Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-12-2024 15:34
General
-
Target
2024-12-11_6bd274ef6750a158bd219730038218bd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
6bd274ef6750a158bd219730038218bd
-
SHA1
908ebeec103cfe3f1bd304c1b2c6a6c69ade2282
-
SHA256
b1f64708984e4d0ce6c557ffa152b73a0a80c466944de797288e7a02f9701084
-
SHA512
4d4f2400c70cca3f97fb582f9378c95efafcbfed02e8ff86a7b371539d19b2c91e6055aeb941eac4d1a250ce35a2b3872622bbd6a6ed1caba2786321d984726f
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUl:E+b56utgpPF8u/7l
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-11_6bd274ef6750a158bd219730038218bd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-11_6bd274ef6750a158bd219730038218bd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UfWaoei.exeC:\Windows\System\UfWaoei.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\apYDorb.exeC:\Windows\System\apYDorb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mCUfuHZ.exeC:\Windows\System\mCUfuHZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FqHJwPI.exeC:\Windows\System\FqHJwPI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QBFRMMJ.exeC:\Windows\System\QBFRMMJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sGEgRMD.exeC:\Windows\System\sGEgRMD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CKnbYHM.exeC:\Windows\System\CKnbYHM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\taOJxMV.exeC:\Windows\System\taOJxMV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tPKNxUA.exeC:\Windows\System\tPKNxUA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bALizwi.exeC:\Windows\System\bALizwi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eTFBMrk.exeC:\Windows\System\eTFBMrk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pqLJseN.exeC:\Windows\System\pqLJseN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BqbntCf.exeC:\Windows\System\BqbntCf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fjMpzJL.exeC:\Windows\System\fjMpzJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pppbfFf.exeC:\Windows\System\pppbfFf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NkxSxDQ.exeC:\Windows\System\NkxSxDQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KwZVuVN.exeC:\Windows\System\KwZVuVN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xPVJjDJ.exeC:\Windows\System\xPVJjDJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FJadgZy.exeC:\Windows\System\FJadgZy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TTIncMz.exeC:\Windows\System\TTIncMz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MyLkIey.exeC:\Windows\System\MyLkIey.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5cc8bb226f1d7d5472f5c755990247fe2
SHA16be3a64b35f1aacc7facc9722ab7d5e7d8bf3a1a
SHA2560593c0de52d5d273b829e08f560c76445617f0d3aa6d5ba94f070ccf53c4139c
SHA5129bcaaf051000f119d059388e5fcbe70230b030be78d70611f7c5c5bf623334f2ff1aed6ec0f3ac1f630bd171c0d819f03d1e151c53181175e8c2f24922b8f647
-
Filesize
5.9MB
MD54453583b2270cce0f3a521b1bf446625
SHA19f3ff180a19d567d19510014960ab7dca0bd7c07
SHA256237e7978f921bcfbbe2e4fccc8b29d774eac3c0d2a2821f389c70ecad90adc2c
SHA512939c020f9edde39fedba5a38a1ca959694ba4ca4438692b4a6177617a3323be2c08f978b9c0e937be6fe19dee89e24cffa27c8396df7c712d6ed63dd614a3337
-
Filesize
5.9MB
MD5d4a96849799c93d7c7a232b87812d838
SHA11e0d42d2b063df6ca1d86907718962a09e105239
SHA2560ef4907923a15a05d319e53a8e35004b6228582323637b64e8d54e4533cc0ebb
SHA5125a62b2fd855f844cf3ae82fd559b1de32d641ee4e8d20fea1487dbfe99a526f0f981edde665c0785abf72abb07abdfa03dd628fcf87c19ecf348ab15e3f0a944
-
Filesize
5.9MB
MD576ed73dae4c3605a13c024482a66149f
SHA1d02bbe70d7913d7d866536afc6062a3197748b99
SHA256b95bf637c48acb75c0054530f70b3fe18594074b023e11a401a4d19fc0614ba9
SHA512e4c16d46cb285cc6410e803c98af3366e3ba2ed4add2a4166400d5cbf1d90a60562bcc4b5bb20d1f5e2cbe8a59d3df372b92efb35104ab8d98d07502002f3b3c
-
Filesize
5.9MB
MD5242b0ec7003f812ba025d0f384e6f746
SHA1630feb146f930930dc5e6a8419a99a52f91b5005
SHA2561d5930a4f7f90784ec399538c9aaa1bc6851d92d1bcbec9ac75b32e5e58c19ae
SHA512becde9b0e38e8a4a257f10dafda385b9b41fc3a3a87cd004d07535e41c2fb40fa844274339e3b3c631fca53166d72817748b7a234a6eadb96a684cf5b94d38d0
-
Filesize
5.9MB
MD57c60f7ed38bd0e1ca4896ad8583da4f5
SHA1436929ffee83abc1c63a386b8c791cbd57f8bcfa
SHA2564079c70c09bbd47cacead9c7691f1d6226d9bba95f49df15bec156bd0fd9867b
SHA512d697222269a8b0c9a130a12922ed80be9985aafd675f9a4962157ef82d69488dfd8828aa4ab0c1c2a6e9f6c468309ddbd3b301d0921deaf44c7a869b126b6da4
-
Filesize
5.9MB
MD5a33a42663e2e0121e9adcd36c7e9d29d
SHA1db07adb3b5a87243d457ce4d0653345627622615
SHA25631a3dc75a36558fd294ad2b4d24a9d82090265e6a7fa014f3bea87291f06b5a5
SHA512e70e8a6f82a2dd182f2c6480ab2234ed527db445d69815e0c44ee85dc57193cf80966ce4aad08fcf41471e32755214572f8eca929a03bc892566acea95abe648
-
Filesize
5.9MB
MD5b7dc93dd08e94f0c6a131df0e3751774
SHA1cc0390b3b39f462b3293ccdb50771b9e1e29bcbf
SHA256e86d4a2fb70ea070bdc0ef32ef5a6b629e96d0be782a07dbffb08730ef0a21a8
SHA512cff3bb8db80dcc7882fa78423526985524336971483d98446bb3e5f6561ad97b8693c1172f66c28399e789dcc4a562b34b1e89507d95827843d55e9ec5fe77fc
-
Filesize
5.9MB
MD5e96a6f1b51eb057808d983c34785a6ca
SHA17adb8a23cd5780a719df5739424509f557447d59
SHA256271bc5912329df72b74f62f2fe648b3511b3212ccddfbc6b37c39577148d88ee
SHA51233f9412aaaef6d38e0dacf3b6ef500576eff949ea3991b471f7c072b602e170d803878bc8612218a7cc3ef1376dd277e4ef7e908eeb6ba67bc46ee31f9de6b8f
-
Filesize
5.9MB
MD5d8ea98f27dace8129912877cca86facf
SHA1709a4c15e0bb3926cac29f9549a9c4367c60affc
SHA256f83d830b912f60a6fac89f684c187fe1fd14cd4c12531866217992d1c57b47cc
SHA51265af4385870bd76e0a0ab6d82f85b032d70197a888b35a404583c931df0c642295aae1ceb4df8d8b4484d9f0d022bded81cc6ef021a0ed0ec86a5fae36c22759
-
Filesize
5.9MB
MD5a5c8f3a6d9c8c18e8673e99e1cd84992
SHA164dea59865d1e8239564fd44c9fb228b81db0eca
SHA256e7183eec140603b1d41353c1aa7ee4ec3fd013b92eb4956843646973434e6bbd
SHA512e2c502ef28dd2ea7aa0280b43a1ad3fd8701906ed83e7d33579119a41c58bc1de3cd8a021426d2052bc8c198c592f6d082284855f9d8de722dff6f1cefab5d23
-
Filesize
5.9MB
MD50f57f630093aa99083a6cd9af3a1a963
SHA196f7dc0da45b4fa515558bb8a692140aa8c75a66
SHA25615a5b2e995e2a50589fd9e226aae6271ae1f706029893c12f7851cec85ca7ecd
SHA512c27973c8526c700981dfa968eee67ebc2e857bc679b5eef83a0e05e7183cecba3a7b08aa8e096ab27dbfd17c7eea4cbc901e200ff0d683b3bb5f204bd3085a07
-
Filesize
5.9MB
MD57504671f83fad25c9848b25046ec0b4a
SHA14c2b67cedd326afafb4ecd4d0c29cb79f3fd029a
SHA256ff9731c09653ee9e57146ff18ec61ad92e6e53eaef3de3218b33548829e62fcd
SHA5123529fdfd91142190558329bbd4a78b1b1aa2d43f9454b65fc23dbc6ef835b03658e333231008094347a28ff60779cc435c250089daa852837cd12855a850a981
-
Filesize
5.9MB
MD5efe74f5eed7737dabbe290e976ec4282
SHA1f134b56c10293cb51ca5b7f0e059136c6c44ff24
SHA256b03476b157960b350ba555054d90035162718052a1e29d117facaa2f3e60e395
SHA51215256f0549933c521ca83e989642427be918e6f4990a67a9151c595385740f63f4a6af50399f678aa00ec35fb87b4f0d20b05fe92d1b7a5b70b12c03d68fbd84
-
Filesize
5.9MB
MD538ec8868fa5246149d9690f70c22145e
SHA14aab15a50027502c61c62dbba330fd171ff09f1b
SHA256cdfd20818045ed2fb2ef150ea0e959d9ea5d76f89ebba2cfd4534f32c3c23494
SHA512e52143b98fa9d6825edf9304d40283a2aca6d949b94826c2aede2787368217e95aa76a1dd2683fd121ebfb609f1912239e45a5e797992c7feb5feeb0b1b1a2fe
-
Filesize
5.9MB
MD5e05df024fc413341d661d9cda478bac8
SHA11712f149a1b41774d30fdb5cff0c8f754f5ce5fb
SHA256e44e969571610b817ccfa8fdf2b9a1d5653b512d755f3e71eef1541760b9465a
SHA51203489242e9d1642a9bad676ee19244a4e72503ab790d9b397a2545772f5b482b85fe582b955bdf38ce0652b273671a868587ce93bd962ca554b95da0e4efb48e
-
Filesize
5.9MB
MD5f202ed8fb6558659c09ae982a82b285a
SHA12bc26d7dd40ad1a63a19e62fa1bee1ceae0a774d
SHA2563be52ab5f0e26149bf4c16f5c900e48f540297b0208c5f8506701f5173619758
SHA51246ee9d67400197e3d941637f8046a289a9f866cb500fd6f37185ac704151146bb6bbea87da6b59b05dc751a3e9ae9606c2899e1481e80b7d85c64380f1f189d5
-
Filesize
5.9MB
MD5de605748c644ad3ddf28356971603458
SHA13d24dae92e810e34452dd7a15a198416d159e28b
SHA25627fe85544129db00600177b114d77785a58b3c5d52cc7e9331aee49a470af89c
SHA512f69ae269315b50927be3d14164b9228ff4f8c710bd4f2d18247446988773cc5119ec76af0d0d02520c79f795669f121c5763887a92b0a0460e44653002a8102a
-
Filesize
5.9MB
MD5ebf5ba3679d26f2335430379856769c9
SHA1717282d25b2bf3be903dacf7400f16cfacf928d9
SHA256955ca5b2304ec02ccba0cc476d8e943b173f2dfdb143a07ff47e5148ad5fbd20
SHA5122010b8c0f2cfe61c6db15e243cf69a684a176aff79b41ebad9b23933f04f982f43b9b53be3c7f9fd885eca9c4fffabdfeffb433370246aacfa5e4af7c4906068
-
Filesize
5.9MB
MD5af8b05a0b472c39cafd371f9eee2f650
SHA107843531774dee7b0ee35c6ad1d90a8f2d239e91
SHA256aa9b4419d398a643b970bda018ac66c8f6585cb3d672b9dd6c5f6b9b33cd91a5
SHA512b0bc48fa565e49af00cec44c6343f0471040b18262279585f7f3ed583e1d58a02be5c9d8180ec5c0c510911609a2ffbc98967168195e0a2237c2e176e5b3356c
-
Filesize
5.9MB
MD5a41a58f3884c4c4133d1aa4e7535021d
SHA1723b28584156db248d1eee08515ce88b947caafb
SHA2561a760e59e03358e9890752d8f7490cfefff2a56819b0c9403d5a041a8386df15
SHA512e41d0d0dae7d2e4b9211df7ad4ffdf0990466e8871ed5c0270add1aeca92fd6f9937c97b9dceca9f99b5006a2712cebac96fbf513966a8c4888e87823db66c0c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB