Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-12-2024 07:49
General
-
Target
2024-12-12_b852ca3c7a492b1252dd5383503cd860_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
b852ca3c7a492b1252dd5383503cd860
-
SHA1
3ebdc4c7f6b2a3fd45b24cc05fc8650698fe8de8
-
SHA256
7817bb61da615275db93b4f31760ed272ceee9265666467648174c5698b1580a
-
SHA512
bb938ec307b98916ec72be6b2f0cf421d0f774de8c0a5fb9106ca79a0537d55f0dab20b13b4b440217a7204b78e71c91a896146c0acf527c4e5f8b1d416a99e1
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUd:E+b56utgpPF8u/7d
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 61 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_b852ca3c7a492b1252dd5383503cd860_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_b852ca3c7a492b1252dd5383503cd860_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LGvVUoi.exeC:\Windows\System\LGvVUoi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZbBZGFM.exeC:\Windows\System\ZbBZGFM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vHEJrAn.exeC:\Windows\System\vHEJrAn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\egthykM.exeC:\Windows\System\egthykM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\evCgUrW.exeC:\Windows\System\evCgUrW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hunGgqt.exeC:\Windows\System\hunGgqt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ftunhUl.exeC:\Windows\System\ftunhUl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YYcEDJC.exeC:\Windows\System\YYcEDJC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eCNCDyl.exeC:\Windows\System\eCNCDyl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NCJGBMD.exeC:\Windows\System\NCJGBMD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dchukeg.exeC:\Windows\System\dchukeg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cUdVTVH.exeC:\Windows\System\cUdVTVH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\inyYFts.exeC:\Windows\System\inyYFts.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YlnDWDr.exeC:\Windows\System\YlnDWDr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aGxhEtD.exeC:\Windows\System\aGxhEtD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HdEWnqr.exeC:\Windows\System\HdEWnqr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ltKzdwZ.exeC:\Windows\System\ltKzdwZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXsZnHK.exeC:\Windows\System\bXsZnHK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rNgcpTx.exeC:\Windows\System\rNgcpTx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XeFLXjv.exeC:\Windows\System\XeFLXjv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lCIooyR.exeC:\Windows\System\lCIooyR.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c64eb8f4a91798fd7a4a7578434b0445
SHA1f6f75ab0c66d72ab9304a3a37647ae3f6e7f5f82
SHA256156273ddaadb34147062c1b788e812b7061afee9442b18a0440eee751e19d7be
SHA512c61383e706180f414b1b969a80f83d47a2833860d140ee11cb745e600efb39f2e19004903e7ff78ecd5a3626402ac3465226eda3b87dd72892894150215871de
-
Filesize
5.9MB
MD5a9df9de8d1ea2615d95c4be375637564
SHA10440608046504184b1d199da5351a62964c6ea9f
SHA2569d52eee3b65958c857118bcf503f172ba59ec607960ced924120e1eb7cddb235
SHA51277ddd326b8a370a579fdbea5734886b5321efa5601826eb12fea5d718f797c25dd2c0da358ba9957da8540cbfe6b76311b4cce211084a3391b0e036a2fe14fa1
-
Filesize
5.9MB
MD55df7193a2be1ea6c2dc8c4f8a84b1819
SHA16121ff3acfb569524e5600204bc3ef63aeeae396
SHA256f7b7e98b653aaaae0099cd3ee7e6b9fb71d34b85a6ef829832b822e64c155240
SHA51271fdff8d080bb9508946970f979665863cbdc8b1a761c6436be6d82decce47dac1dafe4718b5fd4f3aa0c4c2836c144029452c7b2a738dc60e3001e6afef1458
-
Filesize
5.9MB
MD5dd2689e45836b7a9e07213f90055b176
SHA1454d8605a028f3caf41668aac71d49053ddd47cd
SHA256e9c6ca2203bf4a6347fad3dcde9cb3df6c4390a4466be583ae0da5286c34fe7d
SHA512d0c0d7280f09036bddc13db59cb74c0e96f839660577b77c4e633cb9a4262cc59a62de9e18bda1c2450d9ccd2e37caac7fb2e833148a7393076a3643c3abcf1b
-
Filesize
5.9MB
MD56bde4fa57399535e7b007e9a6324de2a
SHA1ebd85ec12da97782fa09e0e118b3fda033987266
SHA2562bc359ec73ab0f35a221bcddc52198c5f987c05585b5ffcbf18dd747d87d3f98
SHA51273cd4c5cdde826f47642dd116b53e98b9d5dc0d3db86b0b3748a6a0ee507fdf511b4d6bd937c84ea3e31b07bcfe23f637dbf17ab0bc43d97dd7c58b36a7ce033
-
Filesize
5.9MB
MD5dd06f94456bb896ec34fccec47c86057
SHA1e34217c98da095270dbffb62a8d0e65885a9b34f
SHA256878d326d4d20ceebbd5d7677ea4b6c7bdb266ee0f3fe2e14425a9deab40c8e2c
SHA512c8cb2b48ec75233fc449ac6cb536da6a3c9fea848061de64f278da6b5781405a3660b762ff3185e27ec12bd3f22c08ce3877b95801441b850cb9f1e0dca7d7fc
-
Filesize
5.9MB
MD54c78cc3846c23d3d32b4715eceba0ecc
SHA100b3e6bba08b68b21d43d551c0600b3e11e2361c
SHA256c9f5765f4e4418bf1baaf0f19a72614be3af8faa4a65147cb614ecb34d45e2cb
SHA5121e08d4f5dd5b77a981e3e3f44eb31e24ce82e63939bd1d9fdc27f226ae1b723ffd17c1f84d1692aecea552a368f8e2b30e4472af18c9ceee6672ce23a4981005
-
Filesize
5.9MB
MD511c996dd4eac61a48978410ec7efb658
SHA11eb3b4c4484873e89b4dc8a173c949a3dfa96315
SHA256c287142b231f91d0657f8b00d0c984653fcb64b446bd4debf0c548cee812bd6d
SHA512467da9b08cd3ab15f7e54e5a561f2bdfb180d44cf2009b67e00bc00322bbdca1f238f293ebc685236be8f1385ffcce1a574673065e6ac9dbfb2eab5aef41fb81
-
Filesize
5.9MB
MD54bf4bb97b23130d2f33b74606c7c3c2f
SHA187358104ba6b905250c466df172b509654f78f80
SHA256feb383e75447877d75bc4be0f898db3a7551abc9e833be7247c6bca11c4651db
SHA512e16b831ae00997efa9dfd81bd3deb4240f9a23c036d1eb0c1a74389483bb7d02dbb9c90b72989edd719096d83a4d4e0e0276a6ea558b0202560f685d12b9b724
-
Filesize
5.9MB
MD512fdb66c34081bdb963cd69372eb0bbd
SHA1ae0bd639e6909a3b650cb07e8f17ba4ddca12c5e
SHA256a9f2ff14a5379bea351ed85e2edac3166f9ae2f64eeeb6df1b8c30b6fd08b170
SHA5127c441114a925a9c68d4b7464bc7e6fc92ca1be1762ade980f5314657943aa23024b185177440663a172c3ada0f1537d8d6540d7052bed93c2148857c9f1909c9
-
Filesize
5.9MB
MD5491500ce1f5cea7c7b3c644da15ef430
SHA1b284dfcc89f736c90e08f9af08db556ce77513b5
SHA2561754a4208d29c3178ab0e3d23d05d5ff0d6c9b8486761c1b2bcd36a2f733d9b7
SHA5123ed9b62d0a18d1ca46a510502339fcbc918a139d4324ebe9fa615dccca3f5ac85c104f8acf6cf19546e1b8a062ee912cc707c7683c80dd841c24fa74434a1bb2
-
Filesize
5.9MB
MD5b53bafc0e1cda96199769a3cd134bd1e
SHA1c36657686af6e84dde756615e25f50341172b62e
SHA256740189dc21d77cbd6bcf18a88234e9d64dcf66bfb27ead739f517d4c47ebf2b4
SHA512d159f6da23c225263938e5cf9f82c4cbfaf78dfdac9ed3226cf50286a7e3287d879ad5f9119bd4f188811102527d1fd22e9584c4703d95534b05bf010c737312
-
Filesize
5.9MB
MD585f8339c2b990749f648cfc9d8800beb
SHA1e758a452bcb8ab7a6f197b8c60cb9c52a8722c80
SHA25627ed24796ea68813c17e91577a5956415dc199679975c6b2289576426d372822
SHA51276324a768c37bcf3c7805b26d96edc94ad25857fe9c8173efd02d8d262b8751927caf1301d5cb0e5e8057bec73e4542bc467cfa86c65911f33d0681b931a69e1
-
Filesize
5.9MB
MD50f6063d5b1cd8b827790cbd7d8167bc1
SHA1fc44dac254b3c55711e86af1ef160265e443c586
SHA25677cdde0148605e8717336394e505d48c2bd2b3d48dfaf49508aba4ece2c8830a
SHA5127c2f5c724dbb0fa5d6c0d48079e486b48fbcc7251837d29d4ffc98711383f8673d45cfa93efc272552a7869d2e2c00e93bbda91803de68fca96f650baa2966b0
-
Filesize
5.9MB
MD54f7f9936534b5ba75a9cd81086ed8824
SHA1eeb6b5b84c415d0c3e1c1041fadf518faea22ed8
SHA2562f64d051ebbab82ca2f6b35d5129d982cd980341f9c5cbefa66a34282b3e6ad9
SHA512d721c7713096a06a18ad860fe7171fab01ebf6503221b214e3da84e1e5065aa9481c0990bc758629290f23e37e2f56a5c86d60505043ee1eb185a268a646500b
-
Filesize
5.9MB
MD5c4ef3ea47781cd364cb2bec2a7db8ea4
SHA1b04b5b724594b84e5ab88f7de68daefb5aac12d6
SHA256c576421499524f2f6f62f24c43d11d65ae137e4986e30dcba358ac4541804f6d
SHA512a4859a6dbe5dd25ddb21ef272bc1070a7246c2a14fdb4cbafd9faf82bc7f7eada2c71c5724d20ce72c7ccb1e8aaf48fb36ab381fa5ffd7d8ca2d4ab17fd701a8
-
Filesize
5.9MB
MD551c03c36cc087321d5f4bac3e953f7f7
SHA19548420390636841b07827288ae865a851cf365c
SHA256cd347e1af59fc5c8bc77041f38db6eaaad468d4b86693e1c00ff3b3906d5b936
SHA512858956c85c9d79b99d08e679537c3fad8261eeb58de03560fbff34bc334a0edca536eb107f0da46878148bde3f9c63e0461f662c3a4535f88e444ec625195285
-
Filesize
5.9MB
MD53ea6ba9dfbb3d0202f1d7dca4c6a6777
SHA1a3529ae8ed749f4cfbedb7b1c82406489722544f
SHA256e6642683350f5ba80832b6860dff37dbb5971d18a99ef500001475dc4ff239e8
SHA512d1eb66437640e60397d6ca38753d1c2d3732cec98b6bb85c060107e7c0badcdc5cd356ecc5abcc4af6883be4e1ca331883040680f45a9a2728875fa28da80bb6
-
Filesize
5.9MB
MD55d9f10756e5fd762fdf70d19038eebbc
SHA18223c7a93992196de1b01953618b99b34096f68a
SHA25649badafc34994a86cf84f62b2bd4daf391bfe168b9bba5d0c3bf3c38d42d5aba
SHA51208e7350b58be92ad17df6291cd39bb0a3a60186193b3ce3c7b148af5fb10dc52393392b5e9e7eae1048bf57f500950d904ba002ac17aab7d08301db4b066719c
-
Filesize
5.9MB
MD5fd5ce96aec743b08bbfbc2f79ce4ddbf
SHA13e493ddea8fdfc7ee58c8622f9ba02f647e2b8e2
SHA256d3f316368528cb88f24009ac363b8bdd9260922df8393885c448ac1fef14562a
SHA5129a137d986a26cf1c9b91ef91fb4318f33080432ded7e6700a96f9fb591a9868b055f97200fc6e7ec351ce888fda1d7bde58da35e22c6d9af1adec114f762f16d
-
Filesize
5.9MB
MD52e116529d23f9db39426b9ececb6407a
SHA1d4d470aaafa2413faa7b4a38b5d33f782e4de333
SHA256d7b9eca29706341462886f1f079897faae82dc145f19dab22193f0dd135e8431
SHA51277f6496940a49c68184eadc46c1b10fc2076d1011f054a9787cf121cb8184e9941609b2d0477f903a379f09fd8672956a4a1febaba1151d8295e30d83e954743
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB