Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/12/2024, 03:46
General
-
Target
2024-12-19_0028406f196dfcb13e649aab0b0cbe64_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0028406f196dfcb13e649aab0b0cbe64
-
SHA1
91fe35a31f21e417d3938bd83c59a7da06898e74
-
SHA256
4c24948b40b15034fca368feaefb8b6c1961e23e1090c96c6741e24766185815
-
SHA512
e550846db114c77a872d575ac49d38c4db1812bb3615e7625d05cdb22766b6f6aecf07707a69591ef2b48524eab9125b022255d2dc598fe26a1a1a04d934893b
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibd56utgpPFotBER/mQ32lUZ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_0028406f196dfcb13e649aab0b0cbe64_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_0028406f196dfcb13e649aab0b0cbe64_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\itDWeFg.exeC:\Windows\System\itDWeFg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\REpfSJL.exeC:\Windows\System\REpfSJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wuyVohw.exeC:\Windows\System\wuyVohw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cUExBPm.exeC:\Windows\System\cUExBPm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XWjsAbp.exeC:\Windows\System\XWjsAbp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mgsWhmv.exeC:\Windows\System\mgsWhmv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vgXlrBB.exeC:\Windows\System\vgXlrBB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wAoWXFi.exeC:\Windows\System\wAoWXFi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jtWdYNE.exeC:\Windows\System\jtWdYNE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YMyEiAu.exeC:\Windows\System\YMyEiAu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aRJqZBX.exeC:\Windows\System\aRJqZBX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jIHZtWn.exeC:\Windows\System\jIHZtWn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BqCeUmk.exeC:\Windows\System\BqCeUmk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hsNjoKL.exeC:\Windows\System\hsNjoKL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rLqFxYU.exeC:\Windows\System\rLqFxYU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oxfWyLz.exeC:\Windows\System\oxfWyLz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZSpbjGr.exeC:\Windows\System\ZSpbjGr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QXFptiE.exeC:\Windows\System\QXFptiE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qffgfZx.exeC:\Windows\System\qffgfZx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XcPiRmU.exeC:\Windows\System\XcPiRmU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KYMsYng.exeC:\Windows\System\KYMsYng.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD561757e778d4e7a120249d537f3642437
SHA187986a84ff0b78b9ad800fa764a435ce0671e31d
SHA25645879aa998bc77fbbb2e0f9a94162222856edc627bfcc945c7ac2c1c890f78c4
SHA5128b185eb5cf7204fb662280fb654c6f66a52ee67c2f02ba9ce82529ae67fca2f3a75d1d685e41c06443ddf328206650d97af0febe786a67d4ac2e1798de89ecca
-
Filesize
5.2MB
MD58b9cca11ed006a3d43caeb672395e5b9
SHA1b1e0eb00ea2ab529355bbe2a76b649f34610b949
SHA25644d6687a8aee6ccac79ca5ae8f0aaf86e34084505b004a749af7c3e0813deadb
SHA512f9c8b1773a0b77d7cc6462a9ecde7d86be120396e8c7aada0038062af33b1d414a775cd449911c2a880dbd6b5ddacae601b60e25bf3b2153dae8ba7c1ca7bdce
-
Filesize
5.2MB
MD54b7c70b0a1e4b681de371fdaca298776
SHA15100f188b8daf71614f6709c1d51010b68b8219e
SHA2566af2158326a69d48c385e8930c6e9752f9a4e927e59bb576c1e3c22d74f10cdf
SHA5126eb1a5a458ffbb5c4fbaee3f026b3c2cdefbd7b0f8840020c9d41dfcf74ce0540036c6a869148a19bf7ce3685ee1884ad5013b3f40f6f861e44070227e285044
-
Filesize
5.2MB
MD58065482988a1a8ffb69853beb0dc68f8
SHA1981a641712773989f04e6d244400ac6cfdc9df3f
SHA256ce70a5c9185cd37e9e1c7b99d76763f1dd453d2abe684af7648994b04eff4a80
SHA512d03d0cf3d00e427900e3de416c3924434be831faec331a9084b9e046d002740a3a8b1facf2daa55c44b1b1371e1548436a4736cf0301e4dbdc197379c953d222
-
Filesize
5.2MB
MD5b0a8692341a59efb42ff635813cec711
SHA1ffbdea7b6f7fc5f6ec14020ca593c553ee54d0cb
SHA256383d5c58b5b41308486a1a3bc1b8843c8075ae0f70c0dc661417a7130b878e77
SHA512537597d8c5e248bf8228cd7089499a0f4a0e5d01633914052d423da963d140d13748f28cef50f378d39a0ab8be55287c4c19e624414ca3e69c70e26c2c234f4b
-
Filesize
5.2MB
MD506daad9ab71c836e2e677dd01656f2b0
SHA1fc4d1f8ea91136b46e66fc713d49fc5c2d4add86
SHA256692d2e9ad23d134eb60a3133ce4dc139588a3d38e6dc32e2c901ae9efebf136f
SHA512b13583e100818037e857b546abb526679d38a4c5465ea42da1e227e78890e93888c117ff2d6d4ea3f43b1d34089277b4b24c9f9bce235dbd47892969aae06435
-
Filesize
5.2MB
MD56823fc5141a7d86fcf1794fd50066a7f
SHA15a1ca5fff7357d05cbc8ce75265744aa4fd9b5cc
SHA2568e9f62ed959d3524c9c58c6ceff558f356039a0222e153535caa30ba5e57295c
SHA51289da96e9977418d8b447dec74b7f0b9147ecc6790a06cd8817b6384cc29f1074ee0c6a9644b86f82a2c17987c60bf9c226febe3ab790e84779acb6ea2214552b
-
Filesize
5.2MB
MD56a97d79e72a8400c676c03233de98438
SHA1dbda5446d73af7ee430b09acb97d7382d45d3bae
SHA25652dd72aaa689e6da7aa8f48ddd3fbfa129080e273350f1854d2c4b627a54f77c
SHA512439395def83d2dba76f483a98b9a456d8f69424f41fe76a3f781ba1d13110effdef9e65675a7943d537b946acfe14cf089517824e43412e5d6c6442e8e3805b2
-
Filesize
5.2MB
MD55f462a0910fe2c67c8bbda27dc337ab4
SHA147f70292e95e864a89fcddff1aab4313d62f6e66
SHA2565e4dcf0d41564c7f79f3f649a8acd6625a2765cbf59e74527807274b436e3df7
SHA5127548053e38f54d397d57d98a2965d3dcb8a877f49a6437321ccbae2ea9a208c52a393c086e1f57712bc1283c535cc6b60e50a4681ae4e20b077daaa11b7c055e
-
Filesize
5.2MB
MD5eafc22dc567ab1dcbd62d179d51ada55
SHA1c6d44de6f143637ff5b0d22a8bff85c36cba71a9
SHA256785d6eea3e19299e1972bde4866d244ee7c6525088a9c52779b224bf9dfab1d7
SHA5122124d1ee72d077040a85aa90ca4f49059b6e96aba625c311a6ee7404c679a9447e52b2753ebea4e5f0f1ed000a7892a9a1292c24cf25253ab5493ec8a22f2bcf
-
Filesize
5.2MB
MD54825f073d7f9dd62b0a1599e6142218b
SHA12f4cdea33e8cf587aa506b255ed430cb9abce4aa
SHA25648bb63851197a5cce003d37b67dc26507d836c0dc9a6db18e0180f26dce2fbbb
SHA512a72a194fb32908f27d573f3ea170967e1ecd32e19bff1b8ea590d373cfe554962812640bf108971b37fb3511a80b38e3e5ad7fdcb62df545286772ff45f00028
-
Filesize
5.2MB
MD544a4db0a7e1846253e25bd0a4479b68d
SHA16451f529dba57c4f41fd4754eff4d2e3a54a0ad8
SHA2562216e0afa6fd846291fd398d65bbd02610824b86eedd1a95f11312b39ef5d995
SHA512f8674dec670c67a8198f8efd1989d4618e52c7b94fb8ce1a3af354cc0e4e2ea027cc6f3a25193c04f6701499ff46a145e7ad9d666f8f483543e4d59a323f7f42
-
Filesize
5.2MB
MD5fc3bacdc0adf5f408e345d0e93224668
SHA1efe3362403d919d80c7773678c91fe0fd31cbf5c
SHA2568eaf838249c9913b3ff279f8692723a91f5c8e4ed2dde709d67e242724b96b2f
SHA51208a036be5791a48d13401194212507389d9531d5fa1af155c04c138ff5c1d72634f6be8778d1a58cb1aa52e699f50da506baf9e953257081abcb298f01e87048
-
Filesize
5.2MB
MD5febb4a8ac5f28b36b2c95bd54c16c966
SHA1908a39ad09d3b8363893b2f24632b3b2433f938e
SHA256034046c2d6707ce5a5e7685584b1049105cae92f874166eb764f673927d905f2
SHA512e202be43c9f4b14607095280491f3c4662d4e48cced4e895474da81fe100c270cfe9952b79bfb52663ff956ca1140cdfebf3b02dc2f6043bb11d46c2111e5ade
-
Filesize
5.2MB
MD54deb3c0b11dde60b096ceb29af03e475
SHA17434d3ef666d9665c1e8a23f7afa79e5666aa208
SHA256291fe05ae6a0605d64827e83d6acb53e2f8617fd3c8905d49eb406266b21062a
SHA512e3b103a09209f8652bb94bc3aa6c47ef969efb0db67f33385de8640069f290dd190f96d09bbba84868e6184b2fde44b0d6ce11b5841d967dd7378d250d848eeb
-
Filesize
5.2MB
MD5302c10b2681f5a219d988d242b749d87
SHA186d86530855e1d23d8e606c77b18183c41439667
SHA25678bcf3bbb43d85b2cd9a193a63e59e99d6a3f8e699abcfe192069e00be50d205
SHA51243fdcad26182b386f78674adbe2dc7a91034209e5090e0be6ff5f9fd94fbc921255fdd5083802410d28a6e5a7776288295cdf0f4cd70c522384ec971333051b1
-
Filesize
5.2MB
MD5f14e1b76530bfe52043d04594b7928d6
SHA1ae8e15c3e3b69725e0c6dd669328a974f88d4436
SHA256d9a560e31b66363034dcbfc777ebd8d008e6b77b845d6561159f32fce03d3fa4
SHA51255820c4fae55e4feef09b285f404a372aeeb0ed16e424f2a301709c22c5215ab25e333eef5f176d47632680c0136cbeb5c635ae38c30c8048dda67f7ce66fcf2
-
Filesize
5.2MB
MD5542d5adedac79297624bece0ce66d5c9
SHA1b9d7c36efba54298ffb4b14d72b76e28e8207721
SHA2567e4437a8aa2932f5cc7851688b921438ab53ad15c227854f508da5bb9a07280c
SHA5126959cac53e2819f3cd5a5fad84b17019f8ca86f3859a15dfd1cc953c5912fce9db94b8131a6ede382a09f4d469224d65a92a0b24044198842aee499083f3ffed
-
Filesize
5.2MB
MD51faa1d444eefc6cb1072c6529ba2b18f
SHA14b6a6038d17fb804794689cd72554d4d562c0011
SHA25673d661b59e8fd79ed6cf00fd329c82a74a5ff694a38ae3bb37447527e1b8658b
SHA512ccc3211e722a46ec5f8902b1bd5452468a3a599a3eb33087d472649a1309bda65d321a33f49d1a149f9ad29b53fb8293ce5f2c11b46621fbb4300f7418a18e3f
-
Filesize
5.2MB
MD5fdb6966ad8703a2c321ca8d0310bfdad
SHA19c871636efe0876236d83aebf7e03637d361f811
SHA256a8405ba99f4fed2921c5537a32563418f461e97a0da6550b429ff2a7b606f212
SHA5125c566fe49489f737c9b7e07a8408140896e96b92aaaa2d5a1cccbe5fee1e333cecb86d1cd720347459ed0c8f47063b02b558e31246f07c6289105b54b03ea426
-
Filesize
5.2MB
MD534d21afdd9802a23bbbc1535c29ce2ac
SHA1884415f2464d64d4f96fd7a6fe3af9a033e7c3ed
SHA2560bd59e41d7fed351102605b6053190705fdf6db1509975a4ddf38129fd7bc41d
SHA5124916bbae65780b97bc84aad9f724646579d808ed9b0da9668b82147dd7b102a017de5c60e9f59706baa29239af950d1745bd27e9cb836d7d6ce794ed217d87dd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB