Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 03:52
General
-
Target
2024-12-19_172e32e4add15b5aaeda4b2ed772cb88_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
172e32e4add15b5aaeda4b2ed772cb88
-
SHA1
5f28c6dbab72f8c41991c5dd262c4d9bfa580bb7
-
SHA256
4cf2be4d6cca5d69cf45ef41db66bc8f4d9fe5e4ceca9cf43ef62fe33567d43a
-
SHA512
a30b32a1e61c2bd046e8e116d213f416813d0bf632e3c0791cf93082f52c10dbcfa5166321b542b5aad93a0185a15383aed885e655ebb54e1bf5180a0cd3dec9
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibd56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 48 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_172e32e4add15b5aaeda4b2ed772cb88_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_172e32e4add15b5aaeda4b2ed772cb88_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rBRyZwJ.exeC:\Windows\System\rBRyZwJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gyNyBBM.exeC:\Windows\System\gyNyBBM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pELfJkv.exeC:\Windows\System\pELfJkv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EAEEzDd.exeC:\Windows\System\EAEEzDd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MKThPYJ.exeC:\Windows\System\MKThPYJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RfUXlaZ.exeC:\Windows\System\RfUXlaZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DzrzcYV.exeC:\Windows\System\DzrzcYV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nZOOhiA.exeC:\Windows\System\nZOOhiA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTJDKSZ.exeC:\Windows\System\oTJDKSZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TGQhNUa.exeC:\Windows\System\TGQhNUa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZGQcWlq.exeC:\Windows\System\ZGQcWlq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DBCUkxk.exeC:\Windows\System\DBCUkxk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iCDvrcl.exeC:\Windows\System\iCDvrcl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ONmVywh.exeC:\Windows\System\ONmVywh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eFNwqBu.exeC:\Windows\System\eFNwqBu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qblAUHn.exeC:\Windows\System\qblAUHn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dcAyyDZ.exeC:\Windows\System\dcAyyDZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xKetEQD.exeC:\Windows\System\xKetEQD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MXZDwse.exeC:\Windows\System\MXZDwse.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PQIlGDo.exeC:\Windows\System\PQIlGDo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TmMbVsg.exeC:\Windows\System\TmMbVsg.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5258fab983685ef157aaaeb04c6f9a42d
SHA17015d71eac47e64487e7f6ea4204d3f60bbfd7c1
SHA256beeba525f639510c763ab1473e16903db9efd17058edbcc2dde8085b180c92af
SHA5128a17ed27970039b80620e9fa4a50b84ad9dbb1078293994e97cec7d6f998e1bf8a52b315ad95b7e260f8b66c8478cc9afaa33c7ae25e72943cdcabff42ad7984
-
Filesize
5.2MB
MD5e0f34276c8aa8be342af99c7e3dc89a4
SHA1bb86b5ae2babbeaf18b84ace734c87845bb879e0
SHA2563e7644ba159fc438727ba7f0ffc7bf7ca61f16fbb5f108075c42c85a7579c208
SHA51297161474d69d00132d56b3c0196c897afcbc8c4c8c5614a489e908bc91d182f0f26cbac8507efa6a280b22beafe6c62f20456362f949f16ad7950dda8f1f176b
-
Filesize
5.2MB
MD5050a4859d19e52fe228240dc84ffba4d
SHA1b9fdf5d7d03a4a6c81e31eaa3fec94012a55a303
SHA25658f260c292f86bbd638f22c7a3566cc1a7a8ac6daf72a4ac4829188543781115
SHA512329d605f65368435f0329052949fd0ac2c0cb1c4a7a35a3b7a485fd3d76b578e5f20d7d3d40a49a3d1ee692424ce9d825831459fbdd8b8379c7ba6e2de011cb5
-
Filesize
5.2MB
MD553fd7929c2dc4e3f710de5b3fb4b2d57
SHA1f7765fd95cfde8cb42037882638fc081322fa72e
SHA25611d77fbcc28f6660184c71506ab2f9983e850a00f90baea5df15fbe1f6c38429
SHA5129106979d471993830f96751187ebe3db144e78c16a2026dee6341817fa245f17c9d82a2ab265ec1a6fa8e29de38a2d3db31c77e992a81e70730c227fb9d8cef2
-
Filesize
5.2MB
MD5d7652c9832317391a6186ba5a0de803c
SHA1638c93ee34732b6e6f3f33fe4c6fc9f064cc5b60
SHA256df438a58f52eb1c5b40a296dc9b714363bc0dd6ab468ecd7a3af5500643b3f05
SHA512370cbfd3b604c0a9054f79ec109bac387a3b9ee7aba9b0ea38ba78c90345deb89916af1e7fa19ead6eea84c27b6b73f6e636ddfcdf971f347dd7ce4838054c17
-
Filesize
5.2MB
MD5308e50e3047d5fe9fc05c9814f863e13
SHA1a264a6b07506fd0a0d3cf90ba83957f2e3dda8c7
SHA256ab1eff06cda0d0e53da4eb033200639fcdf89c55515f4670cc284362dde937da
SHA5124fcfe1c5ebae1d10b2217ef4ac3cad6cd79c06358fd80ab5fc0237d51b2d0008877c561be20788223fe29c529b655508847a06ac87dd650f895e796a68efe727
-
Filesize
5.2MB
MD59e325bbac6904d3242f83bea26ff3811
SHA18f9391201b02590754e61b31f8294c639bb7f145
SHA256207da810045f4aad6dd794992c9b6821d7ed7fbf4e88fcd538b84801d59887f8
SHA512c76cd7201ed4c81bd6408d4a5c4b0a6c14d8803d518c686728a5401243133e60d65cdf985cbdf265c71fb3e8da9ea9edecc2cef4e80c65e76d105a560a1c3aa9
-
Filesize
5.2MB
MD5cecf2354b6e28664f70532affa17e591
SHA1b3ff70cb6aaa2e58328383cc02b38d129a511889
SHA25695643e25250693fcb35e78f136b265f7dd4c1a2cf64ca4dd9061244f8ef25362
SHA512e760e878aca0e636636d555be81a813b5f405956bb9f42af7945f4c444925592a0f06d03462c302e15075080f7634173710136396efc492f611e18465ad81f4c
-
Filesize
5.2MB
MD5d99e440f3d8a84c93508266d56e68541
SHA1722e7f542c9c8b43901e6e12054267c9e6daa528
SHA2567f06650f95d56a53954507d00f0d359ff4df7d400b643526a956ebc0cc6cc9b5
SHA512c3a4cebc4fe01cb62dafb77fa176cfbf635ccd9ec8f1ac05889f2e27dd468c8dfe75310c3a122e724219746e07cb933af3205638c507bcc79ebb75e2a9e981cf
-
Filesize
5.2MB
MD555bdc86d88117fab7845f27e365a1f43
SHA1d39ae17081accb9f608bf1c8baa7746fce760cd5
SHA256ecdf4a980b4f6b5c3eb2f1ef78c8eb64ebb0099c6f23eeca957625d41971d05e
SHA512240a74d15234086ef84b60556d8f433a4a90969a195f3a01a7366786d1939351a85ec665a32458346025b85d542e26f322dc455cce7719666bf2fb014e1ff933
-
Filesize
5.2MB
MD56c3c5c2b4be32b725503f6d24a55c66b
SHA1945546eef718e8a447948be570b5d247699ee859
SHA256baf410419dc007fc2948a93ed6c3cce0bc5076b16fadb9e8d0e6835290dd724a
SHA512bcc2baf233135a07e853ce3c34b5e04461ec8e7ac3b90db9d72b86b3859cd1ebcc02ed4f3d3a8ddd9c4842dc4f6e133b0df727d15763bebf6dfad843d4a969d8
-
Filesize
5.2MB
MD5142068177c0582f50cf37d860d4dcd3e
SHA178582180280976104afa7b2db0473d1f9a1987b8
SHA2569d47073a2e2042dfa11b9740168dba6ef6328ba4d77b1e05bbe9db7d43612cb1
SHA5122e7e46083b3f509f6231b5b173654dfbd0ed779c56342b4c3b4e9d8ee32ccaae22501c0f5480350d59139f5def597931a8b1578a34bf9af49923384258169761
-
Filesize
5.2MB
MD57ae5db06549f2a042fc6af51eeb4b7bb
SHA19a66fc9f53c2c373ac1c9dc1af9e483f1ca189ce
SHA2560ce5e8ef5c975cdc1c29eb62b7cccb89b114d16ce0088c9e6a0585799d92d746
SHA5128de395cb20f291ee8031a1f22810c04602a71b395fcb9cbd5420b0f3b965a77139145144b45e0792df09132c9b8b67a47cf0ad963227992e2a06d0ac8cc49ea5
-
Filesize
5.2MB
MD561d7d4b58b371a63f4980d9f79f141ed
SHA1720ca58142fb16a7b1f4d67d14250cbee61368a8
SHA2569515b83d2f4882a965a6e2edeaaaf009acab990518d384db21be65322dcb5da4
SHA51284dcc8066f5e7da0cf2821f1b4d1d712f8bb73a142aead5226e8c1755ff1f119dc451abccbe4256abe903fc71f17c4d30337dc7b6f29aab41942ac2d9df3d062
-
Filesize
5.2MB
MD5495d02b1933397e05a2c36da236d3c16
SHA13244d50b51e1a0d094ae5d1f11563673226a60a8
SHA2565cb004b0f51bfe29f289b585ebbb50572cb18d53e42c5825a90a531f9e8762c7
SHA5126798db45e0321f2d18779e4cb9308cf7cf9a5a032249c3d8a1c3ed82a5547fed003e87288a34f6d2c9b378410c2f2796337262eb379e3cd52f7b9a258552a7ce
-
Filesize
5.2MB
MD5eeff47d88ad06723acb3ed427fe50190
SHA1691ec2d92d23eca26a1bc38d9b8b49ed320df342
SHA256cfeadb0c576d1de5f100dbf370a138db53618a5c285e5538a93b58a22c727461
SHA512cc8a45917c992cbe8187abc1631a38330049cea7a83924c85264bcdcaf79af8e5006fad265e8c4432603278f22580038098250fc5a6acb254812777df82ca062
-
Filesize
5.2MB
MD580dda8e06f9e63588a593ad73cd7145c
SHA1c147bcd851680948bbd9a90d6a19dc92441814dd
SHA256c0f4f678cab69b55dfa280d5745f8dfd8e27165a24ba1cc9b88bb646352e4304
SHA512d163caf8fa7a184101b21f26cc846a6493e7742dabad6a936b8ef98fa00c00139ba73a3e63062d7f6afd5ed79dd263fc687ea2d59e56fd912b9c705f6903a561
-
Filesize
5.2MB
MD50e9a9cb4a208f2c64c3c13f02bf35bb8
SHA12ba3d7882f5a0ba937a9646537cdad27c6a6a953
SHA256cb61eac80f13c169fab830f0f9dfb28b8919e8b1dfc93542dc48aee8af189790
SHA512bd0c98ab0e4c27dc24a212fe0661693d0480afc280f7f50894f85d7b86151f732561fa7ad6e32bf561eca2f9b46c1d6486c8671f4d0eba5351fa8916bbc299a0
-
Filesize
5.2MB
MD57a00cab5d3a8759703255d6909a6f4c9
SHA1881680d67e1ede29c0a20845b7c8592d550bdd49
SHA256816b0f67be5f6f29a361d5e0a4e6aa91dfe4681148cb0a24db80222cac5b2453
SHA5129ec62f42c7398908905cad8de2619842bbc4d2d9bb6ac929b07301bf01d4b985cc607ce911457bb9f2020c145a8cf18aafc2cae263997fddb2ec964fad97a4d2
-
Filesize
5.2MB
MD5891e15d7292ebb3fdd66ebbaf7f1df4f
SHA16d4e1409cf47fa3d9eca31c98cd83eb001a5895a
SHA2561bc909ea0187046fac95c1b66de706db0f44a9fe5606dbf8ae8bbb7221570eea
SHA512a02a253415816966ddbddb92da4c9544083f07735ad61e95b451f73894e61b5a0b61e35d14da9fa4cfe9ca42066f1d8898d09f936f43c8c846b33781e64a350b
-
Filesize
5.2MB
MD56226bfb4ca93f5b9aacf3eaf034660a6
SHA17d620687f220c217864e9fc64ec5edeada365ce8
SHA25691a4c4c5f0c70b85c439362500985d6a4a21cda13664f869ccd3e1437dfb747e
SHA5122dc4180e2e95961ff6eae03c440b500ee31f315b2664719e5340b44c4d30510e5e5e5de6546d424cb172a4f732deb5e2ab8df35b0efef6b29b5524ac4aa5b8d1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB