Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-12-2024 03:27
General
-
Target
2024-12-14_f1da04412b209f601ffab62349cbc506_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f1da04412b209f601ffab62349cbc506
-
SHA1
1f220fee8ad03e515388ff072738d917ff5fc92a
-
SHA256
e11c5182a5edb8ab859977c3e53b7e283ab147b333dde76303a07829dc5a0795
-
SHA512
470da31e145b3354f20f1bf6613533242f317e0927276f56b4bc304ff2148766b93283f52a28deca73973c2c38b3ea1e249d80a2d92153c1ef841de280602e0b
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibd56utgpPFotBER/mQ32lUu
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_f1da04412b209f601ffab62349cbc506_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_f1da04412b209f601ffab62349cbc506_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vqpRDtD.exeC:\Windows\System\vqpRDtD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\weetWmS.exeC:\Windows\System\weetWmS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LTwYpQO.exeC:\Windows\System\LTwYpQO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KiWgKng.exeC:\Windows\System\KiWgKng.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HkcORDi.exeC:\Windows\System\HkcORDi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EiPXisC.exeC:\Windows\System\EiPXisC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZMUMScn.exeC:\Windows\System\ZMUMScn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gADdvFX.exeC:\Windows\System\gADdvFX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GGZEqoC.exeC:\Windows\System\GGZEqoC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GUrZkJd.exeC:\Windows\System\GUrZkJd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xQKiFxv.exeC:\Windows\System\xQKiFxv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sOnLJMx.exeC:\Windows\System\sOnLJMx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZhPTDsv.exeC:\Windows\System\ZhPTDsv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hhhpyDr.exeC:\Windows\System\hhhpyDr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZeCVKfJ.exeC:\Windows\System\ZeCVKfJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OLBFhIV.exeC:\Windows\System\OLBFhIV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fUHjokX.exeC:\Windows\System\fUHjokX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tnSCMAt.exeC:\Windows\System\tnSCMAt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aPETqCs.exeC:\Windows\System\aPETqCs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QNFFRGI.exeC:\Windows\System\QNFFRGI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JIWlNaF.exeC:\Windows\System\JIWlNaF.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b02363f089d443c5cf6184d34295ce32
SHA173b4ab521319e40815a078e7259a853d5da8d06e
SHA25663f37385a8576e03f8de0024b0329fb2d1515a74b2b79d5ce2dc83b7dd9d902d
SHA5125cf1d828808865cc9f6bf52bd996e997ba47894c88789d096bb205286210e4bee3a70e61e7f5a59a0cc11aae89b74c2dcfeb7a7ec309ece8e8febec7a51f1366
-
Filesize
5.2MB
MD5e1b63fe24915785ed7ff6edfca188acc
SHA13061cec0a28e5f0b5f6e526acb30a9962ae84190
SHA256b510367a9852cec43903e41aa0d50315fdd04d13413bbc96499baf51621399f0
SHA512f63978edc0334946cf590d2fc05de7324199a79040d62a720b219de3865ffa230165a3b6d2506ffdfe70e8c2757aad99edbc3817e2074adc2b8e70d6fd21624e
-
Filesize
5.2MB
MD56f3d13368952906cca9cbc8b3e0d3681
SHA1b36dc66a66163fd1eaac68387973eea16831586a
SHA256c2d7c108d7807191706080e5ecc153b5de91567f04146a6a241937366b68e244
SHA512a5e049e3b83f8135500a4952a349a2d60211a4efee04db97c5f433655aa15c3097450fe30e9af10588ee922c0ba0d25d6d6972fdeefbedaaa15f6eb9dbd3b7ac
-
Filesize
5.2MB
MD54aa580d96fa2cd91e48ff8b962ecc788
SHA152d86ff7001bd6964a410de3c6824e4b3f0e31b3
SHA2565e5b4803a44709009d9473ceee6ce5ad2abf9ab67ca07bd879b2bb8186753f6c
SHA512e2f49a1c873dc09e24f6f933fed0bc8d70bdecf402a057987559979086b778e0673bed97bcc80391c4711feb07555d0bf48f8eb137c3b8c8a06aede6e9b718e8
-
Filesize
5.2MB
MD55b56e002e81f797a37dd27276cfeea25
SHA1c94419f65d7fe87bb76970019cb909a2d882a6ee
SHA256cf04041f28d6c16e87f8e6f1bb783553ac35f098859a0172838030ab88c2cfa7
SHA512ab6409bf7abe23abde7fe7a7e1a97972bf4278b4db64751e8f8e830559f3143a3391960f8835aff58ca5a25dd143a17e8d964348944501fcc232f844a7ea0800
-
Filesize
5.2MB
MD542a51aa4f16af7c14c47471b6d927e2f
SHA17edd40944470a963e9886f92127bd71cd6af95d7
SHA2561d747706e414201f8faaba6c4dc6fa55c0107a526b0b42c905c195a9058dcaf7
SHA512d779e143a0305fd100907501d9f25b997006ab14d1bcce7f2d53b021d6480c6bcdf2c8fa1c02c5a323db6157d8a1b728c1f044f7502d805e42c78d97c8e12caf
-
Filesize
5.2MB
MD53d073e5028149121a55f8c3fdc537cb8
SHA14292ed6963796cd355e0bb3e84377b647a44de8e
SHA25633221efe48c32c18a249ee9865c2a14f3ed68b9f36e0c40790c67237134a138c
SHA51204c1d4769da345f06c837069480d8676a61f945b72c16f62c1e97a342e1b69310cb6aadbf2af814db997d5834671a50ba8456015cfcdd8d98270295b65dea25e
-
Filesize
5.2MB
MD5299d39f11b832cbff603fb22cf854ce2
SHA1828a776839d04311830fd79746d58be5f9561538
SHA2565b4258dac37ca1cf01ee6bf366ebb9db1d017ec80acb3556c021cf4b1c452125
SHA512cfe2c1e580438c450dfa67cfee1e7349103b6106186889946d557650c6b81098e7166dad5932cbd5e964a8db9207a95c09b90df611c25beb9f9b5f4d8bfa55b2
-
Filesize
5.2MB
MD5f040216a9d86fc0f74d9bd9f9b21f216
SHA136bd9451152936695a1a6490f69cb5471e3d1c17
SHA2560784c6fd0fc23b02755f3e9745c346aebda1aeb8531ea63a85ce33a65da6e5a6
SHA512edd1684c3a4734da1e4293aebe5fc818cc395297358e086cd2c72d9c421893a6dfeb5af8e11183ccd9c8000372ee308094df624617be047554b1cb16b91080d4
-
Filesize
5.2MB
MD517659f883ced28ae83dd53e38ff2611d
SHA13a689d38abbfc8d6bdd28561d2ee39a37c3effcd
SHA256f42dec19237df4aa9263d8e19b50dbac77c4f05cca0921bb43a55d3d602a5fa6
SHA5127751d928e9151e33c80d154a3a2a05fd8b6fbdd7782c569c1d4eddebf7f4a1682596d8ac614e5d524e041d640bff80f80fb6a53e64177385eb0cb016b7e99129
-
Filesize
5.2MB
MD53c7d89f39c2526102e92b714e8ba7c54
SHA1ff23dbede33560a7c6d80d67c290987d6026be45
SHA256ac1fc14fd796608b5e2b20ea5f2e81551ae5966371eef133ce50031114c511d4
SHA5128a08923b8bc15836a031879b392706ab51fdf9588d59c4103ad4b1589ed06fa9cbd0f34f4ac6c1aa1eb7c6d19d21b3ad6499dc1f3832b01c152036541194ea29
-
Filesize
5.2MB
MD54e6bb35893378b8ded06cf1640adeae1
SHA1889db34ef6e952d95da2114289bc31ee76bee833
SHA25608932bedd93f927c74fcec261592341bba8a2a07d589735bf9efca70390720f3
SHA512defaf4aa9d7e0382042a9c6e6a8f8cf1912fa8b680c0e570e0abd00ba51e40e2dc16f2dda6255b9905ac3df2968ea74f09b9bbc5949bad252de406037025dfca
-
Filesize
5.2MB
MD533f53e612a8270ccafba6482be60f89c
SHA11e22f3dab5a2f9adf2091465ced39c26a59c7a3b
SHA256685a7a4d1456c0c3e4e4f09ef262987f63f2622eb6b0bb299c32bc9e0e9a8dd9
SHA5120e6d6c3fdc33a53dce85fe248bdb897f1507cd0837c3779b650e4ff35d971e23770e0e87ebfe5b4edb5b85ae623b315a7f95f959b88a39217cf2faf8cea35498
-
Filesize
5.2MB
MD584d78900a051d45d5b919eb8544fcba8
SHA1d78a814743f23f2ebc71b634953f931a3692381f
SHA256db89239f8d8d61c61c047abebea0f3e3fe1bec87630c57c311b5573b4fc06c98
SHA512ebe6bf82ba5c3060669e2e45eb67920d5951c787e93d586e543bbf3ec7173bcadafe1b66711465100ed2282d89cdcfa9c4adfc7ac2d087041e5b904e21e8f7e1
-
Filesize
5.2MB
MD56136eed923a19fd78c627066f1ac652a
SHA12ec03c4ece91dba80945e5be397f5e9520e73753
SHA25628466a4ff836252e50cf909a8d4c0381c7fb9f299e949f1e2d084de5dff5adf3
SHA512f984ca8683dc615bb889c05177001ffa3c088d4e809dbcbe07884a92c9e337bedce3ea4a70ec8bbd559bf3112e883d11bb0f6ff67187e311ca48f067315c8373
-
Filesize
5.2MB
MD5e1afc0b44d8b6f15c25f9121ca4f15bd
SHA10279808dd5fa69304e115c56b89b39c7afe3c76e
SHA25675690abc6bd68051e9f67fc2fd6140a50eaa8030f4a0936f3ad16092209e1a89
SHA512db5107db69fa8dc65e05ae43772cf47e6139b8054b56f466c436c865b1374aae41cd7bf485f15a17bc7486ca7e5e494acd21699a0a58545254ba7f9dc8549b56
-
Filesize
5.2MB
MD5ac58d3654ee296c8403c108db65af95c
SHA175540a0fdbdf2f19616a331e50981bcac1c80aa6
SHA2564d0afd21af252e515203753c3cf25236857dd282ae5a14659ea9d08552423484
SHA512660ee010d05ebacfb511fc3206db967138ed123b2c1d2c376c38337ac4fc68f6db6c11ef0d5fe8a247aa0be2962bbe5085669ce3689914a47eaee6a5cd0b239c
-
Filesize
5.2MB
MD5d2dca21099b3d4b5e65a6c8add73346f
SHA116d265550656064c1e6dd36fd934667ab1569bbb
SHA25660b41ae1bddd0bd6ea8a3ec8369da0b0ec146a58c29ea3708ba96e0c1c4dc260
SHA5128c27d7474b561b55929e32d2b3576523894f3b5f6b0fb070c2dbb1964399b980899d78476743f99800e7b262899332ed3c8cd27b7ae109925a30cea28f6a9243
-
Filesize
5.2MB
MD569e0f7d28e13e3bb40d78271fd733b4e
SHA12af3ee7d66c6b364f7d88430a4d35b10080d3bf1
SHA256e79f6b465e92a3156c9b0442bc0499bbe5cab871ae4f8a9bcc8914195873eef1
SHA512a5c1a45b18f6403ae312f8eff45373df6524a94ff171c099d29d6c0e44df0e1981303d2608dc5a750d25d7aadda54707689a593fdb6d621e51165f92d8b092cb
-
Filesize
5.2MB
MD5653c5f1e833b56ab3d236d8702b20690
SHA16765389f83bc0defeff8dfe353037bf956308c29
SHA256a87240844534ce931b36d5b466d94d054ae29f084de469b28a4c0619c4f28b1f
SHA512bd0afec1e2b583adfaaafcee5e15395526c94bd635fbe156bd264c9bbafe4d4b68aef4009b7066721782c4643199285825e98bf067eb5edb4c1b613c09d45bf2
-
Filesize
5.2MB
MD5871348d00e60f768b1d6abeda74db262
SHA17eb62b2e3324d96d69bfd653d8c37c4acbddc97e
SHA2565aa8d0ce43c9c8ec1dbe20055ff1c7662e65260ebfac1de154697a19dfc1b69d
SHA5128e4b805736f37c62b39e6d13e55c7fc70134706ade3a88e113a87aee98fb4ebe94ec8862aad8ea07605fc3c55f860776802eb5b365b234cb94ecc37044a9032c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB