Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 14:05
General
-
Target
2024-12-17_dba0fc512c3dac157356ff1e4be9e850_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
dba0fc512c3dac157356ff1e4be9e850
-
SHA1
216c3cc9b0e169c1a329a9935f16ab9c00a55437
-
SHA256
8c6db9e2b0fe125f455bdee2a246a8e55be3df244deb5feaa550f14a109cf4c8
-
SHA512
e1f2a822034fdd9b951f3b82f4972a4c16154a999a68af4edb97a97daa8109588ad7d7c1a9c8ef53674659f0377e91a64b57d26c84c5b680cafa5381601aa065
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBib+56utgpPFotBER/mQ32lU2
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_dba0fc512c3dac157356ff1e4be9e850_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_dba0fc512c3dac157356ff1e4be9e850_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gWxgRSJ.exeC:\Windows\System\gWxgRSJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uTRlARV.exeC:\Windows\System\uTRlARV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qbamzNd.exeC:\Windows\System\qbamzNd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sdxkoSa.exeC:\Windows\System\sdxkoSa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZgJlDdf.exeC:\Windows\System\ZgJlDdf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hQbmUBj.exeC:\Windows\System\hQbmUBj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MSHIBCB.exeC:\Windows\System\MSHIBCB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wgZBmZK.exeC:\Windows\System\wgZBmZK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\brRfKPM.exeC:\Windows\System\brRfKPM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RkZtqBY.exeC:\Windows\System\RkZtqBY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uSXCXRf.exeC:\Windows\System\uSXCXRf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AWaBHMD.exeC:\Windows\System\AWaBHMD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OQXDJTb.exeC:\Windows\System\OQXDJTb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rwwYhWO.exeC:\Windows\System\rwwYhWO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gLCqvxc.exeC:\Windows\System\gLCqvxc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xgEUJgF.exeC:\Windows\System\xgEUJgF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LaWDWFW.exeC:\Windows\System\LaWDWFW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kxXXIEX.exeC:\Windows\System\kxXXIEX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aldBSJW.exeC:\Windows\System\aldBSJW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZlGmyGX.exeC:\Windows\System\ZlGmyGX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PZsbwPP.exeC:\Windows\System\PZsbwPP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5932a6fa71ae7c2ad8b728b0dd5dd8798
SHA1557ba8c434aacae16018b5e45737ba3f7bcefd71
SHA25637096113800fb332170345b85618ded2d995d411bdd2bcefa43ab7185fe24116
SHA512803a8b539e5ee05dc890d758672defefe0dfbebd6336fb570b3b1c00f0459a7af34a71d56c4f4664c0d861057104027e09575d0ab134e1cbd65f73d3f1d275a4
-
Filesize
5.2MB
MD5cd14888dfa25139a819bf8812daf7de2
SHA1f7d93f0860c7e313f281053bd6736a30cd6a0a70
SHA25685841e82093e40bb440dc74abe32ea548d85d8f247a2b988d1b796f254d90fec
SHA512065c166ecb71111d788afe07e71395e5e902ba50973818f1bf5ac1b7257d773dcb4bb4dccb7144b65789eed9fc114e6be0fbf6c6bb15256a2f755043eafdbf8f
-
Filesize
5.2MB
MD5cc3884f32e6a5a5bbc7d35e3a9310ce3
SHA1798bb9c314913020ed70890eb8de2ca8cf7ffbcc
SHA2567113fa7a1b6da58d3ff80dfde5725432e694b201e6efd10cfaf6e587d9615e7c
SHA512f99c44a85b4d81e244d537ca5476e8787e309ed496a21410efce8f45374cb388ff380a3ae0b72e1702a955e5c1fbeaff0198499a0f947c358872a64060b42aff
-
Filesize
5.2MB
MD5843e9eeb88fdfe94166f4f9fbf008f1e
SHA1132e6079789ef6881d9a512d55651dccf452055d
SHA25688e2a40ebf0c87c628aa0d58b8dfb2b16cdb529a62b049eee2ab70f2a39d2e95
SHA51220d87180890c2406ba4746d71edf1c581e11a9b46b8b48d7a4590166b25b3b256367273f1c582d77f3b9a676c72cedbeb7920c117177c3e94a48917f6cd09b7d
-
Filesize
5.2MB
MD5fe6ca70d3b618a8aa26b7a1a0a963c6f
SHA1756610b4527dd32cd462b662d2ea131014f38cde
SHA2560191603263db142b5326b71ef8b53aef26f40d2ad282946dd7bbd08ea7e9999f
SHA512b57de739b8c2426934d5e94170af17ac878e9d46be517d46e64ab02164b4efb331caedf81b8a4566e19106038732caa6801748918d7f30dffc462599d73b9d9e
-
Filesize
5.2MB
MD5ebbeb026e901e37e5235909bf36cf899
SHA177b535dba2d8ff504e2b70dec486ba35682b45ec
SHA256f8daf342c7296f0ae82bb93d7f9cd285f2ab527f805fa6ef735958ee916a721c
SHA5122c35615932d27ff840e0efc84f44ffff34447fb06a43b2d7e47230add8c0807d98791e70d8f165fcb38eb1f2022b9aa896aa97d63e24f9b0a26a86f280547194
-
Filesize
5.2MB
MD5a6351aa2a302e758a09d3351875e5fa2
SHA101ef9b1efa0aaa074a7d70be894b8c7b3ff36e9f
SHA256269f0f0698d12cf9de9805ff8bb229c55bd39e4e7ae12b15a19551274c7d7f98
SHA5120310c49148cd6494b7fbd0229508970c5281ed69b4316208919a2fbad81868fe151c543eae9e3cd56cf62a29a840bdc0e4133595a2360bc2f49557e715a9c518
-
Filesize
5.2MB
MD5f7e01713ea57a25e053a2b6ba5127247
SHA1506c54777bb2fd011580fd779e57eb67d7925c2c
SHA256e5922da89b1847c624a20572e4d9ac30a294459d050d0e117c4f79a2455ede76
SHA5123bed2de71f9bad6711f0f60beab67595ab0acb0fde58bbe82fab3d3b23c8a27264714eb1e835e853744a18d398ba86b249df89a6d584d72ff8eef71cb2ef05e2
-
Filesize
5.2MB
MD57b341c93c61cf773868d6b73db15015c
SHA1a83e45a6540f6f33e3939bafff5b5596b0ace240
SHA25693ec620251507bebb6d78b6bbfd4645e4e8c91944ba28688d142df22c3568f7d
SHA5124b24e0893cca8d7c72eae0a63952a808ce007a9f99395bcbfe04f9ab2e895d21f7e4c2933dbf726578c6b94366a005519fa60266234521e7b14c23b668c551dd
-
Filesize
5.2MB
MD58963bb5ac6d713a51c03703bff37f544
SHA1cf4843ae5a7934f7bf6b881a0ab791937cfa441f
SHA256d09e1b89be3814b85a63155f2fb4c37a399f2b8a1f75b2a13d9e94e29ac02a5d
SHA5125090b35e804616f51fc32d731fc5315b7c8c5cac30e890755aef8e2fa946794ec9bfeab57eddc8de8babd2b7762f2d85a664c3543e73ca30f8c4fc34ed2de5e1
-
Filesize
5.2MB
MD50652b17d9f5617c17ee09cf29782602d
SHA1316fad88586ea2c3c212e496034828c0ee1a97f5
SHA2566dd3cb48b800ee3746fda3f4c496647066111340d186ddd41ff24472a780427d
SHA512a2efe84d652bf06bdf88118f727ddf3be6b410c40b3891871d04e60319cfecb6c32ead6147d1b51f2f3958d5fc10ffc29d5e3c216381ec6ce652d8924b3ab9b8
-
Filesize
5.2MB
MD574a003a175f801dee039f99f967f1f75
SHA194824cb6b64ff0a1acc9bf1ecf84cc61903f2403
SHA25648b1c784a2f0eb45164823545578ea8afc3e815d19d1fb463bb4801670c9c32b
SHA512ef88a15903c10b9bd96a0e8e6f9739bd4fcceac325a22074dba52ccc0c0696e831986c501dbb5c0cb1b9deb9a288d7a398e9352d5e618ad13ff4f54ed233877e
-
Filesize
5.2MB
MD54f4399a4ff186a7306eaed6958bb146c
SHA10ca1eeefbaaf2a563c9901f6fa41e32aafe61e22
SHA2563f7ce3fe5eb21ca12cc3e7f5352d54c5f5caa3577830ba6ea7961529a34cede0
SHA512da9a2c4fb97b4e3923fe9db5fdc1b2e696fc6e12ab7de21cafc147d372bcfdd915e54ccf48a84b96c7f371ee5747f70c6d3e8ed8b918f9dc00694d9e68e6a3cc
-
Filesize
5.2MB
MD50fe05fd71b119e84695a24fd79668953
SHA1cd3c7faca8a212aeea24efe4f08fad270ca797d3
SHA2565df81aa63a1be12df755a702dc37b5d6e894b26bacd13ffc159292f4e5e1ec69
SHA5129398cf184b04c45eacae4b4cf7c7369d9d30b1b460246e0b8dde48abb613c45416dd994f24112173fb0c3479c3e4e0ab117e4bcd4bd38724ebcf467f3ee72b12
-
Filesize
5.2MB
MD5708446be97d06ae25c80f2cc3bf2de52
SHA1120d23c436e9a2cf7c3300f8599b72f93d987e6a
SHA256c91f7ca1f19c0fb75b047fe81fa83b3d6a7d6986737413a62c464df219ed26c0
SHA5127835793d872c97b4f0614500fd382e20e0cd6a643c6a8ba303e6f0e089e29bc1b30672966955fa1a1fadc6340f18e18dcf485d58b9d042f572f10646da36291b
-
Filesize
5.2MB
MD5191d90a316624dec037d466c3ae3fb87
SHA1edf4eb450db4c7e13e78084ece83e94da9752fc0
SHA25631b1a1816b961ddd50db11d6933c6780dcd0786cacf6b55c44e6588cd87c6a56
SHA512aa38610a0500ffad243000d9fcf304566acda2f64fe7960fac331af8cc3151edf099eb9b9aa613e93ca8fbb792f54f57525f38d634b8f0fc5c20083f1e76678c
-
Filesize
5.2MB
MD5c797b711d694e11ab8d57aa5bc24476b
SHA1a60ea5dfcf1850e924d2f9a1b1b3c07a3fd4fc99
SHA2562e4d8d38d88c1757be8337bec96bad4f6537b86703a64bab7bc97b0f2a795598
SHA512a7fae1b950f9e949bec1cb469e856420e707c89f293db29da422b6aab1d3dc7c17d26c4949c1b8486b887a4c307fcfae65b9c432bfebfb9d303af1ccaf136a5b
-
Filesize
5.2MB
MD5684e76a9dce92f77687249776d9b690e
SHA18348944c3e4079a29d5fd1f938b74c28ee16c349
SHA25678e27ef20518c96b0abbb3360dc5c0516f81c8e895b0ad5fadc7831b9f133830
SHA512bb4ea0fd36ce2221ed07beb411b99b758ecda1f147a63c7821dc2b547dc2bf4cbc373069884e112d55487878d7c1ae9eed0e921ec3a95bd0943520d5b10b5a8b
-
Filesize
5.2MB
MD5b2105d2c782f19a5f3b30981409dc410
SHA1947c5d0a1c16f992aae36f836179fe9863e43e14
SHA256963861f176b35d7d1e377f5dc76db0000e3648acef1ef03df59e7e89d07d2765
SHA512649a89d09e6320854699c61ac2397e7796257304fca6856f7410a5a662fb349f01012237590df62e24ef9cebf76b013ca203ab0396df61221451f13af47c2069
-
Filesize
5.2MB
MD5500f6005992057e4cd02fb524ca430f9
SHA1beb68e51ce3aa835811421ac348989c78a6a377d
SHA256cbf9dc520121e4c0888e28db66fec21d026773f261f6edb11787298d2ef7bac8
SHA512f8a75f22d7d09ee04cc752e406dca31f1657ee1a3034e3dc08e8f7aa53948bf4d4d2528630354fe40b3773973ac595c45ef52e7914b87cc9cf780a9be42b719c
-
Filesize
5.2MB
MD5cdf18763019daa64610f524a68cb59f8
SHA1c6d7dbf5c1a36a20fefebf8cb614949a24dd4e3d
SHA256044a38da8ef086f6770e26eafdfd884053660fef79737cbd02e447e8f6601058
SHA5127a8bb594d95ff69d54f155147c816751570f5ca1ee3ca8853757070d418b3a0f2f828f93681c1d1de1f9f354231ea68a08376834c67581d5fd8d64ab73786ec9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB