Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-12-2024 11:58
General
-
Target
2024-12-12_f0d5fdba70f25d1e35df127633a20039_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f0d5fdba70f25d1e35df127633a20039
-
SHA1
f9ff759ba76cea8c26336a74d333a476ec11fdea
-
SHA256
364035ae91ea0e6c89770c6b194017ce1ccb6e6dad61f2f88dcc6f4d9889f54b
-
SHA512
2085ab6cde348740a76ab0971000e49365634fd794515a750874d8964eceb8c6496a7fb812290e7872fec83d1b888c9f4e8caae63dcec2e13d4696ddaa4f996d
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibd56utgpPFotBER/mQ32lUH
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 36 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_f0d5fdba70f25d1e35df127633a20039_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_f0d5fdba70f25d1e35df127633a20039_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gXLVUHs.exeC:\Windows\System\gXLVUHs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BsGoJKL.exeC:\Windows\System\BsGoJKL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NBMXXIc.exeC:\Windows\System\NBMXXIc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bpkgGwa.exeC:\Windows\System\bpkgGwa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mKluoiZ.exeC:\Windows\System\mKluoiZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HyFjvRc.exeC:\Windows\System\HyFjvRc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZmFAyUm.exeC:\Windows\System\ZmFAyUm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RyPwRcO.exeC:\Windows\System\RyPwRcO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qdqlZsk.exeC:\Windows\System\qdqlZsk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wkNbYTQ.exeC:\Windows\System\wkNbYTQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FbQXyjE.exeC:\Windows\System\FbQXyjE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gwDXKxP.exeC:\Windows\System\gwDXKxP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XjeAIbB.exeC:\Windows\System\XjeAIbB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hYqEYSq.exeC:\Windows\System\hYqEYSq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iZZdjUG.exeC:\Windows\System\iZZdjUG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vtshHuY.exeC:\Windows\System\vtshHuY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oCvSOwC.exeC:\Windows\System\oCvSOwC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cYzgtFC.exeC:\Windows\System\cYzgtFC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XHfJBnf.exeC:\Windows\System\XHfJBnf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DbaueCt.exeC:\Windows\System\DbaueCt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ixxgspP.exeC:\Windows\System\ixxgspP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5729bad7ee98c8374d0a4111aec41c3f6
SHA19ff6a92709c679d57dbff35dbb24acd34d77cd98
SHA256805565d422403cece28545dbb9c19ae468beec7a32ed3dde9c18e6d422384892
SHA51267e457a5a1e9d91bf34e81be2aabce78c5c294db22260d2156eced6900f51a4a4dffb02e5d63550cf4a7f72b36fc8b4af855bb5c239561fea6e5a4d79cf557ef
-
Filesize
5.2MB
MD541c5a2c096b9d8ac74ae20268e29487d
SHA1ccc7068f58ed8ba1799d586e8eeba94dea7db92c
SHA25657c93b9b5ab5f5c64761fdd32a3bb33eff8f3e5cf7952c61bd5beea53c6e12ad
SHA512159b879655b9c27cb856229172603cf9b28ec87f0a94cd6f143846a5eb33abff043beabb3ee3357653a8ed23d2ab95955f020a1e1cdf85caf5b6f125b3e80988
-
Filesize
5.2MB
MD55f88549d74c3360b5880ea8f7ddba075
SHA178231ba6e39e386fcd77fb2e51c48e07ffa1715d
SHA2569df142bb87161db8e0a8e026fa0cdd42200145a2d808df5ee20bc9cb397c5553
SHA512e6f59ae26ec71a78b863e6e5512fff5056d75053ffb8d78ce74bb1db9083df08fb27a6a79e4dac08ffce3092de5e600b285a5d4c00271e96937d663f5be41cfa
-
Filesize
5.2MB
MD5166fd8bf09b3c3120aec0e01161cf877
SHA10041963d88fadf9c34803f24abe7bd6e50d74228
SHA2565c4139d66c7b4a7efa6fc64c8276f5806d4d86fa46688f989c4410c3b0e5c671
SHA512764c7db21b5921871b6fd4b72ef8b63d30a39ae14cc55df030e491e44b0aba23248f6fe6ded43394859ea336244ea05062209d6e617e60491c4a53dc5f73a077
-
Filesize
5.2MB
MD593aa3ec44dbb11fb77a89fa7e5012b6b
SHA1e5b483748ac0f277ea3e947d7732f039d830dbea
SHA256f27ebf9b7e1b878cda05b6e55a4eb5ad130c9845ba74de0e2f67c56c902bb1f2
SHA51243c5630a944e7671877bb12a20b3377a9c528f286516ec560602ab590290582cd7bd95a53fbe600c1880d82d037a0ecaf252bfa4d507034255265beef6c6f9ae
-
Filesize
5.2MB
MD582ef8df6dd81da5ab786fa2f95fdc38e
SHA1cf4c1394d13b1643365db8c7f27a2747a91dcb02
SHA256c4092b7dc88e7ebda2695f8425bd546a9750f1eaf26047c38d681e48eb40c524
SHA51294e118bade41e04f2840384c3dd7a3ee4b9574c005755554dbf98c2c6e10710fc00e709a5bd7c82a47c527fcd53413d97bc498b361f7fd02484bce83e8af4a21
-
Filesize
5.2MB
MD5356aa14a0fb2f83e7fddf2375775bada
SHA176e7d941d4d3af00ff4f3300171fe91c657aa090
SHA25686ebb4dc5915c4c7535c904cc74b27c733aec40f54aaaaf5e014fcc651549e3c
SHA5129dd14245bc06f1d10b42a08459e36b5d683e532054fa96d138834ee3f201f6123c02c7fd2565f660aca58c0a2bf44ead314fb58ef6e2097e44faa6cc5706aa7c
-
Filesize
5.2MB
MD50f942d3ef6ecb86f53dc357bc80238b6
SHA149246efe703b083228da8282c712b3b252b8f6bc
SHA2566e43e6e929e9f67a3d718b0b354e0f748307530405f1e9b599e798867e48db56
SHA5120352b2f0e47ea2f5f404515531ebcdc3dc17d3d41f498228092d86e6045de1da21832fd2cd3492265c01a9726b33204b76d1cf5d87aac61b1641be054798e1bf
-
Filesize
5.2MB
MD533a7ff59301b226d26f00920ab89a9b9
SHA1ccaf044868d3cdc6b1e55ee23b0181ddf11ef5be
SHA256a680cee80e39e7f1da4465f42fd66903f4a42686de96913d69410d669870b958
SHA51258f37e6ab75f86e54f4cbc1eb4b2641cc679e90e0385ea93b553633407b055ff692b0fd12d0148171511d1ba4ad4c03a71a386acd0bbff4b2dc3c00fff37cc94
-
Filesize
5.2MB
MD5c84e0128983d99415e946325f823d9f3
SHA126c927759d0f082c66c4ffbd63d29e48640ce62f
SHA2563779619dcdb6f8ba9976de1faf71c85088258b26655652e6e92ea70e0d099ede
SHA5124d702653fc37ccc137f93dd81b439e0a371f0822792fa8399e34baa348a6e93b831fe7e96f3bc8f9056905d94383f5114382dec5f483d1bac61afbaa2ffe4007
-
Filesize
5.2MB
MD57605b4cd069a5fa8ba8accb71b638e6a
SHA1887f307d75cfcd6538a1819189471df6a8934fff
SHA256cab266c9198b20b7065b0d29f9fa0af60a298358f84504fdc5fc56179e53dc50
SHA512007b032d7788724a1bae460aa8e2bc9af06cd9eed7e1cd734ec4028792fb31c3a5a2761e4ea389620aa9c3fb3efdd18b19cf83d7df255367fe99caffe351b8e9
-
Filesize
5.2MB
MD563c716b82d10448a9e85d16aae4ceda1
SHA13d6de5990f21fb64e255ddab81444e7f68fe3c61
SHA2567fc3847eb5450322fda6f053333f1456bed892a96990fdbb4d8c5c68744250a2
SHA5125db5c0531d5614802fecfa2717bafd1cfddff4d171f653adbb90ecca647440bec733e4b7caaac0eb428ae4ea911d18bb9dc9e16826fb0aca70cc01a4c28eaad7
-
Filesize
5.2MB
MD506c609fe671588370cbe10f6183ee6fe
SHA1db80c38e62b85574c01d1974eaa62318b95db65d
SHA25650a5fec0dfc48b5a4e937118fc9f8e5ab7cac22f936037ab1ee51c3e0636def4
SHA512b6ac48b34cfcdc36395ce6f82c90f3ee062ddcf5e97724248d9553c307e0c6026a0920f4f9a88f48db2cc1343e4ebdd5abee0142f6d10874a459c31cfbf84a09
-
Filesize
5.2MB
MD56083791bc895497c671ae83b8e3060a8
SHA12f9b8038059fa6c61fe3fab74c3ee32445088601
SHA256b9eaec24e2206e20fea0d1476d58fb5ed6ceff977ca33485d0e4b89c5c5a6f2d
SHA512d673b9e194e6e187db437895ef57b875ddc2b7b2b4200e3f85557caf5e444542d7319d301b990f5fc3d99e2440d929fb71019042fa71c658e723b0bf3eb168c6
-
Filesize
5.2MB
MD5f5ee625d407f8015cd2b9422b32e1558
SHA1cf222289190adc8eef34c6d699200ed24adc09b0
SHA2567cc361b17f72860b67be3822bf961c6f4d4fe28edd0e6ecf707357c690def4a3
SHA512321c69bef1f0f216547a49eba44753dd6868ea7c0cbcb0611151033cb361a9a16b90e8e84dd31fa6dbed01bc624a5b571ef8e3d0e4cd5dbbfb7a0665f4dd5726
-
Filesize
5.2MB
MD5347142b6cf93041cd56f9685871166c0
SHA1280c0dfa58322f1af7cbc08115d4976b3d2f1f21
SHA2566977576c749a47239581d69cc87c55f9b06c4e96d97aa65df8231c1b852a9d69
SHA512390179f958b9d0ebdcaeda8fa3deaba6a3850fa97479f8aaa0c26dafba694473a9030c6e29cebfe791952987a09110a968d3ebe8076c3915e7be6586ad6b2b05
-
Filesize
5.2MB
MD507034ecd3c638af4b748ae95d27c1059
SHA107c35119407ec5e74eec42d76e3835d0e0378edc
SHA256b4a3d1b678d94c0c9d3eff7c2526d34a3bebe358175c43304f6463e2a48ffa79
SHA512b813880c650571569c2e1e723680988255afee955ae14c1ad6a1e9e911f0fba76118686c6fa251efc0b68bf11e28c97014cb154668095a7b9bb8c33588f06e47
-
Filesize
5.2MB
MD563875ac26b81cc1a7081bf6fa464ba45
SHA1ee909770c18d16479ea0f31bdf0127fa66d09947
SHA2567f03cdf5a5b93faa1901534a11315f3daf66adec64b709c7f4023f939ea6571b
SHA512fad3051c47a7b8ff23afdc4adab32865eda2d6d0b18d74616fada8d7e0c48e8ac3fa305249a9ea40e3f1327baaa44fac54518ea1120cc082f84dbe956a03bb84
-
Filesize
5.2MB
MD592ba45d503e7796581beeb6b981c27bb
SHA1f01bb0f979f4649c0bad4da905d913b09f87a91f
SHA256aa01fbabc431f791f40dd06ffc582c86e58278e3925e1641d0efe3486a3266b3
SHA5125dfb24ce34cbe7d6be1ffed6f89b26fd4da9228c75369430e1598c92d1a03d33c515cecdba4410e56371232be53aeae043968eaa32d751d8134c3d98662b37b7
-
Filesize
5.2MB
MD54c88c518908e056d45d2b1627710cae4
SHA1da2c56be8053bbdd45ce32f9f72ef4b6cdd40a8b
SHA256cec655a87ca4c2fbdeb53a2c041cf272bba9c5efe247554af2c1989d8edd0890
SHA5122820809ca96ece66e2cc8ac48bc2bab98df172224e4e978453627d38d556ef381b892a57f39cf5ef5362c2f39b824fa94fa930b65dd7161936eb3e5454511d74
-
Filesize
5.2MB
MD5b757472c0a124c14bf04d401620ed86d
SHA1a9c16b7a2e59a519df01d6ba537abbea2ab0daed
SHA256f1df9e483feb78a926cf8e1263b5176aa9724c991188c4687ec749573a7ba7aa
SHA512a41cb7699ecfc067267e4ca0b48bb71827cd47bfa149024a0d26e0de84cc69e5dbe95a4d6ebf777b9c813564bb903c6f90fdc53eb9a7346c7182aee8b5f1ba94
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB