Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 14:03
General
-
Target
2024-12-17_d755320ef3a26e6f9ae2196200853cbf_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d755320ef3a26e6f9ae2196200853cbf
-
SHA1
98e79e851ad677db044288eae60ab1f05b648794
-
SHA256
b2627ff0abeafbb759708aade992e9b6d6ddde130700214382244a982f3c314a
-
SHA512
30e7bf669f9a1cb785b51f17075c025e9152edac246e60917b6337c337ac0c7794de3d010c967d240320f0fd33a9ff9edd396e9b56dfdf3bd0b451c88287f32d
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBib+56utgpPFotBER/mQ32lUa
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_d755320ef3a26e6f9ae2196200853cbf_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_d755320ef3a26e6f9ae2196200853cbf_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hVCQEXz.exeC:\Windows\System\hVCQEXz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EqEVCTw.exeC:\Windows\System\EqEVCTw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xrlFWKi.exeC:\Windows\System\xrlFWKi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SnRzaDb.exeC:\Windows\System\SnRzaDb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RfiftjG.exeC:\Windows\System\RfiftjG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XmePBdb.exeC:\Windows\System\XmePBdb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\afHZaZR.exeC:\Windows\System\afHZaZR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XIejfdc.exeC:\Windows\System\XIejfdc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lyGLXzC.exeC:\Windows\System\lyGLXzC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zCgObgd.exeC:\Windows\System\zCgObgd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DzOEVcs.exeC:\Windows\System\DzOEVcs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DsxAtzi.exeC:\Windows\System\DsxAtzi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LWLVaOW.exeC:\Windows\System\LWLVaOW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GaIMqlc.exeC:\Windows\System\GaIMqlc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yPQxBgr.exeC:\Windows\System\yPQxBgr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hiziMJD.exeC:\Windows\System\hiziMJD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tryZoen.exeC:\Windows\System\tryZoen.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GpLEQbL.exeC:\Windows\System\GpLEQbL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ELglZyn.exeC:\Windows\System\ELglZyn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rNXimkE.exeC:\Windows\System\rNXimkE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gQHwBVG.exeC:\Windows\System\gQHwBVG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d09791439017c8ac1fb6331dc42cbcfa
SHA13f1821bfce679118a960f3e841c3205b2f4672f1
SHA256289659ac29a0545f6706ee723d9393ff22457ffa1ce9b84cefe9a37f26e74866
SHA512ab462ecaad602327b502e369673eefed73da4815482fa35089cf936e16aded6fef495560771faa314b323ca1baa0637f84d7c346593f1b5ab48d996abc3d6062
-
Filesize
5.2MB
MD5db6d5e1d546dbd8dccdb91e320ef842f
SHA15a7db5643b9e6d3737f3dd6cec3ce52a0df7ace3
SHA25606a1421b49bd4eb913dc84b1d2545ece2206da842a643434faea794df025c1d6
SHA51246ae0fa4a83c6a986e8e10b47a4cc932eba0f00f4c6fed6707d451fcf951529bc67c56bf9e30ab885dea7f292b2aa72ef5dc6ca89ec28d63ff80af81f10b9c18
-
Filesize
5.2MB
MD5e8bb3b5c53b681ef7e76549202a15053
SHA1c77e8fd9205539dd05f42b4ed356cf9a403f1946
SHA256e25184c681f1daaa1810414a710edb553053d7787734096fa4ed7221ec04862e
SHA512cc127b08b49b277b82cff0538f4bcfce649678d44817e5b92d01dd6d219381e3abac13dad58d4e72f731fdb3d0c4cab2bdae7f6cf74b1878c3023ff7444b05dc
-
Filesize
5.2MB
MD5fc186f61688e6555585f7cc74b1e323d
SHA1028215cdf63ba05e5453ccfc3b29ad907727f0f5
SHA256a4d8739f177379de175c13556130235a2bd9ebe4de4202fd57a96abe8ab34617
SHA512784f423b2ff5c61f5ab3d7dab87e6b21456b3c59cf6913187e4ddd4f396a6e787ee48ca16aa873f11511b7fdeeb777bbcf0e91ebb5c47334bbbe2152a1327681
-
Filesize
5.2MB
MD53bc827976e04acef25704c6d5e2ab1da
SHA1125f59e702eb026bf7dc904ed67bce1d480e4ce0
SHA256546f468f4f11d91f1234cf7d8cd5dcd834089a16db77afb3a80d359c319d893b
SHA51206debf624d9224aa59fc8b329aef2883ef9cdb67eaeb84274b71997d26c4502d9c58c5aaa2b52d479a1fb0182c7383da1b09a9a281b3a2c30578c7425d153555
-
Filesize
5.2MB
MD537d4366997110218e45c3e047b09d26d
SHA1dd067adca986818eed8236d8f426ee7f74dd1fc7
SHA2561c251241e7348fe8a32904205bc1342c5b8ee84e9693f2f0c61a1600c54d96ed
SHA5120bbfed5cfc32575393e8d1d727f8857212e6163affad444d127157323f7efd15a6ea48b1c1ba3446c75599ae860581edf73b8e80013ebd45e76b7060a003fb4b
-
Filesize
5.2MB
MD52d8dc14168b28f1a49d3d4cc9b0b3f33
SHA1afacb3c295162100100bda937bfbd1ee95eb0dc4
SHA2568f7812ea711469daef3100853e02877ea44c1d5ea89bfff22b59442160924702
SHA5122a9e50d9410202cfad3b1b96b684fb94ce95440937497fab49eeb331e6b21a4a814f6fe5fccffc0e3c1b5cf09e51673415ea7e836caaeae290823a0eaa1676f0
-
Filesize
5.2MB
MD56072856d9933ce88791bf9add40e6417
SHA140c1c8b75e3e7a7bb8f4b0e0c09d1fac64b0a87e
SHA256394c789c85dd6fd7653b9d6fe0b6a18573982d346f7f96767dffd9eeee511495
SHA512af995506ce826ad1f914851890301ff295203c7a078921a8326abdf3b828bcecafef17871176a00b5d4cf718299e933894873ee87d258dfd5fb40d2809f6f2c7
-
Filesize
5.2MB
MD51bf264e0970428c24e488775d8a86f31
SHA1795b861e8f842f7cec213fbd0d576b03e8522bfa
SHA256a7b0978dd9a6426b0e754f760e51aaffe0705903bcbb9da4330540105ae3ec7a
SHA51233600d4a11db21f82601a30dacab8e1a07f85d28ddbc6a12d91094048f76d45f2b921a3cb335e6152a134c8ccce7273ffc6814e442228e483077f19de3fb40e9
-
Filesize
5.2MB
MD57f659cc1678bbcc5343b4ffb5d217252
SHA110042fe874a083c7e133a77af2d8efa261889138
SHA256e387a4eaf7a47cda1e458f05be7c012c64bcf28f1239e9ff3d6d37355f12260c
SHA512ce37897dc92da59a25aa50073f11c4ac913f0d79fd3f8880d43a8625edbd39304ce598399d5c02b915f8a4a0bf8cd469c1a2ec8069606c49ee4267eddfad14b4
-
Filesize
5.2MB
MD5103990b60cbe4e0c8b37a814222d229b
SHA10c1bc75267bee59fccbea13301f91e5e25483c97
SHA25655faf72b357b5eaa6fa980bfdf9d40939895d7e375cc24e7cfb4a8d2154f9f57
SHA5122c78fde34641d2f9b2021459f301c39bec405fa7ed62d8c702627c344f5208503c73dceedc7f892ba085daf8bb7ec874388eb74b4efb64315e99524a63538d8b
-
Filesize
5.2MB
MD58b64f1fd7a0d90838167f0e2ab2e4d49
SHA1ff6542865df4ff42aebaf3d356bd5e8725bcfd86
SHA2566568b965e3448bca714fadec05a4c084037cf2b47c06c9edf936f366a1f794a2
SHA512c7f9c2dee84db638320f451069b392d78728600f7e4b8f8469d0f53f5ee91cf095dcee48c463fea4d9226604f8c67118893230feea9330b9251af59e0fd97ecd
-
Filesize
5.2MB
MD55833a72b1fdf09c77f2f7494e49ec8ee
SHA12c20682b4e5e1ac245b7b999be2ca08c7565be0d
SHA256b407fdeb33992d7d55688f716d9bbef49e3bd18954256654e7dbab8d1a021289
SHA5127e882ebe9fe95b9eab3b78d6010714a80437c62c2ff5faf62cdb874d9c81331ff40ee62d4d5d1dd3f879f422a177f25c1322fa825db09c14f78c08323c14cab1
-
Filesize
5.2MB
MD5a2414bf97b266c05923bfa3d10c6dc9f
SHA1e8e17e4a2088502867e2860f08841cc946c8ecbd
SHA2567e4dbcf27ebd6dd62d2485bb345e410443f600f2ab70d4796624e04f1626343e
SHA5129612e9fb45edcbc53345d0abc0ac74344e7b3860f1a528b33dbb0f7404a8834716fec2f10263b68d4db32340329f7cad854f53285855c7e56ee13fec7a8bd34e
-
Filesize
5.2MB
MD5f211db0a2a771c1a2841373091f49b83
SHA18ef0fb1b54c680cca9ade491ecd91be07189c03f
SHA2561564bbf1df9778356aabe9b2ed32e9aeb5c282ffa612a9eea066e47595aff28a
SHA512cb7b3a6765718882ceac098b2d8798c4060c13a3697f115e96a32eb5d2194f998a1313e67c81ce216cc25b7b8c02ac037eb535acf21badbf0e3fb724ceb07f85
-
Filesize
5.2MB
MD547a2830fc1830962da141d8900bc6c42
SHA101f98267db473d5043d334f720e5f3ddf9c7a355
SHA256abada50cfeb3b933a682669b904dade9f543e6c2b18c156b713ac7716c61f1f3
SHA512632bcac4e97d9d305646859f245ea6096a6530647dd073f3a30d08754223edb7e58b913c0c7b2fb41f882fc37315751a0d1da8ee5c12a6f95d5c454b37ef83b2
-
Filesize
5.2MB
MD5011b589d9a1fb6bdc9582df43e385d86
SHA16068972c2ee8fca48af87556e1b35f584845e398
SHA2568ee701da601ca596cfc486699b3b12b4f6c9e1225d5a71d3c274671b5f5cf43e
SHA512568e64e1c149c2e9769d219ffa22ada7cd6cc00eda740c9465669bbf2d3f931c6bdff76e29c20083a1eac0649599123d5e456175a5a239dd52755fc373e498b8
-
Filesize
5.2MB
MD528b55fb43a9406f3553a84a642e3cb32
SHA17ab7dd84faf88fb0acc873c6ddcbf5bc2abe9445
SHA25682b8044ef480db14234291842c4b2fd3ea284adf20e238c38eb8d9f515c78f69
SHA51297fd38fc8d7dba323ca1bb379846a9f6dce7e2390b1b62f0557d6058118dc12123b7928aba4836a785ca92f0d34701c4f121d23023f50cab5ddddd249e53d827
-
Filesize
5.2MB
MD56d2af89bc8622ff01c52b8a047b0d2d6
SHA16efd4eac9288e6e2125353169eb66bcfd8c53088
SHA2566c22ef2dd82684326467866cc6c4363f6c4d0bb8ac803311c9eec827e0e339d6
SHA51203100e3f8139ea5be699aded8a30603ad1a7b5326eaebc567f2212f22b0435a66e6b64443f8e90e1f39a948f3ad32bbe10f36917cc8add5e495a4064c4067850
-
Filesize
5.2MB
MD5b4464ea32733d799a5bf6e7d9b03a609
SHA1df3563b3e0b908da85b3e29f688dcb1aa8bd7f27
SHA256a6c9cc9e91e2018c7a66c68690927ca095eca55203b3236ab6c7011c1cf5c88d
SHA5122b90cdae74038e35b5c1e59c2c9cee97422485c73621460a0111749f47418e538854d43daabef43651dc92a18b088dabdc9e0748564c403137a90ef492b7f64d
-
Filesize
5.2MB
MD564c04bf38cbc089386f0666c874d9dd8
SHA16239d7faeb4cfff678c44bd20f59bd1fc3855ddf
SHA256a9deb0f63f8ca54ae9a7e576772a6ffc8d5c724e387de90009fab45924163d2f
SHA51261824003ebffdc58a8a54f259c781a997b71c6ba0ea3928ffaf8e3505a9050fd7f28f990fcdf7d19141e8ab2fede0121469338cd2272df916042ceb2f08f1ab6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB