Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 04:29
General
-
Target
2024-12-19_ff6ab9b02c8a911a03a75fabba29743c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ff6ab9b02c8a911a03a75fabba29743c
-
SHA1
0d197c331842486829cc4a18a241032820895c63
-
SHA256
0d1a54f8cc2c1e3acebf4d15124ba0883d218f2eca2168993c6a90234f399dd8
-
SHA512
12f3bd2ae25b4e7bdb5f5141de527759ef5908f116baea5cd09c0861f9ced167bbe5091cfc1ea077ccdf45fe67eadafa248eed7868d5c2c360f24c07e3ef58df
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibd56utgpPFotBER/mQ32lUM
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_ff6ab9b02c8a911a03a75fabba29743c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_ff6ab9b02c8a911a03a75fabba29743c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\daGnded.exeC:\Windows\System\daGnded.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WvsEzyE.exeC:\Windows\System\WvsEzyE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lLPRmep.exeC:\Windows\System\lLPRmep.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\leUbewq.exeC:\Windows\System\leUbewq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OPEhVoy.exeC:\Windows\System\OPEhVoy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CDPxdDl.exeC:\Windows\System\CDPxdDl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VqNWQdt.exeC:\Windows\System\VqNWQdt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HpnUExY.exeC:\Windows\System\HpnUExY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tRUqGpJ.exeC:\Windows\System\tRUqGpJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HAXryjx.exeC:\Windows\System\HAXryjx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FVOwvsG.exeC:\Windows\System\FVOwvsG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IZeawMS.exeC:\Windows\System\IZeawMS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RktxPFS.exeC:\Windows\System\RktxPFS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OPTIjIf.exeC:\Windows\System\OPTIjIf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oyqFAPn.exeC:\Windows\System\oyqFAPn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YBtwsZB.exeC:\Windows\System\YBtwsZB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AescKfQ.exeC:\Windows\System\AescKfQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RnDOupe.exeC:\Windows\System\RnDOupe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JXItxBa.exeC:\Windows\System\JXItxBa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VuCDoHo.exeC:\Windows\System\VuCDoHo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AuRhgQB.exeC:\Windows\System\AuRhgQB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5920d33354d81d3d6a9a3b782e19aeb9f
SHA1dd5aa1879ba75b886fe7cd92e7206a285eb8b3ed
SHA2563abdcdd046b1242efb7bf16b9e60cfc60ba2586d8ddadf817a5ee6aabfd2535c
SHA5121027e4ca06d002842a4759e1a0489b5f4653e5b19229c5d355b8d2be15401c478ab29d1819ed22fb9bdd7765508d2ce44c4412fad879672575d4a2f9f33eb9fb
-
Filesize
5.2MB
MD5a247b93fdb99c96f3a8d4b6e48726ff4
SHA1edcb62297a457d074019b4a599d909cef15bde65
SHA25653a376dcbe28a0e8a4ba1699c2c985c03f6502d1f6fde3023cfc0dc0a9aea18a
SHA5120dc9515fd66d5fcdea404018928ae51ce95387d24e1f36cde9b2cf27e51da33de996d529b7d150044fc30d7636d501ccfe54cff2eaa041ef3c89a060c86aac9d
-
Filesize
5.2MB
MD5d7f212d50d46a866b2ae183aa03d0948
SHA131619f52ff432e8e61a35ea6d19622e55797edd9
SHA2563e19f4ca99cb152a54d3f12949d441d2269070c15f77769bb010aeaa00b97f94
SHA51297aba6f97957d5d5fafdd4f3ac991a30088e648ab52017938e72939dfdfcefdf948f2faca23b3b8c5c8442c69a78a44831446bf96946ee434bf8dc03ad459e6a
-
Filesize
5.2MB
MD5228f330b6dbed52416a652992ea1c2b4
SHA100d42094bf7b977136501d1f5075cef9e9dfdb6d
SHA256a979513b42dd183f37c150b95f40aa2e54abb6b538bdbbedf2146f45accb65c1
SHA512d3d1d405a1edeb0867c2aaee0579758018644a32653362b98bb54391bb80c5bf3b5918261105290a8114652ef6ba460efeb7c81f721b00a157cb3f5c53464ced
-
Filesize
5.2MB
MD59eae55b69ac7ef4203fa527a1f0a7106
SHA1562f42691c90fdd60631fd07aca244962142e48a
SHA2566e5f5498b333aae37683e2179524acb8c6904f6488fc0699da712483deabff78
SHA512a1378d57136ea987f28433db5c0d5a6ab3bbfca9532d27ded88fc9e6ee8b26567e3e2d670695790f351adaf46970452b6542ff4d1acdcf326d2ba0dad1450c4a
-
Filesize
5.2MB
MD580cd826d5db046ef92ae34e8090f240a
SHA119a39c207aadb4ec927dd7a2b3995807ecd125b7
SHA25679ce09e42d6f88b2dc1562b0468800eb48731bede5d2282a3ee143771ea6d004
SHA512cd0cb851ecb6da8991b7d9144a3bb18b1b300935fa203f978a3fa59c469711916ab1c3b9dd5ebc7009c0f6ba3d8c0225d69b2065a782d7d094bbec23e4145125
-
Filesize
5.2MB
MD5369e9f5f84afe207b04c5c7e6bb5917d
SHA157cd5610216ef3e92fbcddf6f6c1414c0ed2fb5e
SHA25660710ce17a59723b540e510b1d2c1916b7876ba1c5394a5d29a50036a253d224
SHA512fa8408c79679931340ba5d15a6a55cdcdff26371b3b45389d7bad39f7c3c939af04ce9c632f1b0fa2bea551a5291208b80858f0119c852469c234180cc0f4d22
-
Filesize
5.2MB
MD5693806f3ad2d514884f530c3eb3d3b71
SHA19fc37adc96b08aa1beb050e75d27098839ec444c
SHA2560e8d545c68f98ea9b5ad5df6e83e57a03996af0f8d5ccaca40d3456fdebecaaa
SHA5129ad2ebb1b2758b287fd5f43f31ec00dce47a3baa33e7e14078460e829234d39b5122adea828a352ca048d33d8ad2e1d9777e50db0f56f5f02043e74838082500
-
Filesize
5.2MB
MD5d1d6f3f8b48cb7faa079a524bdd2ea71
SHA14e86151b968d83250cb8b2ace4a3777a68dc8f06
SHA2561aa74925e30e402c5b9b91148108cd36456ae340e4325e7f408f4b5b0fa04a06
SHA51282ba1eb03fe15de559054a0cf613386e2965787072f4d4355564dbc13b154d6f8191730e9256d1f125db26778e743949d7d4825e0ccb0c7c1596d6b2c232422f
-
Filesize
5.2MB
MD5d4c7f895fbb25d5783ead8d88b0cee53
SHA11e980ecdaff517f3685cc79bbd7dbcbfd39b08dc
SHA256ab132b500e10a3b6ba02aacb51b729e60fb319941f07a363c63ea7744f4e429b
SHA512a260baf07d6b93b88bd9ff9e14931e9f78a23c197a593d19981b4c6a3d1df46c8324bfab2c6a72818ee6f11e3d191b94f544f80f760039a8ed8387bba2bbaa8b
-
Filesize
5.2MB
MD51ac5783c5288a2d0e2bec9ecc4416023
SHA1c1ffea8ad10d0b1b1de13eb581715693893ffbd6
SHA2569aa51c788f0f70d0e2b6446c8c58b8a44b823899e8dec7e09188b1cf46f496f4
SHA5125d4b4de040f980295e831aa69aaf72d16ce4c45a52ece2363465239b3f269bf0bfdb9c6b2c14c7ceeea9d26e303ee5a631ed8b3aba100876634347c93608f41b
-
Filesize
5.2MB
MD5f6f87a3eb0b56cda85fea043c8617467
SHA1605807f627cce2aa70639d3d7efde86bf0d69323
SHA2564d334ca8f51137ef2fe4aca54afffd9081bd240b6e7c51898969a1d5e60bde52
SHA5129422d5b0b1d8768744595e026017097b199f6e1b84d8cefe8177e5efdbeeddce9275a452d74d6e41c89b551d3b0746bf67f93e1bef7c7fbef830752c5644a37f
-
Filesize
5.2MB
MD5c0da95f57da906605c469953db7923ee
SHA12a67323632677e0892e3597f17ea3eaf21efac4d
SHA2561886117ce8508aee2402be0b399a8270653a39845eb749dd63b70d3eafe0bcc1
SHA5123492fb59eb41f2105c354c226832466096281b9bd8f1c6a98aacc6a97b7a24d54b3d3daef8569f76a06c2015e90a17c37623a5b1d60d4b14179de5b40faca3a5
-
Filesize
5.2MB
MD53fc33cb3912167dc8f9573ec47fa55c4
SHA1b651b4ad3e9a84b49845a02264b03014dafe0099
SHA256877d4ec0e360d46793ea12efdaf764c7321349b97dcbb94002b92aed22ae02ca
SHA512fa7d383debc17e19b89dcd46cbe648d3aac2d7d5e8cae2674d312303cc4d4a79bb1c312a92db2d369cc107ec0d947e15dc8f1849e1d084ff515bfa6b7f1520c4
-
Filesize
5.2MB
MD554cbe31db36ac561ba58414868b4d333
SHA161255b81bf16dc301c00ecfe9eb48bae5f4b9bdf
SHA256ca701b3903e90ef967680cd66e8b0000ca354c11fd6adbc5eed3b7d245bc9aeb
SHA512455c5deb4ce7e59128ca8252466be251e1b7710179886f25392f4c5768fa9d6e7c67a008ead9e30d1fa52f51d80314925f4b45cb6a15886b02d69e4e42fe6e75
-
Filesize
5.2MB
MD59bf29c7c943d5a9b36d0c0adedc1c612
SHA1ffc7b84afa24fe84eeeb8173acbf8517219e0a15
SHA25650cfe00b5a8cee68ab0b45040e6a4c1dfdd716e9c8008403352f8c533d884852
SHA5126c5980312d5cc4559294afcaab4e763cfadb06839a1e34e135645c98b7133c32a8a8c2261035eee2357d217e9380c1c745f51db7e5eb9e05999c0a5f0a3d2861
-
Filesize
5.2MB
MD539f2ed424b660ae968aa303ba95503c4
SHA119188ccb596cb8af6a22710b566a822101b8ccc0
SHA256eca0eb82b7d259a5ed80363dd889c33b12a3f96955a876fc71927cb4d1a2e661
SHA5122779c79c3c068c9b9771cb1784462e49384dd4dbd1ae8e5df15255f6a04a635917cb38d6661c30a33c9861f35b616ea2554313172ae0c48f8c98ad669d10f4b6
-
Filesize
5.2MB
MD5197223f1ef9ebbe3e8cac433f15384a6
SHA1a8e322c01cecce55d1e30db768bcaaf051917317
SHA2562d74498c09f430a2d123813fdd4e61e9a44e3ddc7a666db0220ae18422980601
SHA51257a65feab69a69177599665020b48d2f2c15561ca48a7db441157d56e07377c9b1e5eb51d929e97fe4bca386b803b9319e7eeb37a4284e70d6e6c19a7e60206a
-
Filesize
5.2MB
MD527b093e9e9348013b4611f2c7d4a78cd
SHA11b43f6f480010488d5771ec98aa100ef38340b54
SHA2567a8ec5d6f482df890a80f2b014e415050406f077689ad68b917e96d9d270a02c
SHA51296498609e7e10b692dbbbaf6f50ae779ac9ab5937abfd0b0afcf92fb5de10501287cad0d56dfe72be43eb720227cf2be59852af843550b25d64d42f5ba3d3586
-
Filesize
5.2MB
MD5c8075683999af5759cefe32c05a51145
SHA152bbbc96b7a357da3cf3c6005151e5982ff93ba8
SHA2566d1c986fd69f64ccd7bdc099f9329565b072d0b7c617503fa89dcea2e82dbdb3
SHA5121511870e0f88d0d318d79307ba5dc809bd2c83d9cd16877ee3766300e8f1ddd3e1861d1d5727ddf5f5c61875406552bf4ed3607467ca78275c170c38bb66799e
-
Filesize
5.2MB
MD5b57cf73896bf1b2806a1700e420439c1
SHA150227b092f4e3dc9629822c28cafd8ebd64eb33d
SHA256a2b5d794285343adc1db889f296f8d71d8d1863e59ee64ada04be1fecb023847
SHA512e6d743557702767d4315817e3ef4ebf6455425dcc1e4008dfc826c7e4e28a439609d9238a01a265526342fd3acb58106f6d185afba63f53d1eb0c215740342f5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB