Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-12-2024 07:46
General
-
Target
2024-12-12_5f11729ac3aea98eac320e83dfcfd18b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
5f11729ac3aea98eac320e83dfcfd18b
-
SHA1
8d79d54de04a49d5581ad47a0a94cc7748f2f113
-
SHA256
2b3e969825000939b03febe0474a5e7bb02016fda3d28f0f9bd8ec93cae90ec0
-
SHA512
58b72237762056f34ddf12fe6deafcc63a8dd658d381b24a36a38e4e9653ee2c8a0e5b727924bb2910a770720d7b13ec25cef14840ea55858706d14a46af23ad
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUW:E+b56utgpPF8u/7W
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 58 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_5f11729ac3aea98eac320e83dfcfd18b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_5f11729ac3aea98eac320e83dfcfd18b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rDnHHOL.exeC:\Windows\System\rDnHHOL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZIcFvDt.exeC:\Windows\System\ZIcFvDt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SRBANwL.exeC:\Windows\System\SRBANwL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CvetDbV.exeC:\Windows\System\CvetDbV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kykotdM.exeC:\Windows\System\kykotdM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ogzMniy.exeC:\Windows\System\ogzMniy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kGmiSmO.exeC:\Windows\System\kGmiSmO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dcjrmGD.exeC:\Windows\System\dcjrmGD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ihxnXnz.exeC:\Windows\System\ihxnXnz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EHHSdYC.exeC:\Windows\System\EHHSdYC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wkbxgbr.exeC:\Windows\System\wkbxgbr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wWnlZVQ.exeC:\Windows\System\wWnlZVQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CrxBRvU.exeC:\Windows\System\CrxBRvU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MIOeekx.exeC:\Windows\System\MIOeekx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KiIyYQM.exeC:\Windows\System\KiIyYQM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SNDBomP.exeC:\Windows\System\SNDBomP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\brhQpcb.exeC:\Windows\System\brhQpcb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nbrhRIs.exeC:\Windows\System\nbrhRIs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OPglYzf.exeC:\Windows\System\OPglYzf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TVRbzfL.exeC:\Windows\System\TVRbzfL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kmqCMIj.exeC:\Windows\System\kmqCMIj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD56977368b18ff853ffcfa0d937904e674
SHA1e104b94bf501457bb2611b91d1dd7de79d717d66
SHA25680639649977277177f3700f62568b0fc9d0d1563880b6112a4409f2ceff5cdaf
SHA5123b7f60955f0389cf8b1cb2b61165d95a9841e05930d6842493f2b814baad2fa76cf00b6c58369d8a0d25cf47a81904bd1384c13ada4396576a8cc51dc7f19136
-
Filesize
5.9MB
MD505f154ac2fdf219b551047ca77734c2f
SHA104c6112f84f506331695f1612a3638cc3cebb541
SHA2560d236722a4ed5a73625734865906d462df155861a9367d59854dae1b757f9ef4
SHA512b9c39a3310631270227b355907236557b4a965c2641b86dcd9a08f0a342222549794d7c9aca269ffda1bcb4791fb336e6e174188594ff25c6c5291dc1436ab64
-
Filesize
5.9MB
MD5ff2193daf495551de4aa9da1c84c9b0e
SHA1a8b90d721d7dc8f34ad6e0f822dc5610e26eeb71
SHA2567252307d5c8f83d9ff1b06aae10294842ee731e1fc572f6d7013b1a8dcd63142
SHA512d4df6cd9ed4e781e02d2b6b3f762375da83a1bc6178b22616d1d98d383306b7958d6baab651c05c348696164d073b0dc9794226f1de883d772d9a0b37d995b15
-
Filesize
5.9MB
MD506beec09f6d5c990f85a3a95771301fe
SHA15faf71c451e792c6946fe5ddc134ba3cde4dd612
SHA256630164c3e800cc03ba8c72cb340636fce6deb06b1125b2fc3e2281aa2cdbca97
SHA512fa987b5932e04a8018b31e4639ad36eb2b06c1f0afc635fac4c82aaaa2cb44ab661bf46aeaa5eccb9ef84251477d5cb1c2091388abac66825846323d3e092c8d
-
Filesize
5.9MB
MD5adf4c67d7c0f4a1de885741d9e921d8b
SHA1b89c69c7cf423b20b061a48eaa890ac147c1092e
SHA25647173b7ba1de707cb4dabaa66e4deddb6d7c62e66156264299a61673d4d4abfa
SHA5128237529451860229812ae128f00c3c6732fd22e6297210c3e3a4fef3ad07a3e833956c82a8210219407d9b534c1ce4073113d70f3be45d4aedde59b9346a2eff
-
Filesize
5.9MB
MD5a0af0a3dc608464f249100d64ab2f712
SHA1e01d0924293aabab3e088a8328eb24222914ef0c
SHA256296bee3a237ae52df7a71b331e3f8f0512de2039504e7b88ef841b8356ad7f60
SHA512b652e0d2fa85081339a6baddd032a99485a29e424283facc8989d44c4638972284fa516ec43b5bb1090f3f22cabdea44222c2dc7e8c820d201882bb693fe997a
-
Filesize
5.9MB
MD5869fc2451afca376b95d000960f71d07
SHA1688688b36348c185e039a1ed2f318ed34ab10233
SHA2563b89c1a7fba40bbe81aff10d2b89c943441b8c027ce2cfc91a06f6965c7740b1
SHA512c23a437524e348c1940c8f0d31188a5b2d30c5fcfb49e32264ee2457b6879a6b87471c1e4bfffc8f07388fabc36286a4bfc7b8d1b8e3599f492d41d8c7c70ad3
-
Filesize
5.9MB
MD5ceef7ab69f155461ec8f2f71d35e3b1f
SHA1591cede09fee65e30ef62277de3cf4d77b70a8af
SHA256993a1de3f5b3b5d76b984518cde84f4bd1b27178c497c9e659a9f9da96df034f
SHA5126d7391a80d76fcd16de297b5ee525a3d7e4a19935f2d8ea9a3e7ed17c52eeee26c2d5e14ae4e911c613b41b83cdd3e4b6e99909215c9e92250b2bdf3fd623cd0
-
Filesize
5.9MB
MD5ec6e5f050d16aaf5bba735ebf905b3e4
SHA13831b74dc3fc3aeb3ad5fbf2007f575af384dace
SHA256b9a001d7ede903591afc3370b15300d448254b0fdfa65ab38e9f849c65a0566d
SHA5125f61855ea0970cc82a304e3c12e7afcfa163e33aa18508b56f453417a80d8940933039f1140bac7c41e1df29dfc69f81f9fb872a29f0f77e7a608e25bad72ed8
-
Filesize
5.9MB
MD59a735a5920584caffe805605ae50ec0b
SHA158faf569231d276fafdd8139c3a0395a07ee5b66
SHA256a14fe7cef2867dfc29ba0cedff2f208105bd8939b19a6a0fb73ba499cb5bac23
SHA5126b0285e6ebf444c37f8afa850ca21a1016684e1932605f7ff19633779bd0a5cce938c6ac57788b39457caffe6fd003da00b5f40fa919b55ea47e9c54d58efc5c
-
Filesize
5.9MB
MD5401a1252a39e8442baec6b6c8a998b61
SHA1223c2ae0d64458ae02d125ba0d3f69b80ebed814
SHA2568de9d6b05d92bd5097b57b119ef5d2bf271adfc7317874d7d3ba99de143159a9
SHA512334895ad9634ef7f65299b5b3c390055f92010ce7a75eb38ac59e24e75d582e30748817b59b70a16631e40f3c050dc00b020de543a2dfc89114e43e06ae610b8
-
Filesize
5.9MB
MD52034629dc993d957c776e4c396d54374
SHA109b952524f4c538bd3a3368ced79bc236480b24b
SHA2566def9ecf493342498ca023e2ba4deebe8fd668e51aa04855929e1963e83af65f
SHA512d6e4a267bbdb93fcda8b4b8aa180864b43fe8d179654545bfc36a032e4ef762a11b202f7a0b0fecec6af7d15ae01f181ad94cbb52119481b5c44b96c846af8e4
-
Filesize
5.9MB
MD51ff603c9685744f4436876760cbcc7cb
SHA1ae226ca916e56064f63b7fd8ea33b712d4f23c19
SHA25638cf01f8acef8fec5090c88e76c9fce94164b09dea5672a490407bac44d6a7cc
SHA51210ae0456a5f52d51b7d7b82d2881dfcb5c708a6fc1db808958eade07ddd89aa4098c236ab691c354d2e91476e1803f8df7253f394b2221b839ba1764b977a568
-
Filesize
5.9MB
MD57a9394b90c0e65377d6ef267e6c59163
SHA150c8f0cbf4ddaf4cf25b5a98469bf6275ada90c3
SHA2565819723d648b7a7b59d320051cf2b4e1a55656fe861d284668af3a768e0d16da
SHA51214274a9cb2a32f2a3a9131e940de315c2bc83fe5d6266d7f4321d0db8a56c20ac2d3ba0a2c8637729725181f4a842d2c678777942f9b2471dd59610c9e63d0c2
-
Filesize
5.9MB
MD505e57cf26addf4ed850745885afe5c29
SHA1a7d2073b8f8df946a0a0b7d63bc23d820aec0a97
SHA256ae1462851a297b5c5e3374449c56588747265d775650ea16726431b7b2df7b6a
SHA51256ee366c056d724bbb22a59fe4979704d15612f74deec84fe1f008066a091f9532596a5e69dbb85de049c663e137260ad51b21b357e37861402b0c62aae73a9d
-
Filesize
5.9MB
MD516c3cd110c1c1e13f280a84fa232141a
SHA1cee26dfe9bf3e0ffe45a5531db23452ed8d49bee
SHA256b18d072b003222fc4d08a0dd29f39215c5ff366f94b8056ac25301800ca65c1f
SHA51279cd04398dfd90b02818155cf4c4f3969f9e0002ad2e3beb3ac00f6f6bd9ac87b2aa90a144677060882cc1f98616365054040ce38b8da83534af00e84a84f977
-
Filesize
5.9MB
MD573972d1e7b16c86d2858d4d6910490fb
SHA14241ea8844b2584da6e3727436d62c8bdce6c977
SHA256690329b1cad29c8aac565d2a0696c65580a6b005fb36fa72005ee6b2af4beb35
SHA512211f1b9ff8d4cb0f902f8d8a1939fced78c0a9c3e532dd2ce9a7f772e5e7d0dc117d620c8ab82ea0e94f29f697a438f8b8c3297a5ad1ae220ab24cb2403b74b1
-
Filesize
5.9MB
MD59a3a585e73b424bbe456e6992c492e56
SHA1c88eb4b6ca7563e7a78b6b9cbef862ad2b171773
SHA25609c5cc0b17b5342c4d5120bb66a1c88a988b8138da0bc46ef6e5b811aba4b431
SHA512789c100be38143a4494bdfb2d12d221d78d0ebaa571defbdb40d1c7114045ae7d08ffb95e345c8bb8828d72312a2f95f0cfe4338e23e60123029d499a037d1cb
-
Filesize
5.9MB
MD5175fdc2a8bae7d3723c4a7e016f48cbe
SHA15729f6b4c304214ff8eb38b2280c45b7fb6a1dd5
SHA256cc2c74b58358c8d725e7f04eeff616583c079946ff44f955eb411fa175d3c6a7
SHA512a9e6923827576de04fa5f0c3eb031e90ce7cb27e7688d36764d2da935100f8597ec330a3b07064b5db9eade293f97416c284446fb7db20d347efd5d983076066
-
Filesize
5.9MB
MD5403ed9bf5ca24fd0736fc5d127104255
SHA1dafa8e4528649206974e24f1dc2b56b129fe2dd4
SHA2568899c5fc219519b0d7989cec1e1fb0844ea04d94a86e97ae1a77e1ebe2875fb4
SHA512fb54abd00e245fdcc1e8fd02fb917fe9a3901192d9b77f21b7cb26a48186a9fcde7bf5f38e978f46ad508f3eed714c4e404f83f691266e0c897270e0162c522d
-
Filesize
5.9MB
MD5f8e20d3254948fa53e57dc7b6f145a6c
SHA1f827579cf2f851f96e0d9305adf15e4b4e94253c
SHA25649c890355703e2955f3e9e9251edc92f1ee15e06509ccde3e6173ecf410e24c0
SHA5124089cafeba5b46ed56acbb89d715c3525274c1d196b342233d440416b6a5da1f4785b9c28eb448d9f67063dadf5dd4ace4b95a75471109b0a0a8b0ca5e6bdb8f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB