Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
14-12-2024 02:51
General
-
Target
2024-12-14_6ac16a1e63e1c4fd6319ea0cbb7855d6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6ac16a1e63e1c4fd6319ea0cbb7855d6
-
SHA1
97ece21889d250d2224b78bd9c7fcb1ed71c788c
-
SHA256
5d05f3b2dd429b8e4ecd0ec2e8c74364174bcdee9a14ab36307f8cf03c2e2b7c
-
SHA512
ec6cc0c33613d31e199bb8b3ee88a452ae3867cb9bf736204ed5db415f8ea425c9466e9cb88a9780b27dbb31367f4349adb928fa3ffb1aee437c83c8ab65e5f7
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibd56utgpPFotBER/mQ32lUQ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_6ac16a1e63e1c4fd6319ea0cbb7855d6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_6ac16a1e63e1c4fd6319ea0cbb7855d6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\OuFcERk.exeC:\Windows\System\OuFcERk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oNGkIzA.exeC:\Windows\System\oNGkIzA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bzxQQqt.exeC:\Windows\System\bzxQQqt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HWqXNdA.exeC:\Windows\System\HWqXNdA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KCAndYl.exeC:\Windows\System\KCAndYl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XAAPAyf.exeC:\Windows\System\XAAPAyf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YHCqygS.exeC:\Windows\System\YHCqygS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aZECxBO.exeC:\Windows\System\aZECxBO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dnwCNVi.exeC:\Windows\System\dnwCNVi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kcithsi.exeC:\Windows\System\kcithsi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SAvpnZe.exeC:\Windows\System\SAvpnZe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aLMBLpT.exeC:\Windows\System\aLMBLpT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ohJeWOq.exeC:\Windows\System\ohJeWOq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iUzlGKz.exeC:\Windows\System\iUzlGKz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bTDVSaS.exeC:\Windows\System\bTDVSaS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EAAoLFG.exeC:\Windows\System\EAAoLFG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KamnRYZ.exeC:\Windows\System\KamnRYZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vqelqAm.exeC:\Windows\System\vqelqAm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZUKlFqQ.exeC:\Windows\System\ZUKlFqQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ugDoAMY.exeC:\Windows\System\ugDoAMY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NfHYCbw.exeC:\Windows\System\NfHYCbw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a51a9968d40dc3c56c4c462a9b0c5145
SHA104b1f9e7186c4ab478b7561bf2661d774b8e46ad
SHA2560a2cedb61637ed961a1f425c597325a04f1e4cfdf4ba68502c19c86c36d0f4b6
SHA5124f0440419265f42bb66c9d32ce486c886bf252d5207c3e0cfc7778b282bc41c35d86fabe73f4c6bd5adaf3bf8d8097315861d1cf0b85f0dc6c502a6c4d35f596
-
Filesize
5.2MB
MD54ed0260d87efff1bd74b04722eaa58d3
SHA125780dc065d01ac31711d92a44703d62f8623b8d
SHA2566164208022440d3926b1fb158984fa3214e1123190fee8a4378aab398691d0b8
SHA5123576e9ef89a9463f337cbf68955b826ac7173f5668913bc5130f09a6adfe2e72eac2c9b4c816722b83640bc178cd23f92dd4152e5145de55d9372b9d0ad58d80
-
Filesize
5.2MB
MD5292ebab4c2cd257ad1491a02bdda5cc6
SHA1b9595158bb15c7b0ca3cfe402c6a21857969a57e
SHA25663dde6d61b98aceb1e579bffacff969e0067c030f1ab674c2bf269f7185a4c7d
SHA51281f0a173cb3650f4db1684dc6bdc99e5d130241f720a8f6a2630ae6b8d3d0fe06353d7bffd163ee3972d582b78accd946447b5b72f7783e00fce991f6b6f3eae
-
Filesize
5.2MB
MD5b5fcddab61391a94042b76eaeb9c3be6
SHA19ee3509fc5305b1d57f32f6f1ee272816b598a07
SHA256e795e3edb2474308546eeb996b8722262b8c939e12f27883e97c1868b4a630f6
SHA512d21549e79a8759907946f333b64cf007f46701c910f445a36647116fbc7a3f553ae2c4c256144daf06d04f737e3c18cebf6065d9b4dbb0efc8fceb17561309d3
-
Filesize
5.2MB
MD5513fe8569cf57f80bc8acdb65635ef57
SHA177826497ca14e389dad96fc154163b28ea84fa73
SHA2567fb1d1a786816cd4c80a4e8ec0d453afdec53e130d354f8e45092302b1185200
SHA51289dfe49b11552838641c192656e06c62c695a3c97b2a1f8be74a1e25c8dfcafcf558cd6d9a5c93d9b8236f316ab7decae35488d874544aa5eabee213264bc2cd
-
Filesize
5.2MB
MD56c3a6383c9db690a537a5d41c1934f35
SHA14707e181aa125579685fcda599a169aaa04ff032
SHA256a6ccb7563bfdec878f8cc144c983a6b4faceb9b0c0785c2ee8f8215bb8709719
SHA512f56571e48b78ae9c0df28a335438aba3f158eb9ed16948cd6bf59adcf62af8d431933918321065e194e7ab5a818486a42966d8d19c4d13cbd8484e348b75c24a
-
Filesize
5.2MB
MD5c7fcc1470d79a698abd21a1e0c7e1416
SHA1f8071989533f5bd445c24fe7c8e86cead2775ab3
SHA2567a349c2722b8b4c8b802c55d4fc1c03ddcd72f7f64bdd803018b6344cced9198
SHA5126867ff5cf91b434503b100a29bb79e43f790020dc7437ef3be1de5ac5bc8239843e28841867dc67dbbb0d5985538f9844a0308942cfdee187252eeea8535773c
-
Filesize
5.2MB
MD53a796988a87e8ea106503c29bd03e737
SHA1d803fe47bdbeb179225aab026e5dbc0e481f920c
SHA25692e408d76db4f34673ff59c26d1f4248a543de356f777a2dca8a75916c4d91b1
SHA5124b0fb43b339de5ac275f7dfd7058c85d8a9c5defa51b36509d641bb9d5c8ebdd61ea8751c20480e9271b4da8448bce37deebe3e144625c0a708fe118e4a64230
-
Filesize
5.2MB
MD54755635dd7b6cca6a05ac45392482748
SHA10ddcda043fddba0b13927fd79a6c291615eb09c6
SHA256aa92d178c003f1b168816a66b34e99defa8039adabf0c31f989d549eca0e4696
SHA512fe43b407c6e2b4a7628e2034e0b24a061ebd5fb316e4861d52497ccb027027adedb11bdff8f81c0e38b2929305c2b8e1d7a0b532e8fdec8176f01b7db3506145
-
Filesize
5.2MB
MD5814b5372ec315182a56b460d5d8681e6
SHA1c3b5733b0f7fc904dd7523588b0598fe58f0f0bd
SHA256e38464b5996a727a7225b9e7521508777904f5d9ea71f2d4081d4da87737c719
SHA512001ecee3b493dbd99101e8626a92bdaa1844c58a047cb1c118a97bdc313004a68d2944525283d8b58e8fddd6afb56f903d67567044351357668e24b9785cc5da
-
Filesize
5.2MB
MD5a9eca01f039c314ae65654ce35743d66
SHA144f60abccb7a1bee0db48fa41401cdc4bc80d706
SHA256727a0680c81001dfe2768151a35f62d76abd5693a86a2560d14fe90b6a52cae7
SHA512b96618f98c221492368de6647f7a789db1e5f5d71c6ad5b8ae9e74f2bb3fdb7da4811ce337595478fa16202d0462d98113e08ed41e54b0e7028c6c1754daabc1
-
Filesize
5.2MB
MD551657437bb2f5b70f44ef1a67ca1e37a
SHA1b1341561e584d72c492309f3de557eb94207c913
SHA256e322b31a1b2eb9e6e711449b89b1dc86d6e5b4298db5498aaf9a3e63175d25b3
SHA512ea08c959e919381d15b1d01802ff62a755a965d9dbd495b021fd395e7688a70dab6bcd96fb61a0522656b783dc0946326d337ec4454e9340585ffe45f85f7f98
-
Filesize
5.2MB
MD5c80914c14092336b2a5055c2294f295f
SHA13a3b2ab5e2367dd315c04c496c321e667ada674a
SHA256264b206910a9a29a521240a98af4d789daa9914eb9269a45c44b44fe0cd34e58
SHA512cb078764f1d16de1f1dddc82f0b2c3db761dfb638b75147ddbf9839de807dc95c2edae80235ef0bc22e36f6315bef2bac9af1abad5f2048a14703f213e615680
-
Filesize
5.2MB
MD5b439ddc14665fc2269fa02cf457892fa
SHA10f458d5257b862a055596fc017fda5e9a16500ce
SHA2565d03ac2636a94928436e4c1b226301c90576433d9e526323281122940e2d81bf
SHA51207054221ae1d91dc28421a71fc4ee98e7ae43de92e1ceb39e1372c1f286c1ab9f876e4c9e8309492dcc8ba3035855c2ba15cc1add45a7b51b96d455d7b9e613a
-
Filesize
5.2MB
MD5f0374d44bd830b8269dfbe72f7d7bbf3
SHA1edc364dd3913d6009a46d37aa944378d36dc35b3
SHA256bc5dd9cebd4f3bbd48c153d5a1c38d7d21d33a4a980289bf7e04430f61cba361
SHA512fef98736d757b5a2dde0fc9493724156d0f985726547f2d78db62758aab4c89c0e6c24d5cc0069ea57362c517090fe2f2dbdfcfec651fcafbd6bc54605b08051
-
Filesize
5.2MB
MD5dc886df942e33f51a250b8a4ad14370d
SHA17ff49f40cae9febfb4e0d69c3b459d20783b3946
SHA256cec8319d985d81c42299cf7079f96bc9204ef7704aec611fdb3d82c3139c320a
SHA512febc3bae0a7c389654ac6613d57faa73b38fa717fce0c87069adb53ca4a284888da9961b636c1bbea513d605ecf11b68cf4357139adceed3617c87eec1de75f5
-
Filesize
5.2MB
MD5d5862bfbf639c1bf48f77f7238496d96
SHA18ea1026949ec8bfd09471db896b9c64f558aba4a
SHA256ed45860f09ac967e7d68e24f43aac5f7daca6a16442784e7b056c687e9d2deda
SHA5129f990f22106cc7f44e2cbcae8266fdc70c0c9c056916ac92f64792ce78a2031f66e0ade2279a364523024019faef3cc43071fbbe70b882c69bd323c26a1a2ea2
-
Filesize
5.2MB
MD564ab8895be81efaa1a0214f605bc3376
SHA1707ec88e40f0d177255ba47a1cedc1e02266bf37
SHA2561a38727dcb2b0912d9ebbcc1d84edb7516887fdf9bb993381a28814d11d07781
SHA51285aec3f642fa563b27e4917aa36a44efd4a6e78f4491119391874101b7153f7c62a4bf0a4c52cdd6d7a7cca7c85f9973a0247f7b25778cafc50b2bc087a7d533
-
Filesize
5.2MB
MD5a70365711319d3829e0fb14f639e7fcc
SHA1fb47d9394bb17b581df16877e80af53b1570b3dc
SHA256c751f9856680a889b15430b4bd20d3596a2b23446b07e5e8572a12e569747cd7
SHA51273474cd9befae42fcbdfd03bda7a21ef11263adac6c6879fd458fa80c57d50213c31f8e263a9c46925bb1fe41abafd24e534e2f6aa162a77782901c344ee9e63
-
Filesize
5.2MB
MD560ebb0a6c00597a0fbed419a50628054
SHA154e973aa0da0395fc9fa1c66d351067081b7a572
SHA256d89a9f44decddfe7a4f4648d6c3e19c01562e920f298b971e0812e8ee45aa62b
SHA512013a06594bb9eabbe9222fcfca69a6522e60fba390d4b387fa0c2c3e1ce8c76faf12cb3c3a6995665591d80a645deb553cb8eed1f01f8fbc693b9ed955b1a053
-
Filesize
5.2MB
MD530d0c2db061ca26067d04db107f603c9
SHA1fd54fcf4e31f898c47707354b01cdd325d8c723d
SHA256c3be3ce8ea0f74a706d719a85ed216e59dc905c951a3aa233ff5365dbaa7cad4
SHA512319c8510fb4b79b90117d6660456ee54d7c0250c96aa0a67ac83f41a5118ecd3139e4bec4d86900826a95c12f423947e201bea762715800943fec44566dfa119
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB