Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-12-2024 02:46
General
-
Target
2024-12-14_34d47fe107f9544a6c2d43e088de84ed_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
34d47fe107f9544a6c2d43e088de84ed
-
SHA1
0cce49c90cbfdaf996a2f0a8bfa1064c82e305c7
-
SHA256
4797fa56992164a0d962468c27f7b66a54ef5af6ad52f34602ec28851d79eaaf
-
SHA512
90bbe8c052f40b6c6c21f1a723179587ff48560dcbf4a1a50fb84de3411c8732a8c18ade0adfd32303a09026dd2b48929b9b421c79440d2234447a4a28c273fe
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibd56utgpPFotBER/mQ32lUq
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 35 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_34d47fe107f9544a6c2d43e088de84ed_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_34d47fe107f9544a6c2d43e088de84ed_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gfrPSGf.exeC:\Windows\System\gfrPSGf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Chmjycc.exeC:\Windows\System\Chmjycc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JWXSRzq.exeC:\Windows\System\JWXSRzq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DtBWSjs.exeC:\Windows\System\DtBWSjs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ceRKvBh.exeC:\Windows\System\ceRKvBh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EYhcELs.exeC:\Windows\System\EYhcELs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EmboLou.exeC:\Windows\System\EmboLou.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VwYKeZD.exeC:\Windows\System\VwYKeZD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HuzJtrL.exeC:\Windows\System\HuzJtrL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XhoyOWn.exeC:\Windows\System\XhoyOWn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UbfDnyE.exeC:\Windows\System\UbfDnyE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KNNJiRT.exeC:\Windows\System\KNNJiRT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YgfgvjQ.exeC:\Windows\System\YgfgvjQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gNTSXul.exeC:\Windows\System\gNTSXul.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iRNYMCf.exeC:\Windows\System\iRNYMCf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xQSnHYQ.exeC:\Windows\System\xQSnHYQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OEjPWAy.exeC:\Windows\System\OEjPWAy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dXpgdqB.exeC:\Windows\System\dXpgdqB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NXaTPlq.exeC:\Windows\System\NXaTPlq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PBSlYls.exeC:\Windows\System\PBSlYls.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yueXLQh.exeC:\Windows\System\yueXLQh.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD500e72d2782e89d0b81476e9f0f2e4bc3
SHA15e7b0c6c56b638c24ea6f03258f2796c027dcede
SHA256860eb6a9aa431e3970e1f6432665d2f3c8c12e3c45375c30f29282f4cd17d7d6
SHA51255bde7b647454192227ccbcc7d2586445da20756321ae9feeb11e9a45becfaeeda7cea902f1354573fbbe8a76bfb9492728d47f6493960b6e908624ac2899f29
-
Filesize
5.2MB
MD582937285bede2d93df7754acc48ac170
SHA180b1ae7471605b3a879d3137e072a9dc9582001e
SHA25610a2a02d499d29afbdd212bca22543633b9384a7c53426949143f61d729dead7
SHA512f598e4f1178ad6ab32d6c55dba60ad0c5b2d52e9368293a2d413affe1aadb796b8a955a9910dc3762e65dbf2dec8fa1a2bcf52c3b2f0b33ca600c9eb9f97c9ca
-
Filesize
5.2MB
MD588c456e052c5e1b93b05f5a7d06029ea
SHA1507598c2f2cb20149557653996354766ee9bf611
SHA2560f62e11f82d4f2dfa2011fe1f3d30a292593238c4368c8598f8feeaaa9afad8c
SHA512d0ccf51a3b6c1183c19da52736be37eb435b0aee7498f81ac1d3e3d229b963c9905a2827829162bdb3b2a00f2e643e8daa865b9462e81e2e3107928f4644d06f
-
Filesize
5.2MB
MD575330d1a0f45a70f9f4628c301f31805
SHA188fe5db677374226ff9591914ec8f6a95424afe9
SHA2568f1326c403d52fc1bee73a81f26a739debe9255ccbf0e234a09d21e77c3f972d
SHA512175cd8e1948334e576f077b25e9a785da764a6f2fdb65c4aa19735412823f420fb08a0eb4cbe8f42eb83b8029057036cdb3a64bbe9fd6585b00b14c16b918f30
-
Filesize
5.2MB
MD5629f5d6d1ba868220646baa535dcc89a
SHA15fe375525f18f9e4d8b9f3b0c7fae2b9543ca38f
SHA256fe40698cac943faf9a4122e2b8e154f1382faae694abbd1ca07bfc6458ba42c6
SHA51293e9081be6567a48048e8cd3dd56673e1ece21e01aad8e02d1da9dbfdc250bf6bb8d809ee42ad7961177a559f8a0089d59f3a7a531af70d0f217d5c6d571c712
-
Filesize
5.2MB
MD5e3798f18ae3d2b45f8a2201ad2ed960e
SHA1569755d2abf4a7d2ffe8b30fc2b5354462b929e7
SHA25683f5f4cf275003dcc695493cd9fd9108efd07e423481b0947962dc6d6d6dc9d6
SHA5121673fdc932a3d302f44b313b73e7685ce509a776ffe89eb9e45716f448b7136ac46a02a2677ff937c8ec901dd281c0adf9584feb621e76e740cc4df2aba964fc
-
Filesize
5.2MB
MD575cdf3ca5244b62e0690a41bdb1979b2
SHA1a8eb9038da99d87f5d8263749286bced0de56e39
SHA256cfa55cb60b86cfe164b219bf3e91adb2415676713b76cbc1e52e00043417f7d1
SHA512d05498164b417cd8ef5fad3d0ca1ec78519242583e68c9ae6bd9d52a2064855b78ca3da1aeb8815959f4fb6c943418ed0732f9f9b68c3c1a5ce8e8a95d867128
-
Filesize
5.2MB
MD54a6074a3d1383e6f40212f933a2317ed
SHA145e6dc17fea5089209d5c8cc1ece30acbd76e324
SHA25666ac22d30743a4200f2779f62b03326540de88e50880bdc9773143b3bd4df00e
SHA512f96b2224228cd7a30bb3fcea1fe7524acc4bf36d0824955d847fcdc97f0b5443c506e94b54eba082345ffba68f3551990c7a63bc787b69e6fb90f2ce3fb7674f
-
Filesize
5.2MB
MD5e46d99b4a868329e53c9aba8da7c0150
SHA1f1e53269ba9ca3d5edbc289a56cb781a9debb4bc
SHA25641926670665cfddd0a44cd1ff069ce411b4207217bbfa6a158725946be333f5d
SHA512091efa6a7064d310c0773e44dec16525e813501de2ab5ef46d8c454b38ed4f342f9562ef5ee516ec51eb7cfddabd671b353cd538d11ca91e92ce9a2540d8c5f0
-
Filesize
5.2MB
MD56e7908d43d946d66835e18b49bc16c35
SHA1a47d45d4732b235b2e10442711a068b1dbb08b56
SHA2566cd4781f0f1341912b781a424384d05d06c9fe9de177ecedd5fcd9729919f19b
SHA5123bb4b9b501642fe0c48c8de995e0462eb649d7bb3f50d5f83be46b73bf3d92e5247274d0b8000ac15560d1af077381288f8b0014e45ce41c72984c28b9c3270b
-
Filesize
5.2MB
MD57768adb10abe4ac7b09eaad38297b28e
SHA123f9d77b70fe20e9ecf6cadf16b050be215e57ab
SHA256a51fe0b47f1ea6ab054e91b0e232b14399ecaf15ae934f8be31531ccda2aeda3
SHA51277b30bfa70e37b44a9c8709a6ddf844b1befa73122573142495ddf30d970ee3342f2d3deee262d7792a671814ee8bf32ef9b1e2379db34ce6ec1e56fe95d0335
-
Filesize
5.2MB
MD5d16b1813719cea01045757a0246c795a
SHA1bb9fcac75a166da02d97c5992328d0d593a6f55a
SHA256dde2c2dd9c0ebd327c06ee2d4aacde7e6e582694df759d30720427de7ca6e261
SHA51242ddc9595f8fad48c1afdcf9768f542a1c7910de06308f9b2a2b14999bdf7322597acdd6033b74c594c38c8e0d57a4413e472cae702516c8444afb773e2d6804
-
Filesize
5.2MB
MD510556c7247599d502ec1358e96db43d3
SHA1109855e11f22eaa6f450671dfdfbe72178fb94d3
SHA2564abf99564be563036398b23ed7b240f732508c04a19fefaf7cc3822b30949032
SHA51233524f17f761ca2ccc46c561655f995bf51c718af5f6ec0e75da97143d75d769475eacc5bb4b7dbcf9c5e10de5c99e7a021369eb8cb070932e0e32af3531d394
-
Filesize
5.2MB
MD5a54b96b974412300f65eaca3ec2442d2
SHA16d0049f75a885b2e07bcf2c7fd0b8f02cb9bc9d5
SHA256e203cfbb88418968fb4bccff5657b5a4e009fb03f05b3eb2368f8f1e5197ce35
SHA5128b4ecf5ef40edeef90c2b18fbfb325f880f9210a80413ed94fdaa585dec24496fbade501ee84fdc268d7f6e7664aedcf6d7183ca7f4fc1dea67936cc72d28348
-
Filesize
5.2MB
MD560ef770476b377ec305c872f197274e2
SHA1ee5673c5fa38e86a6f87ba0d46006fbb7cd46259
SHA256e42e3d71b850cfecc86ac4baca3adfe739b9d4801996341df0854ff73f1ef2a4
SHA512df8c6b2cfa62db4d6c5260dd1b15c2f60dc54481ac933fa54d0f0b57e533df0525a2033553372b9cf5c9b252d60542a6709632d03a9a26b8fc76ae58314704a5
-
Filesize
5.2MB
MD5ba3db419b0bd3fecbc82f5c80019e253
SHA1314577259d48f56a67df3561e4903290e6bc2bef
SHA2564646777d717b043666f3696174e67c242bd21c75b491b1e86660470b6980d444
SHA5129ab8543d8f853605e5d0312efc1f2e5b56a5efe59f97709415eab2b960ffba193592b121b28febf5b34a2a64d43468c353344ef4cf3fb3ad2d349b1e964ce6f8
-
Filesize
5.2MB
MD549d3eb7868ad42b85c7335a248cf9e91
SHA12b9d5a8ddc07a1a0d9ed81d000650c46e669077b
SHA256f729fe0a713e5e313fd479be4588fcc0256c6000695ce0681905eb19b3772d90
SHA512d0f089f19d482f22d246927ca62aa69e64ae565e7d62ac9680ad277b80434adc761d32fcf7ba9d98551dabc49c2e23d167982ab3aa0deea1c14579b60e37a395
-
Filesize
5.2MB
MD58239759b3e2d41653098312f35e01724
SHA153002d06277070c3154e05ee5fa5839fd675c8b0
SHA2565da50ee292bd86cfba40476a8b9f33d528904a0f347c8a9fd6aed7b94f59b1f2
SHA512b0b69cb82709584d1183814745b665748694fbb571ecf4c9555f870040b7117223d747edc70bd6d71b3856bdb1c77d30d117537ffb1edab3b1e44e321c8da18d
-
Filesize
5.2MB
MD5224b0682122b736d025355ea4b2fdf9f
SHA1d8907ca03cc41bc3659c036101b7eb127925a7f7
SHA2568a3c3113b76a653aaeabf677aaef1b1d20408eadf89fd27f43da7795fbafd28c
SHA5128cc6dd2f3fc6b79709bc9446114b29fc3f35be929e46740ac421763537002e66c4d131d1e43e67890a3acf7381cb24c15b2d1f6b02724b45b6755c064142c8bb
-
Filesize
5.2MB
MD53db7b4d03d87c2f555faa9147d8b6270
SHA1983823a13309165db718b6cd89d8f0e0f6978861
SHA25604895d36a3a435f608d19467ccc17f0139fe73a2f775fec17ef5e2b1879696f0
SHA5122501ee2c72b901377cce8756dd3a9e121503f3f7090941f3d7c0af991e9d2bca246cc9607a23abac39a68513aecfef601f27bcd6d76d77f3b8cc9ac2ce03d299
-
Filesize
5.2MB
MD5005713e40963fbb9a1371107d2c279f6
SHA1331870016d3d36067a84243a02e01414a9912d13
SHA25604df5b3d169d3a2933fdc53579004fd2ff07d01f1ba17ad759efea202153441d
SHA512f79bd3e9ace0ffb8e7c80e6a4d9f8f597958eed7ed725cc87e3e35993384a7471828f603ae22c41633ba4a1ceb8b417dfb33120671533c1af7b35bd7d1f3ec1a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB