Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
14-12-2024 02:48
General
-
Target
2024-12-14_44966508581295940c56857c364f5e7b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
44966508581295940c56857c364f5e7b
-
SHA1
625db84125d70f31ffd4f2e5e6d854eb4779008a
-
SHA256
cc6e0bb06efb785a4e4e3c938bb3062e3a26c0078f81e2cff5d65919e9fb6829
-
SHA512
46c9ceccb323b9150f5242f4ec72ece9c17e66485e307235812463ee57026d23369aa42f34eea82c28c6a9ec022dfa2c878f44859acb6b608abbf0e8c5357811
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibd56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_44966508581295940c56857c364f5e7b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_44966508581295940c56857c364f5e7b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yUxJSxq.exeC:\Windows\System\yUxJSxq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rjOqidO.exeC:\Windows\System\rjOqidO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kYmoiiq.exeC:\Windows\System\kYmoiiq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xPYbPyH.exeC:\Windows\System\xPYbPyH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UynPMxD.exeC:\Windows\System\UynPMxD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KrvNLYU.exeC:\Windows\System\KrvNLYU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WdrTQhJ.exeC:\Windows\System\WdrTQhJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FpizyMc.exeC:\Windows\System\FpizyMc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LYoKOdX.exeC:\Windows\System\LYoKOdX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UXBTPCg.exeC:\Windows\System\UXBTPCg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WnZqqZz.exeC:\Windows\System\WnZqqZz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BkTTXwd.exeC:\Windows\System\BkTTXwd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WIRQyfG.exeC:\Windows\System\WIRQyfG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LfqJROm.exeC:\Windows\System\LfqJROm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HraATZn.exeC:\Windows\System\HraATZn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hKIWjZL.exeC:\Windows\System\hKIWjZL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZyZwwsd.exeC:\Windows\System\ZyZwwsd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZdzUPHN.exeC:\Windows\System\ZdzUPHN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KCZojZk.exeC:\Windows\System\KCZojZk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DKnXZrj.exeC:\Windows\System\DKnXZrj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cjUjvHy.exeC:\Windows\System\cjUjvHy.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5324cd01eef7f5e74ae986c9a9287f355
SHA141ad4c8d1764b33d70f610fb8870105c369795cf
SHA256b28b2313c430de15290234164fbd38cbcb2258f5549496e8c1b03928a78b896e
SHA512eb3c0c1631dfb9b14a36895f46c8f4fd4624e1bfb6f43d3ab4790adfd6dd0fe1f2275c21830887b069f84d2a246439f2f4d9b7991d2da1b3baeefeb784499751
-
Filesize
5.2MB
MD56e883b8c79ab7c8ace4552e2296c846d
SHA104433676e483f0eec058554e052e21333e0bbeba
SHA256d3b051c6da3c2780bfa4773e369e94812005706fd3d2427646fd6b6fb9d8d96a
SHA5128747651dc42ccd7b14729937db15bbd32c9546a0797f773beba27656e56907647b7f488ac14a6b84dfa17c3161e1b6048f6f3835ad11fcd6333d14f54c5f2341
-
Filesize
5.2MB
MD57ecee646964cbe4762ccf50a8a6b3cb6
SHA1406c6164c7705043f9df1ab3d7a1535a0851f549
SHA2566d8bbd3588114d26adf8452daba807716af9f6379d5f9797e11fc4b901d38010
SHA5120f5c5d4d83b228e377226125ece4c657810f4621ac20ad3e5916aba25218e037e4af26f11593c8725e08c97f192b5ff779ef45402017f8c05e8dbef8273b5ca9
-
Filesize
5.2MB
MD522187bcb794cf4939928de91cf91d088
SHA1359c3d1279c3d739c6c453b77d7a21bd064933c8
SHA256bcd677794dbbd6eb7a099c1e6b1bcb4203aae63b614bdc37d58d530c2aa99d58
SHA5123df9333a593a2bf2d7165f90de5586a3634a9ab3302079650362281540b54d82f8ad3d4c1d8e0920d0fd1226a6b9a0ca7688636583de25a568ce7bebbf2ed943
-
Filesize
5.2MB
MD599fdf2b4a4ab898037c0a174a4f3c45a
SHA1ab5dcfbdeb35ed3a59644c44028f20559019d1fd
SHA256f32370205beefc0c507e5947ed3d006f12de1f1d3745d0c64467f4ee78fd73c3
SHA5120a0f85eb4feb91177a0fd5b1e43da0822761d993ba4a92cf247fe7922808f5cdc4ccd9e0d1ec482072a3c214b01d527e20a8548822c85935397cdd0a8db727ae
-
Filesize
5.2MB
MD503fa5873322b31fc534f9ba644966f06
SHA17a95c60c1ad93ad778156f66c40da14879b6b859
SHA256f97eff7e9867047839438643ec3ee80ab58b54d8899d23c4e02c99ce2c17fff9
SHA5129c197e671b07b5b3235cd3d1f2e71dae9718de25ed8b4a481318eed77573c9a2d827bf7b6092c1d73d3b406c6f2744b597cbf703a0ced641d8ae116f11806e93
-
Filesize
5.2MB
MD50c4428c80aaf0bd3e2a782e04870ea0a
SHA15503639baea8dd16fb8b8b37278b582759929130
SHA25674813bd2ffe3e1e3e46b22baa15f927ef8cb3836ffd1fa9ea1a74f723269b80e
SHA5122dfddebf98af0ef69e67b5b2d426ad445142feb8e2475871b1a21db60fd64081ffde8f3b4028634fe097d1cdba125721917470a3b48d7b62d5ec5e65d58e2b2f
-
Filesize
5.2MB
MD5f378d5528f2109b3c09334e1b999fac5
SHA1f46e988f5b591638afbf104ad4e384b64249c411
SHA2561ed7ea65f92e8a5d6cf67c98f743eebb16c13c99e4461007e0751c9dd693be2b
SHA512658b47012939a1db4c282cf657e2bc8f87c94586d629f9f3e265f13ad2c617fd72f8daa9e77876e2f6beb4839c1f8d7352321251dc501dcb2d69a3786feb2299
-
Filesize
5.2MB
MD59a85c0871d537f3ed4dc2f2d62cf8f4f
SHA193a6f29ec9f015fca34a7ae0cfb86427ce3a5d5d
SHA256d4013c5ca92b868ed39b6d9b133cdff91b4c33e9d38d92729d787f2923341917
SHA5122981034f1ae9811722bbe1a4adc78bd79466c159e15f96c70954916afe68e1922368c61fd99364dcc82fa74e921bfbbeedcefaa8abcbc7d11911c4485e298fdf
-
Filesize
5.2MB
MD5826db682ec541bdeb422e12478aac7c1
SHA1c4fe972fec0049bf377437b5a09a8e513c9b825e
SHA2569698b997c2c3590b4d8d1709ad23dfffc16471e66e90e42bdfeb6a059bb794ab
SHA512e625e015e065f374915e77039b4dc6733dbcec5d9fea7e3ba4981b17acba2617f6821d6a8e873358679b5a9a61d7afec5d0bfba6e80f195e56afba2483fc16ad
-
Filesize
5.2MB
MD519a4ba73b29c58fffd35fd0097212c5f
SHA12171458517d521106d8224c2ad5be50d451bea85
SHA256e7b358aa722d9a695716adc0ab0b0532e27749a48ed610ee8f48567218457194
SHA512d1a626060f14cc919add873c0b23874a04e2ccf1f3365457e378d520a03f96d070361a403c9d1d9d7acf059cf088de41e55ebc3d85868da050cba791b8b0bc9e
-
Filesize
5.2MB
MD525caf73b293f377e2f50cf008774ad93
SHA18ee5c89768784cfe935a7bd940aa6b4f3a1a85f0
SHA25660167f11731109039ca21a1670d336607df3347b7beae41163e0bd113b07960e
SHA5127c31996df3786c6fa317656f04b8065ac18ca7ce03caff0ff9e8bee9038db27fb7697200b6e196bc86a48f8890eaf70ec860ddf372ef24f81d6fbd0428f666e3
-
Filesize
5.2MB
MD5eb3daa751df7abb8e8a54e45db0fb02a
SHA10d02b9b9d294be4041f7b04241b030a2b1e6a490
SHA256d323b2b77bb133f603b04b51b371f36db7df605d22a32b2911091806d5b3dd63
SHA5125171d322e36a56f009d5631175329fc5324ea63f26e64ee17f8136695649d1c66b3180b526dd52df967aac94aa00c2212d4ba470c5a5ac3c68fb67eaf2b54d11
-
Filesize
5.2MB
MD53f7bcb6df4c46990b32dafaa136851c3
SHA14912804b07563ce3687baf75794a465e5e40a9a1
SHA2569f207eeea2c1135ed49fbb69507f3f7df08fb38c9a059072be77ca0a0325069c
SHA5120b4c97b9b2d30927f3d9933bf1fade67c0712fb724cea617eac3772ef225ff7851b8db06d9c83a7dfb566d9c2e9da4f68354cc9e820f121e25739c0e357194e8
-
Filesize
5.2MB
MD596946af9d1539e0665dda12a2be92444
SHA106beaa09ae10d0e4955b88edd3166842dd35262f
SHA256a2fa764a64d01777e7271af2be2e7a37ba7f10ba03b4559f39078fa17e453dea
SHA5126f5d206074e4c7572d44e919f120dfee108c7e4d11e6c04e893f57ca2fb9521750b9ea45dbc74e68cf1eb99b06eed56d1dc728e3dbb6b9a89dd7016c7e8a838c
-
Filesize
5.2MB
MD58c16c1bea9adbda229e7efc596c400fb
SHA1f1c0589fcfe3caf957e4ac4945a631c7c475e3ca
SHA2567713235609010cd79a3f71fb7009fc3998e8efb9eaeba61508e7f9fd39ba5e0e
SHA5120b72bd94706cabc46c08ab695214b107866205763957abe6bb16f210fa20d03ae7319170f2a2df71c790a54d14747d745d5d40e9111ef08ade4dc2558df25b9a
-
Filesize
5.2MB
MD5189a6b81fe29a757d0587b1898d7e10f
SHA1cae5fbb795f22a680f4dee2aae4ca333324cd4de
SHA25692b4df56a446e299aee6d6612e1bf5fe9d24d4e5573eaef45873ecd3a2b499bf
SHA51234fa1d720e5a0b60c3df6788002f2d3a936d35e5b52d1127708ae66dae43cce70018c2ab49f8c7bc7221b8df9785193f5f7d8921f2ae9dc8889860c2cdd7f034
-
Filesize
5.2MB
MD502b8b97aed9410384e7182020cdda578
SHA1c561273347f8e6223c62d1ea05da722462c1bd3c
SHA256fe774967354dec1bbf2cbbb1c51fe8b81b679ac9b403517005eb48faa1cecbe6
SHA512761076025865c4d0a88fb7afc31fd983950f090803fbf087d0aa2a33b6da511669fa191dbfdf18d6b95b85003aab166dbc249625424e672e1a10fe7a08f7b97e
-
Filesize
5.2MB
MD50282cda2c4554768f63665997092e087
SHA12e4d07695b8089773abe9161da8c1eaf2419f6af
SHA2569b0ef80454dec4603c231560aa1019cc219b3a7ad5d1e3f7c6787b651f244775
SHA512a4b4de9c95315ba7d37fcd6f86fc4910e6f154a7668dfc028e9b2491d31049f97b6313e7ce7e5c5aeed289211c5a37e4ef253013a672a5763dbc1b772a0a3ae1
-
Filesize
5.2MB
MD5cec4716d47c613d4c4d0129f35045d5d
SHA18c09edcfd4a45d7a96f61e30da0e287daddffb0f
SHA2560ccead46f961f5e1a6e0431388c7bf61755d4c30668e5ec59abdf9ce27d055d8
SHA51296f293b074174bfded04d95b981ba836dfcaf4af09272a96716ce05b103b837d671e9ab70b5134ac520f2764f85651aecfef9563eba632505863c0fd16676f4d
-
Filesize
5.2MB
MD5ae95560ce6eef21e2c09c93cd581efb5
SHA184b1def224fc7bfa9b389fbd761841bd9e5d83dd
SHA2563b3c15cb3773015ac6d53d59682320ad9dec1f170e22a4587e0181c18710732e
SHA512c496d8e4cd9b754312b5caa3d0e6539da8eca6b5a6495f7cb4e3e5566c25f63bb9c79ebb9d19e9544613914d806294aa298591749416e19311e76e04941aee0f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB