Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-12-2024 07:47
General
-
Target
2024-12-12_7507f8bcd6a0f0f36b028c95e557be1b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
7507f8bcd6a0f0f36b028c95e557be1b
-
SHA1
1c6401b201e6a0fb5657399a32c3df1093440674
-
SHA256
8718049c32f4b982bc35f371ca8407dfd10dcc149c0e9ad0c5d6e15df4f9d6d9
-
SHA512
f816893d29bed75537fc34dad955b8fe22622b956e8aee0772b17ea0b41024626dda3f04368d1dc6c2c5e8def3e63267856c1b628c8c4c34535b1b660017c07a
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUG:E+b56utgpPF8u/7G
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_7507f8bcd6a0f0f36b028c95e557be1b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_7507f8bcd6a0f0f36b028c95e557be1b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XtctKJz.exeC:\Windows\System\XtctKJz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SNRYIXb.exeC:\Windows\System\SNRYIXb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WmYilqO.exeC:\Windows\System\WmYilqO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hEETDzd.exeC:\Windows\System\hEETDzd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TIWxMZx.exeC:\Windows\System\TIWxMZx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lROHjsU.exeC:\Windows\System\lROHjsU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SftkvCS.exeC:\Windows\System\SftkvCS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RbDmRTQ.exeC:\Windows\System\RbDmRTQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nezNJOC.exeC:\Windows\System\nezNJOC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BksdidR.exeC:\Windows\System\BksdidR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rBkpLSQ.exeC:\Windows\System\rBkpLSQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GlgktQj.exeC:\Windows\System\GlgktQj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hdNLXHn.exeC:\Windows\System\hdNLXHn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nTZwEaz.exeC:\Windows\System\nTZwEaz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eehsvbR.exeC:\Windows\System\eehsvbR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RpDsxZP.exeC:\Windows\System\RpDsxZP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cNDTyyo.exeC:\Windows\System\cNDTyyo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OCIgBaw.exeC:\Windows\System\OCIgBaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oVwvWpN.exeC:\Windows\System\oVwvWpN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QGVPIGC.exeC:\Windows\System\QGVPIGC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EiNzltR.exeC:\Windows\System\EiNzltR.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD58baebc27c206de6e96640353f1e6ca68
SHA1cb4acec62137d53555d9ff373caa85047d2628d2
SHA256ff97bf5d2231b0522fc7e42e032707b5c89f30a8d773c2dbcd1e4177d7f9bcd8
SHA51293f3a02978b14f2dc46e38731f3f2545b18f42d661e26a0e1070a255f2f4d3e5ab1a25a327070d2f524f528a4473aade83bbccda508fcecac80c37df82cf8fcb
-
Filesize
5.9MB
MD519ed56760f940c2236405ea5334a142e
SHA140892ef18021ff0f21f6d5d118e7bc5fa0d48a12
SHA25694b353b9c3e0bb1b5683226b12dc46b4614013d072ecaa27fa2476da72ef9dd9
SHA512eda3b4d74c9b417331aeaec5303fdb5642249210e77f88ed2607a128ca5a975d2e800534164fe5f9571bd82d4ee4136fe43a52831f0801606de542a84c269339
-
Filesize
5.9MB
MD5abe33123429b7975d6b320f387224416
SHA1ae68e9978c21ade80d2fa0cfce837356749a9adc
SHA2562d304c496cef5057f84eac92368b648c9098f4e10fd3612dfa26eeb5d1ac33cc
SHA5122dfc8d038d9616a14e5b6a134933423d34df46880f5d40b6ed9fa8d3ffdab37fe44d738bd3ef0d0b39458a6ba6ea60a5c85c80fcd2f566666f133b7cc0da845f
-
Filesize
5.9MB
MD50071e4a9616357c654e86d0cb62d1a44
SHA195cd483dbf7d3cf07f7e2f43c7b0c10bd6d05e49
SHA256c79045b839dd525b052ab6e2410c26a8553c53c8b7dcad69d84b27bedd79561e
SHA5120531f9931a6063b2a8574300271f5bf064d0fe5fc2fa787e62be164c3ce7c451323c56684b3887d280f6e70737bd517645ed4b4de3d41c955c40dbe17ffcb252
-
Filesize
5.9MB
MD5d665c9e99f62ea56da7c4e4e7d86047a
SHA131081e3c49303e0e45949a0af9a6894e9380009c
SHA2561cc032795aa7597d0aec08f04b60b3e1a44937cf662eacd6ccf7a15de098b924
SHA512175ed1e8096155b3109f019a8411f2e312cc3c67e8a800dc29037ff5ea8d8b78ad62a59d56c9e25b777a57c9b5c5243e25d9d1e7e57b2aa37067bb0882fa5686
-
Filesize
5.9MB
MD582d2ae08a4aa8f09b59d438d1eeac3b6
SHA1804843c84cfd7e61e6fe2e153593a15f40994d84
SHA2563518fe83a529b5d1e52d6648934b5dfb84a1c90a0fc2d5906f5866cc6716103e
SHA512eb615ed6c8c18c922bb4a3e252d9c282763bb1d041759b229242dda49b5a392b173fbbd198970b1e2d3bf0a8b437eb98285797aef607bdac750b7c34235bde1e
-
Filesize
5.9MB
MD5c2e1ef2f385d44fb3cc2ac0e56ed69a6
SHA1c21e805db277d473eb6a6afd309e0fcc87260766
SHA2569510477cfd2e8a34c74995e741c526afa9e4b3bbfc40295f4e6a484b2ac371dd
SHA51255b5d0ee9da7aafea1ddfa74ff978fe545652d82f97ac0b633ab72b1431bb20317722983c3613d68d212ea5a06136da66b4d5e53f9d2d74b4b3229695db01c61
-
Filesize
5.9MB
MD55bd38eb12d637d431da9bcd736b36f84
SHA12ad509c71e07cfa8cbd77a04d8482bfd19c84c3f
SHA25600c21e25eb393c389a6fc3393dd4469c91a3ce91c9cee2e4560e33d6c7316421
SHA51295f954754446618b39b2dfda8703df58f5daa99ece7e66bc12f6d4fff6bfd740a8d6352e055222a44002fe238b7b6cba290a73d547536ffe6e36d438cc547147
-
Filesize
5.9MB
MD560799eebfcde3221c9c893369fd86c47
SHA1c96e1965640118ed492fe1a2d64da5bb03d3c149
SHA25613b0ffb90a722d1e48745eca936593ac0eba4b74a5eb884f5adaece90b80539a
SHA5120a6508c7a3aa77fbd2610e89b1d262b16fa1e115043bad50ea5498a4129dd651dec3f0f469bd701d8ce208b3d7b96429dcfb17ba9b44ab9778125f1daa69bc45
-
Filesize
5.9MB
MD54eb3794a679767c3240b0f8999bc809e
SHA11505b8063a006294e9f7db8567a7903edd7167a9
SHA256fdd490f6360fd7480cc7d33a55fc9148749931c3dcbf10409ac38f960b4c0fff
SHA512af20632dab69f67f3e1b9f525eda87cded81e39c6457dca1f601d50889bd2c2eb90dbca4fc0ef9f8e85e5e06bd72059dfa5e1a7b127f11ce7a2e43a32a99d322
-
Filesize
5.9MB
MD5e5a55b683725ce08d215d3dbbcd0a650
SHA1fa3996db4ca9c8e27c1d0c7af0c628bfe5a7bf78
SHA256ed613485a05647c3ddd6ee783ba50ee721ba13b4ad5f2f485a415301719d98cd
SHA51270253defeb848f77fc379e33f3ff61b7de7c4de974fd8dda7425bebd87fe9c36d24c283c1af784e346ce35af6936dcb18250139239d8c012e6722511f260df5b
-
Filesize
5.9MB
MD558a5f253f5994f53c2ba2d616c36ed61
SHA1120461470b6083a1fde049b3802972e94e090227
SHA2567b644d94524cf90c75e409d61381d1211de844206ca2305b71dfacb57d331613
SHA51268b38bd993efba06211a34f13f0191d5959e5f05834f3c62296676d1d2cda58b5767d7da35e6895ab95cac33a99ea19063b95dda4e6244d532b00e2992088bd0
-
Filesize
5.9MB
MD548b189c6cec848f9ebe7f20ce57b2931
SHA186f0ddd1855cf2a044d9826b27a6e3d548e8254c
SHA256bd0eaa2f4ba89885bcc6a078d6eeb28f24e795283bace17bcb3ae2ba994fdded
SHA512bc57227d1b2243f7070bd29c390b8ad79156334140d0a397388e73853814513f971299d3cb4e3883a1b4994c829bde0044c9e0b53a8243cb895dd716cd78e942
-
Filesize
5.9MB
MD5a88783eee35d9bfc198f452917f2582b
SHA1f89f96406edba569f30b7e837efd814a286df4fb
SHA256a5ff43f07111a7cca624831f49a1b15b1ca9641926da497f5a9399bbc7f7fce9
SHA512eb3bcc7af46dc29432c4434d0238a54d0dc6eba56fb21239e45d4519c6407174d4f179cd15b1fcabc352bb1ece9470cb648015f9c8c4970088d0674b555f66dd
-
Filesize
5.9MB
MD55f2df08ad7e3de92d807d26a127cef20
SHA10fe02dcb26ea86ccdc6f998f873f3d9b2f9db364
SHA256ebaf7d8da8d8a3e25db3fe1cefac0d6b67dffdf52e71c5e053efcdb6507451d9
SHA5127bfa95419f283b995959a787f6b50e7fb300cc83306b1df2b408430aa5a83fc401ca52f16e6f3a49e38c0abbea9e3f77617aa76c83e5a63a5fb57f1ce677b91a
-
Filesize
5.9MB
MD584643c509b84edda45432ddea01a6dc3
SHA10fbd714afcd441c960397a614f422e57afb58d90
SHA256b0717f28d9f240792ce2cfd4bef197649413e3043984b58c0eb8f7cd78849b5e
SHA51281ee1c7632dfa8b10fd946e79a4c7ca35ed427a388277909425a1ae725d4686ea22c1d34452c1c1aaf3d84186a325edaafb91ceb1dbc2ca41dde03aa4e1b7567
-
Filesize
5.9MB
MD5c4e24d84fb378a6fc71a8651d23eec16
SHA13c076af1befce2264287d93672914d7e3e473e2b
SHA25625566ac3c4ecb017cb81cca6de81b01c225b1a86d4773fb3c3c80a8e689c135e
SHA51228fe7b81f40d9f90c4f45e1ff33e10858f344350aad5141a7e5990ef16272b6e65fd0301331911318e74b929863d4afeed6638831642a60eaad044883f70672d
-
Filesize
5.9MB
MD5085e4090e98d7eb12037f32b49cc9a80
SHA1e3fa297134626fd2e5219f4b90935f120017b04f
SHA256ebce28502bc6dc055f34824ea1caffe1d79f7187a3e989429e83a32b7b42445b
SHA512fcca3a1ff4c94dd7d63bcbdeb5759805006be498ca496d453fead3b9c3e9d69add1ec4d6651f5a687e60da2acce15d8f855e721962018814cda6c4fd9422cd82
-
Filesize
5.9MB
MD566274bf2e27bcf90da5f6bb8b3495fe7
SHA1dff10483924cbbed3f9f74362a6bb8895b1cfd3c
SHA256593d9cb071b37952103322485205c312376db53427c9f569df94603c2866adf9
SHA512c10cdf4b7d2a3ae39f29f1ce8c4ec51844f3e37857d25f7d135523fdb74a2a726086b38c1a4fb3226115973b4883ab480c35e1e6afbe64ee7cc55c48df1e43ed
-
Filesize
5.9MB
MD5374f4090fa10124843662d3ff3c91741
SHA105d8e46b0196effae631f18ef5c8a6196e090f7e
SHA256a4df35c3553d90fdc2d882bec36a5fda76b2949fe97ac0ea1d5d2a3db3b7a018
SHA512af4fdff5af5748614bd3d55e338214a021990ab0b9fa4012218453154b80cf1c06153133c0378c95fc697470dfcbf70d0f6681de79a8faffc50b3ea33199d7ed
-
Filesize
5.9MB
MD572846564bd9a84a79cf54aa4f346c5cf
SHA10f5a72988219335df4fcbcfd987d9307479b0ae0
SHA25678794225adc2fcb4dcb0e1583faaa4af1f366704ef3015e52479736621dbc68a
SHA512ceb66b3b2e755912af3fc284ce35a31c543b1d249f47bcc7c10f071203c7b093fdc185d12377532f2b7bebb74a99697428ca2883ef221851949442ef7fb0ff38
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB