Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 14:01
General
-
Target
2024-12-17_ae665ba6846dd0e599947205bc28b5fe_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ae665ba6846dd0e599947205bc28b5fe
-
SHA1
52424a594a6ac5d12ee6a33521919d5df2c618ce
-
SHA256
ff4be3eeba16b65e2dacd2200ac43e6c42a98ce073f8808e2af027f45360abdd
-
SHA512
549433b93392026b7d812be4d429d70e205f196d3c7e9fbbda29c4c5b5b32dd774ec3874ec77164ba34b2bf30f358a4d3645d865b24deb0f26178696413f8282
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBib+56utgpPFotBER/mQ32lUU
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 35 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_ae665ba6846dd0e599947205bc28b5fe_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_ae665ba6846dd0e599947205bc28b5fe_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WmXPcRL.exeC:\Windows\System\WmXPcRL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tdJxojI.exeC:\Windows\System\tdJxojI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\docElJS.exeC:\Windows\System\docElJS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jpOQpah.exeC:\Windows\System\jpOQpah.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wCKuCSD.exeC:\Windows\System\wCKuCSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oPHwXjP.exeC:\Windows\System\oPHwXjP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JQTIntM.exeC:\Windows\System\JQTIntM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\criZjBE.exeC:\Windows\System\criZjBE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nYMSLIA.exeC:\Windows\System\nYMSLIA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WCWkruP.exeC:\Windows\System\WCWkruP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bUaTUWR.exeC:\Windows\System\bUaTUWR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PeussWW.exeC:\Windows\System\PeussWW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jveszmN.exeC:\Windows\System\jveszmN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MbxZaoV.exeC:\Windows\System\MbxZaoV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jEnfKIa.exeC:\Windows\System\jEnfKIa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YWwfXKP.exeC:\Windows\System\YWwfXKP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NqnnPWb.exeC:\Windows\System\NqnnPWb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fwnmcCN.exeC:\Windows\System\fwnmcCN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hPjXDKf.exeC:\Windows\System\hPjXDKf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AlIHDUb.exeC:\Windows\System\AlIHDUb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uostkjR.exeC:\Windows\System\uostkjR.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59d16a0480c21f84a6bf1076d86f67b0b
SHA16b1f1157ae8395c9e2144b066d5336fcc11e3d7f
SHA2564ffa5b6d5f02589d2a6e9220048805bf2aab8e87e5add27bc461091bf7c41b45
SHA51256a6b4387a48543341c8356dc7372977595d611820016d609531e2a27321ceb42c2831b62c44ae93568505418bd66bbb524f841656f076a8037912f0c7e0f6fe
-
Filesize
5.2MB
MD51839b27f68ac91983e22bf75773f2704
SHA13223d0783447f84b9c68a5276940a776371542a0
SHA256a55b494e64a530d4a4b83e5296af5120d80068bd681bc5338c3ec623566a5e8d
SHA5121f472e606be2cac7378d725c944c293c1f0202c340f93f30d29fa4266ae3a0f87e372d4eb11af185dec4dcd9cb4ebd179043f2466e8f329db1efc4d9314915e1
-
Filesize
5.2MB
MD5d72da5d55e36d267d6e2e69c41cf937e
SHA178842f8c8b994be8494a5486f3b756abaf3fe640
SHA2562fc1d370ab87a7f6957bfeb987d1384e1c9144128788b6f2d70a3243d6397240
SHA512e7c9768c9cbe24cb5cad08190d9eb9a500e3727562f111d3dd8bc397ba7f38448d35b75657088a169bd3b310398172160eb9466c96557ac399e77602ef3f036d
-
Filesize
5.2MB
MD57552721ab0a2fccbd0548f2d003fc835
SHA1fe4a02d93cac98bbf876133dc2ee528f5cf875cb
SHA2568d9a043c55d433b97e59cb2deeba4f214d9a547e16cf99ef5fbf73b60ac9a3ec
SHA5120592b0d3ae67d595cfc0e3b1d33bf2a7ee46df928d094b847093597c6fea3f96a7914bde09edc0909d9195c0b6c98b46c6ba168b688b6270f6dbc5758e994ea1
-
Filesize
5.2MB
MD55cdd51a2f275378ef5cef4326016cd88
SHA1b3c7ff972d10710a5c9ab3624c33f2a234227aab
SHA25669683952e777a6aad81a1e2f927ef39311ab26519db0fb220190eaaaaa187c38
SHA5122d0bda3d0ab3b0e6ef1a465c00b8426cf388566f39b0d775e636cee83d858ba3b2d6ab3334d4dcff2bdab5dd3bd03d71f189d08cb8ce1b015eeb1891695216e9
-
Filesize
5.2MB
MD533ac7115864f3a59973267bb6da245ca
SHA1bb93f7e7680c4fa70647f89abaa9cc71d4dce268
SHA256f82943c570ed828470815ebb09c15586173d0a3d6d8c025ff8d340c30851e0e3
SHA5122da41cb31fe0c6da9b01d41ec6a0960fdbdf5eee673b4d0dffca068e0cbf1c1ebec27d814e6c1ac0e961e2fef73f95ae9be7f99254d6c4942ada4381ea962ab9
-
Filesize
5.2MB
MD58a51b3efdcef6c5aec78e66237727510
SHA12206b134a1598c2927e51145c7c466a4ae3d9a5f
SHA25615933d49ff4e6567026a2e318468e45a83e86d21b1934021940a5e8a9315a54b
SHA5123cb789d9e337b19229a83432694d8940b55830318774fada6eb196db4334a70044010c7fd030b29380030e7503e08723e643c58cfa11c85d845111ff83b4557c
-
Filesize
5.2MB
MD5613e595e25c80f0d08503d424d88ef6b
SHA165733bd6d8c9be85ff8205664acbe185424fc6f2
SHA256fb90f70e41712864e3400983b7ae71fe4a3284e3e2089e53c1d1bd9ea82efb35
SHA51296a950b170e9a018ec31770b01a1f1e125d4f1dd019fd605f52bbc66ad8275da00ae2b72461fa8a5e498fbe4ca05fe097f4d6e3448f640f05059384d324b7dc5
-
Filesize
5.2MB
MD5ebf370261c700f6f9718dcd1d80af776
SHA14cf33a7dadb90c0fa5bdcab5356fd67bdf7e9bc8
SHA256e97ecb286e9daf32571374b7872c0abbda1a1d68cc683fbee11a48a42444b55e
SHA51216649b95a4aeb281a8159587db20e0393984a6b1266e87c59df7627bc0dbcff5a8c8e7090e71c4b45d28f8300fd3e89e19f4c5d1c8ff3467a253039a3d91237b
-
Filesize
5.2MB
MD50ee5f6af5503ab685ad9062f822f152d
SHA1bfeb49942309d45436f8abfcde5f224fefcb0a75
SHA2568b7bafb8eb305a5aaf1cfcb1ec7a49f202183a2538153a08b55f62abf3b8b80d
SHA51285e112928414ed86adb183a50b42c1e14b331d6db0d7c502538881daf3fe1c89342cbd50dbf382ae9061365b43c5f7bb6200d4b19c6d5ade6b6a723337fd9641
-
Filesize
5.2MB
MD5b886567ad06a0915c52a1a01ce1d3e9b
SHA1fcfaac1897a355e96ec4f94a034d5f1908dff8e4
SHA2560b50229451cbf4abe1e8334d29f6433b3c250ab42c32866ebf28579d381d922c
SHA512c8fb0554b175e9ec40bd4f3ad6c314dbbed037105665e503013367de1e3672f79bb10f1e625138e010b7190c3e8a4eac7443ea69c81ff9c833013e23456fb5f0
-
Filesize
5.2MB
MD5df0980fa9575f04ede91d32990335cdf
SHA117b6d7097424bcc5446a5cd77c943401f1a92d68
SHA256fc97d36e771187f59861f89406a625c4b44392274d167479707cdf02c0b418cb
SHA512e65faa136f98f63d3afe538c53df679286fa3399c5a2f16f187105ef211e1d40b8629005fc288a0baa7935b8574a7a73dcce369782373fa8566bc1c29ef9d0f1
-
Filesize
5.2MB
MD56c37a1450ace6bbef49e4c134616ac4f
SHA15c1a525e757c9537dc7f706426b9c283bc62232d
SHA256199e0c045b6530addc8cfd6403e0ecdd2ef05d5282b313430cca0d68d8a543db
SHA512ef59e10c8329881596155fae823e34a4ff237e30143cec1fe24ce0fdea687fd39fbf3eaf99318ba6e4c40b92a19fcd860a9a0714dc33f9edb788c1c83036b6e9
-
Filesize
5.2MB
MD5b4e3f1e3fb065b357468866accc2471d
SHA1f2faaf9b8a938d986eed6ae080fdae36479bf7ac
SHA256f59a225d12206cfcab8130bb0762db71873af7595042770219ac8c1681dfb1b1
SHA5120e148dc4d8fda8cc33977c5e3616c0a74c458adaf01c44fb8f7cc045bcbab6b734ad162356e1e1fbf22008592ed38333fb9516f49215d2f3a916815461e0c9da
-
Filesize
5.2MB
MD58ad754ab8d3f8ca48f4947a73ed5ce69
SHA17486bbe5ce68ec7266b0d50c4eb2bf1887cc116b
SHA256cc36f5404335ba487ad36dde0f21001a1b5f14547212a1a56c9b382dfa4cd168
SHA512e9c1faa8e0f9bed414670eebfa74ccf609ba619861b5a3217b8e4ba6d75841d512f8ec406995be18b5c99fcf7d7e710ab37bcc1ca28057c61a06175d85e640c6
-
Filesize
5.2MB
MD5e98411ed3073b9b59af1a8c2f493cb8f
SHA11ec3a1c89deef5f219bf8a2f4b292f5da694e755
SHA256ba4d7c73b1e04e551bf63ca5038d121af9511215b8f21b72cf7412510721a5a6
SHA512f46eb5555c4954019e38639ab816aa1d57f4c510af75ffdd3efd0fb2f83350b45614924b50cad42efa3b25ed0c8ac762348e40c435a33e6f82f84efea3123bf9
-
Filesize
5.2MB
MD51fa5b902dfbdec784843e0a59a0ca120
SHA1d84f7e31bfe6b1e06aa0490d1ad00397829887b6
SHA256fb6a5914c2b1ee1decc35e596388fa5a9a2b78b73dd787fae23512b524389b37
SHA512cb28a24cb47516392cb11bce01f5b9d011db3b0764e6cd1e90fe72117faa48843d5720e7cccf45f428a2b67c96754ca3c60b5a1d77d5a8f492c2c41f87fda2d3
-
Filesize
5.2MB
MD5c75852e4281e9c633de002cdf5a7f6fa
SHA12df79c797c0278e671bdb0daff2a2fcd17757737
SHA25626863d7faa3a7b339a64543c2f3601ae9a517209a76cd8d85a68676406fe8ca6
SHA512bdc46954cb201b4d07949e8f4ee483502e6370361b4d89a8928f2d7395c018b829edd1e17929b661ed9b286440c1f2dcf01bf635020b7d3dab2b9d171f716614
-
Filesize
5.2MB
MD5213062ab18897ebdaca6893363672b6b
SHA186b180faae0752afca6d7238b99523fa0ddb3bcf
SHA25610c7bff2517bd4acb7fb90123c20a3462903dbccc46b0dbb92fb584bee90de97
SHA512f32d677f72d33f82c1437459a38c2ae4369d5d3f337ab375b571a07e75ca3065d9e3b19a1f890ad7941c3f6946cf02c98e90b05eacce07c77a4dd8bc5496127b
-
Filesize
5.2MB
MD59b8decbf21df46fa12fa3fe9f1eef9da
SHA1eb075afdeba7a4ef52d1a8140cbacf0cf1dcaac8
SHA256c0536ccee975646cf2e64c1c5ed4adefe0f60615563fe3b8e0345b440c9d0b1b
SHA512e1852202b97475b132f70def57a3310a61ba860357faa758759e1f682763bade48effd86e2db3764df6e0483e22b27bb369298999bcc824c5190226e42ebb8b2
-
Filesize
5.2MB
MD58180f8b08c47ee7a3d562a517c108b96
SHA1d52fc84a8abc5f1723bb01e4c6ee314f1e5a11ba
SHA2562d1cb5bb936d0f375e02b48376c55cfcfd21f34fd1ba14c6b009ce1fbfe25eb2
SHA5121694d23a568caadb4fcf49e34d431902e29a3ffa6d0129769eedbd2622d8806a92f8233f7a171d9c803fe24744528c84296d1695d1d439faea89411b21bc8487
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB