Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 13:45
General
-
Target
2024-12-17_10595bcf920e2cb32cc5707a90cb836e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
10595bcf920e2cb32cc5707a90cb836e
-
SHA1
fb128caaddf8aef73a5581884fd561edf6f7d5b7
-
SHA256
a080ee2cbd594681a048e8020d8b017803a653b63a94ceb9a93bde64ab86dfa6
-
SHA512
03f9cba638d40eb385b2c76496962b10978832c04a974b7e8acfbccaf0e0bf20b9acc8905ee2322ffc0c372da95eb3c15cf0276613f2aad43a10d1b856c1c329
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBib+56utgpPFotBER/mQ32lUw
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_10595bcf920e2cb32cc5707a90cb836e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_10595bcf920e2cb32cc5707a90cb836e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QIdNFON.exeC:\Windows\System\QIdNFON.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\etMmZol.exeC:\Windows\System\etMmZol.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qjRTZdu.exeC:\Windows\System\qjRTZdu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VNoTdQZ.exeC:\Windows\System\VNoTdQZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NAVkIQR.exeC:\Windows\System\NAVkIQR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KmhGTHU.exeC:\Windows\System\KmhGTHU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qKQtIPh.exeC:\Windows\System\qKQtIPh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CLIjOZw.exeC:\Windows\System\CLIjOZw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KcxHznp.exeC:\Windows\System\KcxHznp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ekHtemD.exeC:\Windows\System\ekHtemD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kmfVACp.exeC:\Windows\System\kmfVACp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pMDNbdt.exeC:\Windows\System\pMDNbdt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kuRuxcS.exeC:\Windows\System\kuRuxcS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ARuPjyb.exeC:\Windows\System\ARuPjyb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ytiNnvz.exeC:\Windows\System\ytiNnvz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WncJIZz.exeC:\Windows\System\WncJIZz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UIxulBj.exeC:\Windows\System\UIxulBj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kEGIvuK.exeC:\Windows\System\kEGIvuK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DMAqYJY.exeC:\Windows\System\DMAqYJY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eLBoFiI.exeC:\Windows\System\eLBoFiI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aSliPIG.exeC:\Windows\System\aSliPIG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5eb721c27128f4e98538c367781bc672e
SHA1b2270b5ad405c04e7556f974e8c5d5c93cee60e2
SHA2564eb3b5fb91d1f208876e4dfebaaecbc40b807b64aa4cca2a052a340f605b5114
SHA5126a1d5b4cf03474ccbbc708eee1009f61a61f2be83eb4be0afef64af695a922be8f563dd216dc68b69cee771d74e5f2eff0b68c04413224bb4b63082c0cae24d7
-
Filesize
5.2MB
MD5a683e2068a43b23ab73bd981fad20553
SHA188dd5c1be691c128a8c08ed52d80a8550d3a8c34
SHA2565a995402f230fe7dad15e5c8e3204395ef6133d677303115945cfca67916d845
SHA512e93a8e6c2fa92b58546ea02d4bbd74cd2e1246b69bf49c78dab40216769c43c2a190dfc5e61b842f0c64d9c1145d675570841a69a443220ed737b44d0c40860e
-
Filesize
5.2MB
MD5402f5453124d67ac80fb785ec86cdcb1
SHA129bdfe40fdb09bfe9d02e9fb1abf61302da1f2a5
SHA2569bca3432aa5f87c76014253946d5da52a57e4d901a67e52291729e7b8247259c
SHA512dc2b4d522e06fa7e8ee3ff5701cad5eb985c6e9cb6f9e1210f8e7fcbd19a48757de01f661cb026dd218130b47e92d485ebbdddabb1140d6b4b0d6709ca5771f1
-
Filesize
5.2MB
MD57d373f25839a794b3faa38673d010ef0
SHA16dd9eaa64661f48c7684ab2f52aceca303dfda45
SHA25621c283793834da72cc0edae619cff37db90c263bed7daffd279bb110bf90dfe7
SHA512fe91abf1c3cf688804b23e39e44964b7359fe2bfe79d5ef03940dc906d57cd6ab4ece4286f491ad9b4b412ef5d4056b600a251d1ead3589f60af5a23cc846467
-
Filesize
5.2MB
MD5d76d731e2bd57e90c1c4c4a2b3f57179
SHA14c1a2c509b9c5685eeaa647528d2d6873f37729c
SHA25694a52c5cd8b9a2470c1906e38deffb4a07afa23ef2cb420ebdfd3541ece0ede2
SHA512e4a476f899f930f0c02467203ebd63930aa37fc1ee3861c322dfdb6081c8f328af7edd091b30688db00d0403a72a3b33bde3325211c32811c118dcd0e196cfe0
-
Filesize
5.2MB
MD58cf7353986dd8c0c370f62e2dff05e37
SHA12e7c86cfd7e79d1152a975eebab951cd6dd14024
SHA2563eeb8f11d32afe24448def42d8eb943d7ca85450d6c598db703388e2b9557d0d
SHA512a5f3e0676f4002e9f7fe81ae512b588c7aac9bd59d3629a607f355eb525c9e868bf9f83a2419def28da60c8f82eb45778800182ab96462b8acb9158a258b6c21
-
Filesize
5.2MB
MD51b7c8faf72a3319a3b836f09e00a4be4
SHA1ba6068dedde2f3edb34ed956728973ff19e98a3f
SHA256aac753e9353ad291b966965a998d9f63ca6c40d79cbe3332fc883056f930ab8d
SHA51246294b0db1f6158c453696c16cb0177dbd91ecebdb3afff985d63951df4b2faf38b019ed0e1202ad431e0a16f9a513729ba76f08c562c448d7be14ea144edd54
-
Filesize
5.2MB
MD5f3493e4a92a451f7058b9d640acf768b
SHA14b54c595f237315e18276f898606be4cf8868512
SHA2566ba8b19a1bbbc0fb644055e46e878ed3d260e6e5d2e9cf278311db1568275ab4
SHA51221bf65b3f28e21db1038b65ff65f0fa9a066a6c5f9251b857682b891966ed607161a4f3190341d36541de20e82da0c4339b5368b33c977bd60646265f040f983
-
Filesize
5.2MB
MD5c624c70f8a985ebdf071dfea6e91788b
SHA1456444ea9700e9dfbaf6ebefad20f75b6cfadca0
SHA25690c7895d2798aa618049ae0ca05c30f3dd8f228b7840bd084f9a7848729ac6bc
SHA5129a4e4642fc8a52d2a5a87c66525f0f6e2180b5bae1d58a84c39387dcf9045fb0d2f6f6440edf15b2106d6294e89058996937a2f6ff9476899232d94a7d256bde
-
Filesize
5.2MB
MD5f4ccff987d7445d425f6849c9daae90a
SHA10ed4d16d3f0865171ce8e9eda6f09f9c629994ad
SHA256eb89c66e0012dc55d96d23d7d7f759ffaf0dbfe1fba5e62fe74d8ab4ac606161
SHA512335cf43e3e10088543e4eca17d8d341e664dd6cc37d0b77674dc89487f9e361729b3ea4f1bad9ee2a8f1c0f45723e0ad105f4b17858454c9bac4154787b55b4f
-
Filesize
5.2MB
MD59e55d98bea4f5e59f868f8be01ceba3a
SHA1afdd4659ee914f9458de74f1d34c01c24c64d0ae
SHA256c55d1457766b50134458386ee4bdc7c84d1cff3d257972c775ce33e8eb8de9ab
SHA5123bafb1ed5bf2548a34d53e123a29ad08d46b8761cae49de35d686c3115350a43c8ba7049dafef96577ed305f5932826f17df4d5eff8abc60892445ba1d63a492
-
Filesize
5.2MB
MD5e2b9339079a3bfefc805cdc860d0be78
SHA1cd9c98700335797c99bf9b377f563f72d11da085
SHA25679e23f12fcec4fff17f8938e7f38a8852e06e1930b2609e842960fef7620059e
SHA5126e46531bd37b865505834ec0c782747d4ac667b8b3a184faef617b6c4f0667ed906bab3178cc98a0abc3c03593639f78d9aa160ace21fd05a45a0bced8752b71
-
Filesize
5.2MB
MD52659ca05d9dc5522083f5b39707e34da
SHA1009b7a25d9c40882fa466dfa79716f1ddda7a2b5
SHA2566bd378db695c022ce798ec21c764935b31d42624b8fc80f9f9f6a9d1d722a6df
SHA512ac3fa8e1cf053135834f58d35e690355c36a281af6450f1618af839cd96f5ff652dd4d2de78503f6555a8e69f5cc63a39a68f42fb5f3f5c1d8f55f0b089cbf59
-
Filesize
5.2MB
MD5e791d7c45304eb55169a29c7c43a1b71
SHA1dcd05666c72ad894f1b1af7895572bd82dc016b1
SHA256c36e3719c433be701f92b5663322dc9d23b9b83e54c7e2521332bf398d94e6db
SHA512601291470a2e7a55f4a546aeb5fdc32f18bb32a79d5eb0828748c8105a58632060b073971cc61de72019c85caf5c2cba6e79764eb59071269f18982f7fe3ec1d
-
Filesize
5.2MB
MD5ad41ad48d0b9d4023032cd5e4b4cee67
SHA1823184669fe8116053168537bcd3a94f0cdbff04
SHA2567dda462e0edf6bd3e47c61e262a360c0316da6f1134f1fd3ba7a7d55e43be7cb
SHA512a380a0835cd2b4f3e885e819fbe8cc76ea6c73703740cd1419a52956079e29b5613c17b0c49ed4d71e6b901f828c8442d41f8d03c46dc384e6f38348881b4966
-
Filesize
5.2MB
MD559bde31899abe94358af07a59e475c02
SHA18abafcb8886395f197fd1cbd5d311b26efbd7c15
SHA25622b311c0ef89bc4d64a7c69d854002ce27206624f4df3608f904ee2977729c16
SHA512d9f380715faae0975bc471d3c7fa838577042a50c17d5057475371d75a6c6d85b28cbbae78c42d32e63dde45bb4e26e159482f820bc40d48857510f6801223a0
-
Filesize
5.2MB
MD54e4230df25d8e2f26e2a0a4a672becab
SHA1cd54a27dcbac6d111ffc05c22e6af21e3d57a009
SHA25634c7fe7013b0b7f93c29d577fc85ef5425e470f54bfc3ea4bae3c5df728d5c1c
SHA51284d008d7c78f3a66a116961fa615b06898b0846d49ecf35feff8f95bc3f771437c662a5183d03d36e14138971b1d46121a5162aaee9f6cc0c01175279bd079a8
-
Filesize
5.2MB
MD50c61e91cbf0271c4bdaa450cbdc8d024
SHA1a2a3afad10859dc890a84fef88f034ad0a4793f2
SHA2566efefb123824d7356d5c34c54fa25ef5d174cb943e56c729a6923f8d369872cd
SHA512546d039485c4e523df51d1f0028d1648670417a0e938ba19036e1cfd7079fc6673d4d2f5c21acceb5d116aa6fcf95f540b3687a71442bc0adfb67dcf0e365ee9
-
Filesize
5.2MB
MD5631855e66b3fd2fcfc918d3828bb5bea
SHA1adbce79c710e199e51535b949063e3687b19f694
SHA256f352accedefdb81c948c2753b514f804a49f0df0da31feaaf40d1de9d253eab6
SHA512c4697a88ba62f767cc90bfd8eace17ed41e17b85af7b9d698f7ce540c2d431d309282fda6366501de40775efda63507e2bbea458d0da13a53bd0b717b531ccd6
-
Filesize
5.2MB
MD56bd7aa747a211c2063def379f8f0679c
SHA1d8f561eeec1dbd0d873afd7568562883494147bb
SHA256f08e65781d2d38b811aae3cc3d0137b3d0f72679600365ab6c0f41f0138ec5d9
SHA51234e4d3febef4560b1692d2951e2f989a7b3b8aadc3f2189fa5292dd5d422af2119333e1d784353a4bae294ba7716f50b3fb29955b9ca51ce87e84eb3ddd76931
-
Filesize
5.2MB
MD5c50978d5860d047cee13af84eb15d6dd
SHA154c5ecc88aa1b62eb91f2fa79c5a96b65f0d4750
SHA2568b0587b54950f0a59e7240f57d81f90a2254ffeda17ef576f61fab3bb9f806e0
SHA5126bee2aa5964f59646cb70e8bdb509b66fe89e0ffe3137f17ed978d46a4f9864f796ec59d87d4fda460d4f5e5748d59858c7f821b95697714704d9fd6d001d3cf
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB