Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
11-12-2024 09:25
General
-
Target
2024-12-11_443eba04f8d72c279fcd832286d2328f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
443eba04f8d72c279fcd832286d2328f
-
SHA1
a3fd3ef189a4bdab648dde344ea5aa1ec17c8e86
-
SHA256
af13467ceb0e2c5443e4bf279eb8778f31729b5b2f252c94256bbb7d19ccaf43
-
SHA512
571f52eec047dc489e1d12b6d9f8679f722070872cbfa3da6fa51b37dcad2cac59be6f612b3625ddc039605339af58f792e0391665bedccf81e99e438ba30f5d
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:T+856utgpPF8u/7y
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 53 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-11_443eba04f8d72c279fcd832286d2328f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-11_443eba04f8d72c279fcd832286d2328f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IEvOiTv.exeC:\Windows\System\IEvOiTv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HNRezFz.exeC:\Windows\System\HNRezFz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uIYxfeo.exeC:\Windows\System\uIYxfeo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NyMXvRT.exeC:\Windows\System\NyMXvRT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rTLIwFL.exeC:\Windows\System\rTLIwFL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FLomMHU.exeC:\Windows\System\FLomMHU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VYeMzQg.exeC:\Windows\System\VYeMzQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YSEsNOS.exeC:\Windows\System\YSEsNOS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WJESZRI.exeC:\Windows\System\WJESZRI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GlVLYrb.exeC:\Windows\System\GlVLYrb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UhDTsPa.exeC:\Windows\System\UhDTsPa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DvJMblJ.exeC:\Windows\System\DvJMblJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mdidlge.exeC:\Windows\System\mdidlge.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QPNoLDA.exeC:\Windows\System\QPNoLDA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BkyWWOH.exeC:\Windows\System\BkyWWOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\APneSvZ.exeC:\Windows\System\APneSvZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ftWXFJN.exeC:\Windows\System\ftWXFJN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ocxItcY.exeC:\Windows\System\ocxItcY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hOBVkUb.exeC:\Windows\System\hOBVkUb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xEAQkYV.exeC:\Windows\System\xEAQkYV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gXzXxjN.exeC:\Windows\System\gXzXxjN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5d9c1b733a8f5620506042462770afb78
SHA1c277000d1b5f8b8960196dac56e060f003846ef9
SHA256c3352b2c723b4976253d93bb064139f8e148aa1b6b590a37379688898da77783
SHA5126db7434a6c2ea1fa2d52811679570323a0cd52361ca1df604c8b2729beb1c92452c9d71ed13c4e277739780d0ab368dbba169c5d03e5507a8e449c705c2ba9e2
-
Filesize
5.9MB
MD5278444a11b9e4cd1cefc85c597669eb9
SHA1af4275911cacf27bf1db5808361a82d7af0659c7
SHA2562974f6c6cd67d24422b36ba58622cdf86f43c5b977cfee520eabfb69674b36a4
SHA5126642d186895241e4fa2fd2c3bb4ff47a3dee9a7ea798861f0ac4e0f8fbe3ff535af57eef1343ba42c79c37128ff9ca3c936c7062998338d5d063b4557a4870a9
-
Filesize
5.9MB
MD54bb90a4de92b46b64a357339335b7fde
SHA10132dfe9057c87bc5285a1d18439b3ad3c015655
SHA2560cb479adeaf87ae2ae791156d8c64d2df5af2ec81539a322a9fe3b06cd6938a4
SHA5128b4f22cbdf2e539333b74ee9771cc853adc1e0dabc97d935e1454b8c4a9a819362d119571d38f5193cbccee3e0731906eca83211e29e6c39cb38bb04069e1c05
-
Filesize
5.9MB
MD5823815cd5c346caaba4b14a7c2f0e553
SHA1b5fa2485cdd8f06e57b42be1b98f004d1b553445
SHA256f5ffbb9d44915b8238c61991f563eee69f810e0799154c67a2fad1ef65c754d8
SHA512e936a5c9b6af71d146e45f66b5f83d97ef5e11baf737ddded42a668ceaa8f7c7da5d5854cf5a8e439981a4d2155bbbdb200290ef3961600a81a391362a3de859
-
Filesize
5.9MB
MD59f51a68fb873a1c12bc353f7ada5adf7
SHA1fb45f8957117070b9f51d41ef447a8e2a57f93f6
SHA2567ba037bb307d2c9c1f2398abbbadf08ecb5458c5de094c94613bc8a02e014ea5
SHA5129701930e8365bd59f6c49d7f1698928e8f89ded2ef8f6ab38f4c14b201d826bd4940af037eebdddeda8240b5b2a604761e1db809713941aa16bfffccdf56a6b7
-
Filesize
5.9MB
MD5fd75afaf4278fa3c9c43ef90dac578a2
SHA145ab280461509f3da4500dd83fea4e90a67048ea
SHA2561269386af10b07173c089ba7d44c7adab8cba117cb999f030294cd4b21a047bd
SHA512c70407aedd3b8d319ce91f125e2b936509d48365cb68b526aed476f0d5b419571f1aa5f5738da3f9bc42884f9c88e6552d8ae4af55fd13af2fbbdd43b791f6a0
-
Filesize
5.9MB
MD5f42bbc413864d6bc3b235c94bd197684
SHA1b7d0aedc5d6c58687f5ea1dc1afdd33fc69b4f19
SHA2569d414613bf55baa38352e46af0810c61beb1fa8fb568c50784c6629262c24e14
SHA51212fc3d90fbb0b1301652d27f4e83930a0b7c68c1f1debf2a46486ddcf7e7bceedb7ae9d28bcc885988df90262d83f4220afd0d1b927804d762ce4c66338fe8a6
-
Filesize
5.9MB
MD524dd04c4b25c801bf56c2421b06e5851
SHA1fba7a9b2ffd2c7c325cc02dfb021e2237c8c9885
SHA256dad4d0a813d2e6c128a278eb2227218e02de482425dd8d1451c2a493b8eed78c
SHA512d23ae411074e2c5de903838d22fb5404cfc5759c5ffc66128cd84bd58d9c5ed7ac12fe9211ec5cfbef5632b64258ee9e9639dad02ddef67aa31ae832c5a983f2
-
Filesize
5.9MB
MD51ac8f93619b219727be7fab2e224ea62
SHA1334014637a2ecc2430d6a86944eb906ff61717f9
SHA256a2cefcc0c6bb16d4d0c5b4f6b5c09f7cc87772b014fdb09a0abd44167148203f
SHA5120bb2c594a4c2312ed4247f1abdffbf6b6e4ae2d3e4617e936b0f9ebaae5f134e0d6b812f5fbed023b7b21622be437de3b713d9d11176f9dde12b77d185ea9ffa
-
Filesize
5.9MB
MD562ea67b372684c655d6d933ac61fccab
SHA12df2960142b28b39b65051eade359a6aaef033b3
SHA256e3c4df8f36495324f0307cde831ac7f77708b7824773208f89092e0cd306ef19
SHA512b1b9c63b4e787055f06ecad4f2f8cdaa76d0aff2673935723f18dce5ad98259cf5621229ff234984f1d4a2560a1fa3aa8b602f71c07c5b4e662ecfbfd3e16bdd
-
Filesize
5.9MB
MD56af739eb437fb0fc0d7beb8eac52b8c5
SHA1f9da48c03d8db689e37ec2d4a6fe5602e8cb7321
SHA2560ab2e0d3d42529fc28649e9bf23bc089b5a79e7fe8250aa1ad1d98166addf7c2
SHA5124eee76b218c34f363c4f5263df7396dcb4ccf840a7e150c134268db5a294e944edcdfe2974cc9d35c6a74d9fd9e2cdc09becab190b7209dc3956e3664380d0f7
-
Filesize
5.9MB
MD58e262b18e21d45cf03a8a00ff5fa03f8
SHA1a23ede6a9a7a5af5d0d106c6c44c0f0d765ddba7
SHA256296b3a2081e47e796d54180e196b182bf66ba4aa31a8284b994dac78476e9e91
SHA512b94cf0d64c502182b70c469ee8cafa97c1620092699244c8610b0b98741fbd1efdce96ab0344908d879b4edec3ec548d3aec3c2c781a55cd32baa3136fd4608d
-
Filesize
5.9MB
MD5d907bb09aaa12fa57315eff2a39a1142
SHA15efd7d847a698144a874ae52ce7b3b8efc60adf7
SHA256dbaeaef89f7576714c50a0b3db276e22ab547fd1bcbec243bc2223377cdb142c
SHA51234b32f18abf06728f8cfd4de63e50f8abd3d779f829f9f3f93557179e9e6cd28038c5bfe8ff459bb4eb64c6d774567f02b93c1f98665c5ef5afd78cf6cb638fe
-
Filesize
5.9MB
MD5e08e9c9326353d3a6ab2ea30e110471d
SHA1eddbe8369d5c081397362d8db2ca468f42d00236
SHA256d1b677ab8000dda92931d04fbb2186a12588f71eeaac7e0abcd1dafa24fb32dc
SHA512ad6a6fa9307cf9c98a059bbaff39a9df27a78f3ac2f90dea3a8681238ef8a1072e3a44755cf7fa82e7bdd7023b7faec5932343c84f855ff8e231317d9cc95b34
-
Filesize
5.9MB
MD5ac66ff30ec1a7046dc9ec4d38dde6232
SHA1018cb81262c48e2d8860683a9f26e99f18e53074
SHA2560bbb5f5b32e0771c9175bb3523cbaf8b2c936ae89c193a9be2aba1ba846cad61
SHA512299f3168b742b612d366bbcf1e0f5f682cda8f27b56dfa6b1320351233f756a146114015369a15843de1b56f5b33c470a44f517bd1f17930d678da0cd3f3b4ad
-
Filesize
5.9MB
MD51950adfa895110db524ee85194711508
SHA1b6d0f846c6c3e2f1a590c3ec9050cd67e237c15a
SHA256c5b67e3fed46a2a03fda78e018575001a4d001f242d722e0cd9ae2cecbe0b73f
SHA512580e924c4b5664836b17a3a0510bbdaca6f2761ff87d3985c95e61a10567bcb8f6cc4b4a016041aeeb2b8eb87050c5503cd1f5e9c7a351407fa9e0342e117705
-
Filesize
5.9MB
MD5447386c3cd688ec102920ae91977a7e0
SHA129a1da3aee444f1154426b10f998dc330d96257d
SHA25613cb41cbb9449f30e1ce8c740f52e4a4b84215b502d136f3e6db4c34f2095834
SHA512a9cf5791e88422c4897e30bce8ddc27c75630a064738738df26cc91b5a3f7f0aec52a14f3956d6b05554bf66e18fb806858bb32058fd4f62cda5ff0be05f6a0f
-
Filesize
5.9MB
MD5479b2677bce865a23f1d6f5281854c06
SHA1288d0494b0d42dafb2d5df949717c0c0f3572172
SHA25678791f365700c950086bd0f2c9cf67b48bfe4e158c63c844c29baaba2701d25f
SHA512b5ef150994a386009ca580a3f3c72ca02cbfd6aedcffaaf9cbadca998e803e4b69b5c0fb96b09a12662e64898e8a50472db6ba1ebaefbf6afb7f81177c6b74de
-
Filesize
5.9MB
MD50766bef86727ed7465e8db35aae46f02
SHA138fdde898510ae08273be08701cd7bed6e0386fe
SHA256753590b9d3f923bdad7e8607b234480917e309613f93c0f52587d504dd5e48ae
SHA512e6aa1adacfc64bdc4f542c2bd768d3f44b98856fde363a9aa6c098413a31a43ccd8e30b6ef621627fe8918db3e7ec29e05829f9ff4b4a5cadf99e9b99571cb23
-
Filesize
5.9MB
MD536106eee0de6fd45549630d4c7d65552
SHA1e6bf2c43e2c67224c0e694c89c6c4ed42fdc38f9
SHA2567d02cea65bd06a7ea3c82a5d9d41effabd3032d59c0f7e25d413c54795f74911
SHA5125591764ed25fe5a0f56fa3e781a5c56b9405847c7fac9531c9b74b4dd81908e43b9a887a610a322a8e5442b60568c5f87d555311a2a87bd480503751dcd9603c
-
Filesize
5.9MB
MD5e5e42def891b089c0b30b1f5d6b43296
SHA151fd0ac5fba3a02981ba61cdd670415972129ba3
SHA2564f29ede32175dfd426007635b0675eab03cf96fe5061c53ffb98c0a243f3c129
SHA5124b9ef86b208c9e9bba06a1756818724ca2e2aa68a86858dded1ef9d3290b3f52a22f51ea88a1e31679a8acb21cbd7439538e64ea67cdd2e0c1f7579d51d1106d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB