Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-12-2024 03:42
General
-
Target
2024-12-11_394faed61a340c2d3b8dc44c6b24e0fc_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
394faed61a340c2d3b8dc44c6b24e0fc
-
SHA1
4366def9a3008aea8f7826323a9167ab5523602e
-
SHA256
04be6853f2229c542f5ed2efe5ccc0e432c8e399c2db2e82b3bd5915a713004d
-
SHA512
2446509caac32d76360ac1d9060b62b4c042d3227f08390260bf62306a22a8345c93a83f26be8be25d20e729b33b46c665a47d0d4188d28da00d4ab39764a866
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibd56utgpPFotBER/mQ32lUQ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-11_394faed61a340c2d3b8dc44c6b24e0fc_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-11_394faed61a340c2d3b8dc44c6b24e0fc_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GeoXRNw.exeC:\Windows\System\GeoXRNw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rzJcHgn.exeC:\Windows\System\rzJcHgn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhFTYVX.exeC:\Windows\System\RhFTYVX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BLCYJxP.exeC:\Windows\System\BLCYJxP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mqOazeh.exeC:\Windows\System\mqOazeh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LcrqedQ.exeC:\Windows\System\LcrqedQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bzAROgP.exeC:\Windows\System\bzAROgP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fjLrSDg.exeC:\Windows\System\fjLrSDg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BjcbkIT.exeC:\Windows\System\BjcbkIT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WlZBQfD.exeC:\Windows\System\WlZBQfD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IowhfXb.exeC:\Windows\System\IowhfXb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hCpJySx.exeC:\Windows\System\hCpJySx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TASavgV.exeC:\Windows\System\TASavgV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FCnbUgO.exeC:\Windows\System\FCnbUgO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lXIxbbH.exeC:\Windows\System\lXIxbbH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eeVtglT.exeC:\Windows\System\eeVtglT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NAWAklb.exeC:\Windows\System\NAWAklb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oclmnRs.exeC:\Windows\System\oclmnRs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xJxIqJI.exeC:\Windows\System\xJxIqJI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sbEqXas.exeC:\Windows\System\sbEqXas.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jVLTEKg.exeC:\Windows\System\jVLTEKg.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD549813da1d96242913d341952887ad45c
SHA14d03452e78df4aa235c0f680ce368879837faae1
SHA256636a363da009556c988644b62b811c1dace26583dd81609cbba82c6da00b59bf
SHA51221828c4b845212fa75a06d695f7b59ad5f28f4ecaac337595ec14b7799d89a5259fc9c7b12a6b8493f9906ab4f0042e7cb314e8e6b2f90c4a72fe6e1f5157957
-
Filesize
5.2MB
MD5faf50ffbd12535ad5a5a3df20aa2223d
SHA10dc7a4fee6fc3f160a65949c603cd6b79e45ae57
SHA2565195f5c8bfd41f8a175f03a462112116fddc3b2e5b38cd6bea592fed5d40cfb7
SHA512768ea666e6596c40b83c01e0df7599e0f17bb592134e972441473d427584bdc33f45c1b050afdfde4520ccb3680127358b99bbba9f3048f5c2f6698d96a268d9
-
Filesize
5.2MB
MD58df2592b2b9a851fe62c1a86f8d8aeb5
SHA1a8e2a1aba0cf6e0d5baedf2fac7de91e57f29ea8
SHA256caba55e3382ff9dceb783e9e8341dee531e74ee92f301096ee95d544d22c09b8
SHA512ab6b473ffeddec5f347e0a56337eae1a9bb897fedde9ae6674a64bc3cd4ed455bafcc202c3bdfb0c0302f4b0ea04ae35f3dc473300e9895ce656f0ff8fad23ae
-
Filesize
5.2MB
MD5984e1f3e7ffba883f61b67d11f20e9ef
SHA1b69ca6b6c3aa936f3ac6c7d0afadd9ba76fb6530
SHA256330705543c834c67c84a41dc8ca74faff728997c60b1b22caaa6851f9c50b491
SHA51264c4ea95d802c0464523f7bedcd41c9aadfc552d49a63612189142c9775e1e95fafdb08cea157df717d52778af2ff8e30f0ca6687acbca60261304e485605d03
-
Filesize
5.2MB
MD54cb17fc97a58ee2ed5c5d264e8995944
SHA191c3e4e7b4b17f0d390ca73004c8339ab186f944
SHA25682e91ea7fa0e22cae3372eb42d9d1c6426aee2479ae05dc84438c447c661fecf
SHA5121aff5b729219d5750187978c57e294b0dad624223fcf29f5895925921d423a375ddb489d8dc0a22a85f9f29b341ccd1130d2b414bb0d4f2e9ba0b73bd9cdf8af
-
Filesize
5.2MB
MD5149aab60db71a70e6ed5cfbb310f73d5
SHA1abb36744d37e20df6642bb3b8e5626d0d9b94cf8
SHA2567921222df2e68f60677bb95267a8e57c304acaa8da1d3cd3ece78930adb53e2b
SHA512e114bd497995b97f837c39752cd0ecebbfb4b1a71358a30e34514fa2d48fbae8b7cb96631aa7c0d7fa76bd97e6e6a3e0c0477db6a841e49da4fb1a6a87bdbd97
-
Filesize
5.2MB
MD56c65ce9f97432b0ed135382323ede060
SHA1b0690939bc82ce06b84fc7bb8c32b2b0c17cc4ed
SHA2564eaebd3cafdf1db1c9a1158d0499c96d460c8a52f17ab73e0a6f4eb914a372c3
SHA512143aa90442d949a90f94cf94d00359bed01df20927c91b2979901418b6208af5e72a415c21c1fb3c4dba90010ecf823a21331ef9ba68c6d1cb6e3cc71502504b
-
Filesize
5.2MB
MD5daa1a232e570dda88317efe85d07ae83
SHA1344f09e42bb8b5aa9b95b3cd7f6145fa8d29ccc5
SHA256d5c23966089f9782a37911d9f4c46834d688c60379f73db53ff88dbfa81a7953
SHA512c7829bf64176d3a70d2e7043e26514a9efceaebe94372990f99c232b5a47ad413fbac9f759bf37f4b903d833868acb967ff84acb56fe4e7d44bce4c2ef793dac
-
Filesize
5.2MB
MD5f0748b7fd4289fa8cceb59b51555f133
SHA1574f2395d9d9476677a8cdad653eeda844b8f01e
SHA2568066c0d47fa294d0999afd2919610f7ed492d85fa94177a344e6d935771a4f3f
SHA5126f021151f4128440459cf1087a44139e3eb817c55ab546580908d9a04637401328a81e57466665173703cc2fbbb759be1957b0786297229d468e218a098855b7
-
Filesize
5.2MB
MD51b9060287ac94c4d50d0e9063707695d
SHA17fa7f897a306e994c2b61f7627ff38607b244422
SHA256be2157f93ffb42d8956a60c3c170de857333e09b08a5b4c828600f4d939b5938
SHA512019ebeb5c32797201db9c7cfbbc2afb1895c2cde8784e7143f91d2b229b1d5f5f60c85e63f3c15f2fe4fb691996f1e5e1a157df6cdd0507e4da7a3f121b666ae
-
Filesize
5.2MB
MD56fbdefea7bd610ed39f3da4ee73ddb09
SHA122815b4e01e7037d5427f30e97d9596670e2c4de
SHA2561e6012e5cd44a34cb3b59d257194d51c9734ac85073f720bb32226f71ead83df
SHA512c8b9b95bcbfa7635347bfe07456b887b7ab958c327a1920b9f09d8e79ed5c2b80f39c2269663353677a7e735bdb4f18a84340a4565a6ce4d9afd49b853cea18c
-
Filesize
5.2MB
MD50973bff505f53877a0f093023131c51e
SHA1f86480f78991a91c23cff4247a7981149302dd94
SHA256821498671dde66a59089342c1c098b45a23b3ef8cb81ef2d07deda538ba781a9
SHA51214c49d03edfaa1245c461b0a72c3b229c1fdfaa16f3586768730cc2c101d65e8b9cdbc22b20502c2f0e688ed7d35e512509c93c4ec153bfe17290d040511c6b8
-
Filesize
5.2MB
MD5d6b8d81196cba4f69d84b4ac074badc8
SHA1b12c9f9ea77194de7072d5be05134274d47d2fa4
SHA25667f5933e35ee1d63f63e0971831c3a80f280880d5569a76d7787d5be59688386
SHA5123492dc041b8e7d3d75c9e6c910a488342542053f87e1aae173abcd855813b73ee433b5de418fe542453db185e0e281390bae4c1f27d3317ff6fdfd9e21b486da
-
Filesize
5.2MB
MD55575bd8d9dab2956f37fb2973c241e68
SHA197616bdcaad9cb17cec05caeb11d85e507242bd2
SHA2569ddac7b1b548e34097d0517c64bf4d005536c54cd2e075b553cf3797e03fab72
SHA5120239f9d2e2986c7242213f9cec941f80c2ae50f02c2757cbb54d51383af6364b0c1e12432f2d6a624d7d0de6cafceb7238355c520ee6e169dd3a37a5d29b95f8
-
Filesize
5.2MB
MD531c5ddb3371d00d91bbbb572cf53220f
SHA14f108234fd6e40ac9a2e8c22e82094b1ca669943
SHA256f9fd1666e453efe40e3be735bd37ce0a14ad5059729d26a5b2034558638688b5
SHA5123d6742e195c6ee3251a85e9d18ba5bf86d4ac4a30cafe1082521b9b3adf813d0ab4f2c75d6f20b2ba7bf494faa4abe4ffa773bb4a834ee38405a6842e6462b1d
-
Filesize
5.2MB
MD5f0c3780a9f3b3e03438a810b0bd61e4c
SHA17a782820b6e25a46648fa6356adc257e77ac3641
SHA25697139a8e517054760f8105a774d8c2943cef66de6d067ac0e8fa8efe5988c284
SHA512945d2df94e5d4aef1b59c2a9667c82f9c30f72d4a71806b64d84890fd9cab3ccbbce286e46600a010b7f5e1c7c8866d6c30ac2730e3e8e5bf48a5a8169b2fe6f
-
Filesize
5.2MB
MD5b1ff87cb44a01816759e7f6f753b37bb
SHA12bed9de444bbc6b1c54b7a41a8ab23b224738076
SHA256a5d75712a7882c67694256922cc58c3d073280a6723e7b42176952fb243f0031
SHA51268cf846ae39dd1ac9bf46a8a1b28e419ccfa7a6c2096071556e6350413ff506fafac62149526b85b9d20945f5d74c01795d9a41f1afe6dcad97b4682ce4be385
-
Filesize
5.2MB
MD51b4f59c42e76c5e6283b29e6e21efb8c
SHA18fc3b64abf0ad5edb5f6faace0aba7292542ec63
SHA256c4fe52deb949e1c6c4cdb8cae5ebb2133d91bcd52df7197dc9488a7484450caf
SHA512504240c128f28e92c2c602906ff4032635bcbab5bfab3ae4042c1d801609f92797d7f434b1bf956348842ec8e106d9e509d706e811d8017638cacc138b111382
-
Filesize
5.2MB
MD5b9d1f8a15dbc6b571490f326a439d072
SHA113d60e709ec4074f8647270c3f8e152bcf508f85
SHA2567319af392e3bb6375a7efbb74b0efffe1a415f27a42adcde26dcdea0fb35495d
SHA51286dbdfdf1b5b4aeb8d3a37f0c1f9bfad597f7d6eaff818523c0e76d4b42370e144d2492b8973bd7d6b3f5c9bc939540c88905e751211891273a5bfe1309eb993
-
Filesize
5.2MB
MD512c3fa073dee8f2115faa82af4012850
SHA152f5e368b9e53b9ebaeca2d5a24f1e3d5944167a
SHA256f960d2159ffb6ffc29ba2a4cb520f08c0331185f5f70fe00b4a1d03b0708caa1
SHA51271408e7e724a4719a0935ef29606a928958b5ca3ca442291e0c2ce61094f8c26edcfdc8d3ff26e21272d816da7a142b42423e21d81399ea08821f61d8c3451fd
-
Filesize
5.2MB
MD5335a23edc1e086cf1085e5d974e0ef6a
SHA1b40358f98a251db39729e4490f31aaf2faf342fb
SHA256b92e23b4186e93fc6257d9c46f62817181cf333db26638bf3911304e5bff6722
SHA512058d5c9bf709ab0f3a0492e49bd77ee94d126867179dcec190b19d6f92035b1023b8098059d5845bb9af49788566c990932abe3e9dd7761a11aaa2b90776f11d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB