Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 13:54
General
-
Target
2024-12-17_64d4c8424fd3174ff82f2819fa22969d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
64d4c8424fd3174ff82f2819fa22969d
-
SHA1
0b5164721ed863025d6da85d905ad483646f05be
-
SHA256
ba3e61205af7c4a2ba429e82dc8fc592ceceb64f39d68db31962c87295f0211b
-
SHA512
56e1298775d445963cc2dcbad9375d9b19667f9ad1a94ae01dc06020475df117f142fcb4751094c36d911e86ca572cd1e93a75fbede0a7c3c1240035027c4973
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBib+56utgpPFotBER/mQ32lUp
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_64d4c8424fd3174ff82f2819fa22969d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_64d4c8424fd3174ff82f2819fa22969d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vEvjQSO.exeC:\Windows\System\vEvjQSO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XiOzlUC.exeC:\Windows\System\XiOzlUC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lvAHKJL.exeC:\Windows\System\lvAHKJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PAVyHep.exeC:\Windows\System\PAVyHep.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZKEnfwR.exeC:\Windows\System\ZKEnfwR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OdXBwkh.exeC:\Windows\System\OdXBwkh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cOozDIU.exeC:\Windows\System\cOozDIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qyinZvr.exeC:\Windows\System\qyinZvr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VdkUFbY.exeC:\Windows\System\VdkUFbY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dtYNtFj.exeC:\Windows\System\dtYNtFj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XdNnUUV.exeC:\Windows\System\XdNnUUV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\agiQaOx.exeC:\Windows\System\agiQaOx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vwywnTi.exeC:\Windows\System\vwywnTi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BmvfCqn.exeC:\Windows\System\BmvfCqn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DcoLUDP.exeC:\Windows\System\DcoLUDP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PJDNVMh.exeC:\Windows\System\PJDNVMh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qvoSNUg.exeC:\Windows\System\qvoSNUg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ywDkxLB.exeC:\Windows\System\ywDkxLB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SeQbIdK.exeC:\Windows\System\SeQbIdK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ryiHzMj.exeC:\Windows\System\ryiHzMj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXpsbEl.exeC:\Windows\System\sXpsbEl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54a5d3ffc17d6b11931ee8a27ff530169
SHA19baa8a30599f61740d7485b58fee63ea52569dda
SHA25691df9528de08c880c8075b5b67379204080aee67426cc1dbb233861773f2d6c8
SHA51289431ba6d55307407741349877a6786a9621626d1f40b64d2e81669f4347b4fe5c97b16d645032250334361ae78a84b51759484dd04e60cd113efb0757ae711b
-
Filesize
5.2MB
MD5be7527f479e54b4650dcdd2b43d71208
SHA18ad72d39205a8d113bd9dd2629f2162310d5b47a
SHA2561a8340a29a24e48929f1e5adb347b269c142cddbacd7215e4cfbe3f5c3846665
SHA512909e3c35301a904f5ae6b349de3f283fc906ecc4766d46ffa62c87c2072585d15c74077f69073ca613b18c1fea344eb57dae65b5508786a76ffc3ce1c736f187
-
Filesize
5.2MB
MD5902d1cddba038a95ea11ea84d233d089
SHA1342e8e3140f123edba71b7198ba4ae5c7a7d1647
SHA2566dd9fa44f9c2cdda72a45e5b0c0ed83b52eba153b9b646222e26413c2354bef3
SHA512babe32502d09540c39d39bf066c92a373755a50a7ad76ad059a63628966f0dc5c7a10c5e1cac0cd75cd83f25c5b8a7f5b40370a41e8bc6c8c14762671e169bf0
-
Filesize
5.2MB
MD5bf17466997932dc62bdd7470d1674769
SHA1722dfb390240228ba1810644a142f7a7d02e4d64
SHA256b32ef9cbdc149548aa2359431cafba3bb745eadad188444e91a34530a0df4afc
SHA512c6df658739454eb985284d3988387b12c751172d3470d9844ed63acd41a65aeb8071d9c5305e3193161e2490db6d9fde9df4fa2c1719d6024aae1a13ddf59336
-
Filesize
5.2MB
MD5524d6dc33d3ce47a8844b55f88b42477
SHA1bfa7564d6a8cd170ccf53ad15284d0c882385e33
SHA256daee36d995a3b22ad3f5db2524e48adc3658dcd59532756f80b3787abba66d68
SHA51267d6d66372a84e41c3a45e3badd80847342be6b53861a4c5f916f1058562703859bde96a695048ccd43fa3e96187943f4db382a379e080c347f8aa09fe90dca3
-
Filesize
5.2MB
MD5b1d144da0676eb9ec844d4cea6299e52
SHA19fdd32a7b326d4b97f2163acdfb8001ce4b7f9d2
SHA25670aa3e14b3db50a417441aa5c62ec32a3b21c0e39d84ecd05fb5663e5e172c1b
SHA512632adb1e8c45accc4d81bd91eade3071087a4da94fe8b89367c2d7cdcac540c9035e2876caadd39c878687807755b1468c96b15fd2ecd2835e2c4a98f8397918
-
Filesize
5.2MB
MD5b5e1401cde2a659f2d28ef74f4bc2194
SHA19cdcefffb9d0a8f7ac91fd0b3871fbcbe36f4a2c
SHA256157eddac3b1ace0ffbb635f703278c7ed399ea8458544ccf22720b918d9b2273
SHA51288d43546e50d630b9c42d0de03e146c100a3de24e2f697ae52ae2ec43109297e69dfdf4252e33e974ae7097765209ff26c80cd80c9b350bd4dbda0b787fab4e6
-
Filesize
5.2MB
MD52d7cc33dc1150ccf46974336246764b1
SHA1ddafa86ae2c8a020a8ce367e489c527c0a45e7bd
SHA256a6edd6ebea55ac3989d98b1a5b3aecfde202f53718d3eaae8814bf6f433f0749
SHA5124f90809904618ee348643e0f091dcc986ec5d27a8aff57fe6fdfc248c7e3dc21c218fa2fae2f3f9d08131453e9130c38a2d0347d74dd83403198ec9422d3a5f9
-
Filesize
5.2MB
MD502bd4e8d19e04d9eb452ee8d7e0d2ff1
SHA1675e70162c927a04fd851a199608b7d36e35f63e
SHA256f915ef7488f0d81fc5f05641681c46613fafa54b21d113b07e482e06289adb43
SHA512aab24ddb074406605d284cb1ff98e9a75a1b8e6135c23afc78101c4e19bf6c7b27ec86506c904b2c28b2e4f185ff7c16bab32402b34db2f3f67b88c2ffd4d142
-
Filesize
5.2MB
MD589c909e8663008135ea36f956d158508
SHA1aa4c2cec9518078e1a9e9e345921ce31a902ff7a
SHA2569d50fca8ad27d7f53625f00780ab3f4fe6a2a444e16e9d0a678f6916fc6b6bc5
SHA5127576fa53cf42f07be755b84be00cb64a33adca197301ae23b7bea11f851e49bbf4c048a3631d0fd2e1a1c3139d3544158bc2f86352614a4cd2256b01901d0b5b
-
Filesize
5.2MB
MD5024a29c92a64f007ca83b4bdacbd00d3
SHA12192d930b2d30b5235ecf07f7f60c25804e9acaf
SHA256674dee1ff66376a57306a7254275fea7723ea6763a3a44990b9364c22322e1c8
SHA5129130ac5a9da10c9cd6471d24922d2e110456ed4fe5920f8e5930741bac6896bde951018f1bac99d741a8c56a8a657c37535d85abb87d75c9686d2d97df0d7216
-
Filesize
5.2MB
MD5ca18b5e3f44a3008c27c6e86c76ada6d
SHA17edd3bb6fdc559af82a361a7d0df092bf53f0393
SHA256f364ff8bbaf5944ed2437973f815e70d1223d27f59df4ec8eee5534012baee90
SHA512635b4d5d6664717b0be13e9263e2a1863652cbbc74bd963650113f6e569b93cbbab19f4aa533f1f92c5ab4ae96e4ccd88176f0ce48aed15ed705f7c88063e09f
-
Filesize
5.2MB
MD5d4109d1889754b2d923a58131c4a85b4
SHA1afde0f0a907a9540bb0507d5a9d24ec213ff2d2e
SHA2568cd90aff97cda29c5e218639cb1aa8f04a82282ae48365f933032f4a959a60c9
SHA51286ff6c0e7d6d74ca076119690fa3617f3b773a1a4886505fd5542af6c97e929678e34616a310dcdcbfe6206908fb05d8c40af3e21fde9295091eb71c946af4ee
-
Filesize
5.2MB
MD57d856369d537e43076e8677977503b74
SHA1411d21284d830ae43a24f45084d4fba626316b10
SHA25644ffb4dcd41f48ae50de669bc4c4d6085f1c043ca1dd7f3344d1f68930e091b3
SHA5129fe4e0f50f3524bc2116634467a42b46a13d37ba00a24368e9b907e8cb317512a0a8009d4481a806dab40545adc03a748e9590ca6cf3b0bba5b5683de04f4f5d
-
Filesize
5.2MB
MD5d7032afc314f7a1ea1d7620cd610a5f7
SHA10f3ddabfcaa0bef32e031f89d1a9c7cf8178f0bb
SHA256c988b6a9f10dac10dbf8d60a5af25db46d1bbc8fa5c1a3707b0ec60109260065
SHA512503bd98b39c756af7dc63ba814bc4d5c3360f6d2a09a6e3c881f91c802850f7e6c97f7a2e1e4b5a6adf8e3ec763ec0f254a4eef37c7d2a90aafc42ed97d1e7d8
-
Filesize
5.2MB
MD5fb4ebebb6c399dce442814da86352e1b
SHA1860f539e31c210e65ddd9d0b865749a7ec061b08
SHA256fe16013fd51d641805de334182e1cd660e1752f5857534aff67620bb2508903f
SHA512c60bb5aa4fa70ebfa713b7437baa9199d75f33c0bbbd46db3dd45b12cf5821901fdf95ad0fa6fdcff6368c1f445276ec41cd1dedabca090c67a5f3ec65302951
-
Filesize
5.2MB
MD50aa24abb0b28851aa7f8f10871d8a72a
SHA14db8712350abb63e62baf372ce1bb52c66dd2334
SHA2567c1df7b2e002ef46086c233bc96fe7cf418dfc03ad49c2eb9d5d9c6b0e682d0f
SHA5125ca31c98086d19014120071e8fe2e5c3824601e6edeaa7515b963978358e8b7ec0a16f910a7b42cce19e5cd222b61818021effff2c0f1506c2efcad4bb5370d3
-
Filesize
5.2MB
MD560bce1eb4252538357e59085308189e9
SHA1e1d13c3c60bca74d93633e5aa99b5e6c9136df84
SHA256c5c367010c0b074981e1318c9f27d126b3fd5ec766250315399c2576e1bb16f2
SHA512a3253de1357ea463d45e8c4479f34c3ec21749da21fb4d0b78a4f3811dec302fb7475ac6c3d3c7d115c23a6b131df27c8299bf11a284ba5559157e1c2f88cd35
-
Filesize
5.2MB
MD525d516715fe3a087cf183ba48842db30
SHA1ba175b7b5ff9e7d7ab12c8ae8d3a6d215158e47f
SHA256e6625f1657a93cbdb179839ce8a0148c03a3349fdeb97db5f741e5ba3441efc5
SHA512ece35a7516cf7b14cb4bc7a7cf7fafcc0b383a52650b93d8840fdae24d786312b96ba159ab6338a17893582d5fdab30ce027e01e594ec768b22a0d60f7676187
-
Filesize
5.2MB
MD577d231bed4aa1d9d33f2a64a1829911c
SHA19f5657e17f5f2da3bd7110c00e0d5c24f4aae898
SHA25688cee2f054240dcb4b10a4738ee678eddb9858d120387ad8847dcccee7d462fc
SHA512cd6508124d38a383cb735da91cee0facfa706d5841b87b53aa5b1f8ff4a28f67b32958bda5e714b0e5e0c2247fe94a42713cf86f7d6ff841ec9dfd35842485e4
-
Filesize
5.2MB
MD5c735c490f579acd75714d09c29736e98
SHA1347d1ff9c73504d7d4f6947b659fd9eee8dc8438
SHA256af050648472f249ce1f3fa6c5b8c2ecc1050fea41bb51ae3928fba23c7dc1022
SHA51265cea53040553bedbab60357b956254100eab8c03764ebfb52e1083232a2eb6d404c250afc7683b9a9eae725fadfd05b09b7140cd58edb2525648836bf2d3d02
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB