Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
10-12-2024 02:49
General
-
Target
2024-12-10_e7089b2021dc57f6625e1ec5af92ed3d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e7089b2021dc57f6625e1ec5af92ed3d
-
SHA1
bfb164e84988d63bc1bf3ba16f49f8fa7eed785e
-
SHA256
1d8da13572d15ba21c7e318f191dc72c66d945683b1b667ad98e1e79a97b0b12
-
SHA512
f33dbd16c3ded83f1b42e229a03cca8f98bca3ba480139d749666cb05e519acd76931c4ceffe76c6f392fcf37c76a7db3e0825a62bd00adb4bc2a16bbab391d8
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibd56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-10_e7089b2021dc57f6625e1ec5af92ed3d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-10_e7089b2021dc57f6625e1ec5af92ed3d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WujQwZv.exeC:\Windows\System\WujQwZv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DCPVPhA.exeC:\Windows\System\DCPVPhA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SGzBjZa.exeC:\Windows\System\SGzBjZa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WKMkcZU.exeC:\Windows\System\WKMkcZU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AwgPhjB.exeC:\Windows\System\AwgPhjB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AaJMDWy.exeC:\Windows\System\AaJMDWy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cgEJTBZ.exeC:\Windows\System\cgEJTBZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ToXcOTi.exeC:\Windows\System\ToXcOTi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AMXRzvp.exeC:\Windows\System\AMXRzvp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\buEauLs.exeC:\Windows\System\buEauLs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\olkAKqF.exeC:\Windows\System\olkAKqF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qhUBaZp.exeC:\Windows\System\qhUBaZp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\syeOQOL.exeC:\Windows\System\syeOQOL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ASpGzpO.exeC:\Windows\System\ASpGzpO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AvtjYMV.exeC:\Windows\System\AvtjYMV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zBmnQxq.exeC:\Windows\System\zBmnQxq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GwWHrrr.exeC:\Windows\System\GwWHrrr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CQxDtMJ.exeC:\Windows\System\CQxDtMJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iSGmgBO.exeC:\Windows\System\iSGmgBO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RAdINHq.exeC:\Windows\System\RAdINHq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hZxirvU.exeC:\Windows\System\hZxirvU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD559beed23e21951c6bb921385cdf27993
SHA13ba7a0dfbaab2a46e09de784f186b840fb7c8fa8
SHA25612fa3e26cc16cc44901b240430a1be468c79b58f8b6e1eaf25752af88570ecc5
SHA5122817fcd74b8b4120393f65be9a227bc1a52cf48b7c3f39e0b5e4e0494322e75eeded62f1099170e383c6a5b3af4228125473a8fcab2931564db4376be7599fe2
-
Filesize
5.2MB
MD513c846882179336682ddbca7890d4b0a
SHA1288fc226d65c969e049ad22c184922c84a24012e
SHA256f5714c2f578905f4aab5aacc50383d2aadbb9c25a5898238f931941dcacd0db4
SHA512adb31b197467b7f02e51b42342849a65348c15063655232c6ec577423ec728021330aef72ee438f16ebaa8e8fbd8bab748e6269d3f613693ad126036b35d5c77
-
Filesize
5.2MB
MD5cff55d5efd356c8957793ba23f3245fe
SHA150d582529d8cda3be9e3da9f5a4b1530bd2f3d79
SHA256083424a95936bb8fc1a59b373b50d7675af594d2b9192a61dfdcc29109c70c58
SHA51212d7b6df0a2b8a563fe97ef3c63ff753bfb7c18ea139068181656dce425665612161ecaf7e8befb2ae30436002a5b7c6f1eb10a11dd4704ed4b3b7c4baeff1b1
-
Filesize
5.2MB
MD5be3bafe6fe0769d29c6e4d43b9e60ff6
SHA15d4f56a6c1e5a96535bace95d2f725bc4a0aaa5f
SHA256b62523ea150abae5863d10b695deb19c528619248d954684bf37f58c95ac6efd
SHA512d5a1015fc630096cf2b6f036f742dd90995b66a4a08d58fae94777155e5a1a394963a23d2a2446c0327af9abc93d22b73b4318fe20bb2fc33166023b638fc12c
-
Filesize
5.2MB
MD559dbba2f270335df9201bfd1317d4825
SHA18a0768758e945eaefebccb1cd1927dc5bec654d7
SHA25622aec451234b2704e1a82323cec78e1f79fd8e39580ce815e3a9173ed191dec2
SHA512b08c4848ffa0f3c2cef76e062dc53309466fb2b688f53f6852437ea1e70c801e4af4102d7acc7b622fc43e3ceb510ab11bdbaa3a38df4d292ddd908c06065333
-
Filesize
5.2MB
MD5e11cba72edf85b18cf21011e51540bde
SHA1a82f8212429b487cbf8a819636e5f7580b8159ed
SHA2569b675ddd24ae0cc3ecb2841c173bfaa6a1b0ac50f2af4251686b2a96e25f1497
SHA512c9b4425689e368ada71b7ae096f4885ed0eaa67fef17787539ade69c10e80eb3c678d103f7b79f50905c8703128559029087bb2f1ad1abcbada119d9d38f7893
-
Filesize
5.2MB
MD5e7b676cc1a613ad8c69df02b482d24dc
SHA1f1401026769c9d3d4c3bd54696994aa4dc779c8e
SHA256ca6b9fe4c9d9cabedeb11b9fbc46456af0db0ec22bd60dd7619b6e637bb8e803
SHA5122541d7f24092cc769b13fda0a6a2ce0ffe216510262ba0295a73055738d4903d9c13115c958fa382b4f5a43e8ff1904528df424f78d35b46b1c6014fe70d13f2
-
Filesize
5.2MB
MD587f3e21fdc312839627d79881aa59953
SHA123cf1a3336a79829a312879e8abc583f267c32bf
SHA256467222e7147d6138db20bf2b2981772537f35c88e41e40cd7b424a10a9bc6093
SHA512ecdd4d36470746624ff522c77aa7e144bdd46cc635a75b9a88119f7e33c3a461e9c1c589c8c04d1c3c706e9b46da4eeda9b798491a3869f387bfbd00589f3c01
-
Filesize
5.2MB
MD5d69cfbb74c8e9e5f848d982241e8fd32
SHA143918e6d91133772013a36a600fe18b3888b2cdd
SHA256d71458009b02ec91e93f54e41cbf62e93760a50c4838899dc40c89ea93572d32
SHA512c09356c2db7bfeca403d8b805a8fac22dca85cdba25a1d1e58118c1b999d20677b2061a6ac3408113a342d19b5e18d7f7c4d36039a5eabbbb3fabebf11f846b0
-
Filesize
5.2MB
MD5e99433d09f883a6f56e6f27fa5249c84
SHA176b0ec8d2b1642eb5181c6264949b513604d2da0
SHA256eb30c689e074b8f0ac5bc03225490069a52ffd7226a00342b7aca26cee700c4b
SHA5124a24bd7fb8af2c40862ef7a0ea1863036defe7a64d3eb1397f09c33ba39f725459d5cfb4dccc5635e9a978d1325d40e26372c7161ddace0563734f4a42fe7de8
-
Filesize
5.2MB
MD542ca9dbb6268d5533694ab9bbe7150e4
SHA1a6c939a0118b28434f7de3d31c70f79b18f62f09
SHA2560a9f501cdbae48e6b5df7034582a86f17bdd119f60b235f374d547fb8e0daf65
SHA51256f01caef1ddf073965d98cfd1566dc7dbddf38195c0d2a8a947a05cd6a58dc87da3d5124e5b5d2db63f8be6ac3c7c6832281b7cd602cb8437aa92ea4b8cf253
-
Filesize
5.2MB
MD5598e7f4a836853573a29ad46c58f94e0
SHA1ea11e0d05164d39e33531396eab49304c5a4ddae
SHA2564c6aed83f941e7a753f38f9e79214f74368b7c6025e482dc4484ff2e04050dec
SHA512a58235bf7d4578582a3e6bfdf1849b011f1e88cdfeab60babc9ccc1c7d6b53c97032b64f2416a3ffdf0edb1d88829450104d93214fb65b8efb8ea36b2b8dec8b
-
Filesize
5.2MB
MD5fe7f3bccc1caccf4872d5a3221eb4a08
SHA186226388faef7d7bcb610beda2d4400d4ee19447
SHA256402615d2383a4aeb8b13723febfd5e97187a4aff89f44b356ad2c528731caeb6
SHA512e8c26fec201da61f3ff517c22d75abe40e10db6b1b606d7b76ede46a7678f92102f900e3642c19d2ff86e45f5eca85a61fb8ad6478817de4d74c2192d47656b9
-
Filesize
5.2MB
MD590219946fba5d1ec7c674ccd8c93a01a
SHA1468a068d9d765e9266f5842a14d28f7b1e2a0520
SHA256d47786fdf451deb9e10487bba8cf80492f24a098e64d3b84da98ada63590bc46
SHA51216a3266df99bd06fa2f1edee73eab5fe8bebaf3a94c0f95d212fe1e431d3387a203c264344c7a42b080ddcf6e2c5e57621b1f0e61f5dd8f474fac784051991f6
-
Filesize
5.2MB
MD596908568166fed47757663f97bdfcba8
SHA1fcedd39e4226bd0cc332a96e65679db248a9564b
SHA2561fcaf07179b9827b632423bbcb9ae3d35462cd6d468804d608c68acb2e55a00b
SHA5129da691f1e3087ce96b8e461fba2aeed43dcbdf7816fe289c1522eee8f851344d478f18aa417cca93df1dc0b15c2ffbb7e16223b65560eb906e0a3d52751785bd
-
Filesize
5.2MB
MD5b54274dca1ea122beffdfadc50ec4902
SHA19da1ec753c5810aae03205ff425768a42fdefa1a
SHA2564552ccc8bb3d58eff7578c9eecbde184cb01b9d0c04354cc5397d91faeadcf86
SHA512901c59af44a42dcf633472c41debcf6c563c15db80d1f90054a950b26cf187e3f1b85129407e64ff171490ebbb150302ea76ecc5902b562c938cecb270e81585
-
Filesize
5.2MB
MD594b6d3af15e5bcc5a1a4830a98dde5ee
SHA17860295e5a488398aa2e34b55b14c9f088b95c56
SHA256c252cf8d73e082f5d996abc7299e5986723574441a0db83d1a3fa47bb415551a
SHA5124845dbe380d17920af7dcdc486db74b0ba97e0a5c0e338684e32c9fd244012ba55c89f93e3563fa0a7f7a0f320e5bc6ddf816f0aedc4bd17b92895134f58adaa
-
Filesize
5.2MB
MD5df58e7c8a6efb648703b89a2f3937a3f
SHA1aba80bf783be78d598b6d1d373a1aa5dcc5fec78
SHA25663d469fba16760d0541e5cc034e947544f7b8d48c24b605ff08a8740aedb1f55
SHA512cb69d71abb945d338403400a6e08e5ea6b0a0d744cfdf696e6de8c27cd83788f045f213dcb41d1e4a325a110ce4adcadc7c1b77f46db84dfc837a3a12d58a34d
-
Filesize
5.2MB
MD5478241f56ffb547932b507e666f3b14e
SHA1a86b37d8b4d60e2bf51c4507aa2742edcc4c8521
SHA2560f053daa85fa103e87e90f6418ab18b79c7b4dde1ca0b81ea5d61c5d95511aac
SHA5126470affa23eb212e73a7510c784f32e57d026f095ca6229d5402f578f2accc2cd1a7d86671540db560487ccc3dd25afe5204c7af00ef989b30ccb063881c7bb6
-
Filesize
5.2MB
MD508650ad2e0aba967947bf99827859275
SHA1fd0e7301cd96c83767a436d54f76c04af72a39c4
SHA2567c08c97adc778dd31af01803e9b9d8b5442541f9d2235b63ac91dfbe91db7004
SHA5126c0354fc26417fc76f3c0259d9f14d32215bbfbd4cda0ca8defdfd387272dd460348f452785455ccef9edfcdb78a7fe647108d85dfc3dd29c738d7611b3a6cfb
-
Filesize
5.2MB
MD5058194ad5bff237a92f2b7fd367e85b6
SHA185116285452d488c8f5a2b7f6b7ed7e7ca6cd560
SHA2560a781b8ec7c0988a84f579b75f5b6ff939073597eb08fb6964a562683457b11d
SHA5126c73bee4a2c5b7a2955af8da89ff14c3e41eeced50c77f4d1cd69cb88fe6aa71a5f89b029503fd49650b9d73a8c8a4c414e9b3e43ce569e0e91ff00e621151ce
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB