Analysis
-
max time kernel
136s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-12-2024 07:43
General
-
Target
2024-12-12_2b8d36d9a87f5e3bd117147b89507119_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
2b8d36d9a87f5e3bd117147b89507119
-
SHA1
b56a35ac935e3fb1ba453b65cfe1611ecad4dce4
-
SHA256
c47c8c5a854a40d4b62c5fdb5ee716797e5459ec1772080df2a041b4f19d7a32
-
SHA512
159a6c26e5ebeaad85e7d57ca07b3d75944e548846476817fddbd4a13e941316d3277b87ff43aa44bc25eb64474734e4719358abb45ff5761554956dde4c372a
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUO:E+b56utgpPF8u/7O
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 63 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_2b8d36d9a87f5e3bd117147b89507119_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_2b8d36d9a87f5e3bd117147b89507119_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YZNbbSL.exeC:\Windows\System\YZNbbSL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ejxtjgU.exeC:\Windows\System\ejxtjgU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DkUkEaP.exeC:\Windows\System\DkUkEaP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PVcTMuK.exeC:\Windows\System\PVcTMuK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fzgRqie.exeC:\Windows\System\fzgRqie.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWQaZdo.exeC:\Windows\System\SWQaZdo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TsWfoBC.exeC:\Windows\System\TsWfoBC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NNWiRIO.exeC:\Windows\System\NNWiRIO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EKOGqAS.exeC:\Windows\System\EKOGqAS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zneuZVO.exeC:\Windows\System\zneuZVO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EaQMVRh.exeC:\Windows\System\EaQMVRh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZQEEzkz.exeC:\Windows\System\ZQEEzkz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RRqVahc.exeC:\Windows\System\RRqVahc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MvqPPdP.exeC:\Windows\System\MvqPPdP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dHXmirq.exeC:\Windows\System\dHXmirq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wsZLohp.exeC:\Windows\System\wsZLohp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YoZVmEv.exeC:\Windows\System\YoZVmEv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gqcUYaL.exeC:\Windows\System\gqcUYaL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tPVeJlL.exeC:\Windows\System\tPVeJlL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MfDEfex.exeC:\Windows\System\MfDEfex.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QnutaSj.exeC:\Windows\System\QnutaSj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5325be40134b8ba8d5176aa79f5e9e847
SHA13248b3703fb6afe85c12c8b06160b9fd7c2a3a2d
SHA2569111324e04d6c24ae856eae9eaa8f014e8d02d49eec70353ac2966626a574026
SHA5125c6335055b5262ee15f19156e55c0b9cbc0b188b53db90071ba5a6b79cd3960d711bbd7578ece10ff117aef62a6bd0c0e5bdb468825e129cf008c48c91d2f34a
-
Filesize
5.9MB
MD5a486ff34cefb3039ffacf1c9d16ec3cf
SHA157e2e858896f7230a129bb0471ac4a86d10b0f77
SHA2566689995dc4a71a99e33a0721df7967c4725af5f5d9c7275ad2c16dc1183457d5
SHA512ed3abc04b6cade682b7aa3f72bcb7bc6f8769eb657b0560221c62c111ea842200b2706c5350b6777cd91fe3372e233447e22f92e07c0ee68332d831ee26d6646
-
Filesize
5.9MB
MD55e542c84ff63b1671504fdaf366c06a0
SHA173c201eaa9eb5603319f156a32505614d21afac6
SHA2569c248d52a9c619abdd4853658e943c1bd9b2aff742b7262af8b383470c258ff9
SHA5121a73ba70ee7a934180f7846eafe69b66c464925b380f26fd4383d20a1dd460dfa55c9b65afd445069fa473316198ed331ac6a99839d77551f3e1b95324722df6
-
Filesize
5.9MB
MD570733330013a9fa2034ecd4457d7cd38
SHA1bb31aeb27d7c7987fedb39f976e5c5e051906f6f
SHA2565cb86ef4c6eb5c4aa62993785a93b626a13953e2718eb54c674c17a21da3254e
SHA51281c1f1956be19d6cdaa9b661eb4aebed6b5a3180b3dd89062ba9604dc3c7f8b9d546c14bf894173ff33c13c707c60be9f1fedc479902aff717addefa051e3e4b
-
Filesize
5.9MB
MD5c068925d6c9043681c26a139b1d19cb6
SHA1a89a9e1b2e11c0a11df95ee1fa5aea6271e8028e
SHA2560f6b8452ba4a514c35a7eb96bcd8cfe8865a205ba6ca90a3667819397d54fb15
SHA512c24d774fda01c1cddbd48cf2a5c5350002a004e5239c1f3eb172d8d27ad6dc11e70c5ba663732dfd2090c5a359922cbe445ffe0ba01c09978cef099d4c17404a
-
Filesize
5.9MB
MD58b3dccb143dfc1d649bb81285cb0d65f
SHA100264c9555363e4a770158314c0b796cc58b505b
SHA256e149965df8b9f1d0c77f6febddae32a29eb178f86179554223dac410b0d5fb58
SHA512bf9971b9c0ab7870ce8eb3a207f8083bb1954a2f5aed31429b0fe92b204db4b4df0f8cc5813ef65bd7541b85866bc647538cfce21b0e0d942da61ea790c9df93
-
Filesize
5.9MB
MD54ac3251c23015fcb3fd05dff1e312eb1
SHA1e17fd18b4f57168134d888a69538421b4166c9be
SHA25646b225f8dafd162f11d06b8f7c1fe8d1da4da90870fff4ca184ff47550ed2f63
SHA512b571aad72f5e1b93b043b924dccc8e7726b24c87f264eeb5e31771ee6ff980aeb6282d793c2b78e9395e488e8ab8d1920b639d03a13db3a563faddc6f789dfd1
-
Filesize
5.9MB
MD52a0ae06c88467eb54f6a22b354df53cb
SHA1500b638599af35780710740b31c3e3cb63930ebc
SHA256e788471ac19c9ab457c76f43fe0c27fad6f7123882acbf96d3132168e493e88e
SHA512743841cb66659ff2e1ea695a618ebd77303f39871b08762af6ec863d2bead8ea94622dd84de6449411bc180c18b75c0fbca01f169a6817e48c2fdb5e7b538d7e
-
Filesize
5.9MB
MD513bb11bffe3fcd20719e4c693a3ba7d1
SHA1692b30e37199dde5184bacc7dce9fd3cda47af68
SHA256dceb366a780a6f65cb6eecfe5bb396ca94819312d2a7f132d43ec921e4ad38d2
SHA512ba72d73b7c46e1af5a6cd83707aba10c8dd963e513ddb7709523d169626ab522eed8b8a93b27221cfd76ad0462e8cc5ab91e880cb1ab80c3ce059930749fec88
-
Filesize
5.9MB
MD5a2ffbc6419b9759dc4a603a5a1e7a1a6
SHA13be3e31cd7d07d8a5cb7417722755d0f82141a70
SHA256eff5db010144655e43580e2e45ab6f8eff8f735d9ea4f195f13f032d857501b9
SHA5121aa486818c13a58dc8c032ce7a222c723df7a0337a2468180f803efc599c21601e7588e1e5e913e22b5410e13044767e7e69bea41be08c67a57fcc516cd3f094
-
Filesize
5.9MB
MD5f481e6a33d2e2089fe7c9a5047615f7c
SHA10987028ddbb7d0093b62f83fdb414e556e4f6834
SHA256f58264037d24d024f6f2e6e90fdad081ad725b1725b6e3cbbf7d4ad4c374682d
SHA512b243724dc6526d14cebf555227a24b45dd4fe24ae617551e6a521907dfabaeef8c379a5a14ee39fb1e352d3bd19741a4bd306a0bc461fd667791e59458bfba0f
-
Filesize
5.9MB
MD5ac2e05825037e3e42bc0ccc6908df280
SHA163f3040737ef55e8308860238b32865b471d8f17
SHA256c3f8b10f7deb8407ad5c5ab6934d402f7f6e39088602559f86d1b39f2e6a363f
SHA512901e6ed091646021770cd57c55d526d534b8b5397673757e4d6d093a89b339168f3b17543a3a26ca88717dec23ff27bbe01e248c816a5a7517a2b4432de48fc7
-
Filesize
5.9MB
MD55d6eb0ce46cb56b6f1dd9ad3f82c9d66
SHA1617a068e66e731e35dea46f9f126946c02130472
SHA256b7c3fa0c8d0d978dde1190e916333322d74c0208cc5ad290d9bfe3f02047797b
SHA51226194dc608bdf04088ad7ef2906b2b45a71c75fa74801f82b9b34bec01980f64f23ccd2a43c21fbb299ee72a7bacd567559628c1cae8057058339fdfad0de142
-
Filesize
5.9MB
MD5e32f9b8307a7a134697bd3cad11f36e4
SHA1e105d269629b410fe1b36f57c7ff5ce01bda52b1
SHA25646c6b33cb2956419864d5eeb7ca501d00ab06ce829e50f8749faf580fbb3ab27
SHA51222619e2a4c4b647b6bff9aac6b3c5b18d9f9497067a903ca23e8efbc3df7d96350ace898fe4850e789ae7db1236daa45b1f85d43d6f3409acbf6b77b3124ccaa
-
Filesize
5.9MB
MD56d0636d3904b12eb8ad64281b23dcd5b
SHA14e3b55dadd957bb13b4b6def0f0cedaaa64baa2c
SHA256290659adecdbafda42f3ce240bd97614fcdf49e2cd3ef481ae81d4327a9acfba
SHA512bb70da4a61d942a3b6c0fd3f229124f22b7a8f98ce8df17cc285691cacbcdb4b7802090f4de8cc3159eb75329651920cebeaafa721d819338293000c7eda656a
-
Filesize
5.9MB
MD54744f6b25703c880605d17f09e8e7941
SHA146169834927abf2ebae903779def2f985cf59f79
SHA25627c309acab22ad7b23a14b5d2833f95b3e4dac55b665acc3662721c7b28097de
SHA51254698dc46ccbed0a253ac175e8af6bbe011d1c82652c7829051842e8c3cd85686cf046941654b07c8b0fa8c27c67af4f8df5fa770be608e1ba8e32c80cbf1e8c
-
Filesize
5.9MB
MD59673335cde97bbac1418b7879b6db0ab
SHA1e2c0c523c2c7350ef8052b20c777cb1705ab71ed
SHA256151bb40fa5bb556999d2ae88a9a0fa02099e7141b71b51aaf22306b205e0ad0d
SHA512fb8ddadcb225e692fed8ca42fe77c33fa67010b30cfb0e95a1a5439bcad4bce04a3135a6bfec01289e9ddffc4254f840adf798a82b8675bb49e644a39fb30a5c
-
Filesize
5.9MB
MD504087756c570eb2e9aeee995e8e40fd1
SHA1d2121ee7812523e27c8a8ded225983e7f824ae8f
SHA256c66f56ca56fef0675a2a38dda83b749ab48e97a89d9ce3993952c72d55fcf76c
SHA51272044913e6a59bef3849725cbf332b0a77f3ab1f1b3b3c1c85a6a4d4ae60c997255b8f2e205fd5efc12ee8ee4d302790af5b1c0525522e477f43aba916794ffc
-
Filesize
5.9MB
MD50a6102863f1b0e74c63ada04b6347d44
SHA10bdc9f07afd73f9f557430da5cbfe23c76c84cdd
SHA25676e2262d1e72e286708bb4bbfc8b7b52e90338b97d38c8068928b4aa94744bc1
SHA512a4037334e512968d53def38b5bb2ccd8e4143de2e93c37b41b58be486419f37460388fbd722154c8743e9d8068b8ea060a55647f81f6cd726b28e5a7a72010a5
-
Filesize
5.9MB
MD5ac3c5f7ceb8f8a90d10e3abbaf97e54d
SHA15becdebb4635d41ebd6228b7bae6f3dcf004ddcc
SHA25614b5b2a62240f5379fed13fc349f51f70891bb6e761cfe5860b3a03dabf23c46
SHA5124e2eb215fc5adba5b37a5e6f546bd83f92e68244f5c1a1023346a6811fb7a6f7c09148a2d2192a213ff24de170645483efe9b8195ea359c1a0c2daf97a5ef47a
-
Filesize
5.9MB
MD5a2e9be1394421cac97fb65d1e732935a
SHA1a48041cc5bd8bc921b72c44cabe9cc32082cf24c
SHA256dcf8ee72c7f00aab413e51b775ab69631b02b04766738783f518d1b16a45611f
SHA512087675f74bbb973dd4b9ad9b5dd1d8ffbac0a0698649944fdb95df07ccb1676698eb39122e3f9f8bc5eded07f5a0c0bdfe1fbdf14cee54ed0a7f74afc17f4706
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB