Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
11-12-2024 15:39
General
-
Target
2024-12-11_f2306731a77d3dc54afcac42a5d6db10_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
f2306731a77d3dc54afcac42a5d6db10
-
SHA1
9901f59ed094b6e67f86a2fd029a48be2275e038
-
SHA256
837b9704a9f96e27d990ecfe80c653a309c885a63ba246e8025770ba3e422693
-
SHA512
93a82a7b480ca5037f37c34e6ab02ad82b9844017dcdabbb1d9936d4771c46c9d2ad2e13bf93262390e78372f32792291085a251a0a04a960a77318a989cf4f0
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU0:E+b56utgpPF8u/70
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 61 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-11_f2306731a77d3dc54afcac42a5d6db10_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-11_f2306731a77d3dc54afcac42a5d6db10_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dmioGBV.exeC:\Windows\System\dmioGBV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RTacBrS.exeC:\Windows\System\RTacBrS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fNvBVym.exeC:\Windows\System\fNvBVym.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NggiVIQ.exeC:\Windows\System\NggiVIQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VngHauS.exeC:\Windows\System\VngHauS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QUpTihv.exeC:\Windows\System\QUpTihv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KoePUxQ.exeC:\Windows\System\KoePUxQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dcRXwfY.exeC:\Windows\System\dcRXwfY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qFEjctI.exeC:\Windows\System\qFEjctI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tREvhdM.exeC:\Windows\System\tREvhdM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jfFNaBQ.exeC:\Windows\System\jfFNaBQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\embaOhq.exeC:\Windows\System\embaOhq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WJkEsYD.exeC:\Windows\System\WJkEsYD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xdSqQbw.exeC:\Windows\System\xdSqQbw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NVaEbOM.exeC:\Windows\System\NVaEbOM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ERMZfcK.exeC:\Windows\System\ERMZfcK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aweQFJm.exeC:\Windows\System\aweQFJm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aMOjPCC.exeC:\Windows\System\aMOjPCC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qXYfEvg.exeC:\Windows\System\qXYfEvg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uDpkOYY.exeC:\Windows\System\uDpkOYY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eoTYaxO.exeC:\Windows\System\eoTYaxO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD506775efe7a4b4a73e8d8fb6d1fc22df9
SHA177c7270a09b1bd95bc6ad382ccf50cc67d83ddd3
SHA256a56e0c8440b4749b435b4c0f9236e393638deeb50caa56652c50a8fabad4f820
SHA512a669c46cf359341083ba47ec2ffab8c183e87a2fc8099cff18876cda005939875462faa6d1d1266fb642036ff2f25212b9d43924ff0d11f891dbb3e84a49a1cb
-
Filesize
5.9MB
MD5e84b8279b97edf3018a5c60b153dcdc7
SHA1353051d26efdb0e458242e8fb5fcaea1a39486b0
SHA2565e64c1aab241af0b679bd766563aa19d141f8cdd4406500708112a117d301496
SHA512c36453c7b6ecac099a40c82abf95f0ab15ba3d6aa1f4239faba76b3bb0c382f6339aa7a51cbadc924a4c69107c6441779da17d0b5d66963dc825794a8dcce3ae
-
Filesize
5.9MB
MD54b90348142e1b4814098b1a167786075
SHA1dd363e824c741dd094ff51e9045a085fadf0119b
SHA2561e25d1378800d8bfd70f806c1bfa5f4070426c3d8984ec65ad10470c281bd28c
SHA51219aa18e01fbdb4cc22eae606f18e4670535fcc6ce50bbcd88bda9315266cc0b352d90b52d3af208876b0b1061641f1b477f6ee42d6a935915a369cb63aa9fdef
-
Filesize
5.9MB
MD5f3decb52cf33990dee76229ee98345fe
SHA13596a6d51df0c4e5f6f66a57da8b3bd6ba5732f4
SHA256461b7657d2f3e1a8eb3fad608783da34ab17cae18489ec4d85316edbb7cda0ea
SHA512bfa9cefedffed98814113f80d8013a25a1fc28c742371fb01065bdf731aec2d306d6984286a64f1bd5ee69dd9d7d03fafec6540feaf95051109158cf35274d33
-
Filesize
5.9MB
MD50d3838b3cb3f8e5a8f7ac2876464c14b
SHA1197124be9eb4ef676487e07d496b13ef90cdef0b
SHA2567c6e5fda2782bbbb91c2bd5c752f2d81543f4dae53f0ea79f8b8eb1c56ddbf3c
SHA5124265ae46edfc1e7f88021c2f7c2477eae497fe37552b2305d7d21a78be7b18e21eb75787079d1a3d2a8a4f628c47f800f6b0d9a9ffdb61789b6a5fcf6de29110
-
Filesize
5.9MB
MD5bb798194c5c459622e30d346e790a73e
SHA1ef542255f71c4b5842cf653728e1e9a823802560
SHA25669bf5b9f9cbc48af0bd98e312224cad62f93cbe214c38818094a1341e5ef5e2a
SHA512d2f30d88bee8231246ceea7198fbf5a9f517ae1ea5d1fd4656a23442d9f87acac674cc462613ea77013c3ab94e77d4a7ef834d2c52aed4949c0bc43cf47fdc0b
-
Filesize
5.9MB
MD593a99cf687807dd26fa3072f43aa7d02
SHA10981815e1e3841da59917e003768ec2d72ce0702
SHA2561fd71d4f6017d556d2854ea84d8d3701daf58d864df64f7042f129ba3ddb3296
SHA512e5f94a9b20252143f4a40769e0f927c6c9bd0cebd6aa936a3edfb3ce042c44ea528980963b5d276f93c5c07b274be1e721e2f766f4fc2be2132418ebd7dba24c
-
Filesize
5.9MB
MD5fcfe9af30a47fc6a83c5bbced0163835
SHA13c14dbe3ae3dc6375a0a8e9ce5feda20bc61a436
SHA256074bcd69768a5c78624f306ad9846ca40cc2a3aa89b2928812604ed47f3ac4de
SHA512c33ad158e0e15c8892cbd700a98f2ea8bdef84849fa84c29fe5399d0f15d163e26ef34323c215b7d60f0cde56a79d1136abe1ca54afdf00cbb01a44d710282dc
-
Filesize
5.9MB
MD506d327f56cc72fdbc3f1b8de87b6e45e
SHA1a0944d9dbc4c2c5a94ade30378d3d8c89b69da24
SHA2565f70d95e44531c21087249505a6d9adccc6e764cb50db2e75ce901cbb8bd0f16
SHA512c5927b84bef277dd288ceafd27ce0398b359d9db2c7f7553c72c6e800a389d45af4b99548e9abfd5bd3709f1b79c9402b5e39d99d680bd76e9f6fdd70c4714ad
-
Filesize
5.9MB
MD59b1b7b09e2e9c1710e9a8dff9979bec1
SHA17e8df212f1b382e5526aec460e16cf5ee81d5926
SHA2566452174458c6fd7985831006518e17879851e7afea67e29f3eebd73fc4a251b7
SHA5122d2c79e917435858ecf1cbacb625e908d62ee7219ab8274c3f5e97c6d261885a935ee4c493f1558803b4e858502ae97aa8bf95e3a35165b8eb4ce8e7d82dca9c
-
Filesize
5.9MB
MD580d19abfda2cceffd8901ae9ebdde3fd
SHA17e872c607832d98ecae1a0e0c8f3ee902beead47
SHA256a8b99f279d38b9e4b72d16fa6baa3e6004495dde01671a1dbe0ee61128c60719
SHA512ead9dc92f9192907598505532546a879cf5ca2a7bdb740251b06694cbb0a1bad5b6ea54c1fb77e4d191781e8292ad0fdeb550b0f45b3336c160846073d57ad36
-
Filesize
5.9MB
MD5f43765f78955944b394746293355778c
SHA12538fc9003a47f4f2961e84375f0774ddd02cf4b
SHA256b43c7236b7a5a3caa07eb7745e10b8469f6d825038f39eb2933febdfc9408f62
SHA51272d6bc74772618ad3fbe2364014a5442e56461c529d3f7f12d968788b9b6551d2f0340bfa25aa9838a62b4d650c472e51cd9fd76dc9b9c7a36fc019ae76a0ad8
-
Filesize
5.9MB
MD59ea22e191d2e387de93655984bfe86a9
SHA1fd46c552592cc458d491d026f5d109cfaac1d3a5
SHA256e5cd64a74c2e855fbf53fecafae57938e176bc654fe67ca295ffb10ee10ce9f1
SHA512390d0132515750d7aa7fe674a6bbaa70d0feb69a81f328725a0fb5f2e8740146d632b180a8a285d63f3d2b6f42503ee51a63b50bf9a35f6414668bbd4d40b253
-
Filesize
5.9MB
MD5fb43961b7e787546e623cc0cd04c3621
SHA14d46cec7bfa27f8f1ce711c855fef97d400e4fcc
SHA25609afb6f6e82b350029aa9ba1a936eec575c17583b6699103408615e3e57cc245
SHA5121d6732ae87421edb677269965dcd3804068230ce67d557b0a3e151e2fa3f22a245e166c99d2880a1f38d1cc3741d78a3f33a32f45a37ae9050aaa5ae4de37a4d
-
Filesize
5.9MB
MD50a4fb28036bb1a1e38f13294d1804f10
SHA127247f7f46fd161eb4e353f239c598903cf9ccde
SHA25605dc90b3483d131ba7b8d1af823bccf7204c4ed9d8c6d6bad3ec60fae6d76c18
SHA5125ea4d1c4c8e00083145587ed1e82ee15b29e27ee6ee6e754879a75fe0d9c93117eb4e64a179b2e6846466aeee5cbaa86288cfb23677b243a96c8d6537580c300
-
Filesize
5.9MB
MD5c455ac7203d3347e4522a988ef10c61f
SHA1ead7dc642eb48cfda2ae75322b2df7efeceb5329
SHA256a59281062bb5f7a2f277bdb5f079e4fb3e24822e6faf9daa0b9cc164fe9023a9
SHA512476d4d1f343866b2f55a6d4ed12903f733489e31cf15284f65ece1b0eb3cbd5d958428dccd3ae62804283292c4d98d4e14ac5a51840a9d8726e5a25813ef1b8d
-
Filesize
5.9MB
MD5b10822b49afd877633c41c1e9d27a0e4
SHA1335f971867a36e66908bbf3d25e1ccf21e9ab030
SHA256f8f34e41da5eb9c8a060bb2b270bd720be9389ca18e2b518561877b61c5d9171
SHA512a03f62f54e88dbc9b97d9999d7b9eee0581911c0f3a66df0ff3d57c7a09227d28f97349666f070f3eb1216db0a1238be22ad93696fad3784dafb1d49fb4accd7
-
Filesize
5.9MB
MD5ae3dd4989fc0d5441f40ed4379e49c62
SHA18d4d2b72de133c0c98874d556a414407977b5f93
SHA256d20cfd350ccb9c251d391b506c2d572c2b2c9cbb8dd801451ed30b845b3ec194
SHA512f7425b5a6693ba31e8a9cfa89cc44fbc112c974f48984604b0589ec8e76e4674089eea5aaac0c1c41036d262333a907686cee43daa3246b17ed74f7a5f887296
-
Filesize
5.9MB
MD5f19c87f73dac319328f86dd923e68a7c
SHA15c7d8c243217c62df3f98fd8c00b5c2c2bc05f9e
SHA256f71cf03e71a23fcaa90de5f3c2105f242ebc857dbc71ca885888b103c83292ff
SHA51288ea2723f12d3e3ef5694310171de73daf2e4b26ee05a2791765d0d609c3beb071f214615fe882fde55d141bc877322053fd9c0bb803e14f9b315833d0f0fcaf
-
Filesize
5.9MB
MD5a393a476c8d99554171747230b47c0f8
SHA144ac8cdf176fb3d383d43163efb9d532d7af80e0
SHA25607847a7c13e4a7f60addbdc79491a3ab318f2f8ac2fa58493d714f4f335106a8
SHA512ca8e7e32d8516e43fe9ff277f8ed58838c949bb63d9ec3b94bef084c993169344b6902af4f1c784dfa1ec7223613a5f530666c4c9309f1a9f480f733a6834f52
-
Filesize
5.9MB
MD561207c3d9619ac2f8f9724cbaac0be0e
SHA147a5399286c265d345daac72c970e50b611d9c2f
SHA256c8bffab09bf2abbb829190121f8f937ab82a7fe48a33fe9bc571302d1098acab
SHA51226a528ea47807440ecd0ea268a71ca1063d2d86c6332db3f2a5d7786d8e0db271e4acdfedc5f97d73d1418b3b8515836a6ee0482047934108b0056a120031439
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB