Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 13:58
General
-
Target
2024-12-17_9879166cb50b7c453cc16babaae6aafd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9879166cb50b7c453cc16babaae6aafd
-
SHA1
8a3262978920b4c8f38afe09a39f57c0a7991145
-
SHA256
fbaea20ff43d624498405eb676b052140819ad673ebebdd5e8a95d30539f83d2
-
SHA512
839861b83ae05004d6a20073cba9fa793c6e2c984f547796a72c630cc65605be6d33080744024c53db2832521bf29c1dc15cc7a647e972542c554c49459f5678
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBib+56utgpPFotBER/mQ32lUk
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_9879166cb50b7c453cc16babaae6aafd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_9879166cb50b7c453cc16babaae6aafd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\JorbIgS.exeC:\Windows\System\JorbIgS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RqTKQxM.exeC:\Windows\System\RqTKQxM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VFAHVUS.exeC:\Windows\System\VFAHVUS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ApbfLXZ.exeC:\Windows\System\ApbfLXZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XYBRGZQ.exeC:\Windows\System\XYBRGZQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lPhawiI.exeC:\Windows\System\lPhawiI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QXGNwkN.exeC:\Windows\System\QXGNwkN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jOyJgfv.exeC:\Windows\System\jOyJgfv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\elDprik.exeC:\Windows\System\elDprik.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KgGaaQp.exeC:\Windows\System\KgGaaQp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CSrsKJo.exeC:\Windows\System\CSrsKJo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xdwAkLP.exeC:\Windows\System\xdwAkLP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PXCrvIP.exeC:\Windows\System\PXCrvIP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RytbrXe.exeC:\Windows\System\RytbrXe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GHDIOVf.exeC:\Windows\System\GHDIOVf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KEsRCOW.exeC:\Windows\System\KEsRCOW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tOgnQTK.exeC:\Windows\System\tOgnQTK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yYvUQqu.exeC:\Windows\System\yYvUQqu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EeynXMR.exeC:\Windows\System\EeynXMR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YzacgEr.exeC:\Windows\System\YzacgEr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UdMTcas.exeC:\Windows\System\UdMTcas.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5830caad1d8998b69aa31c65979a6507a
SHA13d70696ea342fd63a7668dc97705f605f2d1c188
SHA2563e8ab8a3dd2f5347704cef4dcfb89325ce4c5b69b9e05c9da63870e97d02e0ea
SHA512a645f42c3eb922b9ad3e7601bd730c1964312055c0ee9493d0252636aa0e5eddf42bf5370c0a072b0409ca436bc2e4cc010b8de419f00a09bbb05360d1c19ab6
-
Filesize
5.2MB
MD5d568b71bd4d2caae8ac91cd7535870f3
SHA13475ca47bfabd5d68d70d8504e406fefff3dcdc1
SHA256e0b7500d2002ac5135a6433d23f1f05528ac45190cc46997d7d12190ad662b65
SHA5124f06d2131511044d2571a6399f65c7cadeb01bd3613ec0389c6e7c64b137b52759390c6332bfe5ef228aa8da211d308c5e2e8df575aff843b647eaa9512dd6aa
-
Filesize
5.2MB
MD53a9062b7e3ac0efdbe298c8fb84c3097
SHA165bbd12f68125c318f29b808285675ebc9c4b938
SHA256897eb68b032c236e5c85d24aab7b22ba4b2afb3bdaffc638896e1e3170041d52
SHA512fdfeb0d7e72cfdc5063e7faf56c3eb3a9c71c00d29d1294d767809722e1c4b31b62ad612ace61be1642312a5d705a520dbff024576e1e42879bba864e8af4dfe
-
Filesize
5.2MB
MD5b8fc9046a4f6221c25d277e8c0338e91
SHA1e2961a3d2b268266df1bfc7438906a1110113c54
SHA256abb22b2b7e86e7d92c60dc83956494d616a2df96fc5a26b974076fc6eb05ad9c
SHA512550f73765d73d542907fa05879b327e74d40e38402f2843563bbd676a6a530b6f8991861ba4f0473e7f2c2ede9a65f7443463eceb0d1047125671f2ae8c7102d
-
Filesize
5.2MB
MD5e1778c342e5d27095aa028cca90e34e3
SHA1fd42aa4f2f8231aa1bb2e89aee616bacf0de8855
SHA256e03dfe52814ce9139db9585bb8420138c52b57d890c9cd822dbd8d71d182a905
SHA51270d37dcb987a5b764cf466b3f4ab49f78d85c13f40603a071b98099fa2bfa3cff40ebf9b00937659d510745883b13ac64e45d96ef3fbf71c368d1f8a91201672
-
Filesize
5.2MB
MD500f9731b93963f2dc80fbefbd6e3509b
SHA1bd25b51be3fb55e11892268424221200f84be747
SHA25659fcd4cc83b8a6438181255602e864ef18643d405ea4b7e1c2581057fe1d60b7
SHA5128dfdf1906a477f2d51145ee2cb81d82c9d53c7ccd11b4bab2bd6eecebe0670dd9e650d3fe0dfd3be7cbbef7e04c0d2a6027d44ae3dd994aab716496aa8f53174
-
Filesize
5.2MB
MD5d7b0822aa6a0b565ed4c46952327adb2
SHA1896ddfe7d695e13ddabd6c6a71b72d6ce42120fa
SHA2561b7336d0fab12c4db6eb858066aa0744be70b8c35de0c5c7393c61090489ea8b
SHA5127ed9a922e67e619ad0e6b904fa76934a5530f112d26733d4156540775497e26843b7f8f32a3d94f394a90697dcb95d0467692fa21b903c80d28afa5d2044b1ca
-
Filesize
5.2MB
MD5e353f1fbaae166efa80f7d88553d97b2
SHA1ccac4d2b737a90f104e38d8bd298a19c93b38839
SHA256d63ea5bfde414ba1d3a2e72625f0666f531089e39816f1ba8b426c1f3b144de6
SHA5120364418e1f9e464c99812e8bac9bb4673163a91bcf56ee708cabab9cb96d5e11033b781da1653bc0f7be9df01308017aee2d9bc07bd0bd65d7fe593f83689ea4
-
Filesize
5.2MB
MD5bb7698ed5771c577e1dc4ff9dd5c999e
SHA1b2cb7ee7addc5bfe696cdbde6a8ebc911da56c22
SHA25685598e6c7d811e6b0af8e405c938d80806bc779bf73c54780aad7511303cb9d8
SHA512b22721a8a58e4fb51bbc7d97a5be76d1c8257ec5f3d8d5da1d52933c11996e3c513d4f7d3bef582ab504b8f61cc35d74b6b41a1cee78bf0649a3e76f5671fc5c
-
Filesize
5.2MB
MD55badd864b1f2750adc3b09e2b4e62bfd
SHA18d7a6307aa4ef2ba5ab0003e1d07b42421265088
SHA25608a19cdd8fadf67cfee92a8cae9cfeaaaffa4fc32d87d687e87d42794b54f7ae
SHA5127e0083b8fc4f01bed117867313efdeb21be721247c73aa615d76452b7f5551d604e7348d8742dd30f1c857dfea4d2a08eabe6c2acbed315ab0f35f3c0c05e08b
-
Filesize
5.2MB
MD506fd42c8af6f03d2e3c2f1de4b21c192
SHA1d682eecfdec82f31f917139e23010732551c44f3
SHA2562bf137c3ae3d3ee8ac06ae855bdbe2d853a1803c8bf5a7702fb3b56a01f0abfd
SHA512c92a2857bb41f4806b2ed3ae6d8dd032b0a8d84bd6bfc5c9e2d025ec82890bfacf6e22268bec4d178db39df12bf0d774a59f0bbcb7686377afbb96788af164b6
-
Filesize
5.2MB
MD55d1bfeac30d648fc1b3aba3b7d8a8132
SHA1e44f88d4cba57fa3259dc796eb70187c0bb2bf95
SHA25695fc7df5b7253040f4c8c04a6119e4d7dec3eb1f2392e6f3c0cdc01e9693cc25
SHA5122643a16cb4605255497320b8d00d44e825c160e7414ecc8992a7138b15919b08fa23adf7b281ebb03aecc2400c5738ed4a95385130c649232706ba1cdb562130
-
Filesize
5.2MB
MD55339e3d951c294de9a6d5633556f84f8
SHA100e34343e9133d36b955994db9bd934c6e9af446
SHA2564bf85f5abf84a59f631cf4cfe7c55d059b7e15bb20d6089751af202041127fc0
SHA512d82899ac62600e5f3f31deeeb5018eed9e68b5ca943d0a3fc0331a31cd51fd667c96738d4bbaf5b308e7031a979761d8fa77aa117ddda490ea3fed429f483630
-
Filesize
5.2MB
MD5b624dc04d39b14a4eda65cd0cd6f38b2
SHA12de7dab27a1e98d1c8f37792d4294efefa13cd47
SHA256264344b2c7980c402c1b4c4348bab79b33c9ded10ac23e1b29c3b3d308948527
SHA51294b81ed5989f1cd089b26ce0942bd057ab737d0446ea5d428db58594b88fe3a583916e404708d0cf98f23ce7bd9f725b8ef461217d7608139d040effe66bb6ce
-
Filesize
5.2MB
MD5cc87e59cb6dc9cc1ecfd3ba9a1344138
SHA13ff8cc10cdb1e4ff2d0ad5d9bf01215a8db0ec5b
SHA25646af641e7482571a3b77654a38f5e193483bbfe0a8d4ca5fd85e73de69c687a3
SHA512e470b962035106d25bb1a828b2e625f9de474f6a544e0e1f193107c1e824e2976edea5bdca7a6acc82262d9b7ae583379755a755f36820f801ab0ae22043899e
-
Filesize
5.2MB
MD5438d82a1115828f971db9bb94f9d991e
SHA1aa2a260254320a52cc46462ffe8a75b07d39bc75
SHA256c39046018c9db65ccc54fb93f3b76a1a044c3c7496599dce6aef3037c5b05f34
SHA512279ede93d672d399db9e09d11c4ce75ba578aab70fb92cf119324113e39ba6a4c3bc4da79de50d20fca26f772d0e894fe851e3162c443b027a7b36f7c6a91aa0
-
Filesize
5.2MB
MD53c6d91c9a98563ca72fdf8d73ab9add2
SHA16392415eaf2468de946f9e6c7679b7a20d7a6efd
SHA256e0a5c9203a244c4c63f539236d3b016467b9d15097a53364a3a9a5c9bd42827b
SHA51238d8362011a9ec939b128c284acb72ed60984ff01a788fa32c3de579c6e1b9844e5949f4cdc20590dd6c63e3cc3967cc768d44b684d7a2f9a1ff06f2c7a0a7cc
-
Filesize
5.2MB
MD59df82ad9f4cfe26fbd66554851355c6b
SHA153f60e46daf7fd7246f3523fcab31c407b43f593
SHA256cdc631b931791c4cd2e021b2f6e74fbdc262ed6d69e14db1e66d5e285f3cedfe
SHA512132794082140ac806ad1cd22388866ef8bc6e47da51dfa6bc301f80d9d08b3f3ee82f4324ffb67a500d5e03be60098bc64a7d5afddeda727e5731441fe125171
-
Filesize
5.2MB
MD551907ed0de61d60de85ef49bf8e64901
SHA178e6ac9b4d1c78d0211f1f6aeae6e13174995580
SHA256eed1416a444399f1adf8955b4297687d5ddd923b116f941e269732e8d51d4112
SHA51223332915b78c59fbc9cb466d9b59a77104ac0198ae1ad8b6e8367394b89e0644d09b8901def3f21d8d5936ccaf5ab311de3459122f11644a1068ecf9c7486c87
-
Filesize
5.2MB
MD5a72022dddeaf97bf990d6219ae4a2ffa
SHA1cd21c5ab842609412b16725c7d950b582fe82101
SHA2567102203b8cb095af057c59b5d17b8069e9c71c633d5f9d3f464086779256af19
SHA51239b96a5b3db71226ca36eb6a4b628cc7be121903fef9cc779e9811c1f0833a1b7b5e464887a4e70fa0b31802c42302138f7d37e380f4798170d5573fd6d83e3b
-
Filesize
5.2MB
MD5d5e22fd07d6162439aa8657587087679
SHA10854bba3c0116fa515b76348286d3aad48eb79e8
SHA2566c3ccf90b99f6dc525f51f232dc5e799c7f6a01a9893d3fde47334e7b6aa3b97
SHA512ad274b484aa79fdc013549d0e9ee8bc31c702b2b96c5388fcfb52d8148fbda74d0b93dde4b8a28bec553c503f41b460358894118398d80af345f2a46216e8b1a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB