Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17-12-2024 12:49
General
-
Target
2024-12-17_ab121c4ea54c859b5668bad2165b10bf_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ab121c4ea54c859b5668bad2165b10bf
-
SHA1
0d51b9cb604d8514c4f1d4f9e0595de3f782badd
-
SHA256
534b626544c76bad2a554141e79c2b0fa76cb6833fee295a3c76d409ae996896
-
SHA512
14bddf33899e8f1ed41a0e68b3763e581540b62defd4ab999d9340ee02a729a26b016931181100c4651a8fb46a1ea407e55c70c3e650f0d3f31d982eb9b8e396
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBib+56utgpPFotBER/mQ32lUL
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_ab121c4ea54c859b5668bad2165b10bf_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_ab121c4ea54c859b5668bad2165b10bf_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jgJsYxg.exeC:\Windows\System\jgJsYxg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QnDZefc.exeC:\Windows\System\QnDZefc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BycMhDU.exeC:\Windows\System\BycMhDU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\klgKUeN.exeC:\Windows\System\klgKUeN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DJOqphS.exeC:\Windows\System\DJOqphS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ishmyZn.exeC:\Windows\System\ishmyZn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KKjtWEa.exeC:\Windows\System\KKjtWEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kMjGdyT.exeC:\Windows\System\kMjGdyT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bQdTlRy.exeC:\Windows\System\bQdTlRy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nkjZiqH.exeC:\Windows\System\nkjZiqH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\csWjmCY.exeC:\Windows\System\csWjmCY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mnKbxUq.exeC:\Windows\System\mnKbxUq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TVdGyzX.exeC:\Windows\System\TVdGyzX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IluQpvO.exeC:\Windows\System\IluQpvO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OndxRts.exeC:\Windows\System\OndxRts.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lodvuhh.exeC:\Windows\System\lodvuhh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\erYJBEL.exeC:\Windows\System\erYJBEL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VHicrxK.exeC:\Windows\System\VHicrxK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Tvsnfpr.exeC:\Windows\System\Tvsnfpr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nBtUezl.exeC:\Windows\System\nBtUezl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xSzfZCZ.exeC:\Windows\System\xSzfZCZ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b301ea8cda3ee6039e23c3b1d6ddc50b
SHA13289f77275dd6e2076477194cb3c96298e9580e9
SHA2564106d579fe4c8e37767e81dedb3ecef93cde1bb67615aa1907a6d4e3f3f0667e
SHA51235904fcf58b4c34ed139b7653d8f7c1f95a3794c8a5893ec4bd0a664625685dbb92a329a68b45dd44d382f29a51ab65bacef3c8f8837a2ee6241cce40252fdf2
-
Filesize
5.2MB
MD5d3d80f189e520fd3aac396354b20dbef
SHA17982b7cbd8fca26f0bab0bde993c4be8ac9c3916
SHA25684f9dcb94b0e19a2e0ee32dd341e9cf8b42de7403d90f0f7a4ce51e9e6ecff63
SHA5127c24ef980a86de5964a627ba869e33282de87dc2fe95d76fc413520c02694f81cff987fd3f032ca23600f5095aec40402c2e652cdeb9d8d87329731f81fffed7
-
Filesize
5.2MB
MD5c5920b8b6ce95ac9b6fc30eda1f413a5
SHA1404cf80b74bb5f43ac68bd13102af6f0edf301ed
SHA256ae0e92ef0f270efdab98f2eabcd299585ed0ab461a78356c99d2b4e24f2638d0
SHA512e7473f876fdad6283ac7dd48c9dca859ef8989cb4a70bef928dc6c9911c67265de35a4f0658ea16cba06fe69709ef89b1815256e7c5b23e8adaa557d56f86089
-
Filesize
5.2MB
MD510e3e18dcd3d156eb077d2cf0d4e375d
SHA1adbf75a7775e98e4e824f39909577eccd71179a2
SHA256dd5bbc8c46528f40944eb85b6843a2cd9d180c0ff527330ef886d3860579e2ea
SHA512bc7ad0b261f886e51600242f5b1f5251c915e536d9850e4423bb45d2cf88f0cce9feecf4f98c592be8fe0b7d95a40f1215c10e56e6321de7bfc98c7828f98ae1
-
Filesize
5.2MB
MD5dfd930b941fff55f503ae99c7219c94b
SHA1b4b1c1cba2c9edcd364ccea770a9ddc04368da42
SHA256065104feddaef065d76e07ab51c6ed219a3f8613705597073c27402cfbaf89d5
SHA51235eb77db5b3106d95c11c547e6c1fb3871827d80cb55dad23f98391a8b6d2d67fd2c504cfb3dc8744cc116fe55fbc83501a470705034ec4cce0bef60deba80d2
-
Filesize
5.2MB
MD506fc7fac7799aab4a99aaed946415968
SHA17b0b2a8bf40cdc02ed156420b0c076f31a901ce7
SHA256020a97a74420345cc5ab40f0805088f6fe0c14d74dfc8cc43233475d61e93ed6
SHA512cfd880527dafe6c16808e7e5836efe8a861bc265cf2371617e31e9e5cabe5cef5878fa74f6e6eb59c29d983183deb2f96df265db7293d6ee37bff28ff1239fe1
-
Filesize
5.2MB
MD52726a207d75316c965a9bdd40b6f8e79
SHA1a967820211b1c08aafe7fea209f56331283f2e19
SHA2564c95d28fc48abb2a77b112ec04cec07ed5a26dfab1a5ad55d5af9fdb66435e6d
SHA51299d1f7ff9b50f06384d8d8e2cb1313b6b3ff6d7b7705fa69fa3cbee4a1a2cd1b39678a08f4a1497bc37d2d67b1f1d16752f801d092a7c363e3e52f393c3fa288
-
Filesize
5.2MB
MD5114187c90d47e7010f29019ebd8ec94a
SHA1cf7dc97e70053c80907eb2c1bd2242108ce29cfa
SHA256a89e4515fda2fecc60e8ce6643b82d4d798c05130d528d8a29612af84f820824
SHA512259c0955140654640a6cea49955765e4ac4fd904dd1d52e8192d3dc14d7f64c8bb9d87051e954c5c6ab22dadbd04c3cd33ac5a743cd937116080a92126b911ce
-
Filesize
5.2MB
MD52c7341bf503a2631ebe3de7c05c97526
SHA1d491ec7e95fee7d942ae859188a8e347b6afb5aa
SHA256ecc0f55c10f45b534ca35ee6a07fcb473323e0f75009190d0bfe49c7ed413ba3
SHA512e6ad4bc1344bbaf1fd9082166415d81354d38f60ed6e705a6687d0d1e36da1df021b4e8be2655f26f7b57711a82263296ae4fdf77328241077d9f8c25a9f3002
-
Filesize
5.2MB
MD5f18c21826bd35c68498f1716065d8f21
SHA18adc6429bdfe15b2ecad226342f6377adfda4be6
SHA25601039b8ec24d1f24f0ad520a5448fcd0bb37ad387b605d352f69ed6e2bc76d52
SHA51272a9e386ec44da121691e5bef23ba47073cddd9591d4bf6824261fe30d41c41c18557bf3d469e57dcb6f9b06f4390d560fe6f13937b0369da27fe200dc7b305b
-
Filesize
5.2MB
MD58629dbc9b22d204a4be17249b5e1e87e
SHA1d23642249aa149afb21153ba2116ebd1d0c5e01e
SHA256ccf30a088e5648b0178f01d768c8e2217e2d29303e04610a4df542a6086e5e73
SHA51253db2cc7921c74eb6fba9be2bbd1f639061e0fbd78be3cde1f8a1cf136bffd1a6fa97496d7842ade542feaee1378510767d4b02f741eb6aa57589112fde26f09
-
Filesize
5.2MB
MD5b57c57c6ea03d6fbb7de738d54cd9f4c
SHA1335c575c333b1526fbf0958ac0d5e7b066c9dc9b
SHA2562588104da581cfd979a4eaf76f0828299495db33ee4086b6b66c7b0b79917007
SHA5121451c134ffb3e7ed76a94ee2a2f309fa87d9d79b38354c2f7d55a0751a9fa99340af678d37619be58c686cf5630f88e6772c4c34fd1576872c3d282f06c57251
-
Filesize
5.2MB
MD5d9bcfef1125777d93a122eff40970843
SHA17ebe9f8cae7805816b595b283ad541d109072959
SHA2561d49b0aedafef619de38f6ed55b78cbd58ded4a046abab09aff35d2a07b956c2
SHA512da1a7b3370c61ad0404bb0dc27f53849b66a57a5ebe77bc23889edc6a94ee6140d89484cb743910ef8196d4d66fbcef1c6bef6b27f3b8b3746e4a97a1aa48e94
-
Filesize
5.2MB
MD526f2a8c6223224b9ae50c888d3b574ad
SHA1f2396b3651faf1a3b63587ecb2e74cd8a33673c0
SHA2567228d6e69b9e0b6341ea8abc593a1b8010f3bbedff96a033ec0f19fe9a680719
SHA51267fa3d49f0f2bf0f3c6a28a9f3d4cda50155d9dab11b55ee135407b782ed813f8fcd3a63d6e4f2c620e7fe69ab8900862058c80b0e988c5b8a9d75511fce1b23
-
Filesize
5.2MB
MD5da935f442a504bd5af4538cc0efc56a3
SHA11e6ced72bd93485e7fa9738dc836ee6252cdfa3e
SHA256576a1c5cf22f5e1680e4e904eddab687c6685f15fe5c4029b286740eb2fd3605
SHA512dd4ac5c8142b9498f47843ad69e7af64bca251f6480ea22895276f581ddf8b6beb2ce2fb96968e353d37444c3980c36ae83bbc4550471983fcd0c052fe2c814f
-
Filesize
5.2MB
MD5f89dc1b0ed8508880d19cdb00489edee
SHA188d7f1cb516c49c8188acdd6e0671dbeb44194f7
SHA256e79d7e84b17d66dfa4784d41879a6038eb27b6d4535c9335557b1075bb1bf73f
SHA51248997e87fb3d17821fb0e09af917f22b86d54f7cecc70a542ac2c38743efeb58a4fa328049a12f26a6e779c17d8d0971f1aa9b1c4fc04bb8e18fdfa955e02834
-
Filesize
5.2MB
MD51e9c71a64d776c45230d1b9f4aa59bb2
SHA1446963f9b34330f5fdad787e1eca5c5dd6e3737b
SHA25687273a9f44b157aef2d13a89394f52bfe254703d6f39b1e4bd7ae390f7bcb22f
SHA512afde49c1f24bec39dc29ce6a430880df3b1067c40bb365a45f4e0575ea28923cd85ca4c28f539694a38a7bb33333ce684c7e3aa710bdd1433b533308a29436c2
-
Filesize
5.2MB
MD5b9aa8e4390250ae6d0da73c456a14569
SHA1078cf6f3f67048d515c872aafa73b11e9bd11a7e
SHA25657b14d54ad857eb51cc9971b8b106bc1c79015d1dc43042de3d9b2e08db33735
SHA512d9c0235ca5f344039b2252d726f9e2232ac6f900a5a20b6c22a7e3a6acb258244e5ff2b8a2cad8608d14a5d60986d60def36e1185fe129d88421d382c236fe06
-
Filesize
5.2MB
MD530aee3b9ad762dbdc04776387c62a46c
SHA1cb1d465fce3aa78a8ac0dc7a324fc08938d09a56
SHA2565cab63748910d1c208941261548cfb51ad3397e9e6e364bb3388fa0dc3ac6792
SHA5127bc7fcfa49a365ddc9ac4f7ca8f61405fd20f7281f0461aecd0e18188e8e44fde4a776348373f05ee626f666101061ffb824b35be7609bd1fb7dba5adecfaa21
-
Filesize
5.2MB
MD5251b42c27533c1f08db41ef8e0538e7a
SHA128b69e62fd97a57548a903a38b7d633641402bfc
SHA256608210955562b3dc52d844d86b7e82b832cda258b55235daea5f13f69b25cf2e
SHA51252d973eb733b3b58a020ac7adca3cabc9b7d07a04e864042a9a06478ca2a90b40d06eefac15abf10e7c94eb0074fcdc329fd36491e9e7769c8917bdf48495c80
-
Filesize
5.2MB
MD519a7ee90e3dee37f46c0b2057b5c43f6
SHA19371caf3c869f60686d091981b57252fbfd76628
SHA25692cdfdafb3a85deef43bc88f9f409213ccbc2e27763eb35f8236a910a40ccc50
SHA51284009010d29656e2228ec994706cfe5c9a667d7132542007a54357f700e89fee8f9a44724d6a7ffbf2cf79dd02f21fdffadf22b07f8cc23de6b9923cec262cc5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB