Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-12-2024 11:57
General
-
Target
2024-12-12_ef815ed4ddc9641764fd1814990ca01a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ef815ed4ddc9641764fd1814990ca01a
-
SHA1
b6f01c27e840108460a022163a0d2edd4c953766
-
SHA256
4767ea2d6a5e98c10054ded22c6907e50d20ee39a1dd37c69ad043ba28fbee91
-
SHA512
8c91a97ca03b8a1f5638f8f70cd018e69091db88158224dfac5ea2af15b4ebaf550b6074f2f4328600cdc1a28b2fd10a92508228ed440aa999b707604bcff5aa
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibd56utgpPFotBER/mQ32lUQ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_ef815ed4ddc9641764fd1814990ca01a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_ef815ed4ddc9641764fd1814990ca01a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yCAWURd.exeC:\Windows\System\yCAWURd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ncRpOmp.exeC:\Windows\System\ncRpOmp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KYRFafD.exeC:\Windows\System\KYRFafD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rCVGspB.exeC:\Windows\System\rCVGspB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hgTXzSh.exeC:\Windows\System\hgTXzSh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CGWTuxL.exeC:\Windows\System\CGWTuxL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FyIXzJf.exeC:\Windows\System\FyIXzJf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iszqJLa.exeC:\Windows\System\iszqJLa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cTlwTli.exeC:\Windows\System\cTlwTli.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NRsvtrP.exeC:\Windows\System\NRsvtrP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tgHCnhR.exeC:\Windows\System\tgHCnhR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nKjRDOj.exeC:\Windows\System\nKjRDOj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KkkuEHE.exeC:\Windows\System\KkkuEHE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mseOxOG.exeC:\Windows\System\mseOxOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EtHDZYD.exeC:\Windows\System\EtHDZYD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rqCLruc.exeC:\Windows\System\rqCLruc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ooxXnad.exeC:\Windows\System\ooxXnad.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VgrwTmf.exeC:\Windows\System\VgrwTmf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wglMvnv.exeC:\Windows\System\wglMvnv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oBBxEYI.exeC:\Windows\System\oBBxEYI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CrVaoQk.exeC:\Windows\System\CrVaoQk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50dd64de77eb5e556b1f8835b9c57f2be
SHA1f5e841225477291b0601858aac1a1361a370ebbf
SHA256e14646b4bcee4df3fe23ad05a6c431bb4f6a85dc96248a200055ba99aacd9481
SHA5127ec9444b8d88f84eed4581fe101017c6923c2354c527d83c1c65a523e859f539c03c906d93815406695a83dacc03281231d3863a8228129fe64669dede79e106
-
Filesize
5.2MB
MD5b3f5328c17d466c3e58441de650dab7b
SHA128dbf61dac7a6c1b8d26026ce5bfd5af839b322c
SHA256e8779140433f14113ba6ba72987b45da2641617c756868dae7b0c5e497066ac3
SHA512ef3e1ae31cac250c24d8216b4a32f0d564415621ef6ec0362606516bc6f42c879446e11a00cc0e93f3520333e8c011365e8c82cf2a369d03fec704d795e5d4e1
-
Filesize
5.2MB
MD53f75a2b11470f0e1cf07f92eb24d56d1
SHA18c877b0e716523f5c1e52875ce85c2fd152b013a
SHA2566007a26fa011d4278f86ee5a86e6e1f900f28e7c87ce3b238958e2c43dceff58
SHA5121b81b7fbefc7da3a60d5cd37fa7f46081d51f79c13ae2cc38188649962930a1299d26487e747f356a6833baba385df3ac8a57763334b43b5cad709cc4a0d336b
-
Filesize
5.2MB
MD55b37e1c8980158435dbd8a71d483b4e9
SHA100ea5598b4408065061ff47a831cbb30413dbc2b
SHA2568dc9a415cd07eab01f985b90536fed3d487b5b295d271c3a8267872d7c64e2eb
SHA512404c6c8765a980b5b5399040c8247ddf1654c20a03303fdd7e58e86e9741ac2fcc39ad6040d8ab03a449183d2c1379a7cced92781fd1440ab34293a7cc0ed1e3
-
Filesize
5.2MB
MD5c7b417634b1e98368e02463e47941cc6
SHA1641188b766774c733d65e192d2af99d54ed0f30f
SHA256e535fbd269fcf294f5e1ba8009e0cd50db9cb2528539a6d46ecdb00a50969feb
SHA5120f1b09eb083008ef6bb052534003b28c9c5dcbb19591414e62cdd30b1c9fa89a0cc6115e956b7076693d7c457843f4eb9beb2e5dec1ea5dbf3e0f32eb08f5476
-
Filesize
5.2MB
MD5a512bb367cb8c92d45dcdadc6b3a704b
SHA1cfa4402abc92b2f0c0ddb063a66c9135db74d464
SHA256111ff804c99c2963bb616e42eb6d397431ca7f40d3e50ee72877a638c25df9b5
SHA512940ae9a2f519b07802a03db981da43fde826c1eafb9099dd14902e3ae62fa38112abc07c56faf1e5a0e2c16089e824fe3054facc1800089b7512e56850cdbf18
-
Filesize
5.2MB
MD5467ce72d90e5366ec28ca0cc9412f7ca
SHA13cdf5c08ed2b66bef7dc4ab1f3ff1fa6fc652148
SHA2566fea7d99fceade60c4ac802b950084e7af99b9721079d9b6aacd6a111e3ea462
SHA512f3b000e9097bbcd9e90db5b69aebd06d3793fd9ce9bb74094c9a5b2969be6a64d0ac89e5e25ba7e128d22bcc8a58b9671262f874eb9e736dc0baef793793ade6
-
Filesize
5.2MB
MD57fc53311adc0cbc2f226eff5ff3f3ba2
SHA1497a992aef7df886c36229470927074e638f871b
SHA2563a6c2ca95504f19bfd6ce9300e5b7e6dcb5a1b42f2d254260a59bd48eeb12739
SHA512a3e0e55fac1087d692a585808a9f0c8206e49e8c32b5bf4dfed91f3981b41e2c1b1a05b4cff88923a9407b34b149194ee9c28b64d615a8ef34252a403bdee367
-
Filesize
5.2MB
MD56bad23fd6e08fecfb08836e939428f1c
SHA17736251dfb448b164fb9ff2f7d25a800aefe1c85
SHA256c652b97cab53d4ef283ed7b50241d18cd3b5f07a7df2ec4346821d8899b9ba29
SHA512c8041ef0ec6bc2e5913ecbac0102375155e5e708f865d1081d1b056cb6d144f03427a67d315a6a55a795d8ec4d387dcef8b5770f172a3bf8430676e8e10b5e35
-
Filesize
5.2MB
MD5f2c7e0672975d52071b3e08ad3ebc988
SHA19f320968c261c36f5deb18cc6c61d4ef8beca9bf
SHA2568e02b17b2a118b362f710e10eb018653aacc5ea778fe1d28195ab4396c17060a
SHA512279483cc73c192cf4063762c5f6d4ee62c898a31d55f753cd7304f2f90e0c3748d4388fdaac3ad21d61ba501fefa7f563b269da60c861294a43826ae90709448
-
Filesize
5.2MB
MD5db03148b40f351bc812fcdea93744fa0
SHA10b5e1fa4645f1fcbe4819377ad2d28c1fc915a4b
SHA256295c3faadd02caddc96a519f1f017ab875dc1466527d2402afd389f7d52c59c1
SHA5124fb0b7cb46530cfa520f2477b930e57cc52d5239427fe484c01b11c18bd038c92c4845d7f40a937bcb6e2a0df0c98075e9d2626af89a168b9735d3db315b30a5
-
Filesize
5.2MB
MD5a448898b0b65cc28a58cd2f48e986327
SHA11e0e37dcce6c4b2923110a430fa5650c259fb8ca
SHA2563df372c87466317198e7aad2c0238048c6e85b851de2859613f323e7fe9eeef2
SHA512619f0b7c8b0d87a2531f3c8f39623032f5bfd9375298a8577b6ea1c08535df940df1375bd857dd727138c734df3aa6a3834cf7021ca9cbb7aaf5b75c2002a20b
-
Filesize
5.2MB
MD5f9f14eeb2d07f1decc4bd61475a520ab
SHA1d746551cd45b5c6ce2e8dfa97ddcf357a965389c
SHA256e8d0ee184c157d11b55d568ee0e88e3123472e202c6cae6c6d2d9f133d77c188
SHA512ffdfff728a0da5926881bde9c6564a16bd07a7d2e8edac44cac8e2103a4be5aab01f2f2e5c2a446c4b8da7fe0aaa89300774fcd48078faf020902ef8a237d14e
-
Filesize
5.2MB
MD5ced93ed2bb2ec47eadd351bf0683f324
SHA19fbffc4a6dbad0ade0d9079a949c2edd694aa0ec
SHA25633aeccd1781712efbf107b009850e7c8b774bc7fcc92feca56267d1ffb3b21e6
SHA512a758a8a265f3cc69682f23bfe41dbaf97d2ed25c853b9f69935895222b6ff63f4eaed4fe86eacc89c197874f6450316b047adc777eb42b5f18a4a92f5fb34d98
-
Filesize
5.2MB
MD5f16c54a0508ec64e7f80cb506884509d
SHA10068b2f78ad981c075543343f464f38444fcc4b5
SHA256d8c705c39fe7f5d15bdb05fdb15efd65281c56797b79efb804d8927c8b03d4a7
SHA5128ece522be8701f69ee1947f08f2f9bcc30cc23153ff389efae7313938874aa62e06bd47577220a1d10639bdc1837ba765b47361b3b4e1073a4aa0937033e1079
-
Filesize
5.2MB
MD5eed762acf3cf331bad0223c9ebaee404
SHA1f5e5f98c6f013d7fbb1a5657620684c84acf39a9
SHA256a0c0fc51c8b1ba89cb35e339b92a5475fea1cba8dfadbad57c0a295bb2df110a
SHA5121c285d0484dc21dc84d2c7ccdd3c1a4c09b609591e0186fef7cc62f9e2eb3f6313917da842fcfdeb710a4b99e1d9eb31a39fe238b2df675f215a31b8570ecedd
-
Filesize
5.2MB
MD5e79e9ff4e244c14b0a84a2a55a9cd1bc
SHA1ddbd8ec28f0fef96459e393bbb568c9904c8fb78
SHA256b002cf1ec9135ff1b8ffc32ab4a8c730ae8b654b22b10f969d5b029ba354f0e6
SHA512518a82850528a50f96e07ce7557b54a418bdffa76cbb7cddf6b7a09547d91710f75dc74c0dd6381f9a42e8cd0183c87b9fea42124f4aad25fc33da3ac8131ebc
-
Filesize
5.2MB
MD598761912a40b1a186faa4c918cd5701d
SHA1c2e643332b86c902da231e93c0c2bc4529e08579
SHA256640cf81f026dc5b8bfc639b17d3efc8a05427cc744228108f3cff48bdc84588d
SHA512f24142a110ad376556511b6281cb59c40aa1178c8faade71a28340187ae6e291a2ea16714006d2027fdf7d49f199a805c3a67c3270a2894e90d55a448ec7e9e9
-
Filesize
5.2MB
MD5a3e3d585f3d45be4c94ca91e9a6664ac
SHA13f29531b9c26351ba91bd52a7f6b31034599249a
SHA256a3ee9fcc21efd97e9c6ef63b5bbfdca8a0f2d1d28d94034885215a0db0af2f40
SHA512bcffe109f92476baff91318eb7513526b49ccf59e0d81fe7671d040bf53ba4bd9c916ee32172e6dd69f7aee5fe5b8e884a37164f4aef8bdfeb21640b769337d7
-
Filesize
5.2MB
MD5c4d531bdf3e36ce5bc0bd9051b9a49f5
SHA10a5832c393539c6363c866c510a3e7829221e73f
SHA2561b876e9cdd6d3e3ab533d90575267c7ca42354266b48f8b0b217ac27ccf40801
SHA512a80c9d8440a1b641fd709787be9a8126647c3c99cb62de168eb142b68a5e7099e1be364190ebf8e70ae1614cf00a2f6132f47b2fac2d79d5be57e61388f2f6db
-
Filesize
5.2MB
MD54ff93c203072eaf5ac42cbc5765f4d45
SHA1a2bccf42034b570b6409504b8f7ffc316d4213c1
SHA256d0c99ceca58bb1f6a97b24c21499bec7b2337d909ec92d288ef704bb942ba248
SHA5120d9d35f081f0cc99993563cd393472ea71d2e977ecdb8dc40aebd016ce94a7ebaf566aa0f48d5cc5418206eb40212e292c535d574bb7444fc43c4692a44bd5aa
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB