5393307d9d80674b626e152d32fa41b394fecb0c88c19a212a1cbfd1f90afe73fec89832757743643fc6e562ba
-
Filesize
5.2MB
MD5e716bd795f9eef18807998d38e4c929d
SHA12fbd8bb35d5bcfc04f9181cf221de835b8fdede2
SHA2567d0e018d19c6476e1095fe376aa3b1445921468d6527b23605f3ec7690808aa7
SHA51240a054823490512c29e0d53d7d91683c009d6139de05f253999a093bb05971434b6fc022b6bd1b54296bd927149d489d1f9def6685628301f0c141dd49a0294d
-
Filesize
5.2MB
MD53ba3caebccc527a76aee47a12bed7d0a
SHA1b1ba1d4cdfdc1c83df3fca675207406cd7a61c87
SHA25612cdc02265955154cae24c1a04e402e75f620366565b7f61b79d6d1af04e0c12
SHA51268a6af6279fbe5fe9672c5a2caf1d389d9fe51961e1505f8f0748c97eb53d47c231ae54611e16e4bea8f327374265a4a007df84dbb5951e323104b3564b49b7d
-
Filesize
5.2MB
MD5a0b84dcdbdc12f11bbe4a36477af6796
SHA10404eb1656bf88b2e6fc4bd511ab6b2ef1198d5d
SHA256e2dfe4663099e9fbf14df875eb55962456b4692c449994f262990693772fc7eb
SHA5128a0288eb0c322998419b83fdb25776f42f203603dae38d135785220fae35612377e79a479fa4d4317d343657bd36dff560d38603e99a3289b07514ab4313f278
-
Filesize
5.2MB
MD53f81554305139adf1eb128f0017405c3
SHA125c344ff2968c5859f440a0edb628bae393ae0dc
SHA2562159a5c14f503f2a13937521a48ef5fe19fbbd6efaac18f034c919275fc1b3ad
SHA5127dc28a7e5cea6b8e9994cefe4595ec214f2b4a8ee3f6b35d6bd0138bc8992caf7a1c513549c30475db5dba8ce37d15b5a3e8aaca647015ca5eaa45b4d0411f77
-
Filesize
5.2MB
MD5d5b571b652dacb3a85650aafa394a34a
SHA1f811e9d28cc3e4f3a3a2b25fc23607d1fb36cbdf
SHA2563671afcc1fd155aeee969fea23abba0bb86ffe8c29e64bec6439725fed7c1e81
SHA51222a5a0dd10e9ecf735c595ac0a99dbb504df97a6d1c8bb002079afe1924adbbb872483612a91c66da6763bcb7cef86c9759213beb31d483fcc498a7d0baa6a7d
-
Filesize
5.2MB
MD5ede3e385fa8bbb5852961fd83a544bbb
SHA1ae1cac6866e0d72566d21c7a0084319943805806
SHA25635b6137ae879ebc96889c49b916fff06002d15db2cc460ff68cccd71919f3d5a
SHA5123738da5d6fe4e2d2fac59910a932fc63f25ff453edfd27551675e8271a7b68a54d296ae4daccc76ecf3614b816206ab1c72fceab1ccc4f7722bd24e2487cf88d
-
Filesize
5.2MB
MD5541ffa945c3fc0b4456deaab4ae76bab
SHA1242f85e2f0bfb141bdaee8b975e222ad6ae6725f
SHA2568dd0a862c02506abc7240483a0732d9c9e72c859c8b7643f132b0bf37cc19d9f
SHA512dcdbd27414c9639aa947124e15ca6ffd1d37efaf7d795534a1bb48807662ca9e22143a8a4ed5ff2ea15726f9dcd6e6357b99934f32817d5c48d0f82f5e67b7c5
-
Filesize
5.2MB
MD5b0f9440cfc3099e74bcbb889b1241174
SHA1336f7f7e6ce2f31b7b3acf2e0240ba5ac4b36d0c
SHA256b32df736a263e2d28a5e9f2c91cc09025ac4e61f410a304f7d3947fe18bd61ec
SHA51232a074ca2901d6b14343ac4e141552a8f93a2443bd61c4ead2ee2c82949a843947ed9469ad68f43c9d29424385254c501b7cc5145ef7efd60b5fa1be25465523
-
Filesize
5.2MB
MD59ca692e6446ec17de8e23c71243e925b
SHA1b26fa9c7b1093083f5e1ffb5b25756dddd17c171
SHA25659d6d0aad08a17c7f56ba61ade3e160424cfc9b12bdae8584cf821ffcbedf8b5
SHA51243a483a7bdac0a641de952abdc23d0ac09746aa54e0b1356b75b4bd71b654cd90123bea9ae74d459e94dd37f4e67025dc836246c52970e46dd5b989214259495
-
Filesize
5.2MB
MD51e1e895f334888e65a8ee97329e0188f
SHA14d00a7656a4ae3a132bb999033a8c3a48e96a948
SHA25679602d20ddb9672e316873708bce8c484db550bd6a036fcd72d4206a050f4f93
SHA512cfff974084276d0f861d8797c93400a3a0fa2c1853dcfbf5b8e81055a9335ac44d439fc2ae0ebb56ad0ce802c9f0a5e284665c8ea0fe21a128c87b99edc5dbb1
-
Filesize
5.2MB
MD5e565a5de9846eb0212d2f7889983ca88
SHA147c677547a61b18a11f099f764edfa8bcd2a1755
SHA256218578dc73b7827fff5c8b74b4954efabc0d92008256ebe5a4deb8a9312890e7
SHA512f721e1192c58a7609733e513360d4e88e2b45a829ab08a666e8b3f57725f54e91c72ee923893806d574b4e5b6edf330a148bd97cb456cb6bb3d9f4eccb7b11d6
-
Filesize
5.2MB
MD58b80ef7cc135272dc49329a7a48951a1
SHA149815da9490e28021048cd2caf98568b8be13329
SHA25696c293aef9cbd4d6802d9128d75adf5068aa52f204f03a210f312740eab1111c
SHA512d153326f099893a8adc6edde64d08744b1ff5130b4f310e178acda319bcf08765227fd04254f6be6fce54c423d3e0cdbc4cf28ce67d63a032348377cc104541d
-
Filesize
5.2MB
MD5b08bccfa4b9393c68f88fc20ab04a7fb
SHA16d4841dcc155c2ad39a32d3a09b79bcdc295ea08
SHA25658109eb94b743c80a47500622ffefb1dfed6144f444d0a67894bff85d6e569b0
SHA512750488ea5131ac3bca7ddd6acc6a56528d06dece46d9c69f498a53b5317d0374345c916222147dcad7180a36146d434cc7769f1f34be0e9c9094e1f9421fa0fb
-
Filesize
5.2MB
MD5a050e7be0e1bf8d2772960f13c5b4451
SHA119eeeb50a724781b1d7fd52e143f39c34fc84442
SHA25686148564e07204216d6c47db170403281b9f1eb4738d8109e883522ca784354f
SHA512492b1ba0aca0a5729f4e4ffeb1378b55443bbf36249a7921523c47936c77d84756af32c2821397a02754f67a4606767f7942ab465693bb03011b769ae501f6b0
-
Filesize
5.2MB
MD52bd21c0c8cc62bf245feb9cca867a51a
SHA11949c6f16a1ca817186a1f937cea296ddaa2dfa1
SHA256507cbd1170b382fb02556170fd086b151d4707a11c18152deefe1e37b11aa1c7
SHA512596755706f214d6994dce356cfc25ac51da15f9c03854e9e88eedf6d42488fcb9ff5f6f087e80124ea9dc301f9e3e31703b53565a5a21ee8cb4260950cc91274
-
Filesize
5.2MB
MD52bea03e470c333c2284c58eff10baabc
SHA1c0bb8e1807aacc54aa6837846e3343ecfe8553c6
SHA256e68f4a066c9ac76c08bef3c31253093035559c3812ebfbea76e8d3778de86c3f
SHA51236a10269fcb2cd45e39544defb4a6cec90b460905e145f0bed15f5437c71a23865ecbe3f728b5bc1f7bc123778fc62e1f0900811fcff36dc9b0d64fc2eb3a064
-
Filesize
5.2MB
MD559ab3ab62a468794bec6e5c478c6e1c5
SHA11f99e1bf02b47fd330680f2ddd3295e7aaed7d58
SHA2565f8f0b56d32b898d6c270c9fec474aa99ba34acc9fdadf89f536dbf770bcdc35
SHA51247c703e32ae324f3d874a6ba7cdfe1cf78339c0bb147edc51de740e6ddf873f74df2aa5b6e313809af4eca1a417b8a952fff26f740586b9c2e97cdc24d61e6f6
-
Filesize
5.2MB
MD5193124f68c40b3bb34b9372a722b71bb
SHA13aef1b23a808965be6ab498ece41a4006292554e
SHA256e60be5c5ab75b249753f4f8d12c6299407fd8ae0a1fcf4d5da696178bb51d29b
SHA512155661b9b9686cca56487ce9cdde2b3d806c1912970b9e7591687b6da6a371ddf5b9af5bb27d427c71cb7e6401999912b03cdc6e518a93c2f134d71f206011a7
-
Filesize
5.2MB
MD500a383a9435ab46a96bffb0b5f1f99ec
SHA1d85fd5914297c4b25d76c739c6c25000c6a33925
SHA256f3398afa1b4435a434217fa92f45ab93e1fdcd9f33a45af31b4eaef30fc47433
SHA512498e8cd57f3295d5ece9378b66556631be638af121dcdec1429f0a134c485db5e3ba48e2533ac48ab99e739ec291e845df0196529405ddc66b966f9d21529a57
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB