Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-12-2024 17:44
General
-
Target
2024-12-13_5c5aaf76cda30cd97b1f28bfc00c5824_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
5c5aaf76cda30cd97b1f28bfc00c5824
-
SHA1
a2a19a2c0601b4114f1a9b9bedcbdb3d705375e7
-
SHA256
9fa4e2529dc9247f9cd14cbf4775cfdb7090491cbdcdcda3bc261398897f91aa
-
SHA512
b0db66d9d299cba14d072fe2fff4307e0892d8fb58a3ec263a37b19c710c455e3daefa4afdf902da37215dff916a5f7d0cc18ed4b23823892f47fe5b534842a0
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:T+856utgpPF8u/72
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 56 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-13_5c5aaf76cda30cd97b1f28bfc00c5824_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-13_5c5aaf76cda30cd97b1f28bfc00c5824_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fRbWjDs.exeC:\Windows\System\fRbWjDs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BcFjxRm.exeC:\Windows\System\BcFjxRm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yZdzFSO.exeC:\Windows\System\yZdzFSO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YEGtbrZ.exeC:\Windows\System\YEGtbrZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tCFlSbf.exeC:\Windows\System\tCFlSbf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GkmUayi.exeC:\Windows\System\GkmUayi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sBgjkGP.exeC:\Windows\System\sBgjkGP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IaHHhmC.exeC:\Windows\System\IaHHhmC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\griPmbm.exeC:\Windows\System\griPmbm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\majjRSf.exeC:\Windows\System\majjRSf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VgWGIAQ.exeC:\Windows\System\VgWGIAQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dFrKBZa.exeC:\Windows\System\dFrKBZa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jhYSuWP.exeC:\Windows\System\jhYSuWP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UqDxeVM.exeC:\Windows\System\UqDxeVM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CFxtres.exeC:\Windows\System\CFxtres.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YSEpYya.exeC:\Windows\System\YSEpYya.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CPXPTEe.exeC:\Windows\System\CPXPTEe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZvvXKwG.exeC:\Windows\System\ZvvXKwG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZEqoATv.exeC:\Windows\System\ZEqoATv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mQqtDeH.exeC:\Windows\System\mQqtDeH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TywFOck.exeC:\Windows\System\TywFOck.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5b4c660f12a888d2961b2cd887c9888bd
SHA1177b0b4a52725b643eaba7636ac82400da70a397
SHA2567bc49d243ed340154bb71149dcf3f3a25be52ae7edb386b85addac135b44ddcf
SHA512215200de2d8e7e9fa7afa2aa3010bb6a930a1c1e6b269a59245864b654eba3610a76c13b00ac32aff6f9e515dfdd3bb8dac4b7384a5333cc8de2625185abf86e
-
Filesize
5.9MB
MD5deedda0600628e863a9aa8a3ae96b3e3
SHA1cbf65e4c9e4b6d1a3582b7e1008b86cc776fe39d
SHA256484f3f268fb1e424859a88dfb49d214a1e79baa0eb261401f8fa21a1c1bfc2fc
SHA512a3da847b670461f64551848b4024b7cd2de2dfdf68283f23fa8295a8521cf2a46110e1ce95eba26df3956e883ff8bc0569fc3ce3e7ae92010d8359d062a91e58
-
Filesize
5.9MB
MD5a8b426bf9351cf60ec5615fed0d041ad
SHA1185bcfc8d279687212dc2057a5191e88731dcd72
SHA25662b706a0808b5fba2a1c21f778c814f66b6180471f2d8ed5edfaee2c8657765f
SHA51278d7bb90a4557305069c9c75d7460144fa9366adb73910c47e88a1d15ece479fc9d4124b132eec603047150f431b5b59c4438df71bb20388bb33311e59731536
-
Filesize
5.9MB
MD5e6756bec94b2e8fbf3cc30a7c60bbbf2
SHA1cc9b31430db632c69b87e632b123453953b244b3
SHA256a1a4dce4482188514fb209857c4408833cd4f2cda2bf92fc28ff8c9e9b020907
SHA512821779b43ba3cfca380cf206c082bf7fbe5855223a51a165442f4560068bfdee588c7676ff7ddf9726c7201d7130f685b6d27d31c1bd622e5a5a61360e27f972
-
Filesize
5.9MB
MD5e5a22b769392458a51a9c56d91939325
SHA113399f8112bcfa0d023642fbfb2839fb8f9349da
SHA25651d6166acb0bb1e91fb3f836ffdeda3c30e0bb238c99c68ee05730e722d0ea24
SHA5129072e6d2925fdb1003022c3c188ea3eb787e15bfd961413bec7ceb77f44391d43c8b210a50b469f6a8cd3fe145d60a263eea16131dab341bc43aec65e2554d77
-
Filesize
5.9MB
MD51ce7ce7defb124b5637108c412bff301
SHA15ab4e557bf9cdafe375246632590b37ef95f21c3
SHA2561a9ee74783ec073cc610acabc49ace8ed1ce5056e067d3f7222f59ba0c1ec8ae
SHA512c07891d487d4a938de08d4bf45fb79c0775675a945589edc88eea80697d28a6d031d135151dc8fc7ffa024fbdd72811d0558951a27f5672dc9d03d4bd3cc1afd
-
Filesize
5.9MB
MD5b5db44a9a280caf04c205533ccc97d69
SHA1461db6497d27aef5de27949d417f8ca66297f527
SHA256ca89b64b61eea0124eda9d6cff8f2b7f3002b5fbd574de51f150562c8f0fda9d
SHA512ab964c9b420dc59ad6a83b0fbb331dd6dfd58ba4521f265e9e63288eb7e18def1c4b7ac2504f362d61652c9f12649ecee02613e5ce9fb7564b5b3980b1da1936
-
Filesize
5.9MB
MD53c7104ed0628ae59f40f00262cfa8f4a
SHA106bddb1d8b0f67488299b0477b39420eed9fe1ca
SHA2563967e26bfdc2bfbd767c1df3a9e9726e114d6fa41a0d2dd006f043876e7290be
SHA5121e7a92177296c4fec89a1622a905a4d06cfe13d1b0f00a85b54c2f69e116ef97e2c3a92f508cfc5204abdbaa6fcf3b50f154415c2b71b630e4d3da4374cbcd39
-
Filesize
5.9MB
MD5461b425f349c63b0ca284d70037223f3
SHA153c458b5d2f7983bff139e2409fd8a94a8317071
SHA256b9a593fdd5ccfc8cc135c32bc9d39c676c817d893986f0b92d7b2d793cab908f
SHA51285f8ac9f32af92cd01b896fa29b17196703e8401ead66e1c3ba23d36fe39620b1e648cdab53e858a2c60ea5dfe75958623fabb508815c416c201cded5344a8d2
-
Filesize
5.9MB
MD5d06212913bea4bb657f9789e2291d1a9
SHA175b429c6909bc3cf272091e5c68c73698f428929
SHA256539c395eb4c4f4e07efa200361f97660ea4ca70ab484ee89400b674f2f3dc377
SHA512baa2c227ad8d8550d77f57cf920cfeda3bc430e9f4ed36e223ebe45ca3a261b748aaa7ab720119a72839506af8990632e1e8531aabc441a5b63340c33d0a2aa4
-
Filesize
5.9MB
MD593e36afea18d525fe0520b53768d5edd
SHA1e7b0dc9fc3a55b9c3ab4c2fff4a3e1b8078a6b82
SHA256743c2c8a5a454feab75b3d29e0ce57d1ec181b13b783fb0d8df9395dbc9cee43
SHA51248a1610d95b33f0534a9a68046e5428d0becbf15069b3e57153853ab0d91845f5d2947c6f074ec58e7c043909d8f9b995e601611332efac33d11685c416e8c7e
-
Filesize
5.9MB
MD53504e5409d8b9fa1744f3a98c8b821b3
SHA1f9e1de794ae8c146c5421812255f876c869640e8
SHA2564495af59097366e3f5ffcd67d41841d63de5b240d4c1aa826030f189bd038232
SHA5124c2ee2cece3f0664deee0325fc85914640c10b92267913d4bacbcc0fcda4da63bb46bc58ab6810e6e1241f127c4e453be605ca88d883f5ffc30f92b0f9fd341b
-
Filesize
5.9MB
MD593a36c94d6b89f9d4cec0f2bc4cb6849
SHA198c8180132457cf84f69e6c3516a5eb21c8bc61a
SHA256b4626ca6b398fafec3cff989be1eb299d5aa67ece91e1c67d6458fa0eabc3c47
SHA51246ebff3e8acf8582f8154f4aeee575e238a44d7ef57451650611aeacad8899854c5c25588be59010202e460c7b555af39e3ce8532421d07cf4a086a8e5840281
-
Filesize
5.9MB
MD528ca18fc62e5b9fe25c56052af072cbb
SHA18531e84ee8e57b3659bddf140e866d6334fcb49c
SHA2566392d02cd8c02051830aff154a4a03943d55dffcacb38cdc1f9bb4937d156351
SHA512aee0026dea066d48060b4d79d766390b6baa8aa50c55c0daa6b45a21e8dfcc5603c0590354444a870627f60e7a5786bfa9aaa48904dc2b5f5ea043593d6d3ead
-
Filesize
5.9MB
MD587ec26d9c78db8be3ae1a380481c38c7
SHA159bc9d505fa96fa43637b0bd6d15ad338b2cc7a4
SHA2561cdfd563e69c21962bb21bc5eb2faa71e956c5541b3f07892500934842b7b2ea
SHA512139b07ea4f8a0fed5c8e6aac37d41a563025a524d072ed3dcff1a767afe3a965b3519fa7b6ebd93b27dd6a29d4efa97ed5a587cfcfdd3903268b55076df26e8f
-
Filesize
5.9MB
MD557b3fcadfd6a97fa181d4a54710134a6
SHA194252a7555316c356ae449047b7fa42aebf49a99
SHA256fdefc26c98c66c1b6b447106da6cc5ae3d007a4a35a81a5331f1a46d9235c858
SHA51266a3b5a1d66a0bd2aa3ea4ea21aafffda2694d7168dc494cfd1c65c2b160454ec343bac47f99705a6f26788da55ca52a6b285b9bb832761a6fc52808a00f20e2
-
Filesize
5.9MB
MD594e2ee35a66939cabb8bd634ae190f4d
SHA1494231ff813921555fc45898a083e01ce27afd10
SHA256e84eedabae68799aba43c468fc67e621078299aa1bc4ce890c861eb4fea5f0a9
SHA5120da68d26dcc158e1799d70d95ae56fb1ef36eb997c2294386b42dc997d763e3baccc51c3979c02a11dfbeb74dd486bdcc9b76e6e283d045f2b86bb4a3976d32a
-
Filesize
5.9MB
MD5276d5d5e32949fe37f95959669c441f0
SHA1b1a6227e9376180021bd48e4b3b4eb002b49d3f3
SHA256a9ff91ce997071f5e88147b9ddb71f1259926a2fcee3809f4362d9173c3ef229
SHA512ccef2b1622f62340babb7b90289165db6d90157bfbe2e0a6ae368ea6a146b88ddfab65a2e2d85db3c2ce4ce79ef8198d2848d23dadf4befe0e78b352abc3a56f
-
Filesize
5.9MB
MD565553dc842ccb0f8803b77b01035a98f
SHA1461fba573e7d6fc0a6431e13f773d6f4011fcc9c
SHA256ff471050d032c87c354183d77c47a44d40703768fbb7a426600bccba909172c3
SHA512eb2d4767855652e27c221b1857d6d0173a3779e6c57139e965e65d58c3002cf7bd75543abf84889c22630044902ea9872e882f8a984a0f46701f9501ab1cd7b8
-
Filesize
5.9MB
MD5e560887c983c8e1b9c156c12d8daab9f
SHA1f001c9184a0903b05dc37b8a3685706bb0a24664
SHA256f0c57175aa8751c4abd3655c94229069ccabba3ebfb0535c8df8a578756ef38a
SHA512a64a755633f8be839d18583e98db30cb42a7bc7eb1c0f5a0cdb0b3c6a42f10e643782ad09d17df8ef7fc8cc7f16dd630d18c30b8990bebe629ac1f354399509a
-
Filesize
5.9MB
MD572ab0edb6afc400129485a4ac27ce22f
SHA16d7c4056e6bb6bfd28974bbbca90f07005941a93
SHA2568aa2ba7230fc3891fb1b69b29eb2e23bb0f9e5d852d8978b40349a865830972e
SHA5124ce129c3a388e5fb0a7bbea23f1bbc48fb0efbaafa06097054b37f1e7e38985fcf282591859000dd752334deca2ecea9b76c856427ddb2a1d283ad30b13ea2ad
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB