Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
14-12-2024 03:46
General
-
Target
2024-12-14_63aca0f86e1e0ba50843f68f1421b223_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
63aca0f86e1e0ba50843f68f1421b223
-
SHA1
5fa3daf44d87ad19861341c4ccff8d857f488d6e
-
SHA256
da57c78e16e538c54d1060d07b21200ee3f67996073fabf35b23ca9b0e58bab1
-
SHA512
8fecbdecfaecf83250496d1c4803f261be51f0372a556a57a84df370f7d0ea8c03d2492ba0e26a9950221209fc92ec325d25e2ea70056330d5afb649728f1715
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibd56utgpPFotBER/mQ32lUq
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_63aca0f86e1e0ba50843f68f1421b223_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_63aca0f86e1e0ba50843f68f1421b223_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DNyIpOa.exeC:\Windows\System\DNyIpOa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mBsiArT.exeC:\Windows\System\mBsiArT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NfFQTGl.exeC:\Windows\System\NfFQTGl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZDyapMX.exeC:\Windows\System\ZDyapMX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LeyRvKI.exeC:\Windows\System\LeyRvKI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eSkMPXK.exeC:\Windows\System\eSkMPXK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OUtRKKy.exeC:\Windows\System\OUtRKKy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xgFebob.exeC:\Windows\System\xgFebob.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tjdAUZY.exeC:\Windows\System\tjdAUZY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Bhlznzn.exeC:\Windows\System\Bhlznzn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zIDANCX.exeC:\Windows\System\zIDANCX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sPxKiQi.exeC:\Windows\System\sPxKiQi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hiHkBOW.exeC:\Windows\System\hiHkBOW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HvfHHkc.exeC:\Windows\System\HvfHHkc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sRAZkwr.exeC:\Windows\System\sRAZkwr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DdHUfvd.exeC:\Windows\System\DdHUfvd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CToTwvq.exeC:\Windows\System\CToTwvq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MFEinHq.exeC:\Windows\System\MFEinHq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aWXxVFy.exeC:\Windows\System\aWXxVFy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dDxZNbE.exeC:\Windows\System\dDxZNbE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ctlNRkr.exeC:\Windows\System\ctlNRkr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56a4057f277dae9e5655272fed7c9a2e2
SHA124b2a54a36816af644765a1607bb4f91a7db8c9b
SHA2563ae56cdbcc756409f69976d7ac83f9b39525be6c9c94aed0fbcdcf02c3657738
SHA5128ec9d2c744ec00ae00f6c718038ea3fc920512460caa6bced3629c2df93fd169fc1e5ecdbcdfe0408a5bab297cfe665234918fefa1d456eb3e7ce645f5559c9a
-
Filesize
5.2MB
MD5dae69d3eb65f48821c69207291e11bff
SHA19a888627d6c6641ca322a0ea0bedac322d37922a
SHA2563b52fc3ad0d29df6b442dab90b17f730856a617823f1ed01b6688aa5bd8a6016
SHA51284c9d85235a44cbe671ef85b82f05d5d786889a28c416d143300694f82cad836706b930b74f72531194d97172c9ff19750f385a337e0cd11929ee304021226be
-
Filesize
5.2MB
MD54f6528ea64307ef1882e42606b857e8f
SHA13207667d154eb907cd28b1e5b1c1ad04f15db9f9
SHA256fbe2468ab46933facbe7a4f23644896a7c25c4d63d23e19a765c08271523c4d3
SHA51215595d590833c2bfe63174f23920501c43469f808423adf0816574c8307f63f4b3c29fccb26e03bb837f046d7f41a44f1fc06e06cfe811c35271d566b8c220d5
-
Filesize
5.2MB
MD5953bea1d355c3c3621968f3c22e7e7d5
SHA1b72472f0039b9020fbd6aeda51f52b8c3afa6c37
SHA2568f7538f223bf8dbb4de8c41108d783c030cfac2b8f5b2b778e967f4e1e8c2f38
SHA5121407a0801d81fdd06e2fd1378804c79d277a30de12d0e93c022ed7cc98333cc5f243dfe94beb77cffc01137b5a9ef8669e9385d6582d1f22092ce6062a5c5dc1
-
Filesize
5.2MB
MD5ab25b8ffc156e0c6f2e5949190703f7e
SHA1673b097d2703ebe7e9203de9370dc278d3abe22a
SHA256c69eadbf4ce45f534552becd7d1edcd5257415bd87f92c0fdb22295cfefc5cda
SHA51282a0344572edba4cc54e7150bab06f538e64b9abcbf2b766be418f6fac14fec7cb4fdaf16f1d3b8fab0fd84311aff506c4b9313679a24a2846a2e5f48ab59f03
-
Filesize
5.2MB
MD5df3964255a0ae063b3c724636dbbcc8e
SHA14290bded454ebb5a499e526437044443682f21cb
SHA256737fd2e90791c91e92a25e7458ddf3cc2810e3d5c4debff34f4cb4ff7d405381
SHA512c4dcde1c708be4611d204bd60c93e908f8c297e53ee9eddd2e788223cf1783d4dbfdac7c135da101286c4701fc62d1c1e1f850ac6823aef3bcb0c10ad579fd7d
-
Filesize
5.2MB
MD5eada35b84e77e5f60871d35a54ad9bdd
SHA1297dc150b4bf13d0caec5134fc95edb7e6f5f453
SHA25635641257db14695f745cc7a186fcadcf01394e70bc9baceb29a459abbcb94bdd
SHA5120d95b456d9ad03ea98f2206731a53d3e9d72c6774c4a5b65c9c98bab0b55c59949d43b6c8b2dd7fdba657f0fa02a5619b085c3a0d3f6bbdff0826813b2478f1c
-
Filesize
5.2MB
MD575190a6954527830a2da98511ce818de
SHA120f7b8dd7893e7800541cdfe6bb92e7739ce4231
SHA256dfe63cb7c1cb0b249467f6f29f6cb5fd8a34fee79c97fc1fec156c3566aabd51
SHA512458320a8a48be6b24cf492bb4178778664de5e38739818fc394d14722938ef74633d0f07cc6a8251245c832c26f883ed7fb9a5d2fc89b65986627868e5d89db8
-
Filesize
5.2MB
MD5febbd8fa0d84db69a218e2c7eb0a442b
SHA13af738191b7580a16357361cbc7aaba2c63a291f
SHA256a65f57eeb0d14622eaeeebdfa8ffff66ceb1b08997dce005cf109d488debbf89
SHA51208e67ee379aa4c3b1bfeaadc9b95712b2b6cc26f3b8611a55b76354dc1d18046b2db4bb14c5e7c5cf43bcd0a261b0418ab45d63dec529ebf3bf14ce3e3bbdc1d
-
Filesize
5.2MB
MD5b2abed8457864cd658dcd522b416265a
SHA11b12f58ca3c89a40faeaa4372dc9c009afad4f42
SHA256ef74a7212b654a73d7f2972e953c72ddfd8250d385aaa419c5985331a75a4f46
SHA51277c7a44baa53b6d830b64d5bb8f35ebc3b183c757893025f4c70823f576bb859fc2561f6ae0c07d3ce3c904550a8e20e52d2762dce0b7608ded9b177afcd597b
-
Filesize
5.2MB
MD5d05f70b3e2fefbca438d60d6eaa8f3c1
SHA11c8d4f1c3c09f7bbb9b81a82ec53f40f3a8432f4
SHA2563882feddf7090d9c68f604ec7b03c100c7a3bbf792ed321ce71bbe4d64c28c49
SHA512ec1172319d5a2f2df85bcfa1f3553ce8117884bb0792cdf6c6e9e881d2607279cf4206400a93567f8267f793575c7c11af24a6e6a80d085f6f2bf8726aedec83
-
Filesize
5.2MB
MD50bb28ceda38c01cfb8eefded0e4005d5
SHA1ccd0a61e8e1add340b7d34bc97b8c8b0ccf58744
SHA25691005b58c704137404b5b337fa5ded06cf44a203f07f3443c25e33c2127a1ee8
SHA51207c839236518262af91730fb2b627221145416df617c9b7158de6a1b2b9c849aaf967a7055913be97f14ba806f607df24f2a5f75bb7ae32ae72558ee2ed07ba3
-
Filesize
5.2MB
MD597c835546f71f78cb910ede2540c2e8a
SHA12245f2036582b9fa6a43285eddb1f0e472b0f013
SHA25699d45c1fb38bc80e49efc4326f26f48df180a02575d3b7e8e1f93eadb2dcb2e5
SHA5127f963d6a22d4a8c7e797db805b52b9da29f331c3dc8f7efbbebd0e2ab517c8c06e0d81cf248244a6895c4ffe3ac5a5c2a4364b24ed8ec648c35604b54018f8dd
-
Filesize
5.2MB
MD5ce8d28cc9ce9e9adc61842e6d4cf8a3c
SHA1550206644d208705bf3239244338286b63884532
SHA2565f0844b412bbde76fc4cf85aa94d1f5dae8b24e2f55b050a50568a62f33667cb
SHA512ea8cd9cf8bb64eecf413ac0c8135235c36ed17797b2b63b995cbc7d9f8d0070c7b946a88030cb3e6844585acd5f60786b0a1b9fd718792ade6672115216d91f9
-
Filesize
5.2MB
MD5a348c3dc092990b07d4485e139c494f2
SHA14eba5152357990c9d9861892eb575b4c376c6277
SHA256c4eeeaffc548b8acb4894a00a6075f7891e91b29218cd60eba31cdb22c02a8ed
SHA512f46eb1a068976a881c6bbc65a9e645b38e7718a456a4ed54b90d891966d087e8c7f764d56e5cb8ea685871ca30087918fd456c62cfec98162e6894285076742f
-
Filesize
5.2MB
MD578a64cff0586f7051b2da163ea0c341c
SHA11a88ae519806be29af2a3c391b3a71a79dfcc275
SHA25648f281591e3fe3975e97f467a9c15c6339cb35f7ff9dd55f397bcb27489c491d
SHA512ba0abaa63f4e0168dbd87097ac865e96a65f5dd926bc3fc263dd78d39675d2c55cd4048d63879bf432096be784708185f9c3c8f657332ad5e65edf874dc01f2e
-
Filesize
5.2MB
MD5ff333bc002898fd0f9037f19dabbd803
SHA1a3bfca5590b830e93d3bf545e04a1e84a00249fc
SHA2567baf33124e5f624f1303634fbe5c8cdf746a236f4312e692e88f78a86064c667
SHA512ca78d60b8fa4aa46a9492be35e3727d992803e7ed1a8c1d2f718d7ec310b41ade4dfe8cdf6cf1d60ed8815a2d5d2bf0ab52bf5d7cd56b815bb95cc1b0b9ead31
-
Filesize
5.2MB
MD558b01d580201c2ef086aaf9db87e2905
SHA1b3e2c026393f4bda20c404646082ffe989b83af8
SHA2567c6557c3caec56bdd5ec7ef88cd737618a4c3bb65cf83adc2e99a534931aa5bf
SHA512645e83c6f2d0439e0ae887070e20c97337bfac7a84127d677c3b0e9b103c1583e9cfc942598ed66bd3b50e0da0317461d0fd16b2c941e74692ce84fc799ce84a
-
Filesize
5.2MB
MD59aeac38938e601edfefdea21142de48b
SHA132e7765a1416db18c04aa9ab30a389a4a6fb492f
SHA2567a4ecebb2d066a4fbb7a05fc7dbbd1b074ac346358e354f0d249ba1abd9c6b4b
SHA5124eddf3c295021aa2366b81155753cfe4bc2a273f4454911668ccc5c6c6ffeefc9e34b5ffe3a5f30dd9c0dc85918473307a175bbcf23d504dceb9fac15a5fe51b
-
Filesize
5.2MB
MD594f5ec43c3857036a5905b17d08b2cc7
SHA179c2732d7babcda85601e76896c41c15665a56d2
SHA256fd76f32443e501976e38c003dd5973c81c6d8309415231fbdea909da37c28b2c
SHA5128b1572a8b2c7c971f77fd2a7745f6cb620c422fce66f8c6f7f4bcd09b105096e8f8a09e8a49e4f1bb749fb4f2378410c376b82a6526dfafa16dac90e9909105a
-
Filesize
5.2MB
MD5d747dfac8d49c07f72a4fa013e78f816
SHA1cb4ab69dee1eed623d948548e5fbd9d2dd1f3417
SHA2562cf32ee6baf5b923b7e51eb9f55d2a84de740d635947da6c8f323cfd79fb5e58
SHA5122437d3766375086d1e64a0a91acced60b0e46eacc274d5c10570245dd8fbf766fb080bca921978324a14da3e6093c59318efc4b48224394cd92fb0a999b7da5f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB