Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 12:46
General
-
Target
2024-12-17_4dd2fcce9f2e4457ce54e84134fc324e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4dd2fcce9f2e4457ce54e84134fc324e
-
SHA1
52db8673a4e4b7e5079eba449f5ff3b3e19a536f
-
SHA256
56238fb6e0af22f3851c7b5ce0c5ce23a9e5bfcd6488bf512ed2ceb71fe472b8
-
SHA512
cf6018b4628548faa7434fbf38cc280689c4031655b945d833ac83477f4b7b23c1819bf605ff805967c5264dcbce5acf708abc09e06676e7036c71cb8d3bec3b
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBib+56utgpPFotBER/mQ32lUT
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_4dd2fcce9f2e4457ce54e84134fc324e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_4dd2fcce9f2e4457ce54e84134fc324e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UjmExia.exeC:\Windows\System\UjmExia.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zGLzWxC.exeC:\Windows\System\zGLzWxC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TItJaTC.exeC:\Windows\System\TItJaTC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VAiOPID.exeC:\Windows\System\VAiOPID.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AcdCCtd.exeC:\Windows\System\AcdCCtd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MdHPNxh.exeC:\Windows\System\MdHPNxh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OYivaKO.exeC:\Windows\System\OYivaKO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WWKblPG.exeC:\Windows\System\WWKblPG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AgSLZuo.exeC:\Windows\System\AgSLZuo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dgSmqlK.exeC:\Windows\System\dgSmqlK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PAHAKiV.exeC:\Windows\System\PAHAKiV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mihmWno.exeC:\Windows\System\mihmWno.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SayFcHJ.exeC:\Windows\System\SayFcHJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QZcQqlb.exeC:\Windows\System\QZcQqlb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jcPvfHQ.exeC:\Windows\System\jcPvfHQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IfCrJop.exeC:\Windows\System\IfCrJop.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uYbhNgL.exeC:\Windows\System\uYbhNgL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MkTaZKK.exeC:\Windows\System\MkTaZKK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CPdEBOR.exeC:\Windows\System\CPdEBOR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mZHCukm.exeC:\Windows\System\mZHCukm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uMHbnme.exeC:\Windows\System\uMHbnme.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51c817e0c9630e7a2bbc8611e0c83aa9d
SHA1b4d419246f8e968f82727c3ab0aaadc9b61569bf
SHA2561732540b23ef912df947523cc0a01fc45e0cb0859ad42502c00db7d004bdd2dc
SHA512dbf43f077f7f25dfe200b24bee0321c1f5f422ed8065a38e466cbb0ca817016dc4f1f3719cc3191fa33ce75544166fe13bf3c794fcbd100f35d3de6861292703
-
Filesize
5.2MB
MD555fb8680f30a106f99e8bcf3db0832c8
SHA1e623a33f82811586bf56c9277bb0829b6a478a2e
SHA2566e8e43a46811e81989b15f854806494494f802763c0b49999a4acacb589cb30d
SHA5127058ae346c5bd3dae265dde568a84d7d36b395c705e8bb526051c77534fb168fdd14149d1c9c6c8e63ffe9b4d16bf33d3fc99464c25f2fb4f20eeb31bfcd5685
-
Filesize
5.2MB
MD5b60769a85cba7bc773e5268deb3b748f
SHA1382c4c110cb1815897b95ea2dad5daea76e92204
SHA2565f6b2ee03deb2a528fabb3737d2804e16fa954592f2b8e629725d86c5e7382ca
SHA51259d6bf44444eba8965f6855ceddce6c80f3cc4758ab0718577893a7a7cef18e392f68996ecd02ee62999cab56abd2799813f4cfa04ce9a6d16f2e572e09c2181
-
Filesize
5.2MB
MD5674c037e6a9c183464d3353b0bd51625
SHA1e2d78ccfc944617a8c9bbc9699da126903f41d2a
SHA256ddd62c69db00848ac657959a86fb5e8cf78a8455b8890214ef81147861671872
SHA512ee02af4524597cb26c7a90b774211d7888d2e17996c380ffe981b23368e54a17a4ec14095f9f3d55bdd0d4ef5fd9feaac22f0943ae84896cf2e29846213463de
-
Filesize
5.2MB
MD547620fca8694c6d9da027a731a037b52
SHA10273517a4c647f411a947fb301cb1e73efee9a41
SHA256bc00fec0068e590d37f9985f2aa48347d565af7dc28f39e8dcb114e46615dc12
SHA512e545ca560e1f063ce69376cae9886b65fd3d3218d4c042251174a1d2640bce9b00d11688a68881a996267a6bb6e372456b915bfc166a1ad54520cad2534556ce
-
Filesize
5.2MB
MD5fb4ad0d29442786db4c27b6d16694ca4
SHA147f7014777ae53d4f381af1206c656a05000d48f
SHA256a810f31bb9a06d7df05afcf4ddf826a3db8b9008b196ba71aa5bf4b0e01f5c17
SHA5122ad314f64a8c66d3dec69bdc733fd60448925d7f216618c3e49775647f743cdcf8a00317c9d0baf4ed1d0a2d2c33893eab58f44a952e85215c348862668a2910
-
Filesize
5.2MB
MD595f511648cc4c65efc09693cbac15780
SHA17a894fdd362433a800c3a8d509e49fbf6802ce47
SHA256e2e1b4e24ffa7f31cdfc53aeff589a993ee8751fc9727391c487d35d69e5e61b
SHA512608eb05b14195e1f83a01fccb2f4bf06e49668ab784e272bb8d8a6a796879182c95e1fe42b957119eea9bb781b4b616b2176639aa871d1330bfa6ad82f9d6e62
-
Filesize
5.2MB
MD5b545847468d9019c7570601107c3e119
SHA133685f0e040fc89e3224c1fee1b746be3f1a069f
SHA25667c6699fdeef2c623110d8c38e0e867fa5ee97d0ceeeea21c16d6a6efa32f452
SHA51284ef5d457224e7aa1f8602a6ad40a8005e0d865873d7f227d48b90acbce7422d02ae6bf774757c54328fb6de6a05c6897ed0bce40ca358847b5314269f3cb828
-
Filesize
5.2MB
MD5d70e703a57a3e337051cdafa9f56fc1d
SHA18f3a2ae87792769c477815927edb63139040dd0d
SHA25636a121531dd418a945da2755a17acc9436fa44b57849e761ad8c1ce1caf83c37
SHA512183d93260b761544671b0b51344d5d78125d559da2a14ab1cffb935f6e29819157b76002315f2fd854955d19f6ff78d1d8e598f4ff83523ad8be6619b17900aa
-
Filesize
5.2MB
MD5b2c7e1dd8331332695fba0b3e168738f
SHA197b400e98ba46813f12262bbf27a9c091e7654f8
SHA2563f2a0ed2e864d2687f047a3e66f14e6fa2bc2da479ecbc45f37b0c24e509adb4
SHA51209f45a8befeedee4ee5d8090c6247c9eba08519ad69fe820418f3ed74c7f5892ea8b7634379ed13673059fa17f851f9c858a812c78353f75c87dc9004b759a02
-
Filesize
5.2MB
MD58eddbaf3b280d57a10740406ca4c7b7c
SHA1bfbdd40b2578076f994f90c3d636c5227680f3b0
SHA256c94344db40b5fcf39cc0bac4c618f9a33738ab86ca372c931eb37f8744f4f591
SHA5120df58025573fe0582a882d8445dfb86abe077fcc39c5013ae501d41850fc15af67df3660cdfbefeaec6524a5d6458d85bcdab05e3b732542bf16b1f67f53c840
-
Filesize
5.2MB
MD550f773a22f5645ffe9550f4e67ad588f
SHA1ebfea73e7b0385a5e7dcbf8c8565745c86b0ced4
SHA256c842ce30337427390e3c0e33d580fb7a9b3ca082f1704b3ee3f91397804521b8
SHA51275c9abd995673db21ca27293c5d7e6af91428664eb263256819c03ed9e10f136614d9dafbbdc6c6502892a7ab2ad7953f42eb4466db402074786b3f0f7867908
-
Filesize
5.2MB
MD5e27b31b1172e2056711288206ab0667d
SHA1345d14a0e30f92b453ffb4e80e1d617ee4a3ef5e
SHA25632f82d84f610783adfc973aae4c46cfaf77f7751d302da34be549e7ecbe1e0ff
SHA512aa938cdfd00475d1cc76db4b77fd54a9646298ea4d444b7aaf2ffcae22858168c80164ac2415da44706b019aee98ab0bb3f0dd09abbeb6a40103a53f7f34e270
-
Filesize
5.2MB
MD56e17efe44f59c9e76c4d989d5ec2b928
SHA1dca3609b3c92cc0c67d0a83f5a19652ddc676a8f
SHA256259b3ad3e5d5de1eac4d27c5a1d05957038a51ff2438dfac8d9e0a1685d504e6
SHA512f4c8e9b3825cbb8c3e8a5026c84e75ab2a42188e859fabae103393fd74fba45fde5f313dde534fc014b3b9cc4ba6f1dd7cb2e10719f13a5284fa35a85fb464e0
-
Filesize
5.2MB
MD5424edebfaea907fece41a72adf613927
SHA187fa11bc73f555d372d7a2e306f5c74fa8f1a350
SHA2566990064a61314cc002d676a7f92b60710e3664e40acfa587a5f76fa1183a6a4c
SHA51290f283748d11f9d7ed3d63534ce841ef34bddb1bbb6fc067de95f5d19c1c7a273417cc9f21ca9d3887f29004227d04f549f16e63f0965c7eef68db2a324acfb7
-
Filesize
5.2MB
MD58143b3269fe8e06060d101858deaa66c
SHA1285c74a82f9f72b50be959153f63f98201e50586
SHA256dd71886eabdaeffc7dda96c323d3c20a0390769e096dc4a176be66eaba2aff7c
SHA5121bbe63cbc55892bd7954c3cc197d44bfc10437c01a6876d1b9d8604479c8c7ff32da10e18841ab7572221b12279620cee9810094ad4a801ed79b3a6f574db68c
-
Filesize
5.2MB
MD5ee70ca4267100d9f798b098ddfb68d74
SHA15445022b7abda14dede864389842fb4a0f25c07a
SHA256963ccfbc766357b3586c0ec318996c80c5834d63ce2ee3ad5b2e8ecfc9d54667
SHA512d391280744b6bd1dcc3a4164e4473f7b0fdf55605a18cc5034d035211d11c197ab46bee895f01d3adee2e7cb70522d66e65d65853c335746786e1f26d4cab30c
-
Filesize
5.2MB
MD5605f42b751989b4a4f63ae42b21c92a8
SHA1ea12d34b3ddffad24c370fb45e0adfb00499a39a
SHA2565f1a502d05243a51bec753c77a7d7c3b76e006df5ef73e042c9ca3cd8f323e7c
SHA512c2770f3d6ebe43bcfb625996da5def0f9ca7758ffc635e9658f42813d7ab6942fd00f1936f91d92bb696248ffa928c2cf0cb814cd70277024024a598cded2450
-
Filesize
5.2MB
MD5a795332b7f6f3628e4570d65f6dda7c4
SHA172840bbecb021cd949bbf9a2b434e9670b565ff5
SHA256cb6c466b69975f6c405229dcfa40a8b230118ff991da28e5106624a0823f88d0
SHA51238040f13308bd08c30d2f3507d85353eab6f6f005f3776c6c11342d9474a3b6cc5c44ba7fd6fcdec0e6e8b8ba6dc5dea90c6a6bbb02ab5c2a61258ed40f33a13
-
Filesize
5.2MB
MD5969be607ef2885012bfecf114e1e3960
SHA146e143c3c33dbbe595d3b95b5dae395a918ccc12
SHA256a7d41de3d06616318ad0f6a0600e87dca9f2e09549e82a243aaf1d136e9a87e1
SHA5121e602452f472afe0a9557a864e37b5936c7761746a310e45f5c146d748b46a371921a1f5d47ad27f5ec10391293ec38a2906b00df615c98fe8bff6e341e9b985
-
Filesize
5.2MB
MD59da2b7b2a41d32bd0d5135d43a7f06ad
SHA1bcd36e99abfea40c02a42c5fae0814f3eb43488c
SHA25644f2a7efeee2e4481fa8ad108034e448852356e87140360c44ad947ca5877350
SHA512ea58405126fc890298d50f27308015ad9da9f4bd1ac10abdbcb811a590f131a0dedb7e761f46d64b0ba582eac5e967a66f487f5e6135397926572974a034765d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB