Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
12-12-2024 11:51
General
-
Target
2024-12-12_873fe2aa4976c6f077b7831b76dddd74_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
873fe2aa4976c6f077b7831b76dddd74
-
SHA1
0926501ffdd509d6d03fd9cc0b53d327806fda28
-
SHA256
f0434f1a58dd1d4d6202f0358a0710d373a4408bf56837e0815c332967c99543
-
SHA512
a2fa302f891de7de317c6149fc919ffbc1c60b56327a26d73e6b677e947b9b88d03df7ae84e14a51c9a95f200b0be5bb73e9321c3a3458e68ff2d8e45a79c6fe
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibd56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_873fe2aa4976c6f077b7831b76dddd74_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_873fe2aa4976c6f077b7831b76dddd74_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wAMfwbf.exeC:\Windows\System\wAMfwbf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CXixJMu.exeC:\Windows\System\CXixJMu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QVJZlRw.exeC:\Windows\System\QVJZlRw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\auqVFuX.exeC:\Windows\System\auqVFuX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PqpCKJf.exeC:\Windows\System\PqpCKJf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\untUScF.exeC:\Windows\System\untUScF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pPQYhzV.exeC:\Windows\System\pPQYhzV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZnwUXBJ.exeC:\Windows\System\ZnwUXBJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\spCWabQ.exeC:\Windows\System\spCWabQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dWlKgRV.exeC:\Windows\System\dWlKgRV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cXFalTi.exeC:\Windows\System\cXFalTi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dLrYHYl.exeC:\Windows\System\dLrYHYl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HJptJml.exeC:\Windows\System\HJptJml.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ypRgCGl.exeC:\Windows\System\ypRgCGl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UNjNFDl.exeC:\Windows\System\UNjNFDl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QKjFHrm.exeC:\Windows\System\QKjFHrm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OXSDRVO.exeC:\Windows\System\OXSDRVO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tGEWNEu.exeC:\Windows\System\tGEWNEu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AfHwcMK.exeC:\Windows\System\AfHwcMK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\utOVhFt.exeC:\Windows\System\utOVhFt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tausJQV.exeC:\Windows\System\tausJQV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD517473b16e049daf5d632b135c2f2bea8
SHA16cc806c80db4cea8a5021da6bc191b94223f21f5
SHA2565f437daad46d61d9b650f06a7245aa204eab7e9b2e219d209699e51d81f143ce
SHA5126d850ccbbb2f68e32175865e5b9e2f8df5ca0b32486f6285b90cfc6b8bf87479741bb9b1293ebbee6937216c9320a53078efdabe8d049a1c7d3ed616d40569d6
-
Filesize
5.2MB
MD5aa0df407677871760b16b3b4907f78a0
SHA12f87abc79b4917036be96822c071f95ab824a791
SHA256fa9ffcf5249733a677c5b7bf6414308495b8bb4f2dbbd1e80c9a0ff8ae73eb62
SHA51203b05e3c851a2f21347f138bc2acae84a5af69be97add461c60d86e90a189956bbf498b316063cc61c06d4e71f9bd41cb4cbc26da042b11fd809836c424a7b97
-
Filesize
5.2MB
MD5e6ddb7b5556445697ced8498a84dd66e
SHA1ddb0821409492b1686088650fee02e69c3e403e7
SHA2568b7a6614e5a9f703637e4bf2c9b388590c10d98ef748d23d254b4f7a9b756f1f
SHA512fc138b11b0b03eb29846f26ccc674f30cbeb962ce8352bfe55f613384e72fb87fd33a48645b6848effa9dcc26173b5c0473df44a3a09b0a9e9ef52c0a0280996
-
Filesize
5.2MB
MD52a4c847cd8dd022291175b5b982b769b
SHA189aee70e8b2150e5fe2578775808378a2cec021c
SHA25606bd913c91fe4f88f712a3e338f2b2fec1985f69c545a105ad70ebf2da9793d3
SHA51231666e889ca44808991dee42d1f343e86f06be4b6be53048b8934d7a9cf63e4bbd1297c9394d746ca6bcdc830078bffd144315a016cee1574c7d3ae259ba4b43
-
Filesize
5.2MB
MD5208d31e8f4f2cfb6104378c7c84c5127
SHA1df4d95a6b30b9d25611c0897c712d3ecca649d85
SHA25629f39e20f19c6843166cbcb568231833109f2995ac1979d6f8167a09eb14e6bd
SHA5121a28a904f3006fb965516c76ae7078cb8fe4d53bb3bbcd15ac4f0a805503a31125774c8ace2e308a60d212e8df57a97253019c635df18e6bda7995afebcaa23d
-
Filesize
5.2MB
MD51c80b1be8ccafd20c43bc8eddf384d8e
SHA18d1c651e16c596027c5235344f9d4dbc3110dc62
SHA256b047bfb885afb21a4830747cb5cbda543b0137e1832f5e65ed451354564787f6
SHA5126286fb4a8f319a6419460a3a5a4e81b5ca9694fcfd0b65704ba1bbdbd56fdad551690ffaf7fdcd7eefcf1ec31123b1de9b510edf6c4dfc6d349ebf43632fb663
-
Filesize
5.2MB
MD5c1ff15ca0c1d5f26b09f21f8ca3fb387
SHA16769bdd147376cbcdaca68915d3459eb6747f1d6
SHA2569c9fd7faa3fd1da4876ab39c959c90261aa63c782d3a0c392fb2a5edfe3aa77b
SHA512b24be4572fae3edd5b683db37723bdea555195b794771cc3a36786ab924edce202a6030afb483b0eceb9107bccc736a8e76bb239f2f94a4ec51116e57a5d9aed
-
Filesize
5.2MB
MD5759e7d00063d87e9199cfdfd7cd08fec
SHA13bba63ebed49c4b36429679d25fe3e7272142faf
SHA256cd009c351a55deeba575c49cd8e1c298c15b759161ed348a5f15026620bf7336
SHA512b417c064113a7546f80bca946e64e72d2adefe84097f5c5748e59a9e4d454aeb4b2753220bbbcb7eb011153c82e541d17ae89504fd4294679caccb8e7f95334d
-
Filesize
5.2MB
MD59e1681e9e37eaf1fe2512e78741e87aa
SHA1509f134ba3eb0405d4a7657d3fae54afd513eb4c
SHA256e8bde4b2d3f56aa50c9aafcb99d2103bbff3ef5865de08c28e6e98e27ef94d9b
SHA51248939f704d32ccca4bf817eb1657fce7f05270f3e4b00d6478feaee41eb4d983302b30ecd9fe02af873e3370a4a873f7c31990e64ad808bba7522ef6ffc2a08c
-
Filesize
5.2MB
MD5baa9f4bc2190adac13bda4e3cd5dafd7
SHA1765caf3a546eed6f0eb7cd7652e217a1c02cc8e0
SHA256c25d9dacd0a885c4867b3b04834ffa11ab4eaa7ee312b086d155f7a038086aef
SHA5125998738de421d0bfbb2949c0bb5ac0ea5052bf20c772da38f77f7046b432059d2f8666a710e7165e3680a9cc83da6fd84c4a6560cb8cb14c12a7a774e2393e08
-
Filesize
5.2MB
MD5aa5292b89b350a4242d3dd8d58572567
SHA1a75f2caf502dc4a78458e1312cc37aac919a6d54
SHA25622ce088737e69de863564fa6518db0499f65323543f60ecc1ae18480bf33b6ff
SHA512b0da95e02ee06d6daa2cdcffa5720cdf73efc6de1f15b68ae468d5fa138d08dcd2f999983be1f2dcd1b2a4e0e9f8d7ec15671d49b0222b3f001a65dcfb5ac7d9
-
Filesize
5.2MB
MD512debd1b885abb857d5bc6276d9784f3
SHA1148bd8ab0eedda3c3e2b46957a837c17ed1c172d
SHA25641f0f62a9b864f8c36d2f46efd361a622885838bc1a0e0c8cffe3d1bff5d6c92
SHA5129ffd9d2ceb82c5755015f69ae5ecf5e4c409260af053591f03abeb27aac85b8facdd2680c33c95323f4e307a6b7e10c004f6a29f6d66aff0ed7796261e4308cc
-
Filesize
5.2MB
MD5ed77ed3c2b8f8185cd59c7dcb8efa11d
SHA12d2d118886d22613268704fddb86227a3b9c20af
SHA2567b2945c6032def6095aca81f64869789473227db857faf45a99e887005d75af5
SHA512ad87a51cec2d522166babee04bb40f4b3df9621ba8bd0e22e93eb9228ac906a455d8f53e1f7ab5de1a8ad4adbc5f5fa01721a9cb26db9e95833f4b68b627ee38
-
Filesize
5.2MB
MD59281554e58e70f51d75a5717a78d9992
SHA145236e42927b806b7be6bb8878a2088ee6701bb6
SHA2562d3b0e6b55cf052bb8593dda261f34d3a8ddd84d7d47e92c7fac73f470f37c6f
SHA512cb44bf7fb2869e4b5264b4ac741bee22709554784965010a6507d9ab5c7a1ed38d469034c297d9e93cb5eb7c4a79ca0d985ec7b1bbb2a97daf97a8ac38120a03
-
Filesize
5.2MB
MD5e4a0f01be42144807c37419e609ce151
SHA14caf0b25205164a61f5b7d7397bad9a2eb5d2a09
SHA25620173634ac29370c821651c1c08a885e9f776d653255a003867664258661b4d5
SHA512fd1b67119fe9b5dc6f3ed9184f77cd9aed29ba84bf0dda18b3ffce828492718e47cfc80e4396f3abd0c00a19c7ee77741736e7c1e41d6223fafcd736f7c71e92
-
Filesize
5.2MB
MD5743b129f7328a86b3781d2ca75fe75d8
SHA1d62a62eb2b99d3e4d33997f1f106f1b84f9bb790
SHA2562a3bc05015b45cce7555a9b22692a7f242fdf822843a6ce311a80672633c5ba7
SHA512dee24b7932eee7bb17d409c906e8fa6857ad4c1ce987161157ad9e698d14bf9731b2d3ec3eaae1056a3a2629c269ffcf9366ac765f54b417d7903763ecb6d079
-
Filesize
5.2MB
MD51b8df4155b809ce7b9b89b1cd1f32645
SHA1b84c2768c9eff732a799da5cd0a4299b7321ecd4
SHA25652362624359c4a0a3e615314b9ead02cc70975c2c44768525f340244ee46a00a
SHA512f4e5402c0feef28b55464715ba7b61f780fa055968b92f36360a4de9c612fe771cd1c1f2e226835f6553f4c1e005ae4372071719d53e1f25029d3af27b32225c
-
Filesize
5.2MB
MD533875cb81e25d7d52f470b6c68d8f6bc
SHA1c408ea4a2521c62f33dfd2237e57336efe59deb4
SHA256de6ec1854535c1db212347d24677aa6c8d191cc3ddc47e333c439b7c4ffd5b6c
SHA512895d357b5668d034b823447ee4ee63c398672c55d6f7bd9f0d4ad3d770bdf815be32f30caa858e7f65793cc364d267fb15cee668cbcef8f643414718f0e39f88
-
Filesize
5.2MB
MD54578e2285505fa6c62cc235a3b433f25
SHA156ff34e42cdf9b3ccd1616a21bda5a9745527461
SHA2568d386b20a96af7b87a5db8c658d33ab239568631e3221432a7855bcd6c48eb71
SHA512e5b9fbcabf3ca78b779367ec9dfc12ff3255d1bf8c2dd7b52f4546b3f0bbbe980bd89f25cbaac39232b67028b437960a51da7814e75ef16bc26a0bf8e9ffb3f6
-
Filesize
5.2MB
MD562ed656ceff873a7da83aaec6da083f9
SHA1ead12eb99856c5449fa7fa31cf7904044b3d7086
SHA256d7029c667c7f2e0c48ef01599da17ff7f35f9ef3d2222dc043fd1b2294a76145
SHA5122955fd0a3c2ef2ed8ac8ee84b428cc8fc878ab195644b82d20d2256935c6033a3e33e4290cfd6082a00412d18d4e6de443cc3375c74bb59b94698847d0ff75ca
-
Filesize
5.2MB
MD5d3c25ddc13e9e88494bda0d7aca0e50d
SHA14813886238c6776743b9c19ddb9b98117dce65bf
SHA256abbb747f379cd30d8c6a3df1c0edd3847bce8838dcfff1e38fdc134f752df653
SHA512d25cc811bd359c43bf98f59304f00805a209640c5397c087c7ee7219f2b3d6b31cd34797bf91e54b3ff51a5ee556aef4fab38fa6a7159a4e1b19939582073d5f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB