Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 12:45
General
-
Target
2024-12-17_24462c5ad530fcb2014dbc3209bc96ce_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
24462c5ad530fcb2014dbc3209bc96ce
-
SHA1
3401fc9919beb9cb20eb65b437fbc68616576de2
-
SHA256
9bce67a462c971df9893bfaf767a9b3d2ac57c20c2dc03816f7438bc1795e3ff
-
SHA512
851b918589f33ca3dccf26107e50e3b0d242eb081a289e32364c176304d9aa8dbf071500379c2fff4028f0f99d4287c90a160b5013e342ac8568f2c6470b4409
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBib+56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_24462c5ad530fcb2014dbc3209bc96ce_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_24462c5ad530fcb2014dbc3209bc96ce_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mdpXCAR.exeC:\Windows\System\mdpXCAR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pSUaBSw.exeC:\Windows\System\pSUaBSw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SGvnVlz.exeC:\Windows\System\SGvnVlz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ppImXTp.exeC:\Windows\System\ppImXTp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LKiteMQ.exeC:\Windows\System\LKiteMQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ofpRUhZ.exeC:\Windows\System\ofpRUhZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ONvXuIH.exeC:\Windows\System\ONvXuIH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jDBjIBJ.exeC:\Windows\System\jDBjIBJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dnmsfkf.exeC:\Windows\System\dnmsfkf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PZUfMXc.exeC:\Windows\System\PZUfMXc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WEwTfsv.exeC:\Windows\System\WEwTfsv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qnCCvTa.exeC:\Windows\System\qnCCvTa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xqnOkuL.exeC:\Windows\System\xqnOkuL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ptYowMi.exeC:\Windows\System\ptYowMi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sfTGDZZ.exeC:\Windows\System\sfTGDZZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vqCxVFl.exeC:\Windows\System\vqCxVFl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xbJIlQl.exeC:\Windows\System\xbJIlQl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ufZkKol.exeC:\Windows\System\ufZkKol.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OMZamHc.exeC:\Windows\System\OMZamHc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vnkuoBx.exeC:\Windows\System\vnkuoBx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kpUGZWE.exeC:\Windows\System\kpUGZWE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58311abcec9737b2708d74984c90244a0
SHA14826084dc37e154752b70ec6f207bdb15582b976
SHA256d30bb28441bb61de1513ccdee7b099477c8adcfdfb5bce7242a50823f680d039
SHA5120ca225e8faf861f86323b6c5cb6a718540fb0d25e79b398489a63017d1ac9cd1191c510d62e163573e77f468dc5c1e7929c05da385d136b9729942f818d714f7
-
Filesize
5.2MB
MD56de4c58de6f44c5a88bd158529049884
SHA1c5ee3fb426cfc9a1e75b9d8d31b05fd7adc0c655
SHA256700d8c9bc27ecc44efb30d20bbe0ad84f2e963fb3aca2b0acd0208c96cfe3497
SHA5124f7ce8e6a3f33d8bcf1b7ee04cbb4974c33d39d331ca7b3bfd5566f26c995144f367da120e9d973a98b8bfcda6be2f57704ebc3b8118ad9196b10c00e1bbb2da
-
Filesize
5.2MB
MD54fa01483d73f24fc93a44a7494d19715
SHA14957c0184be5592c8d65d1da61ae47fed6fbbe1c
SHA256383594e7ef20833cf7461f7a32fbf0dfddec2377d73ca84f2e4d7cc7aa3ddd75
SHA51221533afed0aee411d5dcf56be6eb4343edd32e3bd8f85e721c72ce8dcfa5a5fd07e7258447160594513d8f2139cf85a1a96f8a96f8f620c96f519e2a471eb2e2
-
Filesize
5.2MB
MD5f281eba8a1739b305b6840c42766d9a8
SHA191133f667d0604746975aefc0df716167de4b428
SHA256b975330bff055799500444e0d665fbb6b2555d09697af63fee0e7b86098f34bc
SHA5121468e55f824c5b1ceb9de6dda9795aecf1c23ae31fd0ec5cb77d9122f6f4639f9331f23c22c3c389046d38cfa96c8bcc6d27f83e948814d739cda8bda7051fd0
-
Filesize
5.2MB
MD53d77061262677f4a101e0f6496b4e3eb
SHA1b6dd5cedfbbbfc0c423e7a30bff2a87a7d90eb6a
SHA2562556ddaa32fff9f1dc9f996374a2f6b8a11d272b54d3a6f73ee84630354d5994
SHA512b9eb2c03b5bcd32089f251e8a0d9656e3bafd31fb219bd3862d585dcb0d13d634b40f54cc8b5e50076ed53944431906312ac15822f18ee5fd089b7a0122e173f
-
Filesize
5.2MB
MD5e6767cdb28d34389e4ce1f95336eb746
SHA18448fd2710153a43af923d2fbdd6ef9b87b5218f
SHA256e4003e9d5fd3d198b69d32c56674311dda0c8baed13427b5b739c648c3396c82
SHA512f9e0b1fcde157f8af69138d220994c38b64361da65d2a822e5d08ccc0cf8e44a69745135e58eff323b2fbc59af5da6c067210f33af8b2b803096a3c96f10844c
-
Filesize
5.2MB
MD51ee14a8ec66ef108f6c94f2b7c09c44d
SHA1d95a61fa2096ed3f5a9518460ea052404441bbe2
SHA256dccc363edbe1331baefa977238cc4445f2820e8c3dc2bc65a7b08ff0edd38012
SHA5120e8feb18974eb0426852930ce2e7daf80678451d7a9e14698eb5cdbdaefe4e2b89bd3c6daab6578902c2fe26013e9b3be80c24cc0ce1e0273eb01ea2dfed045e
-
Filesize
5.2MB
MD544fbd922cdf09227079989159eaf22ac
SHA187587e8734d7b2978d9d8a84f015ecf2a1a18034
SHA256668ee375b10afca83fb98f6ec75c52715852719b98220a84262f5940956958bc
SHA5120aa3f62b56b34a9ce9daef7028e9f3f7311ddce8f1c6aa32bfacd7b19c536cd655a39b65b8a58fc1e0582ea78736b6b902566727ea8d10723ce2ac15dc84a3c3
-
Filesize
5.2MB
MD559100f4eb5b479fa87a2d3a917d4ee93
SHA18d6e5c70c90555413f2c96e43fa391f9003d2293
SHA2566aae253cb270a0b5a0a9cfd77b616ec6f00700c5cf659ddba8f8bddfa9ab32b6
SHA5122c898fd3dcbb0f1fd443338c4c48247b32c9f3d1204cd52551d7bcae816e0f3516e89d45d09d2d9280f33b37294e2b9ef81abf63525a647fc6934097ad031305
-
Filesize
5.2MB
MD51bb7979f9fecf6115a5c20835a524965
SHA1b1a8ccf82b3ce3a7a7fa625bd3872f5a37ddd655
SHA256e0794ef07233d4abf0dc402d7defd6a36b9dd993b04c37be7e1d1f9cb62a7e3c
SHA512c79a7dd2fdc1ba963a6f715f1104e24b730d75f15f2b2295e6bad5466c3dce3695f109547ddd92bf6eef14d6519f435c5675f7c55aff5918586f8ef799d45383
-
Filesize
5.2MB
MD5c4ad6df7f35dcb2e44f6aec856e3a982
SHA118006eb699639ec15d4b1dad05fa7304a024dee1
SHA256fc5ff52b8587759635f5b1746ba0bb4777bd965276ed8fb9c66b70f845045ce6
SHA512ae8651c28d15d30e15e36810310cc74ef83661e83c41cafed7e6d62a26f3703457fea4ac89f597483f170fceb9a3383b4860f0e01586d264d5ad280e044c1cde
-
Filesize
5.2MB
MD5c4187c5fd5aed4ddfa87aa182a8f11f6
SHA179855e9f72f2c050253619f62fbb6cd8c986b4d3
SHA256ce729ea19a42d9aee27265ad92e9fd997d0df2448d784ecdf735d5e4741cebf5
SHA512139b6c98cb153f1dc9fd73d54a91966e1e3e640c1538ac5694e4d35ee866201431e16cda38dc77b4798fe0c0ce4734af332d7e3112b4fc67403d263a57f64430
-
Filesize
5.2MB
MD502c96a955a7d1e9219bc8fc66cf314ed
SHA1557ea25e41a063177f087da24ca6e0978e516a6d
SHA256a3139efa4100ca0a77fe5818374d98092b625a11a08714486f8268ad3cddb548
SHA512dfae5d308f35522e4882b4136e366cbffc6e1c3b935bab9a8bdf01b9ad05fcdb317e19c3a5239d9a4be775482e818624e88f04fbc02060057d06a4d27d98ff41
-
Filesize
5.2MB
MD5265669442422846d1385aae0b9574693
SHA1cb354f008c77aab02cbf37295389e3e414ebe1bc
SHA25645fe8bc5f4ec85c9a616b1e005df794e7ff547205303256a3a3409cca1d70596
SHA512e4a9171d76a073513c1adab9374bc8e98f63284d8671e5a8ebf1edc373db64bd4a0208a2f7bc1c5ffd53d3c7984edf49fc4acb114621e633d613b640a4787255
-
Filesize
5.2MB
MD5c0d5d7d5648843c6e19853809c60578d
SHA168d9cbce700c3ce6dc9817fd36796a3fcb24cd9e
SHA256d9cbadc83e4c6d9148bb9581a81d800dc23edf3f97f1c87d4ba38caacb948220
SHA512833aad08398d234cc0699157a3f18ec806e75038ea65a745a79ec43e9d577a0e1d43fc4e8e08a4132fe9b04b09c57e5799f62691217262c86365a086fc3359a1
-
Filesize
5.2MB
MD584afc8a784497edb771f3e1928bb31fa
SHA1fea81d985175922837bfd15cb1ccac84b6b1d64b
SHA25674e328285cfc00d6d3cd5acdbbb5e64b86351baa69fec5cc4d36f1ecf529c23e
SHA512de3ad2ee6c72082a61e843c02c1dd07921c76d45f5d8b7908f6472c4d6975063281081d7b2285790649a78da2f2bf95b266046e4397fd9327d620df3970a6183
-
Filesize
5.2MB
MD5ed7fc0ae97e9da16853b615ba94b4d98
SHA1ab263b3b876ebd567984d9ab46bf24fefc7a0251
SHA256a5f48cdbf739943106100247a118fa8e9f13a05949189f652cc75b5a04c1d8e7
SHA512a42ca049120c524084841d9ccd01e8c161442b6c7dd15dacd1a3d1e0cbe1855c03164ff7cc10e7e782e88f526ace03e24fa40b5dc8ac1627b3a9a06e09e22208
-
Filesize
5.2MB
MD57f1b1628630ab4414921d9e0376f2417
SHA1bf1f2ec5288391baa2be96df1ea5226d97c82343
SHA256d2174ff06dc37fdb9e5ca982fb709f5cb4bbbee7781f362fc08ec0d1514bea23
SHA512da6c3f997736b36ede31d8fcdd80b0802ed677a50c86b993700d7435bb4aaba7efef5474f173a7abdd355690dbcdce3a625b0aa3d930365cec7d02ade3b72c0c
-
Filesize
5.2MB
MD53f377f49cfa55f6d938ece98ac8f484e
SHA14537dd791486da2fb1f3376816c247a33ec625dc
SHA256ff2c1663a85485c871cb6f509a760467dab976b8214f49c820d0c0b45a81bc18
SHA512774c720717dcb4f67150b21f32da23b91c8c53191659df47d85dc98827f76b36ab41ad5c37437ba6795b0b92df8c7b48e706f76545ea49e4945a0de51e8168f4
-
Filesize
5.2MB
MD59a90f777bb8122525b5f247231948949
SHA128d031357f4bcd0a36c443faa6f7aabd830f8147
SHA256990fe6c9a437b55783d7f7309d7360fa8322253f6dc7acbf7839ea36277b131c
SHA5123b3acaf6c6e2b019b187aca31ba387cf73bf799e1104f6c40298e3decb016947a901565811f81d1f704946e20fa564269f57cd9d7a641e16165a38e71689a4b4
-
Filesize
5.2MB
MD57cb32f0841ab29d1b7124fdcf80e4dff
SHA115fb7e9a829cf38f45352c6f510adeae57d62946
SHA2561c2237f8af4945ce99db89348e036adbf2a29624d4be47c67836a4a6aa36d205
SHA51270d4400e6a83fcec2e476f5d4ded2d0c07d83c0fc1fdcdc3ecadc1835b84cddedf2acd1565366a9fda29da732e8ef45533029c8e3ddd26fafb4f0826dae9ab42
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB