Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
17-12-2024 14:05
General
-
Target
2024-12-17_e1d4ed06a5736162c6a5aa3cd65f9ced_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e1d4ed06a5736162c6a5aa3cd65f9ced
-
SHA1
2d134a02bddde91db16d677a1d18630f0c9f6035
-
SHA256
8fad5f9e5b59daa5ec5b1366018c12efd3d46503d2d9c6a424de7978d6260e6f
-
SHA512
05aa364ecd989eae6f229363bf21ebd46773ae268a3fd7f2eef562a09bfe75dd0a7e49055b22bab9cb1df4ff4be335a38f3304ed46b4a7afcc7404d01dea6369
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBib+56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_e1d4ed06a5736162c6a5aa3cd65f9ced_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_e1d4ed06a5736162c6a5aa3cd65f9ced_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GIxHjMU.exeC:\Windows\System\GIxHjMU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GGSoIbZ.exeC:\Windows\System\GGSoIbZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kNnKplZ.exeC:\Windows\System\kNnKplZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PeQhGfD.exeC:\Windows\System\PeQhGfD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\coKDfZT.exeC:\Windows\System\coKDfZT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YahGoEg.exeC:\Windows\System\YahGoEg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\adbyuuu.exeC:\Windows\System\adbyuuu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zQPwQaZ.exeC:\Windows\System\zQPwQaZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kTcckGM.exeC:\Windows\System\kTcckGM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ivkndxi.exeC:\Windows\System\ivkndxi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pEbETRO.exeC:\Windows\System\pEbETRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlTUOyx.exeC:\Windows\System\TlTUOyx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntzpcUW.exeC:\Windows\System\ntzpcUW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VpxhvKg.exeC:\Windows\System\VpxhvKg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KLNobnV.exeC:\Windows\System\KLNobnV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eNavDIz.exeC:\Windows\System\eNavDIz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fnYofcY.exeC:\Windows\System\fnYofcY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JmlXbgP.exeC:\Windows\System\JmlXbgP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ejBmbNV.exeC:\Windows\System\ejBmbNV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rtmSPoE.exeC:\Windows\System\rtmSPoE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OjAmNfP.exeC:\Windows\System\OjAmNfP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b014e35e72d94fe06dccdb80f2dd3506
SHA1010c8681c2512a2ec70809d3059113273d656940
SHA256cf4be17a8603397d562bd97ab019f135b9876419a26f38ed5b098091de44489c
SHA5121bf7036ab29f3075fa322078feef5b220dd35ca357fbbe5d77af5dcc7fd031a55157418fcee1de0eb27d0d04286d8e0c88f48bded43967b51662a0fa6a517440
-
Filesize
5.2MB
MD5e1ede13da3555c0259218c4473e059ca
SHA1d0d5f2988a4e67b29d7d894e1985465c48cebe91
SHA25651a64312bae62152b08930f5fe23d92032b9be3e2a8690cdec331714bb9d44e8
SHA512ff115a7b9bcbcc9b70572ef25c272d688fc75dde9550b306c04457176a7111a6a91d5dc6486357bdffd0a7258af629bed023b5e393df4353c3ade5ad70c09de1
-
Filesize
5.2MB
MD5c78c7d5b50b1775d9789007804fc3580
SHA1e4b300d68e2b8383e838fcceda6b9bbf178636a6
SHA2567a773165ff8c9d00bd69c6ef2f2f4f8d98bcf0567ac4c3434a8e637f695cda8c
SHA51299d31bd8fd3ff5cf5b9f73080bc1f836d93c5622d3cdc0f6420081471c1a586833b99cc26c26ad32be11501313e81affd850fb7dd54b2a1e053b2b64d314be18
-
Filesize
5.2MB
MD533e2857d8cc03ad965dc4280aa3001d7
SHA15f3a63aef539358785dfb6baa26688c56590cbb2
SHA256f3cf925c79778c6955dd099e609bd12ba83af67a31f7bf6f5fe72f57f5beb55b
SHA5123981a1525dfd24204272d930488d2ad813e1223e23a6ad78ffb4626c70239729e39933c9ba427dce75f3758d5cde0ecd3a3438cf6d03f1db9af584966ffb9e20
-
Filesize
5.2MB
MD56115ba6d93da2b2bb390d104916b33e5
SHA1928be8ce7ad31489023fa0a33811509a56d8e10e
SHA25614006b0b59c659ad0391dee8f97338a899a92138cc98919e5ce873b3bac7bb52
SHA512ea38678afcc066c3a34de74365f5af74f2b06a9911d258f2680ed9750cba4f922bb59cddaf6796fa25c9c44e6faed60e4066618d985d68df4654d645f6ce7ecf
-
Filesize
5.2MB
MD5d857dda27bc0b06dd4d12cc95b4a5698
SHA1e533ddde31e4ac32c52818740c97f1e7dec339f7
SHA25626715a6cc96e534f59c464d775981497247fbc6456775e01b76c1d6ddb192416
SHA5124a5b219a47d68bdfeb7dcdde0dc5af03f96232b5e062fe4a68334d702674263be33a07146f1aa7216775a75ef145db72d9c601b83e741e3acd8fd8c8683a362d
-
Filesize
5.2MB
MD53be7631657d138cbd3526d3370b13da9
SHA1a617c554dba235839dff713d808bcd2d64f555b2
SHA2567fed4afb99bb6aaad52262b16a1facb339e1c2552912fe88dcc834e62724fe61
SHA512ea44dc0759d2de9567132a95ce2cda64b97e395922b188cfe3d38e2f042c41a09e09b7d0d909ac7913fab1a47ccee1f9e7e9d28c24a997c841ee17ccb8a8c06b
-
Filesize
5.2MB
MD55dc418ed4527aa1128c07ed0b89844d2
SHA1051b183e16f26b7c914e9a92bd4f1f40bb53359e
SHA2563c951034f22f548f1cf948493ab28c10db9940793da913ab424447d8ae948bd2
SHA512dcb7820dee4d2674d6d7d6fdac650da8b9571c003cde873d394a78c10220d2a1eec135edb34064ed2f6f99f8c9da74117bce16204e9081840e6dd6efd21e184b
-
Filesize
5.2MB
MD59a326c07b66fc57533fa87cfc4efbd9e
SHA14d13094fbc5403b0bdcc368c9ab648e162d05153
SHA256d2c7434e0b3ecb3c8796648e78d0b0d0400b262f0b4574c6f2624ad704a95c1e
SHA5126ad749032d9c39cda74ae3170d410d95d33b72d6a589943b53b2834a4a2f7cfce7de50c39301c488bdc199a11de2655d06ec30a0f93f29902953b2f4020edd7f
-
Filesize
5.2MB
MD5cad3128df5b369513388cb002c7822a8
SHA1a944d270c15cb9943aeb91822d6cb9c85ef0cd2e
SHA256b2a3e929534346906f162f9e575605d44eedf69fd0e49da6755d336178f5c6f8
SHA5126dea6a8503e7d3b7e081b744ce946ae57d54e6e59996ce1e6251ec4e690c681d6f1d697a408d65cba7a8f87b8215fee004ae1bbaf2b4ead34ac3c6892e31a614
-
Filesize
5.2MB
MD5ed8ab4489fd48522a7e87f29327a8e00
SHA1cff056ee8572a5f07bbc964ecd7db1dd2a4fe280
SHA256cb7f0f9060a8d66c99afe60f6e728e03aba172cf97ca2c0921297e84771461e6
SHA5121bb158929950123e3f16334f2fbf3f1a3fa1f6e7eac44d189b0cbfd37e324fe461074d31e9db0ae631c1efa32fa82a4a25bfd9d4eccd1dab82236fbc0b91e10c
-
Filesize
5.2MB
MD5a91da85c9cecaa80cc406c3a8f407053
SHA13df1b0531ed0901243f202c7e3b7af129e2a4700
SHA256b2ac71309b3bb520b45e3e1446e6fc20086f042ed40a25be9a03a1139266a411
SHA5122ad52867e928c2979203515f2f43fbdd54fa165033b2933bd39c43af06e803bfb7ef17566c3835b8ad31a8b90403ad6291048bf5c76928a0a5b40e116c8d8422
-
Filesize
5.2MB
MD50803d0f211da8ebff977cf5fb850830e
SHA1196317afa9cc964e58e3da94c15140be62ec7758
SHA256a5dfeef58512b300e7c07471847c2bac71a57764cd81fa8e81f0f3b18b42d492
SHA51241d19c61027d0a77b493498d0f8ca86b77d647148d025dbd5f782ef32460052fe5e8d3b88207ff4bb6c4ee306098cffd4efc0819e676a821cbd8e89f1acf60d0
-
Filesize
5.2MB
MD51040d4e3422138a2e661618153a52bf4
SHA1c13f390494015c72a6f1e19f18f91073f27f040d
SHA256e4547cdfc2a53d27b9471283d2dbc5c2ac181230939eeb1c75bc29b8f8b80838
SHA51267a6b5934651c1e8ccddf9e50f4c721cbee7b9ca711e924e834059ab6bf237b2531ad89a781923c3537ad1ef5482bf735de7afbbd9058cabab05be1077e4d4c7
-
Filesize
5.2MB
MD5fd9222d824a4a3457fdef50e13d21e16
SHA11df1f045c33ba4e8c271f87f711ba10e3a8d4b67
SHA256f8b5976e47cb9afa5d2954c5bfc7b9c9243a62c2f1e6279ba19c17c0d8dbe8ae
SHA512fa1706599b5b5623b36c6e9fbb705bcc37d4a10d2d8172848535fce530d04adf7ce353ce2a20b15f27b4337e27e379579c37dac616e01bae4a587d235af4c600
-
Filesize
5.2MB
MD5febf0dcedcda0287261e567f295831ec
SHA147672379ef686bc2d9a5325a97a1b3166e92718c
SHA256fb21b6674268e0428f69b86ff925c7347043bfd007572143840c2146947597aa
SHA5124190a840968e6f06fbed55e0a2b94e51bf751d9fb137a0866b38bb4fe556e105e5345d1926c6809bdd033943bcf5aec8641065b1f3f5c6b0616168a538d8739b
-
Filesize
5.2MB
MD58d2e274671bddb5bc111a079e8e25b30
SHA1731feb9e74102d42b7ebd702fb6aaaf6bd264fa1
SHA25692871e5974b4854e385adf3c007853d56cfa97a86383d4cc1f8dde513f0fad4f
SHA512d5cdb9af220d8735c291e65d1b1593ead46cdc7a45351b68586c0d74a4f97b12ac435b777bcbb9cd59555fad21da747325cd79862758ae5155afc2d5b724bf95
-
Filesize
5.2MB
MD5174ba7075514c3e24b758b1da840a113
SHA17aa75d1bd8fbbb9ffac4d22585a30ec2f7fa4469
SHA256609cd81264ee2312b9576399b28f35028640d36716528ad131c800ff30c0bbf4
SHA512677bdadc4e44ba7abd09aedb0e79b0766ba9136645dc7477b7d0c22e8ed221d87ae2a8b1637da91b55b01633960150f7c8e2ad6be1cb6bfbb1cc2bf64dc763bf
-
Filesize
5.2MB
MD582e50387b526360856de0f9026053a82
SHA1d0bb3cd556ba712053184321b0185096cb336a9c
SHA256752ada31254d9210739862efa8ab5aaa8e71c4d9205a0b93e49d3257562d60df
SHA5123e11089befcfeceb5a3d5814f61985c9c6f06721990870d1b5eafab2aa18846df8e6b812f0efce183065adf38c83e2aa270d2a79db870ee00ae20d6fc4588cf0
-
Filesize
5.2MB
MD52ea4164bb76ff28fb0588e1f89f70059
SHA1c53a29de11bb6d198721b114e53cbeab8f91672c
SHA2561f4fa66a4c50918c72c78f3f043d0ea76586688f268c763a6848f8aeeb8cdbe1
SHA512dbd8820cf13286670f5eb45cb3d04879be0bb468cdf235333638cdc5493c09a8fbc9a6bf7d0e138e6372f5d0d17efafaabaa09a6df5500aaaeb96f205aa4ea72
-
Filesize
5.2MB
MD59261040420b44054786dace4a28abdcf
SHA1c7efbe21cd0c70d6d6da25ba3c3631fba0757632
SHA25635b2c5859a03c4eb3d0959ce0875770be96b31b7a5f942c6373a8ca6c4a6a914
SHA51213918f30f79be94526992b921bbfba6fe67e3ae8b7bc9ba7a44f8ba5dfe849d3b4e5fc83d40492b15aa1e79ef85d8774e5a1339b5b5931217729be1b56d9cd4b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB