Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
14-12-2024 03:02
General
-
Target
2024-12-14_83fbc72a6abd04afaf0579e43b09659f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
83fbc72a6abd04afaf0579e43b09659f
-
SHA1
e3cf2c79b63e00e923241505a2b599ec87b19a59
-
SHA256
8bf609e81ca1b1518d5613c6243c7f1696800b1ec836201b0ef024a69895334f
-
SHA512
20b6f948d9188c9e629f32b8cd344b9dc7c2520891428dc3c8db94eea83c5e4a66c1de39bed44e28d59f74e045e7426c39f66a99e234eec731a5f950ec39d6ea
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibd56utgpPFotBER/mQ32lUF
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_83fbc72a6abd04afaf0579e43b09659f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_83fbc72a6abd04afaf0579e43b09659f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SdLquRy.exeC:\Windows\System\SdLquRy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jTXRiwB.exeC:\Windows\System\jTXRiwB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RpiJMpB.exeC:\Windows\System\RpiJMpB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ysdkXak.exeC:\Windows\System\ysdkXak.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hWMOnmq.exeC:\Windows\System\hWMOnmq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dXBAQDE.exeC:\Windows\System\dXBAQDE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KJudOvi.exeC:\Windows\System\KJudOvi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qUWbtTF.exeC:\Windows\System\qUWbtTF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oRGgYIa.exeC:\Windows\System\oRGgYIa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ReLuycb.exeC:\Windows\System\ReLuycb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qEqJEph.exeC:\Windows\System\qEqJEph.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TQNYfRC.exeC:\Windows\System\TQNYfRC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bNWAOMG.exeC:\Windows\System\bNWAOMG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HwiWfTO.exeC:\Windows\System\HwiWfTO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tyGCbhM.exeC:\Windows\System\tyGCbhM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CICGPib.exeC:\Windows\System\CICGPib.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SRLikiH.exeC:\Windows\System\SRLikiH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MnuYEXh.exeC:\Windows\System\MnuYEXh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OSuWqhk.exeC:\Windows\System\OSuWqhk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QyzqXvr.exeC:\Windows\System\QyzqXvr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UECghok.exeC:\Windows\System\UECghok.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59233e90cc4cdd12e6c8a4afad7dd5076
SHA16716d556b7486b978824b20cd7ee37953a12af8f
SHA256e85b2df7b8043bef6c2c45cd14dd6e7402d8fac1d3d8d324d3fe48824f367456
SHA51294f1b4386d32a31ce58a740e10159d9ea9ca7b942db8fc703348f0480f8601174260649746a8b5e94116fa2978804df244a3240feeb9afb6c4d032a3f09377e2
-
Filesize
5.2MB
MD59e3b746f20ce9d57d299d2a9f235e13a
SHA12c74d5d49a002b0a3771a52e6e6c1bfbd0d8745b
SHA256e9d0885860f69848a70e32eec22369e521bdb6ec083299e3d95c8fbb9c15b604
SHA512ac6510a8c4e9f767807564d81a8e20dac1a505e63cf1ad31aafe188feaef7fefa1a1a52ceeb3d8e20f645c29f28fb97f81353c515aa4ad5cba1576d50b44f647
-
Filesize
5.2MB
MD561e8d84ca1b3423293f35bfb475a172a
SHA1c175f70111722f4cf8f829f351d7fa78dc39da61
SHA25610e9448481b37cc9bddb810b6f966452737697fedbccb471a4d8a1c394ab1358
SHA5125450856e41a349bfdf9ea08d7f5a58ffbc06872dc26d564ca185e88f984f4591e8f37f7ae3197d0f6608bc2194e3fb20cf70279aff329f4f3e73c7bd5f2b72b7
-
Filesize
5.2MB
MD5b8e023df89f200e9ff6fb3837fe13b4c
SHA16db139bde61ad0c8cf3f157110c3b030cd165537
SHA256590b307a7924d6cc1d08362b142932f3c25176faf3bcca329d49ca5033a9259c
SHA5122b9747edc12b6639616df21cee9a9e1af25257e319975e5f307d559c51cce7e1dc8ddc52d84acf6ce5bcd36565363ebc6b9a66b7142275e46e604bac49b45fde
-
Filesize
5.2MB
MD57c14a649105a5cb180672b948f29f8c0
SHA18beb5e4d868ebbb594944f38cba63e5bbf50b7ee
SHA256ed7850d198e365955e6243a5318fa4cf83ec068bc7a9dc76a5b9166599bc202d
SHA51227305b4964e584fbf13593e4f4d9728f12b1fd97b83f2dfecda615b722c93b096143e7e195b6223447dd070ddb9707ac59a9abb764704db4f0320107f06f748d
-
Filesize
5.2MB
MD5d685c74b00dda47da254b3bc86359433
SHA1390c5734626bc1332b22b6b39c86ec965b7367d9
SHA256b7a4cf6beb36b9042c10ff442e26adf55a0e5004ce2f28f257f65ec916fbb2c5
SHA51215679a9654ccb0ebbd41d769b0c4d0eef4ab003791dff2485d01640a4c599dd371736c8fd46129857fa833037555edf811992d2974d2dca4c4e445c3834dca55
-
Filesize
5.2MB
MD53e389854fb8c3d996b21cab1f6a17c74
SHA1d8e36af531c0114ede9af8d2e0c80052fc66f02e
SHA25620af7ff1ea37c6569cc941f0e3695fb3d1bc73db728c917b23794b6d3448bb9c
SHA512ddd2539c46597a35b2203ccf81f6f7049fd899d943cf48677c4134432d89ad3bb85d8afa7c9a9d67851345a26d7dc124c11ec3ab8c9f5f3c85180786749987e1
-
Filesize
5.2MB
MD535b0a565f3c8c493c36ec0c52b4291db
SHA17a3780e2e0b09d6b392c8c2a210434209c7cc384
SHA2560b57593fa2466bf7ae8a67ac95a55cd106130b20964b7389321bd0d76668a89e
SHA512bc472553d15e1c0556dac833ff5421699690172d95dff8eb74c5991f73a4e259d2b8e45bfc05a776aa754b140cb3aeb8b23a44afb5064862c53af1c9f50a5f2f
-
Filesize
5.2MB
MD5d27fa3fc49954ea7afd11a20d8f1b3d7
SHA1230ec09de2afbf20061fb551b5b0bee3bdfa2b2a
SHA25603a707803c0073f7c92ae0e73e7b94ed9b742007bd2413543f93fcad0bcae69a
SHA51219d25d27f173d2410b3c85b31a794065c93acc322717636743319d9750f82176c44afa361912abf4566c449b9bfb668531aa411b8a984b710717667227362906
-
Filesize
5.2MB
MD55ef3aa4ca93dffce6deda1cb2e0f9efb
SHA11b8ee7989180755b010a56d74aa8c1923e33780f
SHA25634dca3c2d844b2752714aad22842ebab8a10f359bb0c03dfb4ccc520f27f6585
SHA512b7ff408e101051f1637afa3d7c52365cdf17f7ff0cb15fd6a8f82b3027baadd87c47bd146b71cc66318ebe8dfa06d0aec37adb369bbe4143fa1949ef29cd06d2
-
Filesize
5.2MB
MD5a69c6e631cd20dbfd442cca82dcff895
SHA1b9b9989c5b24d2aa697718f6b2fa859391a8bbca
SHA256323e25c1fb1d482b2d711d05f6a2eb65a8dfbf3db9303ac5f51bf4b2913ffe45
SHA512e4f0456b1e33ff347448bc3b9ae3a89e5e3f689dfa76884b69169102c643ea7583173a1160dfb8b9f4d7dca3240d33310615f6cacb248c4e62b74b92abec33ac
-
Filesize
5.2MB
MD50443ffa81e75052cbcb0ec377ba8446c
SHA1a50e9132037331a45e3c870b12ca72ef60859696
SHA25666d4dbf33f1b74181d1e136154c72159e5237eb3b1aa8e6d184f97905adb6bd3
SHA512cb562866a769a83146018afc896326757396d84b256745c173bad6e07b7e98636a3ec9ed18b6dd13dd6f37b4a3e22cf261c7abd803908478953aed7ba357c75b
-
Filesize
5.2MB
MD5d0f2e5cf4ccf017566bae6d3ac56e238
SHA1a32d97a91497cc1b19755b43707210664826a1cc
SHA256f846742e9953a841f45ce9719aa6db4f15e8791a9c1b4784d27ee37d85574abb
SHA512480b0e2079029d250eec4832e6b6ebcbe81693e32ab5522cd845e83aec258a5c9636f3cc38e11545fb696cd471a3c551d4b48a1e1feff0d27bef124ceb17b290
-
Filesize
5.2MB
MD58749ba10df1ba31021acee96385ceed6
SHA17f3117829d6e8a184eb99d39f11a69c8a31b4230
SHA256549f29f44a18333c0111ffd5a9292184fb08ddb4670d56c0c06721de3b3ea310
SHA5126889e74b24830ecffa83a223a92c2ed597b29b80b27e8471ccc764e9998e326ce370a933cc5403566a5853e149311afa88c6fbc09810e75a0aa38edb63082d99
-
Filesize
5.2MB
MD5229c2bea74c15484cb825320fe9edfb5
SHA114a56f69b6982e4944d369403323eda13aff9f40
SHA2563b6e85c31587fda72082ed42aa6ad0cc8e218b5eb2a540bbe17b3bb64a14ae45
SHA51244d9d4bb812b14dc03a8a92e21be60097689fb27c21f5a248bca3896d145ad36d7f905ae7c0ae483fc5d968bd65b2344443dadaadcc44cffda5a3ebba1285b3c
-
Filesize
5.2MB
MD5fb0b9bb87af8b3fecc6fed6ff3ab4f57
SHA1600940f7277083b8418b4f882029d49808ea07e9
SHA2566f2dd763cacaca805bee5e5b5d15bccb450cae1dfa7f42cf2442793e4a6d9e50
SHA51239cbb207de7b1813c04863357dfec7e70b9aed989d9716479403fac863a5e46bb69912a8797b52c4dfe9bfa6faa7788199f8b94cfd422769c67891f25409df49
-
Filesize
5.2MB
MD5508bd04dc6c7e478359a5a915603ef57
SHA1955e04bc3b87f6df2cc513ef20755ec1f0a41888
SHA25607d1f5d1ab3c8cf28deadf7bd5b12803c1d2737a82cbdb59efdf375847a2dda1
SHA5128a0a7c8cf02d1fce46869a8daf174710041c1f00c047db51fc906eb6cf8b49c579c23f0f8ec33379d744f42348b15a548bf313a1fca4bc1ad104a4167e0cba5c
-
Filesize
5.2MB
MD50e61b0fac737202ad6817bb96ef93c05
SHA1bd3d64adf69451e5eda95a897d3caedc8dbb9e1f
SHA256e3b40f3dcb8e5e54f8ec8b0085049263c0cc53b64486d7db659562f8f5d62544
SHA51262e275a7fb9008bd4a07a895d21ccb74efa09954910bd98542489c9adadd1be7d5473f9dc9aad2fbc8e824986872f5ceec78f09ca170143a33889ce06f65c973
-
Filesize
5.2MB
MD5129c6db3d2c4600bb15f80f4778fb82e
SHA1c4529cf7e0e0aa3f24f34966c48e6b5e8da85d22
SHA25651473469d1526bd01096c335653771ea634475d26f0b6fd3f737496036d54155
SHA5125434b0e6c007c666d4564cb37785ddafa556786d9a2ae18211ab1d6973f43e7821f78a54af04c088c97e79d125990f4851ec2713e06a554c04f2e38bb8424a1e
-
Filesize
5.2MB
MD5a7e41a2589ad95930cf240d867a8c950
SHA18cbf7231f8137bb87df5f005a2c45f79ed051ed7
SHA2569602cb9bb2f6c375833c1d624b2c931395bfe02fb462b611ddee2cccd2dcc5eb
SHA5123b9db60a6f788dc748bab9fb397a0be1ae50a0c4fae713253694d02626d37cba4c5112fa59997f2da79284fb10338e6acf58ef6984dc38a4f324abde2a81cd5f
-
Filesize
5.2MB
MD5fb34e28ef05d18c78aa8d82475a434e0
SHA1d912ba8f5a057192b712f5387a424cc91e03c2e4
SHA256dbd743677981eebe59e95ad2899c33a9f3b6f2602cc0ade3cb537577488e6570
SHA512d3393e56d1e7c6d9db1367b7dd85f37f12dc32437ad4620822e10693bb869749c81b905c6c528c6d79087a01400d02721fc7df118693b37303366fac10d74909
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB