Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
17-12-2024 14:02
General
-
Target
2024-12-17_bfd79d61ff65b86e55b78f729bfcf3e1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
bfd79d61ff65b86e55b78f729bfcf3e1
-
SHA1
b8370bab093ed9a93073384ea10c36a0542d7e3a
-
SHA256
d023d1cb6dc3e4ef885e15a357e8bc54db7b94555bc20aa9a2507dee87ef40ce
-
SHA512
c58be2b48357c8dd304d7da16ab8993f6d273b9d47d2a14a2b1ce3f7e9ef5fa9a1f3f7120772c6c8742f7270094effe1c8577e707e8a268ce2356d7d834bf505
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBib+56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_bfd79d61ff65b86e55b78f729bfcf3e1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_bfd79d61ff65b86e55b78f729bfcf3e1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AlcwGlJ.exeC:\Windows\System\AlcwGlJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OWGjQjm.exeC:\Windows\System\OWGjQjm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wqTLrFC.exeC:\Windows\System\wqTLrFC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sOXYxxl.exeC:\Windows\System\sOXYxxl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zZbljOH.exeC:\Windows\System\zZbljOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AwZmFPP.exeC:\Windows\System\AwZmFPP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NjTUOSO.exeC:\Windows\System\NjTUOSO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vwJCmKF.exeC:\Windows\System\vwJCmKF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PTjHxVA.exeC:\Windows\System\PTjHxVA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WlSUfph.exeC:\Windows\System\WlSUfph.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iZEzXGh.exeC:\Windows\System\iZEzXGh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rcCXyTh.exeC:\Windows\System\rcCXyTh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YBnbgBu.exeC:\Windows\System\YBnbgBu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rYEzFbR.exeC:\Windows\System\rYEzFbR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RtNpErq.exeC:\Windows\System\RtNpErq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YMhagoL.exeC:\Windows\System\YMhagoL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vmQknPR.exeC:\Windows\System\vmQknPR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UvKrsGN.exeC:\Windows\System\UvKrsGN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aWHCTvB.exeC:\Windows\System\aWHCTvB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KhdbwER.exeC:\Windows\System\KhdbwER.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hJSjLAd.exeC:\Windows\System\hJSjLAd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD586604aaf56c26ce9acdc0e87f94917bd
SHA1a1cd2210bfd05f461b577a6ee51d8a3cf85d2a62
SHA2565509b56fa72c84a15706f40280983804b59a1d807c4fd313dfbbdbfbdbb4a240
SHA5120fed2418c1f9bcfa0098b9302eb73940d62ef5989506ff600b771f1f8c5643d93e000d40ee8330702d3a88166134ade31f1ad1cc44da699987a49cc615e48057
-
Filesize
5.2MB
MD50b1d477c68b47c9e833f4a5fb640b5c8
SHA1c6a39704982c5671a33fa0cd518a97ccd186ccb4
SHA256339711ef5471ff180a7b980450bc5a3df76fabc3753538fb3013e41d7aee534d
SHA512fd7226aeaae2a8c6c0cf4f48b83d629397fb5846e331e5baa8f697786e828c4e85db02911d846472e4f51711b373e940850151a4c792119feef6a2fffd248ef3
-
Filesize
5.2MB
MD510857f38a6174dde6489d66fbbf3bad7
SHA1e47f01fc8c9e5ac82db3745b9c0a5bb5b86c67b8
SHA2567d69f8bb09313feaf1fe67f0558ae9fcd7c72eb43ae4412a5f271985f961b0e3
SHA512ef2696c01d95b07e451819252bfc4c93df73ce6e3316b4f9579aa9213565f9e0e967e1e77c03d3605d360734ec0ed7cc5249843dc066b54f3551f72bf58e9c92
-
Filesize
5.2MB
MD5919140ef7fc107c99e87d169c9a9dcaf
SHA1b23a6129b612c7f1c6f976ec1483abd4b98f4b6d
SHA256c62f7033e6ac478653735d1753deb1fb7e6af5cad130a6b4e66a5dd30698da88
SHA512202312d28a173e15f339c94c4b67ac8f3a863c615645ade9e4de60743596210a22d737ba82624f25ea97e5281858c8d3d0a5b8a8fd0e25db3acf9d27c7bcc323
-
Filesize
5.2MB
MD56a949cad157a16d6eff6c96dad94c26e
SHA1736f43c4e32ff88e21dcc27c1d738dc484c97d6b
SHA256e6ff0c430bb7ee12f46ccdea97588163c9ac50a668230f5da3483bac5253db63
SHA512b63b9e1ea2ad0d7ed93363ae6be8c9a45cb01f8ee1c9e7b002749083f0ef8ae2334803f4f16f1d06bfc3e1ca32967fb5532e8172a6413d18f182c5d038f1a224
-
Filesize
5.2MB
MD570ec1c7bacb1ae17796338097524d3ca
SHA1b5dec74fc89472ee646587d2f2a23eac67b4cef8
SHA256500199fcf7c000412d3742c9dc640d4224d3414b7388021b764074f0969ff596
SHA5125cf2cfca4112f2a9149cd8d15aa8ff441a3bb9b713ca9566f1a3b5a710bf932e834d76f145a665fe6c18b38997b1681fb0a4260bf12f122eba9e85bdb060cb51
-
Filesize
5.2MB
MD54d098300a26152662e346466583e0902
SHA18c28892daf17935c26b46530a971d4017cd810c8
SHA256e65846127ad6bf52f7cce00e4a2d41e0c04f95a1dde438eccd94395d895e9acc
SHA5121e7b2436d3c1ad9f755c9d3aad17019ab0280f76ca481c1cb9bf98ff4145ebceafce4471914fb01eae60ba9ebb2ff78a4ecf3778a158a595c806212f74e65503
-
Filesize
5.2MB
MD576d6bf251b5910ce2fc6fd2557fd7956
SHA1d554ef3fa099281688382da374413f8d7c4e5e85
SHA256e64d89f8017a3ba403b6c3b7342d004f698d81a1f7f6d7ef4a83dfab36dd19b0
SHA5122f1c77f1d4c4c0c9f35b2b640ef49563598717af1acce1e582a0087cbfa176d1eb93a6f29bfae390bd734785005a58c1b3b3b64a7adcecea240b53eeb79d8d7f
-
Filesize
5.2MB
MD534d0d9a231245d8d377e62acaf2efa51
SHA1aa0c2bed61bddb19318a148be3730472af593f56
SHA2568cc3aa82dbf042fce91acf9b60537b64c7a6855774142aacd006dcff9634d310
SHA5127b71780a5d6409db74c72743783d66e5083f0de586a0829bbed0b6b5abacb7e788670647bdf3a02e994980766c98d8d4bb132388c842ad62c1a2c7237e03726c
-
Filesize
5.2MB
MD543792543a8119fe9fa43a37af10eb4f7
SHA190b5968381334ece5c4b44ae41fbf552f37cdbee
SHA256b6a1b8b55b781087d33491188a46f57ed755613159ec17f8f2e5c4c64ae88231
SHA51270fe115d5219e47cc69ecbb31f09cf284c1022b6f987e26e0f8252c7ce51d3155e8240fd40d41c9a65380efe4a77374834c6b14a930ac51a09acdb7f1a7a2619
-
Filesize
5.2MB
MD507a08881bdea662cbb8c0f98e3f2dab5
SHA1246bf33f35abf1fc54cb12a18aec2fe8e8e39af3
SHA2566eeb00be75d8a972ba054f21b2d3209bcf4569727b054ffb544ec5993e2d0038
SHA51220d7ef41c6f2876fdb5b8d6fce111ef898ff71c619c25942eef59cac268e221d30f9bd185a2d93561307564fb16f0beb62e29653f67d341de7b07151530c6055
-
Filesize
5.2MB
MD515e895c9dc39b72d8c76c677cb7b09f7
SHA1502563a471eb4ec1824b9aa1d95ed6cc1292dbd0
SHA256e257eae49af62724ea3aae00d05c2d16f98ae0787b7ed9368bde1309ee3e3475
SHA5127cf181350663d6e49d0ebc11e9157ab177431eabfabdff21849ba08d665d10c738faf6cca42c5757f3ca40653964dfaff072e5216e5f26b664880c8e4b2ec493
-
Filesize
5.2MB
MD5dff125a69290df47794859bc5048c18a
SHA13a680c4da9c3244f9e208afbf8fc7e9aa23098ea
SHA2560d753cec144ae44bcbb37b13a0c30b6012d07dec95405096f45829e2bfec5bae
SHA512b1a9b6c5f9f199db197776122a8709335f552f7b9937decf35e86dff330f4ee63945b241ea3f2eea5806e526a185ebc9a2870d77c648fee54aa5e0f12b8a8457
-
Filesize
5.2MB
MD56ff10963d16e1429ef3e6c69a27a804a
SHA10bc0531162cdce7d534322eb3c7c4a43ffae4771
SHA25667a61233c04ba3ff7ef09ed6edcfefe935351dc41c3c4b5240aa88b6314db655
SHA512c8b29f72f88e189036c56a898c1899b2f75d78c8b867875078202fb900554de974fa8e484f281515565541f5879e4f1c5cc3d04f0f3cafc885f48169d5cea349
-
Filesize
5.2MB
MD51584b0df51d14ec9ba2f13b976f74e0c
SHA111f6a4df788e538dc82512a2fabfd6332f289c4d
SHA25644ee1ee4569c2437f8cc9f37d27dcec2e96aa86bde8897e6af0bdb8cb4fb6f8b
SHA51272352efa6b2a442ac71d4cf54b02efb8ad11426fe232879a541ea32df7a49ad26870b7c8c5c24a193cebeb73b3eff4033e08c4a45c6a4eff0706a4af663ed1da
-
Filesize
5.2MB
MD5a5896b05e09560ea29be61f195caaa2e
SHA18cfa2e95a6583adfd2938491266ecca824b79cd7
SHA25605340bcd74ee393f0df4b5af4dd43f20bb0e8453fdd67717bc01e4bb4cd9af9e
SHA5129474e04481f1c74fecba32672ab26a42e771fe6c3e79929b28a28d7d7a6d0ecb6e9ef5ccf66407707be2841fc1104121b84a19a30f53988b145a631ad8e5e63d
-
Filesize
5.2MB
MD5e7cb3ca4e06255db243b02a237854b1d
SHA1657b933c24af89233931e9157b2571ab7b5edc7e
SHA256e90abf0cee953d07ee43824fa2aabb2b89464bc1c0b1f3ac741656aca90b26b6
SHA5123daa564c8638592ed4751c9ce0bee905de331bf77b98eb71321ddff58b5acbf4fe298bda80befc6d79b93d664382c43ce051de96268cbe3f5aad5ded85ad68e1
-
Filesize
5.2MB
MD569addfa745389c4b63272ce6e6b48c35
SHA1f4e064b47fd7871b2fbf25095d76dc5122aad1f8
SHA2569b4665f1bf8bd6abe606f3aa063172228a64a7bfec56336e99d5da78fe972fae
SHA512768cd03ed19f28f323cb3e444ec7054967595ec837fc18705a8f5e798c205cd14993eacef979015ecc0ea47523c5472bcc8f303e8e1fed5cc4f62094735f3df2
-
Filesize
5.2MB
MD542d3b9a61b4762efd8393f15a166e5d3
SHA1dcbd7cab7d48eea5146fce53d77e037d67894631
SHA25634a1c86301f0e57ed4a04b06faf9722e0d7ee91820c925a4e28184e825ca1d34
SHA512ed08b742fa16871d5ab0832508aba2ea5d1249d0be18e437eda7d16cbab4abbabd245f61e0cb0847ab92783fed586bc94f5cbb2886448d8c5a23c44ca3eae170
-
Filesize
5.2MB
MD53c93da9c64e27905c94da28af9d4b816
SHA1a483cf134cc871cef2c0ee5fbde800acd8f60643
SHA2565f19b869c731d2cbcdd35b626ee4557cdb4c0a6106896c42425943be6643e7fb
SHA512e221dd10bab4d328400cec900b013827e89ce0ea4c48024c43f807c69961e4bd6b5a0e84b8de310b13a1dcabbaa8bcd1958d4988d3ba065610185181aed6bc16
-
Filesize
5.2MB
MD5493b16ae0ca544a4dcd39d8a5fbaf3dc
SHA1ad871b0431ffed118ca63af08d61d596889be091
SHA25686dd874ddf43f4ff7e929ce2910ecec6a09c1d9af81a20fc1a58157b19ce9d16
SHA51291c5a7fba79863ec2edec5968f743b61cdadf570876985e7e605bbbd2d58a18c167a55fe81307252f4bae811d83848587e4d3c9eeb5fd81bc6d6b63fe864f4d3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB