Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
11-12-2024 15:32
General
-
Target
2024-12-11_41370bb5a907523bb901f5b98a3f26c1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
41370bb5a907523bb901f5b98a3f26c1
-
SHA1
0fd96dab8cb497678bb86bb587796f32fb78941b
-
SHA256
3dfea4f6644b7cc71b59daa42cea2d79b6c8ea1e57ae23659068c70e4686af9b
-
SHA512
a82a4ad7176288379590a1e2533ebe0c7613650fa43e68e119f077d0c7849e4f11ce2fcbadf08d63aa79a0cc43f7f73be5b664fea6dbfcd417616735f3e6a60d
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUP:E+b56utgpPF8u/7P
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-11_41370bb5a907523bb901f5b98a3f26c1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-11_41370bb5a907523bb901f5b98a3f26c1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fefutEQ.exeC:\Windows\System\fefutEQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tqOYZJf.exeC:\Windows\System\tqOYZJf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AGkUJMz.exeC:\Windows\System\AGkUJMz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DJwSrIg.exeC:\Windows\System\DJwSrIg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qIXOrrz.exeC:\Windows\System\qIXOrrz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZswtChG.exeC:\Windows\System\ZswtChG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xZfOflc.exeC:\Windows\System\xZfOflc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nquVJlE.exeC:\Windows\System\nquVJlE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CFTfzWo.exeC:\Windows\System\CFTfzWo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RQPOexp.exeC:\Windows\System\RQPOexp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kkbmJdJ.exeC:\Windows\System\kkbmJdJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uQwWkDU.exeC:\Windows\System\uQwWkDU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BLRCKGK.exeC:\Windows\System\BLRCKGK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rQQescI.exeC:\Windows\System\rQQescI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\icIKxvd.exeC:\Windows\System\icIKxvd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nEnkEzV.exeC:\Windows\System\nEnkEzV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\udWGLMn.exeC:\Windows\System\udWGLMn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VjbjqEQ.exeC:\Windows\System\VjbjqEQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UjbVYZD.exeC:\Windows\System\UjbVYZD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HqOCBSZ.exeC:\Windows\System\HqOCBSZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ujdQJbz.exeC:\Windows\System\ujdQJbz.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD54d366f85f97b4d77f1178ff5f95fe989
SHA1f2f88e62932f21705d8e3b6c7994605553e4d1bb
SHA256ca0d950fc3955e62c2991e14a0b1de71ab3343157a758ee7575d3e28fdc28557
SHA51216bed3ae2283131ce2d873f31923407708bcdd59421ea75b5360b748509e8d16d6c10af5239adc0156faa01a6e6c51f85fc70cd5b9272f1e54ea13f3ca276dbf
-
Filesize
5.9MB
MD53334060a064ae1d906174ceb17ccba13
SHA1d3a5f85cfe57637e2936664c8148328ddcb65cc3
SHA256ee8bc1791d9029d2ea32b49de2e74f772acb685a0442aa8dd36b30a3b569d67f
SHA5122ccd9a9cf226e25bef3e8ead599fa0aeb010e5c919b550ed2c232c76d17b32b18f11af2184cfd0a00e88d951602c73dc1f0b604cc240514c1b543c88cc9ae108
-
Filesize
5.9MB
MD51f3c4960a212dcd1f61b329280af994e
SHA12074c13ff4aa8720b44a93552080972416ae91e0
SHA256cdea65415e5a7bbe1e146f5dec7b3d6da8a77b0135f89dbe30570a517d5189f4
SHA512cee8f33893413a7c4bed34b517d8c97091dca25b298df8c1a989678d2d84d597e763f5c4b9c962d7ab9c58b64e449ae08344fc6cc790cbb276ef7ed39a7852a0
-
Filesize
5.9MB
MD5e465466b5436e477da483cd9f9dcc850
SHA144362de30cef4849f0eb3c9b81707747a1d91914
SHA2564cbe5b7fcd65a2c60d338c67ab54bbcb5174b8f8e9dff4e7d4ceef87ab443851
SHA512f305a622c42c8a9e5cc7667aeb0f3ec6977099acbb4a8dc161ef4862bfd8512b6a7393be0f0e482237e6023186c6691dbfd2c99c3c176e49ba1b195c585b2104
-
Filesize
5.9MB
MD5592bc560c839487c0549269f1d8c79a1
SHA1e301fb4a4f9c77067a5d0c2cdc99678611e44461
SHA25637491b548787855b7f174e58eb7bd68f1d4d444c8249d4db52126e8584cf8be2
SHA51264c7ef2a608a4d139544f2c2c35a5c013d78dc01bfe148235ef4b7a4e6ad85d6e9d6df8487319f57f26f2dfd17817228d6f1cc6794cdc6bd838f962fca6cf85d
-
Filesize
5.9MB
MD53a9e26e64a3cf299db156ce23d5b6c93
SHA1c1f26b00af55ee59204b0c41fd5a6a4752d5f034
SHA25620471dee4fd0fba2bbe8c58f1db1fd771bfde7392b231f2ba26463df94d12635
SHA512151c213f67b213d2b80efea89ee857e0c4f6ffec2689bc46b7bc54a84c08db0ff773ffeac7e0326e2fc79d6fea2cbd16f2b326882c7b7218cfe93e3efe44181d
-
Filesize
5.9MB
MD56f98396a51d0053f28c29b60fdd431e0
SHA175ee6df51d49b5115acbc3bd34533b819a001217
SHA256a36b7f91dc24138b9a030a89419b5d5ac822ae463082169ba5b3a7797eff10d3
SHA512b2d4592e96a6c545d5016cf71f4c93c71a7f441a0039a44e9a2301f41da02349de08fe101738636ac5719d8cb16fa25555811a275714c8b0582b5a1d89590c51
-
Filesize
5.9MB
MD54acd7a9010775161f9f9e785af8a67bf
SHA1ad12e95fe0f83bf1fbdc4752b0c7aad0bbcbb4c1
SHA256e297348444cd684ade55b6907e4e4ef111bc7d560d37bfcc26604a2fc205b8a3
SHA512d36de3ab59c5db54380be1f6dfdab8d85f8ea3018cf2cb57ef65bbd74c2592f6b3af60be165ea391abdb051718f86feb1c4e9551853601e094c8a48395b5ab52
-
Filesize
5.9MB
MD5a7c1e22e001b65b03f14d5a05c520772
SHA1035f5601e6a950b4e9bd79318445e19f42f6a8d0
SHA256c40c4cc64f5005b32fa9ae1ccaf93d992ef83af14814597c48cdea7a60bc419d
SHA512146ae8aaf3c622f828632d312c04e26856401ca2cd80ccbc743e31002609bb128e5ad68d0924a734c8e043b536eda12c1c466871c83f0697633f517a5e0053e1
-
Filesize
5.9MB
MD50c0ad6cc8107afe800de2c1b1dc20fc7
SHA16445c88407ef9de852fdcf0868bfde00da7ff2a2
SHA2568e506f408ae8798ea1e1005fa1e75a34c7d78e6f11059392d0602125b0e23991
SHA51292a1d7e7e1dca6ef223751a056c3d7eeb7941334148d9992421bc254bb0aa19344364c6a8a05697e6808ba851e0afe7b96d4e416e3b1e33fab0be1ece481c5ef
-
Filesize
5.9MB
MD5985ada16bee3313732dc6c866cc2b95a
SHA14fb690bb44fc5a87cc9dd3c37d2b10f052b737f2
SHA256f8e256f936f859fef821dfc83b4d8c4d8c12320dfea8d6ab528e1b75159d8702
SHA51216b96eeb9d671e6dc50355079953f9e5e0bfa1c720c38cd8fbc8ef4eb8bbfb97915a6beddde946d8e8cb2c7d432ccf50978f4707cb42c9640eb837e402df2859
-
Filesize
5.9MB
MD5ff2ac985ece61479a5d4004a635e005c
SHA16376ac8c1e67df451eaba7da9a423a78200a50fa
SHA256c263846436e518dadff5ddbead285c879232b5c33d3cec09976765dd134c01fd
SHA512e4129cc0573a0d522967fcdbe612950508267f75bdb419adf61bbb6c811066f6af9b32bc875958d2bf7a9a8aa6d31edd381592cbe448ff5a60d0b1f11f8f1db5
-
Filesize
5.9MB
MD53cef11f2a9c2adc67c4dd668df36c0f8
SHA1c286dafe8f8d3b1e41cec84f87fbae8d02f827a8
SHA256f9f47b6329ed93b8db3835c519b7a4ead1b7e16ff3cdaa55c1fa7cf1db60253f
SHA512251fe2b7570ee8f7012bd140df49cf075a01448df6a993d8e37f1ecaede2e2abfe2b018aefbf99543de60cf60f99d26f1885a178b2a6d837cbfa5758d75919c0
-
Filesize
5.9MB
MD580b699e1f57cb1b2ba38ed44b1946e0b
SHA15fad4b5228a1e6ac0290a0e3c1bd0fadb8650686
SHA2569e90e65a404c699f81e03f001a0e39dd4b0df4c2b698d9d08a66549052b1a41a
SHA512168d0fe8ae09b562153e834ca1daad28d6af439f87db5888be2fedd213462228fb476a159e90de1486f23cc066b1001017898fb261d624f32f1bbe33ffbe6c30
-
Filesize
5.9MB
MD52d50f165d07bd4c48add93a1e509adbc
SHA1b9eaca98933fcd68fc72a7ffb78db91817e0f6b4
SHA256a7904f2e2b0a01a4b45a8204944ef7827e2a315cc4b2e2b764b1d93b43571e52
SHA51201255bd72f610d24a5d77b914685b15c952665b0f3574127746c83d00095049a7bb244bb8b8097089322221b6c5bfbb54d02e65f6333d6c39fbefa1620ae418b
-
Filesize
5.9MB
MD5b2df04197e5f33b293ce2166bf195475
SHA186788e3451edbb0be845c6569387d5234aa1ec07
SHA256d5b13471f10481a7885430d47f092e32c543c1fc17448e649d991ed3b8258744
SHA512308b9d205cf78fde37d14f8137be3cf281020014ae6b4c839771dd40056c6e767b1d065967b7050687fa90b5917cc7527e150929a11e3534cd7e2df5d0e2f6b3
-
Filesize
5.9MB
MD513bf1e5a9081027ec6381cf621b45805
SHA1bdf9a908c5f60f018eff54eeed255ae50b440c3a
SHA256625b1fa6b03005a999f61c50b973155f416b24f6060c63f93be2501139e6498c
SHA512e9740d6cfce3fd616766a88d0c411a70040c306b82a891b56c5eafe2ff0666c66746b9c8a2dad03dba27a7d13cc0ea1fcffbd39eb34decdf16aaf903442ba907
-
Filesize
5.9MB
MD5a1a4393464305ae12d03b78d7fe56ac6
SHA173273fcea1f8d798abf2162e6d2283bddfc12a7f
SHA25627c55782889311f1d652144fcd2b6b8502b69c2883547259017f64bcea94276c
SHA51227e9f9ccaf4ef06838448ac83a35151c614a37eafb5149b7e82e31b3f1d6ffb0c5208306d415c08236b4381e73f985e5b880ead0cc056da3a7b9ec7d5c8e060b
-
Filesize
5.9MB
MD50d7f7913450a05ba73c8dbfffa3ed18a
SHA18c6c3db2def5fa1e802f959b7320e238ca439f61
SHA256a803d34c39a9aa7cc160d5cf525838a47542da3f0f46f1b4ba484d434a724b12
SHA512f9661f0364b80e4977cf29ceeb78fd19bf872197cd4bd7a1b638f1c81447f6e66870d90acf3ce5ec3c8e0b71a29e96f936aeb803bce33be7bfaebab17f5a38dd
-
Filesize
5.9MB
MD5d69056fdfb0cdc32743c6d80ba58da27
SHA188ff970d020cee16cc31ddb3a3591964b7dcb29d
SHA2563e79835842f57a610fdd5806e9c58bb40d713074c68c06f90b6bd0fc8503fc48
SHA51249b0e705d5ef9cd31ec2153903881cec15b668c5ceca2ee7bea8eec8a0fc5166bd9b04cac61c980dc84d856a0517ee3e8c161da40ccfc485ec13e0b612215c90
-
Filesize
5.9MB
MD562b7291bdfc069903e213b7bff3405c3
SHA1d8ee1d565c6aa257489b3e0c6199c0321e5879a5
SHA256162df55db9dca480f7b34f60bbf239ffe62d3808e7188fd15fe28c616d699ab0
SHA51215a17fb489f8ad002186778fef006666d55869112af4802631216568f16a74da5dd7eb534277c3e364ecf3d8fe3b341255d10ed729d016db536a91f9751e7847
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB