Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
17-12-2024 12:52
General
-
Target
2024-12-17_fa6eedf895a737ee0f34c4ec5533308c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
fa6eedf895a737ee0f34c4ec5533308c
-
SHA1
af5cda5f0346c151a0b9c11fd53518285b8e9552
-
SHA256
0f3b200e55738526ad7b9fd157f70646e688febc023d62f2e75f15fe94bffce4
-
SHA512
07a5dd73a6fd735847cf0792670cc1402af7a458b652fe48dae19a4afc7ee43f7a4189b59c3fcab1372ef039c5be3ac0b79137d30058fb2fdbae9e1be8664237
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBib+56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_fa6eedf895a737ee0f34c4ec5533308c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_fa6eedf895a737ee0f34c4ec5533308c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PCHHmrN.exeC:\Windows\System\PCHHmrN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\chGogBX.exeC:\Windows\System\chGogBX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wTLLHko.exeC:\Windows\System\wTLLHko.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nOaVEId.exeC:\Windows\System\nOaVEId.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QwYSnrj.exeC:\Windows\System\QwYSnrj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yOOSRJU.exeC:\Windows\System\yOOSRJU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QmpGnAK.exeC:\Windows\System\QmpGnAK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ryumtSq.exeC:\Windows\System\ryumtSq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fUBkenD.exeC:\Windows\System\fUBkenD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ncGlUnL.exeC:\Windows\System\ncGlUnL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XHoCyuz.exeC:\Windows\System\XHoCyuz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VDzrSYz.exeC:\Windows\System\VDzrSYz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qObmlRa.exeC:\Windows\System\qObmlRa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\womSHcd.exeC:\Windows\System\womSHcd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWZIVPY.exeC:\Windows\System\SWZIVPY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FxRDODW.exeC:\Windows\System\FxRDODW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\voCqRtL.exeC:\Windows\System\voCqRtL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GHDXQBJ.exeC:\Windows\System\GHDXQBJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RwjIWAK.exeC:\Windows\System\RwjIWAK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jHBVIAo.exeC:\Windows\System\jHBVIAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VhVPYVO.exeC:\Windows\System\VhVPYVO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5be0c6db09bf0ee41a60c03d18a136d49
SHA1fb2565a2aa1e60da37d54566921cbf83ed545b13
SHA256a264711e25fcdf4b86ceb0aa052928bbd0c1540f9584a7aa6090bebf10848f07
SHA512b93b4ec175ed5770fab8ad3f752c3bc017ad3c964261aad784bd7a132f4cdc6fb359efa27ae0d57dccb630c2f43e1cbed1c57ad557cc6cdc09944d47606cc8c9
-
Filesize
5.2MB
MD587a42a2a061fbdad5ca10ad0e07d52b6
SHA19b6d5ba9e3ec54a6da81e886d6316607a816b834
SHA2569f001865699ddf4e19ea8e002b4456ccaa40ceb634495a9cdd17b633b38d7661
SHA512e6d11cda25678bcc45a8612d01b3620d59c2f2866c85d428e29d62d82522fe59c19f014a88a611e8d43f37f80223020ec3181fb8cd934dff6039fea7303a2d77
-
Filesize
5.2MB
MD5ee89636b1c675d042f057146c4f9149b
SHA1c180349bae574b6af050fd7c2210c66c858d89e5
SHA2561571614a63892843f2999f55e8af1d444ef5ddc7168a44b64084e4ec724bd057
SHA512290e4f5dece4ca1ffad2fdd20b720957fe6e14184b673d4f3c2166eacb312dad188e5eb16c5da76aa33a29b248d366550b2b7d8102b8bbb3dbd0df24dd63ab32
-
Filesize
5.2MB
MD5954036c89c8a50748c2fc8c83c3a9ecd
SHA1c0d7c68a1662a506f15320f914dc907dd7975198
SHA256e6d9a6a3f650a5f1bd5ce1c748581384dbb130fc8faf5def869e0f9c1b083d75
SHA5123711fb034a1f1e6518d61afa861646e23fec1ac75afd6914cc744aab2616027871ad555623f638be0989aa42609505c09d1c61b1510a9419599d7136a880588d
-
Filesize
5.2MB
MD58fdf571dd13fd17be14187e82ec5c4c9
SHA1a79d8ba2dbc37617687afb7428fd59acd65152bb
SHA2567338c1d6ade4715c647615b398a8b4167aaca57444bf765d6f9de4916b05b555
SHA5128abf66c9cc4f670220841160ff3a3d830cfae9eed06a876150a71ad21a213de8337d36006bdbe4b34bb426432f004384c25036b0b447b3112da5a5dab05ad58f
-
Filesize
5.2MB
MD5b86fa248bec911310138821bc48756f2
SHA16ce6dab754c449c635ca1e061a5c625241de8500
SHA25654c90f25e1c9e39d3af835ccdc87de431847d639ed5f2abf28d13e0dd6a75a5f
SHA512965d3215a7e74a6aef4c040b529dc8a587933d7d8a9ac85a88053d402ec32980e35fd7d262e4752054b4ff5f68d8d51e9814a944f84b44eed1b41d5b09d52cfa
-
Filesize
5.2MB
MD5a9d3c0c059e851771fc69076a43250c6
SHA16105ef1d7fab74b0da89f1508695fd2ebe898625
SHA256ab4f2244e707b43a05ecf2040883201703d48251e7b719330e466ff3f0833b64
SHA5129d3e34657ebb50069927630f262e8b140abf77d344ada2678d80ab17f55c5c7b6cf71bad44d9ce3b01b2001f51e60e380d1dab3f74ea0d47c94a7db083a89ff3
-
Filesize
5.2MB
MD5eb624be193e1fc0cb0bc3d30865c9e8f
SHA1650c8345dd2d516e31ce758449d95ae1ebecb28d
SHA256b7f2a72f5962fbc49a1ff27139579c99faf97ca5dc20e278397d7034964a7bf8
SHA512f422d3f0a6301b7dce1fae4015d603e1fe10062a427797c78b5b9999796c2b942a8fc4dce8c3824ac212feb6c062b113b1286068a02f14466b81095897c59841
-
Filesize
5.2MB
MD524645de466c58f78af63cc5a5841c36a
SHA14a39851aa77f62c16f825362acd2e59dbbf89900
SHA256587f15af21451cf9815bc0530283076a2444dba1112462a40a5a49eaff3e38af
SHA512df06bf86e40dcc1c1b8ca799558bdc404e526a95ff78dc0f4eda64b8a570e19645f4ecb1a1023d5ae2bc1973b5c9cda2b93d7ab2208ae345569246c842b0c97e
-
Filesize
5.2MB
MD5f0a2cd087c46f68c8c56da5f4b0d1bf6
SHA1dc193ce484f4ed26f47e2102cb49aa4f8b9327ad
SHA256ad78001da710f4b3d381fbcd3b723191b70060bc156f5e3ca089c2d5f7919dc8
SHA51221d758ffc4a55f3f433beb8e24da65edd4fab8486147cde0a3d1b3605c9398b5c1d7cd1f6061c061dd7cffe875c643c962656d2893000ef3640bc97e5f99af84
-
Filesize
5.2MB
MD5aebef1ebb286fa374d9c3a719e029c31
SHA1da1082eb94fc5aba454afe88206f38072ae88d9d
SHA25612831798dd5884e680499b4a9a76ccb73bf3d5a82dd1f93096e63e189ed8a7a0
SHA5120abf7cc0893a87557edce4df69d26848e9383c5d1a1b7a47dbfe67e5817624c5f6ff14130c3f6567efa5e317cbb3e0766b89093a505d88192e2789d38996ae32
-
Filesize
5.2MB
MD5f29e00168aec92bf11a712e5976a38e0
SHA11ec479953b154f033442ee88ff88ba4578b5dd2c
SHA2564ddf694b55deb12ad3fce0274f387f59a4d18dfae30410488fb0c3af6949f807
SHA512b06b8bce948d0dcd85b266ced29d62b9b80ea21c5e376f287a9525efc30e7f2896eb1a4fe3143505493418d8caed5104bc46fc54c0db95af2b9bc4a400387c8b
-
Filesize
5.2MB
MD5e2662ae31fb655fb58a3fde4cf361db2
SHA1be66030fad39b2c8c9a0b9f0715f8a1351d77fa5
SHA256c9313479465488ae8e567d2b08e51cb50bf87c6ea1a99ea592f2fa33e68f886f
SHA51230c1f56b0b982de2d715597feff377b0268c9ff2c689e5a8c8e16af8b76bad3d83551443ba5dcc08522162cef76582aa44e57f63ebadedb7818b298ed9225a47
-
Filesize
5.2MB
MD569d52f38475cc4ca63793b1195be4d71
SHA1d3f7473908669b90bf923aee110ea69975bceddf
SHA256f1482afb6b3bc3508efec68305b8c3cd25299eb073dd2e0919bc85a93d67a8f4
SHA5128bfd704182441f2703eca2544e3a5729c22b5659861cf10e0e403dd21337ac066e52aea6592ecf9db5c0d7ecbf29a4f6ff95364e7775276f16760aa76a4e76c0
-
Filesize
5.2MB
MD57d127549942d881a0263571c6b33c178
SHA196df9938497a1f5a21ab02b98487e00bd87ce5af
SHA256c1315ab5b5e70f1a7bd093289bca39d6e0f1847863ce7fbc3dba033f7737b0ed
SHA51214a5486b4697135d0f1fb4b814e49aec7d5ca6da8b61f1edd0e71920879f3e98b06b16d94fc18e04e6906242658a03485d95e83ec1e145b1e1fd2c17359dbc19
-
Filesize
5.2MB
MD57469434a801540b9d7d2797914642249
SHA147250efc92a8a8844f37a59367a2fb7da57133ff
SHA256eb0ca13f62b138838ca3df1c0762036de0de11b1d71b0437c9a6f72eb1af484d
SHA51278586da84d15ea0645e8b66b21a34f7d51530ee158ce451220f1dacef6234fa074a2bcc0dad32d6635214d9671cfed9e0335bc10af121de2cc38dfad0c2b601d
-
Filesize
5.2MB
MD593f0243bc5ce51c7adbe75a5ba40ec03
SHA1c67c01c4fa8bf50311eda80b45549aa7ab7f4474
SHA256b819c96120cd92c39c4874c8a03495af75186fae1412cebabd92cb2f84b248f3
SHA51287c8ab7ae31d23df524489556544c61547b4a12ac4c7bafaa2a80d00ff871e930e2537e408dc78c66babe5b76771406ea88807f0376e47e7e008ed1036c70fe7
-
Filesize
5.2MB
MD59243f8a5b27913b59a55b0af10704878
SHA1cdac7a9fad26411abf059f423887fe4d0e88b290
SHA25614fefc9dc336c2766abfa4843914a4c4c80651ad66b103671933ac6619fe098c
SHA512303e2d7cf6bdc91d3de3d28e8a9187059dcb7ce94e6957be73102aac5ef03962b7c80ce058ad9a6d3af0f41daae5763e12582326cfb6c656ce3cd25729603bf2
-
Filesize
5.2MB
MD5dc2c5e8443e89a97d8f7f3b9a1cd2e27
SHA1a5f6c5b10e2a1a6d014be4a702b5c83d408b7a6f
SHA256ff7d47b5ba07e114d5e81db6d7356f1dfbdf3ffb69e09db9aa5398ab5f72d37f
SHA512da72f5a78248bcc3e1f02a523c5f57450de77d8a7310551a6b103b64906b5d07b73ac7ef3bd11fedca5231e4a4bd6b7a5cdac05429b33692d2a08471708c08ee
-
Filesize
5.2MB
MD5e65d8bd2436fdd8e8f53e1f761fa7602
SHA198577245068abb207c98f4c0184d43fd5d662897
SHA256e60ee5236f1237e231250f345c0b0047982df87d680b4a3b90237c1e2d3d4467
SHA5123dd3f3f0ca57ebef06e421d5e666371b3c1c8ce4ba1d785facafd7a82c8fb7b2d374aa113312ef5c96b06f7ca65f0c4ec68b9a98c3f0b0092697396be1a58a8c
-
Filesize
5.2MB
MD5d5e7a062d60c79050f9be4e89baec639
SHA1a3e3265671ab5b33acc666aa91812e4b98819f21
SHA2569af0d1582780ddcb20353885a947dcdeca049f10043a658a8ef42ffb2aa50dcc
SHA512c77a439bc3dfb305c585f25792bb3af11982ce7fc9b943627c59716a93c2192f15293133a4f5008e65533f45f1655a3021d24e43821cc5bb5983d075064a267a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB