Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
17-12-2024 12:43
General
-
Target
2024-12-17_0cb672eaa35f77f9841998cdb3d16b23_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0cb672eaa35f77f9841998cdb3d16b23
-
SHA1
9f316a9b75072a6eff4e13a45efbb6058c2fdcc7
-
SHA256
966bf2153454ac38d964b05edbcf92bcdfeaf3795093405986fcbb9554c4389e
-
SHA512
9fb52256028956cab1c01ddd3cb965519e0ccd858c73aa679c8e42b556ec062f4486e8b8041b4c05a21d167b2634a90e3a5347557f2077fedad3fbc0aca1f3f0
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBib+56utgpPFotBER/mQ32lUH
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_0cb672eaa35f77f9841998cdb3d16b23_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_0cb672eaa35f77f9841998cdb3d16b23_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rpIZKcY.exeC:\Windows\System\rpIZKcY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sVrWPrY.exeC:\Windows\System\sVrWPrY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KySJdJs.exeC:\Windows\System\KySJdJs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zVhLXpS.exeC:\Windows\System\zVhLXpS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GQPUUfn.exeC:\Windows\System\GQPUUfn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PECUTob.exeC:\Windows\System\PECUTob.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rDBoyZl.exeC:\Windows\System\rDBoyZl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jfvtUMV.exeC:\Windows\System\jfvtUMV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YBQYNPX.exeC:\Windows\System\YBQYNPX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PbzvosP.exeC:\Windows\System\PbzvosP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tSUJleg.exeC:\Windows\System\tSUJleg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SGucasa.exeC:\Windows\System\SGucasa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SjNEgtU.exeC:\Windows\System\SjNEgtU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MHxjCAk.exeC:\Windows\System\MHxjCAk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NaZeZda.exeC:\Windows\System\NaZeZda.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jxulYwq.exeC:\Windows\System\jxulYwq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xCHVzRl.exeC:\Windows\System\xCHVzRl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aKzncbE.exeC:\Windows\System\aKzncbE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\izyjjMI.exeC:\Windows\System\izyjjMI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KCNLQYZ.exeC:\Windows\System\KCNLQYZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lYmrzrO.exeC:\Windows\System\lYmrzrO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56e184b58c834588cf299279e72cbe8df
SHA135317ad00e1df4c5cf723bba2de4527d83fd32e6
SHA256bb5e21b9756b74f15421d46c36a9fb6b6acbad5a1d2f9cf1bcf51f6ceba765af
SHA512720f5853c5f669c9ed1b87fc45e53417ccd1180096d3e416c1a2f801c6b06a393dfc60fca0f891de38e46571d45e1c4686e1f0b24ef329b80ba16c715fef2731
-
Filesize
5.2MB
MD55c06d77c8f28c8960fe0812cd864957f
SHA1054f8b601c08cd181fa9c923d00596a5b5049689
SHA256968342e6fad6e8a6f5b95327fd9f9cac604810bc5f4d2c7ef1858c79d37d7bfe
SHA512dee76c560401c0b871d1730d8e3cd662ea606473d9cb87c6c9ad274cb62b7321b99d5e3924424fd446166a926366bdacd3f0607e673168c1a6ae2e584e258e7a
-
Filesize
5.2MB
MD5035af2581c997843c60096d765497fa4
SHA155ccae6aee4aa3aed159814e87022d623aa8df54
SHA256c69aa59a73957358e9995608e9877c3ca62b29f6c1faad94d7cad17d466842ee
SHA51288bee20d5a0056d49eeb069e78b97a7709240da535ced8c6109d7b978b9e39999de810339ba4adc0911c413ebd29876021ffbc141a48b9a34739059f832ec861
-
Filesize
5.2MB
MD5bd30773237cf5521be4ab1c606a6be92
SHA1b4d0c48be55a4b55b95afd452ca45a58504ba701
SHA256840940cfd9d3aeaeb5f652ff10967f3983888cd8e835ae8616f95204a3608850
SHA5126a8a237ec1eff68393452ec07753ce815ab924a369e85a8a1ec36df55c0f0aa694a4ac6c03e4c95c277f53a3ff245fe79f3fd45ea13b19a03347638d6861baae
-
Filesize
5.2MB
MD5b4cb28e1429d3a5fe5b72591804d551b
SHA11131bafc7cf2c20ce3dac0c45dff1c4f18ed293d
SHA256d70ce18714b9fb2755ee85ec8d37f0496067818f505b47b07f0e6c882ce5f193
SHA512d6ba51cdd0acc0f06bbc5a1adf051b40ad8cbbe9108542184baf9b1a62ed819fdaaa5178a406d5680c089ebdcb86c7e3b7be16b681fab394e4f396696e50f0a6
-
Filesize
5.2MB
MD53e092949c70597c7bc7db89d69433393
SHA1025da7868df954f601b83a6f83e85ae6158c86b7
SHA256d45c36c7c59fbd4333dbba0dac86d29e9281dae65f0ff3c752809705b065075e
SHA512b4d9964af775de576b3322ded8312a74cef41239012f4a6fac856417f8c61a1337a43436b839ea1e938e24309519d204314b630bff70b6e1e082641b866765f4
-
Filesize
5.2MB
MD5a0baf96fa5d2134339338d4878b208b7
SHA1bf582d8b97ca572eb8162c8a13b8c8ddadb85ea9
SHA256b7b5e04913e7b052b03dfe43e0df33385e23bf324f716fa2fc301d35bf0dbbdc
SHA512004ae1570fc1c4b281460d4ca32792da3dda995409e75ac412aa0e8288b02af8a3f1f076cfa9585758d5e3582f720efc92ba04598f6af79687634e2cd1f1c9fa
-
Filesize
5.2MB
MD5eac14afcfd025da3468df12093f015c5
SHA1c6b02325054a97aad0b20ab9d0db9bd8dad7b16e
SHA2568688bfbcd6b9b71dcde7d4d38ad78b54d32322ec05e50aa1e58492884e9a0201
SHA512ca3c77cf211b11a7e408fa3c57bb558da59899e95b03d94662a3d7695ab83a6ee86b9b116c814f5fd48506d1a57fae2e32e06641b89a255a1584887065f2b0ef
-
Filesize
5.2MB
MD5fb3dbf5c9b469927c7e2638cb2747afa
SHA16365432fd8ef4f41c2c8edb4c0afb40637027a20
SHA2569ab0fda73f97156e8a6953707b52ac3b628bdfaae0d493665e4b4db8e0850e44
SHA512d31e1cb9e25dd5066483a9ad0f695bc80f211fa2f6b879ed5bee00a2c031300ba1ad2521f2db7ed170ac80460fa456aa61d4ab80530ad346c99d89c58424883d
-
Filesize
5.2MB
MD58fc4969a33e404bac013b83d960746b2
SHA10bfd33fef9e8a4068d709d5d530dddf09ad04c6f
SHA256ad061b33fb16b3a2bcf17d1288ac466957b35b2fa52a76c9b798e1c3c971db3c
SHA512d29926d07fbdfb34c0daa6898a1e359a4148b1ad3c6f7a32aa6bca1a2280880de8fa5c1ee91d44069ecdbed10e588aed63b0fa4a4611678d1417840073d446cf
-
Filesize
5.2MB
MD519419a07baf0a6f77329d68ae45166f1
SHA1a36b06f91868f381525cb1cd9cf03ee76dca9bea
SHA256b24f5a8fc4aee549d61cd5a54a8873dadbdb0642a0f9b55d8bb00bba4f71fd6b
SHA5123d97724abdb3115eca16655709d1c62b3c873525f918715ae1e5103f58d448f2a191332d0ffbeb2f6664a8d0f6dcead4d791d3cb26f8c9620f2b53a8dbaabda4
-
Filesize
5.2MB
MD53c847838e7905a96f7bba38127490cf3
SHA1f9597c1d86d233e26c595bdf93498391f2d70da3
SHA256e8d0abd46078ec795765a194cad09a637cfafdb8a01fafe1b60357920f10c325
SHA51202ff478fc5a412d94febb2fad5708ecb81ccd16487b05003b6a3b7373939b6496f367ec990afcf33a8914c4603e67796f0f1d104e4895c5e1c818f3f7dac7bc5
-
Filesize
5.2MB
MD5980a4000a87db093a2cc8c836744a6b2
SHA1daf46a820602faf229b9925d38a0f42b42197f37
SHA256d3c871d83c00e27b7e5e0ddaaede733b4620a0bbc79d4d95e9389c9278d43209
SHA512f87e42dcaf9ed53a108c078c5d4ac103a1d7abd35b206100fb37cc5df53aa2757163f5dbe8e038b345629d146b5be002c52d5bfbd7dc35c8debacbc2d200dd0b
-
Filesize
5.2MB
MD534e3362af357e94df03f28a929bdf5b1
SHA15b2c181bbaaf6cac2f8ebacd9eb302cd6adf0e9d
SHA256e1f895b6866757af62b3b0eb8df6db6265241e835fd85d07116eedfbc232beed
SHA512cfb490a784565f072fb74a3ddaee99f55c7079354cfa456fbbfd4009d8436b374329ce99ef99cde2c274cb815c2264fd4b1a80329f5204763fab811282090a0f
-
Filesize
5.2MB
MD5365d7d98670bd17552da4e386be2d852
SHA1c51a9d424287f55c3891986d5c59be351623fdd6
SHA256aa7fd93b1939e94770596e72e991b2da2a69dbca3d196bc7772e1e319c10e665
SHA512ba3c5d674ac2dd4f0bc1f2544722f06c145d8f8e3f6a8deea78527579c8029081a4adb3281e7881b466e38af9bffec4195ae0ab6a8c0c2b0c0004ccb0db035b3
-
Filesize
5.2MB
MD51c99461ba0ff3093a0945b3bc39999dc
SHA1496fd709e3fcf08f9177b723edc534cc947d42e1
SHA256d2dbc7b7a4924d526382dcbb7588a3b3909b51549bc395bfcd1effeb9a59acce
SHA5128a3070243ce57e08de13f681e7f7a598199a1e134e3c4ef8e15d5342aa3aea5c0668e3dc988f5a671a3d0148796418cdd86e865d0b4794d884f36f9235f761ce
-
Filesize
5.2MB
MD581a80f6eea2dfbbed1f65d92fbe48faf
SHA1fad703cf26e402ad717889e82f1ae9a4131e96f1
SHA25666857bc611f178a5fc060b4e5abc26af1467784474c0493cfdb735b9b80957bd
SHA512217b3bc6d672b28e1fc2dbb5aa9093d376fb092ab801b79bdd0767f3a74731eccca385d22c88574baadaf91ce0bc7818e3ce542c227752f83f13c2e85b750086
-
Filesize
5.2MB
MD58a5ce3d3054e32e8c3aab1b65aa1d1bb
SHA1108f6d70c9eb9d65cfd38bc38da5097cf75adcdc
SHA2561c29f8a4c7adf33205320246083c434c235995bfec3eef8d06b8f05f1a15dfe4
SHA51263887a96ad4fff152d12b4782f0c12330f3767a1dc19eab9089b5c0a8da41cb719aef67af301c40c4260dc611edc1a02f4ad6f966cd69f71ad2a2ea1047ee64a
-
Filesize
5.2MB
MD57f121d27f08e9911178201bc7821a66f
SHA107207ce8a3c7a7d2972a0fdff0e0a8d5a1b07bf5
SHA25631df2498cf6955bccfd0d29e665835ad6ddb798fb72b6c16b5d65bc694b69e39
SHA512752d1d86f6f37f6e423cc2e7c6e8f12f975a4cd17e544471b5d299b16db1dc49b35b26bf39b053825ee46f7f67fdb63515a404ce88b50456bacb63552dc9da56
-
Filesize
5.2MB
MD53316699c490a34989d69154100733a1d
SHA116027d859db3699d3ad772acdf82ca446964a08c
SHA25659df15ce6fafb650b4f6f56b14b7e5a14f98408654dd63cba7d547258fb16970
SHA512c42817355fb9a2849de914a5c13cf3440c97cc88d305e76c46b246087ac9e96ac234d44355d6d54a838bedeee168c9ba178f44af4f2af69027482f0ed2d94219
-
Filesize
5.2MB
MD5be6c41c7596ddf092c11ba8cce790fef
SHA1fff2067bee827f66ffebd822381cb79865ba8d1c
SHA2565c26131a1600805b09f784e3726768591d35f317a4a3b96ec92f8408e366791b
SHA51260b89958d895276d6df9e215f81c61ba2d59ad731a3cb1560631f21cf1cfe80fa5e5a3d38ffbd683f95c63cd85478aeeb78297c8a1913e1e30b2d0b50af33b25
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB