Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 12:49
General
-
Target
2024-12-17_9f97733c370afdf57011e9791ef3cd0c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9f97733c370afdf57011e9791ef3cd0c
-
SHA1
b2f6e9bcc10f05486d67a306f53ce7122694dca3
-
SHA256
cb5a83343ad98385feb91ff12e43b4be27d49b0bf6ec87db7d8869cce15f9b98
-
SHA512
09bfb056cf0dbdf5af06f68b8554c4a5780eb5f7a74a37ab2a6d11280b022c14d8e0b51fef0ff49a159e0b8238a2074fef3f7fc4287a076dfb645c1f8846d435
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBib+56utgpPFotBER/mQ32lUS
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_9f97733c370afdf57011e9791ef3cd0c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_9f97733c370afdf57011e9791ef3cd0c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\MfdEReV.exeC:\Windows\System\MfdEReV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZjoWgFF.exeC:\Windows\System\ZjoWgFF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qwybIxj.exeC:\Windows\System\qwybIxj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oksXXtV.exeC:\Windows\System\oksXXtV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZkLKiRh.exeC:\Windows\System\ZkLKiRh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tAGysDK.exeC:\Windows\System\tAGysDK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HcUoMBi.exeC:\Windows\System\HcUoMBi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ArWzxIb.exeC:\Windows\System\ArWzxIb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MRJurAt.exeC:\Windows\System\MRJurAt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qryoEqa.exeC:\Windows\System\qryoEqa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vSFGdpk.exeC:\Windows\System\vSFGdpk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UqFzeQf.exeC:\Windows\System\UqFzeQf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HBRgzEX.exeC:\Windows\System\HBRgzEX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GGzlhfL.exeC:\Windows\System\GGzlhfL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bTCpoab.exeC:\Windows\System\bTCpoab.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NnnYPoh.exeC:\Windows\System\NnnYPoh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SfkPNCo.exeC:\Windows\System\SfkPNCo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWzcnun.exeC:\Windows\System\tWzcnun.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BeUQNDI.exeC:\Windows\System\BeUQNDI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jknKCWJ.exeC:\Windows\System\jknKCWJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LCzrIpq.exeC:\Windows\System\LCzrIpq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD523995bb149e976892c09056531cbe032
SHA135f5ee1fb9a9d7468346296fe82406ec2518adbb
SHA256f950bb115414db48313a1ed8a0284a56737512418ca3728919da1033f7f52962
SHA512c1cc8332e3ddbe8cd970400b421766529f8ed612fe5f227f5e29709143248f36f1703a54cea2f3ad010608da4e8e0e54d1727b4c67ba35c49a1fe62de621cae4
-
Filesize
5.2MB
MD5782b6dd2b3891113fe69420b3e731bdc
SHA15b153b069f1eee172d3f3f8475a8d1db6acb2686
SHA256c5fd8d89f92b17249f9d6c9e048a7d472ea040b52b286fa6bd6c361a4ab4e718
SHA5129a29ddc3ed537bab3f61912458e3ba23927fee9d6bc87002a8856510549e14c6cceb5fd71efa0cefb789e286386b5da0d85c2ab83ddc0e76186e32ffe7ef239a
-
Filesize
5.2MB
MD5bedcca182447aec4e0809c6086db2c50
SHA153fbf8bb5947b64408fd57b766d37fb3ba587d3c
SHA256402a4cffdbbfa036763eacf3d9e850960034fb27a228f32f23bc20fb80bad447
SHA5123cd0e2643a5ed9d87f36f2d98a6d5d8c8805878f0d0eb63c61c50810051eac10650193e4dbdc0608208630a8b8d2f6407536ef2f9808d706a7b36dc70f97a892
-
Filesize
5.2MB
MD53e525a5e6928332a9587200341588cff
SHA1d820741b7efdb235c0c64218dcf7f3d6c0d58016
SHA256a5ded73ad8cafbb58eeb77d2b77989de61632fb12b156c96231228b4f1c50060
SHA5128108bcf3319d32c1fee00984d7f23d9740016366a5003ba119a8d21554a3a4bf278ef49770917d7102dbdba983fe44003c3a7d088b0de44e28d4a89fa45e49b0
-
Filesize
5.2MB
MD547a44950ed59258cbaa1a91b3916bb9b
SHA15b1d7b4b339dca04a2b3dd1277f0867888fa37ef
SHA256966971bd42b3fbc83f76e0b45c307b46c582c1f73800f684f18fee90f5e233f2
SHA512270107d26d34f3cc33d82c235dba8a0c2f1ef4aa62f2576e48699112f32a73c83d61da83368953e729e39418a3464ebc72be9cbfc3b6f19d82642175f58404ca
-
Filesize
5.2MB
MD5eaada009fabe46418dab9e51b9435d78
SHA104f1abe1aeebcdf02863730712d50eb6727c87cf
SHA256c558adf6da83222cf1d2e29557de46dca60c483e957b294f6b9badaf16a4ca5e
SHA5123341984b872017944cb4874daed3a503ed2e3248cb62adac017af854197d177184fa1017a7255f44fd9a0e6c90e5206c7161bf10ff2437d0d17bd3110d695483
-
Filesize
5.2MB
MD58756cfc31fadf27a89bcdcb6401bb220
SHA1ebc90b98ab80b9ac03d76fa16cc86c8e5b7de567
SHA2565766a19dcd86b1c9ac4ba02cfae1cdebffb7d48d98b67927361ecb069419f39c
SHA512db297ceeeb84ff64035b714e1afb7633b2523f2d68a2c3681508ff41c2cf5b25c478f394ec6d59613c6c355c95ebd438867d64ec7254f59833faf35d2a82652e
-
Filesize
5.2MB
MD5a4ab7b58fdb5c3c790968aba9174c3e6
SHA1e994934a290cce7777efc48039e4dbd0dd50e2d8
SHA2561efba88a46f5cebbf90744731020f151ce9051242969939ffe89469a7c457f7f
SHA51299aaf8e65fd375a42052ac442d9deb672f66e75dba7bfb97fa02a253c251bcfd109407072645923efc5b239d22d7d6e9b2bb9ccbfd04829be9064dae0dcba0d2
-
Filesize
5.2MB
MD51d44ed6194d5f4f6bbe81a81a1191ef5
SHA1fb5e9763aefe06f8570ee10ecfba4d7b58975818
SHA256a957e8fd775ef6be8a4d83c747249104210a768faf32c95aae0c5f4f3958c11b
SHA5124ab83741e9a77e5bb4d7096cce3ff0f29d6a40b3afc206f80a895a20b5c85e88f70657c3cebbf1725efc2de03a982ba5854041cfb72ce470f3d3ce62b1946c5d
-
Filesize
5.2MB
MD54b50e74da770f909b00f7dfc3c126fb0
SHA140a7ece9c1b1cc025f5be9a79c9b9a03856f06af
SHA2562fe5c674547205bbd22092dc8918b2a85b8e09e99b51e634989ee183cc9b2995
SHA512d4e54fd1038439d65064371379859f93b7961c4c802edb73c47c9c45cf5d945008b80245964b4e7f0946c07ad31a63850ef6cd534596d9ff956e0e968d5284d1
-
Filesize
5.2MB
MD514ed264555d0e0309774b03c90982057
SHA18b39e4f685a94a47635a010f27a2a90f21643734
SHA256b98cbb00f2d80a4812a9452f9481e6cbc428693464304e672b08c42d55296bb8
SHA51218601bab5b2f1aee8bbb436b3a6857b1b8727e41eeeb03c45554653c8e1bed95f12e85b9bfcb5371e4a8f8006f1c5cafb7189142722cd97b566f3404e147064f
-
Filesize
5.2MB
MD512f5263bc89e8e2a74401091168bc2ea
SHA16d20e4003efc21a04400e169c682ceb5ff2bf509
SHA2560a9031612a523d1955eeeaf0c57091d38758a1ac90aaa5edcf00b142c4913c52
SHA512132a3edfbdefc75f13eb448a22342cf399b72d82c5026777b9d7cd88facedf8a35a1500f2cc22685efd5191aed8289b9d755d89deaed57faa9cefee1c8dd914d
-
Filesize
5.2MB
MD560cce1071fe5cdab8e461473e13fe82e
SHA1c5cdd7bf9b6e93008c5fc5e9a5413d8cb1483d2a
SHA256e1150c88a709b52b22a0bfc20d4acd1b1839c2fda9b9c5f2ef92062e83faa86e
SHA51225fd5b21a934c6326f4758541049ccc52f3a0c20772d305a7fd45ee105872fcaa417e5bf3518414e25c7f3c9c9d74ff86c26d48335f4ca47cf94ad1fc644def6
-
Filesize
5.2MB
MD59d9e90fe4c77319dc9921920449fc246
SHA15e3bfd4d5f5887e8e1c6691ed29f3e0cd34d1332
SHA256a9cdc2d775c8b029f943861a8b4a7569e1cff60359f770c638915a5007f6b726
SHA51218f755693f89fcdfef917d320ff2e35aab7804a739ac5e02b06f6f35e3e5a1060ec9717bf6179306baa51393161ebd8cb4ac86ae7d31d31d9479d9706590c4eb
-
Filesize
5.2MB
MD5dca5a3b9364bcad8bd37a477af494b67
SHA1be0727ebc3747f7f2cd69bff59383c169ab3c58d
SHA2569bfcfe972222f6078e000f3ed24e06deffc4a40315635d95e13f0a47e4504b62
SHA51220ac98bedcb9f9558b3e27b8d714dba585d7c2f2ff247e1257c578c169c783bbdf4e921c829ad81222c822904a963558596e1ef06d23bf90df42838458b6e1a9
-
Filesize
5.2MB
MD56f08138ffc89dd667375bf529166dcb7
SHA158650bd2b6f72fc57b942239ecfdb0ac86f4d089
SHA25640579112d503fe840445c2ad03ba7221dfd184b9edc9e3c9803943c2294d065e
SHA5129db49f98dbbfd2df0891f72c5796d612d64719f8265db1cae935e30c20396d61f959cf930ac886d3888bf7b06949fd6d25a1095a75c4f6d18d6e2db306b82c09
-
Filesize
5.2MB
MD5fb1624cdbc5e682406197294c8f327fc
SHA181da6c0d40fa760615a651d10fa77ce8e03392f9
SHA256737118bc66dcfc65093e5d7e735e86e6e3af9fac9a5ac1ffeb862bc7a712d10c
SHA5121643cb898cf36fd69d8f57305b603eac6e2b10c4b19ba1b3fe2be147e2419eb7f0e4db2fef0c6b0f7dc454594c979fb7eabe2c46d77ee2db593b58bf040176c6
-
Filesize
5.2MB
MD5adc64cfe5c95f037b8b58bfcfcf6d0c5
SHA18d80d24dbdabe267db0a16e1a290ff1e5914b4e1
SHA256a7366f30e25eab0fb10f688b26365eb60e3c547d3bc6bde067163095dd157292
SHA512c6c441178a800bb22639c946367c46575d2210a5cf27be767001aa4f3187186947dfd7fb65064ba38903417b95e7f4f2ac6fcd730322c73a26f50b99d77ed217
-
Filesize
5.2MB
MD5908d8e58daf48f9cfc374ad489ad03fa
SHA1910cc0d14e68257d8c386d7a4e9199b1be267ca2
SHA256ab3d490ac3cce815767606d80cf9dfe9e3279086821f300b5c13e36784a02993
SHA51234928311c3ef71d557bd0f622cf5b70e79c1e6259223587afd768f8c36fb14992eb980350089ae959bc24884a77cd3b20574f1aca240b340100e320ea3b5f29d
-
Filesize
5.2MB
MD5c7d3e642316d3cb91a9d50a15db1d690
SHA169bdb5b438e9bd440dc55b500c2fce765e60de9f
SHA25618f8ab0526e72b98e8e0c0fc6a643e209ae1be7ef7f30b69b54e5106004ae82e
SHA51208f2f49a8325ffc5c4320089c5989c1970460758e78bca3e8e101ad99913c94e6e5844f96fcf512c7c6ebc7bde6ca11315b86cad5999cb8bcc0beb20e8182306
-
Filesize
5.2MB
MD57d5ae073fbb2754b256b4d889d9d49bc
SHA1955f4a3aa5bff25b0b27cef9dc29226cdbe1762a
SHA2562d8b0c2ee56824ecc2c5e96ae55e7c50cc2097945c644ff8decd43a246eb945e
SHA5126d07b514a7f545109a299de6c63fcdd779ab60d8371e7f55ca2eb081655c80f6b11d3b8f559e1a68b2a52a94628025efad1caeb49263e7aaa6b53c396b1b7dfe
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB