Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
17-12-2024 12:46
General
-
Target
2024-12-17_5bc094c13b7c1efce25cd8c1b7aad886_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5bc094c13b7c1efce25cd8c1b7aad886
-
SHA1
87c6109dd98611a20fdab3fcfb5a2e1cea6d6fa4
-
SHA256
96f84bd161b23a5f89147e3d49763d5c2368094d9f686509774b25181126b05e
-
SHA512
96b137509f8c0169c5bfa91527fd0a044f3a6595f9beb35267c0e4d1b4f5ce8be5208448db1d7311a32f9b6f3a9d80785f5cd9d7a0aaad7e478a645c4a9d558c
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBib+56utgpPFotBER/mQ32lU2
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_5bc094c13b7c1efce25cd8c1b7aad886_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_5bc094c13b7c1efce25cd8c1b7aad886_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XErRCAF.exeC:\Windows\System\XErRCAF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IDGaqoM.exeC:\Windows\System\IDGaqoM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rXXApqi.exeC:\Windows\System\rXXApqi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yYZZNae.exeC:\Windows\System\yYZZNae.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zsmbPst.exeC:\Windows\System\zsmbPst.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hHcdbak.exeC:\Windows\System\hHcdbak.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EYNaAqW.exeC:\Windows\System\EYNaAqW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lqvKMYm.exeC:\Windows\System\lqvKMYm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TzWElXp.exeC:\Windows\System\TzWElXp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VvEVrbT.exeC:\Windows\System\VvEVrbT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TMhmRJL.exeC:\Windows\System\TMhmRJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nRoydGx.exeC:\Windows\System\nRoydGx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iKftjWF.exeC:\Windows\System\iKftjWF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hmjqHdy.exeC:\Windows\System\hmjqHdy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mSWIAAn.exeC:\Windows\System\mSWIAAn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bpJTgyk.exeC:\Windows\System\bpJTgyk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AHBCbuy.exeC:\Windows\System\AHBCbuy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\btinWeS.exeC:\Windows\System\btinWeS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXmzAue.exeC:\Windows\System\sXmzAue.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cVgiPmv.exeC:\Windows\System\cVgiPmv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jYZNxgq.exeC:\Windows\System\jYZNxgq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5cfe1a76c9eaa8a726c680cfce89b16a1
SHA1e32153d9d10c33bc81b3560a1eeba25e8ea94f22
SHA25670592daa52f8d614471974bed6bbe0ec3a3a51e4cb775f7498b545a5a7444d3a
SHA5123c32d9306ca520f5b8f26512f8b68a2994ec4661c7a3e4aa0084792ba41b7df615b049052f7aa25f35509553a1d5f490dc3a9c2e33ed6f2829aab6563b4f6c81
-
Filesize
5.2MB
MD5088b6fbc7d09b98e8693aab572b292f7
SHA1b3fb701aa875de8369ff25717d48469a9bcef05e
SHA256a3386aae4bfb6e48e6540fdf05f81aba7c8c53adfda492bcaab46d360a1e0675
SHA5129a577a5c469921643769793684ce6b339b0bb58ca90238d0089f57e2357e42173eaf3f953c93dea90bd0b59f3ef975c43d09a4db6893a88d37322ce83be0a926
-
Filesize
5.2MB
MD5b8737d861156707a81d82b78703be812
SHA1a8441a747fdd8cfad4486342e5b0d783a4c4d7f2
SHA256750c94f74b952e6f175d27da8a89e75361a24d0b28deb13d99eb4180c472994e
SHA5125b73b5996bff63587c4fe7d29e18d419c8aa936eac2041c61fae690dc4322a66acfcb21a6779e5a076dc73c2145b7c1c2cbf105beefd29c1bdf1d37db02bfbe8
-
Filesize
5.2MB
MD526b2665ce0280ceb98db5c8ce570206f
SHA1bb7851f5f26c0f7d790f33f6aa464cc26738d19d
SHA256c1f4ed4caa6df5227262090b8b433f8ba8de95f91a63d2a388b76c140b79dbda
SHA512458191ca3fde2899e4645c223377b0837895d7764c005728aaaea57a5c7ddafd2ce7f4d6a7538498395c40985b989cdc2f788cdb9c41e529b4d09b0abcc431dd
-
Filesize
5.2MB
MD5c27553a6bb8681bb860c99b3ea6543c4
SHA1a8354eb715582bd1ebad68615ce4d099099a71e6
SHA2561fb0e5e3a240d337d8cf87baad0ab88bc28741e1f0301cadc538998bc9638a4c
SHA5129d14ff65593aca9e1298a97776752b3b5f5f49c49bb0165bc1fc31c76cacc4f6a438b027aa9a6e0478c4265abd93507900397f1105ed946c99c09a547e34870e
-
Filesize
5.2MB
MD59bc7ead6d544360efb3ad4d4c4977145
SHA1909e77a5c7b4c207adeefa4bb075783a8a04b742
SHA256088bb5a0456435da6aebb8448cb21fee8d6a49080568bcfd110bfd4e6381f9c7
SHA5123b29720c0976285fd1c0412a1235573be524ad06fa68950463ddf6dd49281c86636cc7dbc0e60c598680fdee0fa5ccffbba19278c630adff595040017860a9f1
-
Filesize
5.2MB
MD57bf0e9d8486eb9a1519d17a76d74495b
SHA1a94df1550d35d69f423f755e361252690f1e5dc1
SHA256115f67b9d1415a867962367d6e7bbdfb185c345e3566a37fc808a7e8a6e885ca
SHA51238a652d53db7d67905b3752be8d09afc91ddbd8144605a0264405f665932a4566569978b8bdd475d096750a6ac53aff0fd4ca755af5f3f70eaa92dc308adebe1
-
Filesize
5.2MB
MD59ff6d061b83d06aa050ef4816dc93bcb
SHA17154bf9909b9292c1d3b407c6db07332db43ff8e
SHA25673529b3e795a18146ccd34b27b49f06838a6249e5a4bfed6947806243786e78c
SHA5121a35cf4532912d4ddb4733d3d1381d8865aac434237d90a43ab00978b83a187ba3c4cb087efd98479e6063de493c01e3e7bdcd901d1b4d3bcce37e9cd77f3379
-
Filesize
5.2MB
MD572655c03ef8079ec7eb9db731d38d903
SHA1b7854f4f3eb6bc83cf881ebc999a479df0625e90
SHA2567a64c5f5cf7fd440d2af4aa24565e032c6b1d64fbc3b29c2cfac4f6a9860d43c
SHA5121d1090bfce95ba1e53583ca0e3baad8990a62c7d6d0af9eb9df3dbf01db2e19d7f86f21c1a72506086eeea2aba7b4f661fc7bf15dc84b332eb7e498458933f4c
-
Filesize
5.2MB
MD505acdb38d09648fe9cc9d9a0610f7da7
SHA13a9be050c092d027fce3cee44fac2b6217705c78
SHA256f2e23a9aee12dc16326e4b2c1ee211cdaf3228ee54c94c0b7c48718039630960
SHA5128e9a6cbe2dc415c93ffe00e5a524cf05bbc356e5c04b120ee92c6bec920e5553dae84716a0b78455a1be3a71775a222286b85d1187cfe452cc3298d59e5ac839
-
Filesize
5.2MB
MD5aaabdd8e5035c7a4ff29c903ef5be5e5
SHA161a42be3b9e6daf32e0c3ba39274dae53932eec8
SHA256b6ccf890afbd8f8b5ab4476920db58e647acc9c7ee1199c8c5048d053686d650
SHA512614dcc6a75338f1cfea4a13851a33e3a07fc83ac5d12f021342fb5655203cfb74b200af44c313b4387c534965837f4f0456fc71bbfe3b8582fc450c3b6deea72
-
Filesize
5.2MB
MD5b43a6fd14faecc6e44316b3e26b87e5c
SHA1d53a2f3df1385453a128fd7ca1ce50f244c99973
SHA256ace07a2063b7c22e3fa1d6d4d7e1e779d3b4f072efed24850b81c09ecaf44bdb
SHA512893eecf0622376a898d14bd3066ec7e4d7dd7ab41e6e0f5642e14e21538c807f3775655ca97d5469cae8e87e24dda1fe52af899a7980750e2237bd50f3be1f0b
-
Filesize
5.2MB
MD57ed52fe76e628617968fd9a7b35fe38e
SHA1b7039b8b10d35e56a44d27cdd2f47f4589f68ef6
SHA25656b1c0ea4c78c4c49ae64dd09d4ecc83b7bd01d37f9021a6d71f5eb3dc87284b
SHA5120991401c9ebc1e705fc586c93b4862258b820f2c0dd8b18643c7483e00fb241eab5f1b4bc87d0ed7d72bb141696d59cf7bd002ec9b269148ffe03780b8ca8252
-
Filesize
5.2MB
MD5e52f53ec4e492a0b8d8621148495a038
SHA14bdddcaa66cdec5a0d9995d3958dd3e97ff0bf94
SHA25623b3584f186305e33f547776d186de3ff8dbf744c97876340ea0996f27ae42ff
SHA512c6ab3807ad04fce7f2c449c47fa7ed0387138395dcee4ae710f6f5eb7309159798894475d81e3343069cdfddd735d9f774e3fbcf65802bc2d8eb2145c9f51531
-
Filesize
5.2MB
MD50f8c19967975101eda8cf54e8f072adf
SHA1b5a25843571fb4d05a180c2109871d2396e40b18
SHA256b3b8518ecba6ea3a433253dded741264f2baa951ded36fa4fdba441e45f3da02
SHA512441b4bde41af5626fc337c98798caf78b336b7ed5da79208e5489ddb265f5b8c2a0db2135482279ea40ac6da95d10ca89652598d92fa410268ea32002620483a
-
Filesize
5.2MB
MD5234b155fdc618bae0e5d3153a7df93bb
SHA14a995fcc515a8e3be28850944b9bf660c76b71ef
SHA25686a20c0cd03c607aa105988cfd144685b7a49ec0bd67c1142b4d0a9aac54b226
SHA51282bfc61688084ade0bfd0b2074a8d5a6b164d1711fdf4005e2e02d6f45e7f781db3ee0206331c22cbc82557bf1a44304564330bddafe8fd7bd13435a0f1e0adb
-
Filesize
5.2MB
MD59f4ecee8b4e7415367e2ba615ac8aeb4
SHA11de514ac1b77e594bc50afd76ee8762d6a0ca09b
SHA2564ca44f0a9987c1318274756623d0e44c74abe045667a0b161e64af6c9dee763f
SHA512f95b59c0512fbe38acda443ea4a10facd58ec0410295474293ad30acfd88078771203473960e5f409461fa8bec9978477633e2f40201016838674e472c32228e
-
Filesize
5.2MB
MD53f56cbae6543552f951e657a4dc95496
SHA182c500f337161b879b0d3f6127a90cb7f440cc28
SHA25644c685c12f99aca3ff851e490c1bdd38ae7b69bd0a387a16d073a6fc7488b89a
SHA51271d433dee481773a939dc674b45ace599997ca49e6855e9859bdbc3588f149d9d3c172d8a8b5d2eeba339adf8cc05cee3ed28f921b55a1be31889e93a95348ac
-
Filesize
5.2MB
MD5c7aa0f928ce37b24071d08de79f6d645
SHA108e9a359cf0edee1667eb3e5b02125f4268ab7d7
SHA256ff12d24be706cebd2237eed92160ac43bf0cd475d54a0a7794be21b152fe4789
SHA5126de69a1cece058c79d1becb6c8729169d24196da731117d6a87b9a2ca6d4b20040200a1231a83988dd43d9da1eea3a26c2b8428be0c4da801c887e8cf81a5d3a
-
Filesize
5.2MB
MD52635d6e2088e9af4964824a17229fc22
SHA180d305c42b9075015bab4c43e22077473bc44d0c
SHA25621232f05269fb7579fa9655f2a59e87f5181ddd586d1db429ad8a4dff0b57047
SHA5124d467ebfb66de05b2a802f825a18249d25337b9426cbb3181de55ce21821e21197077f95fee2f811b16b3afc50b7cee251cbb38a654c17e120e31bd120654bcd
-
Filesize
5.2MB
MD52e32fcea0defd066b61c48a6775b1fb6
SHA12823915111bf0998cee39f27a631087d14d8a95f
SHA256d5272ce0a43636767d3c0e64b69cff6034f2b6ae9aba3b61149d13bba08d323a
SHA512bc32bdcb9d888cdb489636c48ea600658916b353ceb69787f0f2b849183e1b2543a52a0eca46a258f1e07eadb0aa40140eecef0c1ef3b4fc56c0b91fe7cc1842
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB