Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
17-12-2024 12:48
General
-
Target
2024-12-17_8dd7d4963553e370090c419b70e5f1ba_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8dd7d4963553e370090c419b70e5f1ba
-
SHA1
be293f2233f734c9ef63c3b20966c6b608167007
-
SHA256
56d9f85da8c7bac86584050e6bf0b2437a14e886c29c7e5956478c1e1d9902e3
-
SHA512
7d7d07e41e0d5ac08939aed0afc0a8cd0a013a41df44c3487d9854d696a7e093d9c479856100b2dd74dac0e85cf900aaf653578ca5b0cf4983b7c34d49fa5249
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBib+56utgpPFotBER/mQ32lUZ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_8dd7d4963553e370090c419b70e5f1ba_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_8dd7d4963553e370090c419b70e5f1ba_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jYIxgKS.exeC:\Windows\System\jYIxgKS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ANtLWMM.exeC:\Windows\System\ANtLWMM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NKBYBPc.exeC:\Windows\System\NKBYBPc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jjnIkFH.exeC:\Windows\System\jjnIkFH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GBWxkvq.exeC:\Windows\System\GBWxkvq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HgerBbB.exeC:\Windows\System\HgerBbB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jgLXbSg.exeC:\Windows\System\jgLXbSg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mAnBXxj.exeC:\Windows\System\mAnBXxj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BMGilqs.exeC:\Windows\System\BMGilqs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NxWmJqo.exeC:\Windows\System\NxWmJqo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eNUmmuO.exeC:\Windows\System\eNUmmuO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BBQqrvv.exeC:\Windows\System\BBQqrvv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jXihNxr.exeC:\Windows\System\jXihNxr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HItGVUX.exeC:\Windows\System\HItGVUX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ynGtMWG.exeC:\Windows\System\ynGtMWG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WjUkOkd.exeC:\Windows\System\WjUkOkd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iRcniKG.exeC:\Windows\System\iRcniKG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XkNdMBp.exeC:\Windows\System\XkNdMBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MGFTOYs.exeC:\Windows\System\MGFTOYs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BsZAhrX.exeC:\Windows\System\BsZAhrX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BzkIkPh.exeC:\Windows\System\BzkIkPh.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52b0830b7d9b729e88fe74141f6668eb9
SHA1a22064ef5769ed3eaa04b9395f794421e3cf0ffa
SHA256ac815e4c3928e0872496583b3dbe03f4acb47dc26f217cbb1c0cf9c384cf422a
SHA512615316a3ec3a23a5954c3e8ee8d9c917fdbb28a11ae8306fefd78f6a3dcb613c0141e033071675347a2d93f527f9292b57c20f90427bd15081e6dcc5c8bac3eb
-
Filesize
5.2MB
MD5dd8897d1f3cbfe6d8cd5a8d677ca79a7
SHA1035b2ff6b34b3612bf3f08cf2a4ef14040ebc6a6
SHA25687d8214b63b07b5eb80e08235e7ac6a4c56c6b50219edc356f8aafc5486cd3b0
SHA5129ab1df52194d560c266550a011fede183f0f22418e8d9e755237cf02f786d8c6603cadfc2aafee33bca3704d1bb6d590e1e8866a17f13787a5f852b70d521ec0
-
Filesize
5.2MB
MD53faa44445e3b920fb40c41c1e4702ed1
SHA1a782b55f3ebeb9a54b7018b7437ca71a5b1e34b6
SHA25609aa76538e0f590c84ce79da59ca75fffa63afb217fd793bbff98380c812fc63
SHA5126ee61594b492ae3fa0ff26d3bbb60f7a46bd316242deedc91fa44d038c199fc30f4fb2be85617c0ff35a5dba56ef5724cd8fb74579a4adc3b7cf042b7e094c24
-
Filesize
5.2MB
MD5e3fedfea47e793b3da1eb18ab784a3b4
SHA1956b91a44aa52b9521a01e0657e091972211549c
SHA25618a263f27430447f5086bf059045dcab189892e3af380151c8898934ff24a63a
SHA512f27b09e2618a0b0474d0bab970e351ae83dc3a420c2e420f3f26244fff2fa9f3063e47a776e8167af138f39834c284a4de6ba188303c343b9f0a197b5f2034a8
-
Filesize
5.2MB
MD54d6bfa00f803fd7e0b2ad2afb6fb3a45
SHA1d12fb34bd9e3d0a5d8628c6ab53beddd66b18d42
SHA256c8658bd85d162ca87547faef841e590d84256cef65db4c8f842375c6503e2c4c
SHA5128c7656e814aacc461c79d79335ec7ed8368124b799e1695747dd810652ca98c2e1f44e19ae70e74a66669051dfea004273484450d3f163bb30e63233e471164b
-
Filesize
5.2MB
MD5551e13d7d08bc91951a8b8fadad145fe
SHA1db46513d30a01727df3d51b7998b9929ce5e0f44
SHA256b687c17f921040a1a0107374efc57f72804780af229e6bf0ff9bd892fa8789d7
SHA512092f9bec659361994246df44ed938147420e0a892b01b7c445342b9e16b7ffee8aec58c00b4d901daba39daef3e2a9e93b573ee390d618151a4f8056bc50dc52
-
Filesize
5.2MB
MD51c0ce00ca3d4994da83c3cc8f07cc804
SHA1b5bb50136eb02ca11c5112393555d9f7ffc45e0c
SHA2563e54fbc850a63213878401a6063554d83a5213848ec6ab19204d761699d9a2b9
SHA512b6eceac2e863ff1614292487c54166fcb21a14c3cbc037aca225f80d385c2765df9e27801ef070c4cad64acb7b26d197ac8f6a9154022c7167595103fc89f344
-
Filesize
5.2MB
MD503fb6e80fc902022e0c821ab03f4a74d
SHA134aa5f87a1c6c7ec76d76932ed8546794506facb
SHA2561df23f5ba52770d34783fd2af93d6af8be9b759f33733285e6fd62536b52f757
SHA5129ce104939cd59c27f7710bb06f243813828bd55e212464f0b679941d961ada2ffb7851f9679c491e5739250cc430a49018092a090387edb15eee1d284e7e7b39
-
Filesize
5.2MB
MD59bd42ef7af7266a1452b93cefb3abf7c
SHA152c29ab80dd27df46f2c9887cc062860deb7e2eb
SHA2562fe7dd91583c2816ff85c0e4a9f8b5e916bfb56ba270e49b0cc07536ac2d11f4
SHA5125f8a79d92150aeabb357c6dc8c22431c977d20cd0a1f958a8c7ab1cd131790f91f3e10d682d1845a5a827f4b9ba1ed1bb58aa320534baeafdd8fb818ef28398a
-
Filesize
5.2MB
MD557f7812237ad4b9a86b19569a6f9cb88
SHA16e6d203f711d24b04e4accad2a1f5aa36e3b339c
SHA25644d9fef02be860d402fece11e939ec3e9fe3fa74165047df7b8b4809026fcc48
SHA512e281af97a4b0a72bbec63bc6e55c07eca8249982d8fb9a0d2d141cd4e6409d671738bd855a146d3d0074f14489bbedc013bbe504e82a3f611813d10d055b5c6b
-
Filesize
5.2MB
MD5d71d3e0b418b31ee4c3a84cd8ab141df
SHA1c7b750083b29a9876c1c843e362536f8445217c0
SHA2568a6431032c7493ff64f1dbe6579b7e07c2a995efa6d6f97b8b313d95b1e8b28e
SHA512d68df235cd2b86c7bfedc59a782b14be515b603fde912f2df1cd17581c5abed31e2bc5257c647be2ef7be63d810468eeb2ac14a89f4c5611f279e1e671a3ee76
-
Filesize
5.2MB
MD5017dda49a6fbb3897582c5bfe1a4e598
SHA12691868b25c4f765c8546a0544bf684e96fbb54f
SHA256f27bced4663a98ab0bd87dc85447f72b05e0b23a9f80bcf18a2e9e4e5c638ff5
SHA512bd95694573ca71e6ad64cbcdb4e93d9998bc89a1c5c21d4de4135d0645e59d0ff54a4a6ad920266ba13d478ad685008eea39576112c51906cfc07e12c6b5332b
-
Filesize
5.2MB
MD565a3e80742df282d2708f0e308ca94f6
SHA14b69c9ca736af043ec1906b17d9d0dd2870cbd63
SHA256dfc62b090206a5933bdd66dd0a01d71a550322e0d810b3db9f26c8495f300779
SHA5126622edd2ab0a093f694655438cb02fb832de1e4fcb4dea81cf3dcdc1a611350e4d6c394dbba8f722eaf1254825a31b4c4110016992598455742ab96de917eff7
-
Filesize
5.2MB
MD5eafe8a5cf68413a734440adebfc50c98
SHA1d842ddc3f3fba901776325a94da75225e9c83f2f
SHA2561978fbd539cd7fd9628e6cf7e7dee140e55e087cac19c2c2b0198d660f098727
SHA5120c94b5ed2c7b6d0324c61e9d364925b7375244ffcbf40102c734f81e394ac80987603977e9360fe7e266f0dc92bdacb8183413f2ce4832f059f22c62c882dd25
-
Filesize
5.2MB
MD5dff39197fdceea4914e8cbf66e47bf31
SHA1cd36ecc3ef735bcd92855a259be906dd3cf5ea26
SHA2562d775614bb977a4a6ef17b0ced02c35b3ed77dc4f4903221335fb0d393d9953e
SHA512c4673d1d1905368c7ae79a1d2cdf49ff4f4db04f151fe6193a54aeddc9d57fc862b9668934c9de0964ba93c606760b11025d3fbdc5ddaff126cfc8c2f0ef500e
-
Filesize
5.2MB
MD571f032a1b34e9dbe2b038c1bd252fa8a
SHA15e2b00ecdd276c86bf968347bace5072d046c539
SHA256f575423d076b2f0f994a23ce3ace8f4e10c27743ce7bf50c8d6d380bbeeecb0f
SHA51222bfe8cfc50e043883a8ee5024897bf1011ba953dbde3cc9327e7b23fcfbf8829b74a4bdaaa23087cac8a09b47e74ee59a9a519a5ad62c73a7dfeee440472052
-
Filesize
5.2MB
MD5f634680551907132762ddbf5e9a12cf3
SHA10fabed797a96c8fe04a8a68ca825b5b1cdaea51c
SHA2561caf2bc5494428335dbc5627ede756cf681b1254505cb30a89e434081d733818
SHA51297a36c4b1b98a18e5e09ba0d783124168de1e8aed36c706faf62622698301d0d678c85acfc0b3565ed94ac555215c17c1cdc4026f54d1a3bd54e23ae449382c4
-
Filesize
5.2MB
MD50c46fe8cc1926b9b3518457632aa14ea
SHA1f9c4c8481e41d39a1cf85be248adaefb3f39b452
SHA256457cfbb9e1460568eb70c3cb3523434e4697d48b450c69d21202bb317b16e277
SHA512eb450c933cd72a8ee6d6c91b115fbdecc881fee825e4b47e0eefad60a29e6cf57639809c819ed757383c3747ce2bf1f166618f418440b7a87fbdeb6c9e2367a0
-
Filesize
5.2MB
MD50f978a8cbcfb34ac1e9fa4e0c1bf2a66
SHA1fb0d2d581155ebb5f806816e0b15008076b4a9af
SHA2562b2d0dfb8ec30ce47acc50d08991df285cce4307a51f6ae82c7e693987691282
SHA512289c3fdd2f758cda0bb81e88cf59baafb63826d9baddb2bc6e677bf4bfd8009ff284079e39586aeb0d24303d9dcab67e0bfca7155d86a012d5df15d0261ffc03
-
Filesize
5.2MB
MD5ee4fbb0140c72057f7034e29fc02fc4e
SHA1fa2187505340a2467597eb7723d9ceea88e95ba8
SHA256cb806b4e469287a31f6b5155da2d5daf0e13c4caadd8c5c8d51adc6ccd0530b4
SHA512db494924aba17faaab7ac40cc567e50a0c1ee5f851ac6613ddbab3eacbef75c0da00b120a55ef1ab635beccad246d4465a95728b94be9f1c1c3a8ce80b9d1876
-
Filesize
5.2MB
MD5cc5f101ee33889541a2b7303feda7970
SHA1659e78efced3ea8be878bee21e11bbf6839ca278
SHA256a838a947def18bde0a477b7a12a4be802553ed819639753e37202bf3818639e9
SHA5121ecb4fe1b5c6442a1899ca2bdd2e246a9379ebef615f4f9fb6f014b317cb4c1a7dc0450fd7bf77c5f1eed21cc71467257abddbbcdf3c0ae27d852d199d2bd1ea
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB