Analysis
-
max time kernel
132s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-12-2024 08:01
General
-
Target
2024-12-12_bdc66c0405d51e4a445611b70a6a88b6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
bdc66c0405d51e4a445611b70a6a88b6
-
SHA1
e0a872286116553b4bfcbf16492da3056af1f5e4
-
SHA256
15ed5bca5ed8f25ef1783544bcd8d1fb293c40ae994866167c86dac21d5de5ed
-
SHA512
34b1bd5e386b1c4cd96106f7946d11a1085f0d72e4d6d49a02b920673adf6edafeed2ba6d291aff09cbb4d651ead1a9201fc8bf7da32d97b31b12646e0079f4d
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUs:E+b56utgpPF8u/7s
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 53 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 52 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_bdc66c0405d51e4a445611b70a6a88b6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_bdc66c0405d51e4a445611b70a6a88b6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\usvvAwu.exeC:\Windows\System\usvvAwu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\auJIoWk.exeC:\Windows\System\auJIoWk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lregmfr.exeC:\Windows\System\lregmfr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YmZqDfH.exeC:\Windows\System\YmZqDfH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eFyHlRi.exeC:\Windows\System\eFyHlRi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZUoehvH.exeC:\Windows\System\ZUoehvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ixDazfF.exeC:\Windows\System\ixDazfF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NyhhSoo.exeC:\Windows\System\NyhhSoo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cJcWsVo.exeC:\Windows\System\cJcWsVo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BwfBAEM.exeC:\Windows\System\BwfBAEM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FtXgtIU.exeC:\Windows\System\FtXgtIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KNFeOFd.exeC:\Windows\System\KNFeOFd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oDHRxAg.exeC:\Windows\System\oDHRxAg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MXicjvd.exeC:\Windows\System\MXicjvd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vYunCey.exeC:\Windows\System\vYunCey.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YgBLXmI.exeC:\Windows\System\YgBLXmI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lBjZvhQ.exeC:\Windows\System\lBjZvhQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PrcqfJK.exeC:\Windows\System\PrcqfJK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jjgjHie.exeC:\Windows\System\jjgjHie.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eKSRWPz.exeC:\Windows\System\eKSRWPz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rceVmgp.exeC:\Windows\System\rceVmgp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e1ebf5a60a10c1ae5d04c333307569ca
SHA1288075789069c0a7b2809663ced7ef1e9bca9f07
SHA25604d0cdeced013d0bcd18e93bb68edb728c7b11b85b89bcd6811491569d27a920
SHA5126a5b45022d3cf68148eaa1503f620de805513baff082f1a475cfce7ed6c56535221c0eff8f99fd3b5bc149efad6456b763ee4e9a1a6e318d55cc2f115fd3c9f8
-
Filesize
5.9MB
MD5de134e829ad757405f9b1a4fbb53a678
SHA1f5c1ff62cc1c569a502e05ee722f3df2d1334756
SHA2560a0b3c095281b52a07d73cb60ba8d4b44c212759536a63e22ea6ae9a9efb9e4e
SHA5127bba2e55a01c2212632d3b2e7b4eea147ade7241f3522ca54a29cd934fa464b41f80f75ba05fe0b9ca4bc58d1af2b278c4b71df858c319ab92dc563def27e947
-
Filesize
5.9MB
MD5d901a974149a5ee9227e5e3de132e545
SHA1826c077771f8d7275381f0344ae53b734b589c17
SHA256a730b6dffe745b5d63bae834f1709f8f4eec719a2b195d52a0d6fb086e00ed1a
SHA512ac1c1bf0245831cd60649ba6fc2a495e02896887e7347bfe6bbb25e91e5685ec0fba21ab29dcf2961b81c9dfcfab8198ecf9f909af68fe5eba0087273e5222d3
-
Filesize
5.9MB
MD5010404a2af0187b514344468905d3ac7
SHA1fd95f2cf74ed344a80a2dbbeba8575ea7af20737
SHA25659bb301a96ee01ec65b4214c0c97a1941dc49a38918e6a57c244b6c9b84081a4
SHA512145a009315225ef7d2f7fe6d335e48243eb88cd5c149435c47b592c74ac218ed0d8cd8c6f3dd3ffbadb39f8c0e355a67d9edfd6b8208497274bce0957ebf1e10
-
Filesize
5.9MB
MD5aa05f43c5d3d0a7180b259e7acdb972a
SHA11f7366847f580fa2a6a6fe0ea01319d726cc55e9
SHA2560ae90c95222a28b82b35fb27c81869500da1bb53a4d54356b96fe73fd3a5eaeb
SHA5125b9f7d0098ddbf8cf6d581a0026ba40a6a0d7a448424586c850cb85dcdbac00447fe24bbf64a6c6997054f80d8c74c3f7bfa2b7ee33570bc997b1acc83278dcb
-
Filesize
5.9MB
MD51e5d0228089a2838318916082932e4c0
SHA10d5a1158675e41dbd8943a882b1760c2237b5b7b
SHA256bbe921efc293ac8edf86dddcbc21ea995dc7eaa3e595aba008647f2a19d631ae
SHA512e567a424bdfa9e34a06e3d058e17fc79384c2c2e389d2f0a1b6daab9a710f6cb5a8c8ba49dd81a160f53bb69266719afe5938ba7b3f3edb1d49cbc32e7b0d259
-
Filesize
5.9MB
MD5ee16f6b443dff468f6b87eb2ee35363c
SHA12faee1956b741c402f917285d8c21d8ce1ada4c2
SHA2565ebd94cf57a4de54045a6ec77058a432afcc7ac6255147d436d30bca987287cd
SHA512a5f0eec51389b22a0177c167e732d210644d137fe6e368a69f364782e0683338b04ca9ee112a892d1f49cb3a8d250fd9da7e14e267682e4bd8be45abdac35042
-
Filesize
5.9MB
MD52621cbc8370658f1da054d86899908f4
SHA143f8ca84f628a1176544680200589e7077861e64
SHA25607f55817495a9a06a8dd9bbb25d1498266ffe55d05c05e4f36c10253d16bfd37
SHA512a301980cc4c3021b53babb8816d0613f04a4d6ca1314067c796310ab0314473b2bde6cb7bdeea54b0be694bead36807acaed4aed17da05e0484a853aa91fd3a7
-
Filesize
5.9MB
MD5ffc8ca96d996c1e16e69b236a1d0d241
SHA1243b17ca26daee600034bb7226dc0b703935d58d
SHA256f624a98de21ff1576f885f0ab6b0e98bef8fb0e1f503e3e3f43b2c25e6749b27
SHA512752bb30a07df3d467794834ad524b4968fafb11971ca3a37e3de4dfaed5b036a41f9d802331bf95fd878e202f041e8b144b61a1f79db280660ce14e1a2e3a0ff
-
Filesize
5.9MB
MD560c589652e6bf7f909eaa608cffd9b1b
SHA1028c8412543ba7e48ee309632ab636081317a1b0
SHA256e4d8fead3d6b1e30cf22a01581bedf94fd5c1caa304a82d3207c1cdde3f828c9
SHA512be667b21f2b316f928551b8421157f8e7d95fb029296c46bb3bac07f22c6029b5c1c87978072ebaa77dd42bc79f42de7a9db267e24dc8f61d47ae2e258de6e64
-
Filesize
5.9MB
MD5576eac0e3413de55da6c5e3365de69ce
SHA184787c015647d72a5096a9b03a19913f133c162a
SHA2569e0a721e5d9bf2b191a88ecd96df7824fe430e71b7c7f8cdb0bd8377fe3fc58b
SHA512b8903fc0de0c24d58fed6a2fe8042cbb87184c5585d5d22bf150e814487b9decf811fec23e4ed8ef009551dfbcbb0f36c888be0df067ed61ba398666fdffe12d
-
Filesize
5.9MB
MD550c27eb2b2d564006fc65e29451b4d02
SHA1624805fa0985a8af8413770cfcef4f155f405754
SHA25654070f30abf05014c405fe1898959dbb8a7b1f612b6c34be1bf930cb4abcc869
SHA512b8003d60e05f1142a98f22315a327ba06657a88cb375df493f30cc876ee72c56c4841570b2c698a70cf123a892db7a00dbb3667b73e356628ab8870ef641e8c0
-
Filesize
5.9MB
MD550bc5749696004996c4be7c9a1d2bbf0
SHA18e5b75389f56ea4f5cc744f83258e6c5183f6d94
SHA256933a445758c994a0ba0d98eb459565a208201766ee4b6a2868369b40f0a67770
SHA51209512dc768695dd59ec088b473444e724abef58d805a8ee341affe013d1b899915a97ec378c66ea38e9fcdc6504587c875a521f4326cbe1f9cd09372590e4b86
-
Filesize
5.9MB
MD5d0c2f16c11ccbfe239457894c9ac0be5
SHA12750ae69e8097f43146eb6d388a37bdb49c90e4e
SHA256d70cceca17a9a64ed51ae919d48ddf5f53f112049559ad9af179a48fd002209f
SHA512234d2dcbabf4d1adf81f2bb78a8c4d0cfbb401d07e6baae7a79d2c218f79e8e8e271e17a2b4954dbc5b3ad1a3bbcff7b3a4299078a548e4771a96b6da02a2286
-
Filesize
5.9MB
MD53307e95a1562429694070060af7be2a9
SHA1e2875c581913334106d3691c94d6dc4b1a3b4eba
SHA256854695e99f890b2864cfc890e46aacbac5f998710990389d3547860c781d98e9
SHA5124f739fecda4e4d2e003ee7988c137722c2617ff745bb2f8ebbefac7191cc9dade924aa6f15798319faebd342486fc3b309b9747b398c7fd9fd7840ef5fcb7d71
-
Filesize
5.9MB
MD5ca05371b6c4d26cca203002bf56b07b3
SHA1423f3994fee746ed30dfe233ea6fc041bc4df68e
SHA256aed83c257a2fe6d677bdba4ae1ab84b26519c085edb22b715199c8567959db38
SHA512fa151cea9286f1c8957b261d1f1b1f774e6769b66c0a0cd3d3c33a9397956e00b4b86275c687fdaf2378a3cd1d12b7ec5addfcf0206d08809978e0f285b3ed78
-
Filesize
5.9MB
MD547b0028a5e49fc36ef37256e6bc04fc9
SHA1a0445ae86fffc056838b953b3be6931cf240b372
SHA2567eb1a143f8092410dffc4512aa0f880d1b2097823f8422a73928d60e1c2443fa
SHA5124f63e9889299103ba1a8a143d2bc52e5216ac761d50477bcef86f4bce26cff7b1549fd0742d953071e2f2259b08fc36d665995c1e5d8f9b05d960ff918760a57
-
Filesize
5.9MB
MD5752701055fb0306d318229daaf116626
SHA1bd32e2ac62faa12c81a3565678efddc731688cb7
SHA256271b8346457a140ff542183ce312daf1c491c3a6e2458b614f218db416458b1a
SHA51244705b8c945ea672d0a4aeefd827d6d9180f0bcbb9cf334fedd133f33dfdf3b4dc53d603aefd4da529835e266316b1e4435161ec3c0fb1e1b7c158a3c5ab4e43
-
Filesize
5.9MB
MD59ce40028b70212a1fdaf5a0e2db03d82
SHA1f796330be3c7668cb11b256d2c39c5a7fabfecc0
SHA256824acf3649062e58d07ff8305391938102ecb04b17a2a62f3b64e9bfc551b86d
SHA5123de9b32c5036de5cd03efc195e6e55c29f9b48ea4d09ccd04c5c071f72e5d4eb18fae95cf5da820747fe667a6f423d6af93d19c2398abc1b79caaed33b8087e5
-
Filesize
5.9MB
MD52e7888c246925ddb1a618e751bd4e813
SHA118088020801389261cc1060a4a6f3c3668b8c440
SHA2565b6c63d2ceb89ddf792c4770573458d4ee82731a7681994716475c4017d3f9c9
SHA51204689a07fe1e9591637e4d764252a4d5cabeb3015c15b13c46a38aa95d5b1f4ab645e837baf41fe2ab0c110bfcec32cfd1362e5953c3f62bf5e938c9003e2a91
-
Filesize
5.9MB
MD5256b720076e4a94b598549fa52e07fce
SHA137d8b967b9e1a38c3c27cdc4e2756a0c2ebd33de
SHA256932f02e277fc2c4aea2c9359cc7e6e17f2ec33cb901f5b8a61e5c31a6182ea03
SHA512f59ea464882b09d3f984dc30c29538bb5b492e9fbdb392f36260192b688845fb8e7a593fa3a75bee08fdd53221473e19becd91b9d7a05c254464bd05db038273
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB