Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
17-12-2024 13:50
General
-
Target
2024-12-17_3c6d0ac862aba1f42aa7ff2ec684a44a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3c6d0ac862aba1f42aa7ff2ec684a44a
-
SHA1
e85bb023dd2526b2e8f5e5e2384e49dfad82bcbb
-
SHA256
909d072db72e4bcc9706045ed104d92bcdf3e132eb73ca31e368cf6cea308882
-
SHA512
903f36ecd511a8a333afc9ca464c87137d23eb1a7247cadb53340eb53f3c66e8464a1601c6e6d9985fd0ef3a4030eb6d4d7763e5c86296b210af269af24b4a1e
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBib+56utgpPFotBER/mQ32lUS
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_3c6d0ac862aba1f42aa7ff2ec684a44a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_3c6d0ac862aba1f42aa7ff2ec684a44a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LFjMGTg.exeC:\Windows\System\LFjMGTg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mRGvAoZ.exeC:\Windows\System\mRGvAoZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dfMehRS.exeC:\Windows\System\dfMehRS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ixAawRr.exeC:\Windows\System\ixAawRr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IAtlPBQ.exeC:\Windows\System\IAtlPBQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mQSwTRM.exeC:\Windows\System\mQSwTRM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FIfdICh.exeC:\Windows\System\FIfdICh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VgxbdZx.exeC:\Windows\System\VgxbdZx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gudRsBM.exeC:\Windows\System\gudRsBM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CqCfiZK.exeC:\Windows\System\CqCfiZK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXUuAtv.exeC:\Windows\System\bXUuAtv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FDlEkSj.exeC:\Windows\System\FDlEkSj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZVQvIlw.exeC:\Windows\System\ZVQvIlw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DCEuzjD.exeC:\Windows\System\DCEuzjD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fDHkqRS.exeC:\Windows\System\fDHkqRS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OlIiFbk.exeC:\Windows\System\OlIiFbk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WhoKPWn.exeC:\Windows\System\WhoKPWn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zRycori.exeC:\Windows\System\zRycori.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YYcztkX.exeC:\Windows\System\YYcztkX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SvayDCJ.exeC:\Windows\System\SvayDCJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jdmHVEs.exeC:\Windows\System\jdmHVEs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5379b8efdc0cab47a794fa03931ee5b3e
SHA1670d63b4810aeced40255febff46a894c84db76c
SHA25667eb4f4a5abf52d1036d84c1b15b8ed395625b2fd6b98da1f0ab3cfd84ad24a6
SHA512aad52076c2aa82f19a08d9d60df2ff7816c02d67f723bb0a26b41055b005d69141c7106a862e45e5a6dc10d0f4af8f058c96a8cad28658d4cfc9ed00afd688ac
-
Filesize
5.2MB
MD503612fc91827779ae6d05ef0336eec6b
SHA193eae0438802f0aed6d8a5215bc5cc0b56727b90
SHA25693aa51f2393d7a9680a9285dc9be42ed5a5a984410dcb37a229e72322bbd552d
SHA512ad0f7e813c3cb3a57208c19451d472d821a02319213db1b1e47bc44a2ae093fb061c2a7a969428451d228fbd6ae48be51d14ba75920154bdd3df4c9213979344
-
Filesize
5.2MB
MD5ea95a072efe42befe9679cc1c24aa531
SHA17e37e89257fcf4a5bd7fbe183abaccd8c5e979f9
SHA256b7b36fa89faa0bbbc82951ca56517c7816cc3e9a7c9c5807acba24d48c138278
SHA512259b0a0b67a2a7ccd8d72da3aa4814b63532aa6080af761fb6fcb3ac9a761214abc5061683308a06f029f0d927410b7a360ce5a224193c1b387ee8e1be8bbceb
-
Filesize
5.2MB
MD5c0129b6fbf5a9ce83b33e4d8433c9cf0
SHA15727980faf34cd9b31d59867b3dfb401930cc17c
SHA256307edb6c5666da7b1942c3a55f23875ca2509bf6398ddc6df9034a47df38505f
SHA5127dce72a8236799daac7bd07d67dd493167e622a284c659ba5f2b07edbebec921a3a527f2f1029bfcdef3728b9c55b9a6879d1a2e53ea63ac56ecce16387bb5e1
-
Filesize
5.2MB
MD53f0dbea0bca813a0ae0b9508f535a1f8
SHA1f14763db690f66a79106e975effefce4499f4ab0
SHA2569a3bd7c3eac6c2dc12e067fdf19c897afdc514ad2909cbe2caef940572e6cc16
SHA512e1f3b07c3d46232e48c60cd475c45d5c5b8d4021b6049f896aa7d0f836972c88f4d2fc6c96760337a77bf45ffbadf3bc44d6ab07217f2e54d1316b03e0bea4ec
-
Filesize
5.2MB
MD5b7ab9a781b7a28310832784f08dc56e0
SHA14a19f4b4105e671a90eab0d36e7c2f61f45ba8dc
SHA256c9e3eafc57dddd213cacf8aaf6e9f592b7caf35264db007b37a2991a51feee8e
SHA512273c05f075e46c81433a7a4bd5823b1e4b13a6a280c24a55b47fd2c02a47a374cdd52a345b3c876fd9cd9083250e76fb3966f7b5c570b349a04fafb0b656ab63
-
Filesize
5.2MB
MD57652e70a2e79b995d4c48a9801f9999d
SHA10adf2b2cc5eaa8b49c3b0014fe54573925200109
SHA256f5f069346b249ef6cd59e2049606b886df4a913c8aa8ba02d14521a92f4c5464
SHA512b0f71ea895fe73d2bd9588a89a38b342c79a510b356c7ffea71c0c105f5095866c13597ea7495f1461969259440e2c3c883960551307440e565ad1950e1f8ddc
-
Filesize
5.2MB
MD5e93fc0434516a05caed31a9118c11e24
SHA166919ccf4af4d4da23dae6b457da3cc05821f5f8
SHA25636cf5a2afadfe94d77883c668547800e5570c20de175c2743948dac9dff4f011
SHA5122c8651d0aeb7f9fb3abb5b5bc430a6bf4ac276f16c158557c6efad0d5deb2f83bfbe7c7188f4a1f39bbf9be82abd186bc9faaa6c2eff455eb808d0dfcdcd4f59
-
Filesize
5.2MB
MD5d6688666cc4ed683b949a35e94f002ce
SHA1234b43aeb26a93ad79e344d53ac3b9323bfe35ff
SHA256d61b7ab10c451400ea7ab8907d2898b7f95f1c717b9046c399207ce646c82752
SHA512800818585848fb8727041b9a1777f8aedeed73f89983d6e94b82d88e6e8aaac6646404143fe0f24663d8f8d09f2f6668d3eae73596e889d264232a84a0f8cd85
-
Filesize
5.2MB
MD51f66e0e42249f5e156c3f44a537563b0
SHA1c2573fcf4e366fee13db04af642ce95aed8059d4
SHA256ce2234aeb04f461b7f6cbb258224eba85945a13810e99d6d866f294497a46509
SHA512b0fbefa5cbc3eaa5d87ce3fc3c9a986692938bb61f6f59da6f92088c4c2587dd867b945f7329cd6577b7e3f5e8a242b00628f09c7b09337d0e0af3981dfda7f3
-
Filesize
5.2MB
MD5bb52c2ee752683aaaf49ee5fbc788631
SHA14a351314755d3abb3053791991428b41e2a0970e
SHA2569bc7a80d8a9caa5a47a1e2b19eb9f292349560a2203027b30d3bb339f9096e09
SHA512b8c4a8ee3b58136ff73f5b25e025b402c41c4b0360470ba8605c970694d3b73e533e51d8c0aae0904f9916e37df4694d4e989460f82e86a2ff198fe49f1d0f39
-
Filesize
5.2MB
MD53dc082c341b7e9dd64bf86cefb7cac93
SHA19dcfca4121f6f5786f46ad121aaa080370ab1b15
SHA256286f2ecc31a0fbd8c05ebb0d3cec46d33752b87a9792173593f90de5a6e92b33
SHA5123d48178c6c6ef54a89447e5c856532db6354072cb04c6adebf59ca93d407e20f3ad01c26752a5c142820162b436496c1182e4564d2593947e174f70690624abf
-
Filesize
5.2MB
MD537ed78f9d62df0974379319a014ef4a5
SHA1c4cae97009557ef5596e2e46476bb47c018d930b
SHA256c95892098fd17ce40f65c23828fc2b3ae5b767b328b5a53f65e9e8c08e827ddf
SHA5122ddffac48ab7c6f9fe3fb40b973248b986c04be04815409c183609b7d9def64a45431edab8a64e30b030fd0ea2f5c67a247e246234a1dc31d6decca830983218
-
Filesize
5.2MB
MD5650a9c9bd2f78904e51fccb942b4b132
SHA1ab079e5f6a6d02af20d555be649816ebc9365079
SHA256697f01716b6d3bf3b523758036433f240b76238634ba3283f14d23b9fd86173a
SHA51288102901ea87e45a0f1a6a212b80e989dc8f6bcb8cea2ad981102db0c3b9888a6295ae182d6041f9b3c010b7eb11058fa9e7bb8df0704bcb7ac34683d1705ead
-
Filesize
5.2MB
MD5705c1b170663666e4c720da1b910552e
SHA1a873ed741810c7bb8fdc89cff8cdedefbad18dae
SHA25681be58b71ebb182acfb7d68705422cb26aea402d347517edf4145268a5c8b2b4
SHA512559452d2b9a213040ce18662f49b4742ad54c8f352bab35ec14562a9e73b14bccfd190b5ac0942d14503e893b787553d26a133a7fd885f0e03e7d6a08affb9a1
-
Filesize
5.2MB
MD54ae468ead83a15dafbc26eb9ec0d6fbe
SHA1e07288073ed139387132f9f76d7cb85617ee3d7c
SHA256b154dbe0a03676e0199cfbbcfc296687f9046df0f0dffbc1012e96b758a59c8c
SHA512f5d85db7aebb4963b97edd44a3c6b722f7cb543fce45ee9fd9d95d36527c62348e75d9e797657e0f2a852b45760a92f8cae8e8012629cff1cb35d8261958f27b
-
Filesize
5.2MB
MD554da6c4caa52d9e3dc7280c59092384d
SHA1194d96419494a688af4c417f84615d5e9fcb929f
SHA256e1b64af3a6dfc3e138dbc0f7f22a84c3e198bb4c16dc029db8ec88fd5c6582fb
SHA5120dbbadf146693f1e7c9b2de42af3dba6f24c4b371be25fac5c206fe4094c179eb34c011588e79cb9533fcc8c50e8112052c638c73b8329d569526582f26e40cd
-
Filesize
5.2MB
MD5f14771315f13f7d5894ac996ec2813d4
SHA1a654599777727da0d9cdadbeb6170e83f8c6f188
SHA2564508b53e9b9076db788fbf3225b764fb45cbe3be59429ef0e19fa1ff04107a43
SHA512192d68987463091e56631a70fe4d54bd9ef4108efceb1fa12d34afd29b9bc520d6744065baf38f159c0eeae70e14a298ad8e26cbe573d10c80f7c21f40e36b8a
-
Filesize
5.2MB
MD5db58e81a5bb42a13298cf397088d15d9
SHA1db748dd3e2af0c44ad055baeb0e9b8061f1f6e3e
SHA256dd8b78b8174b01078d1dae0d0db2b03818be5de68fe125a2a100ffd8c77b8e29
SHA512b1e20f0ef611199f26bc3f3e970ebf592029bce60dc02110632221fb97e2728ef6fb94a556951b0dc68c7f5f525ad96e0831c926d44585d5a420fcc60f21cf87
-
Filesize
5.2MB
MD5495e8957514993581334d3455bde0def
SHA1b5790080b2e6ed6f6e2c20def4d0e88cedfa2929
SHA256b3d1ac71f7a94506139b3ac6eb93c1ce22531e8e0ca409df6d9cec64ca0960f7
SHA512e48ba95204b3b56aaeff2164e14d9e08f6a56e0126eb20945a51b4c541aeca287f02bb3e4608a64874e3ba886df4542e4e7a189170be051c0c2515c026dfe9bc
-
Filesize
5.2MB
MD5015806ff4820af21d66819ee8a137ac2
SHA1918c14fe02d7ab1d917a060787aae8fc3bd588e7
SHA256af620997a0fb8956fc8172e3f1c7a5f0884f38abae848e155053a86d35e6c6b6
SHA5120a68b3dfd63aa15416834139f58dac9df28657df6f4e7778358a09634728c540f0095afabbaf55d347c3227786b2bd72531bfca79dc0f8f14d74cb67cbb834da
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB