Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 03:55
General
-
Target
2024-12-19_3334ffb21ecc2955109d7f06bfd115c8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3334ffb21ecc2955109d7f06bfd115c8
-
SHA1
4963962167591ae187dfd022b024705e2da4510d
-
SHA256
7051580a73a83ad565f1446cd385d26b72faab3b9217a3f461ff75e47f0ac5ee
-
SHA512
f929e1a19b87df852727962121d68fed6d271b7a756f22b1ea17eb4ead9638181b2f2b125e727d45c9ec624b717258c811bc8efc59c305afa701b7b4e317ddb6
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibd56utgpPFotBER/mQ32lUK
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_3334ffb21ecc2955109d7f06bfd115c8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_3334ffb21ecc2955109d7f06bfd115c8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\eHitNfm.exeC:\Windows\System\eHitNfm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BVMAxuZ.exeC:\Windows\System\BVMAxuZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BRdQrOd.exeC:\Windows\System\BRdQrOd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MPmtgTx.exeC:\Windows\System\MPmtgTx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TbvWSCe.exeC:\Windows\System\TbvWSCe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KifzkbZ.exeC:\Windows\System\KifzkbZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XwhIyfS.exeC:\Windows\System\XwhIyfS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hnAFbKw.exeC:\Windows\System\hnAFbKw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FMaWjEp.exeC:\Windows\System\FMaWjEp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uGxfroX.exeC:\Windows\System\uGxfroX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dfDVvee.exeC:\Windows\System\dfDVvee.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NvRQMGY.exeC:\Windows\System\NvRQMGY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kiUmQFq.exeC:\Windows\System\kiUmQFq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TEqEuuP.exeC:\Windows\System\TEqEuuP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jbQcflk.exeC:\Windows\System\jbQcflk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hykDLKe.exeC:\Windows\System\hykDLKe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bRZrhjw.exeC:\Windows\System\bRZrhjw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QFtZlEg.exeC:\Windows\System\QFtZlEg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rAvckrh.exeC:\Windows\System\rAvckrh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AwBvmzE.exeC:\Windows\System\AwBvmzE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YyCEOdI.exeC:\Windows\System\YyCEOdI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58859ec259681092fae79b38215f758e0
SHA1ae79621dd0f8ab0a6491437aa6c37d6ec9ca4b35
SHA2569acfb8d0a79964c1b6a8db7bc488acc1ba96bb1fc0ba724bbeac5c3edff4ab53
SHA512c0bdf9f7aa40f28f123fa51b5db2adf11e04cec49f6ae16c7161657c0858c06c93c4948b776fdd60dd4ca8d930de116459db0021ccd5807bcfc176cd5242103f
-
Filesize
5.2MB
MD51ebfad0dd201699d6aa152e405743f38
SHA1b43aafbd5f94623f94cfae0be0ab8f84e39b101e
SHA25608aabc197b270eadae5c699614b95736ceac792e9e1a2d8cd1d4185e2bd8497a
SHA512aafa1384f8623e878c5530a3b905c75a299c7011c412e40094d0a7470f4a7c12db5e2cab859296aea38e31161c2f816e5dbec02e18a3fdb89eb35639942db7bd
-
Filesize
5.2MB
MD52b08246e1ad61a36c7569e1e4fec72fe
SHA119ef13a9da91a7b849266556c79d90f1a6611811
SHA2569c4dc8789b4a386b9573e22aa0e2bcd579b0cb5682ad9bdeaa9294c1ab987e94
SHA51259a985635de45bd4fffd108ce36f5374a9d34e89671bb2ea964b479041c66f829a9bc1c333a850be8fe92957933dd55bc2a7c5b8a0ba1699b042792198d93ad1
-
Filesize
5.2MB
MD50b386562b3672374bf1ece670cc0c410
SHA16104814cda44d842176814e4c852efca4967ce9b
SHA256d28caf70203a3513939ca03d1c491c22a6747780643be59379943140cae01d50
SHA5129d594b57977c166f907d5c943b634cef7aabc910c7c167f4e4b07129492cf6bba5f18ab4669bb3c3f12d7f1e105e072f0c0b72eab0661969fdaafd0241024b57
-
Filesize
5.2MB
MD53a18fbe5e9526d29671f7dcaf2d791ad
SHA1c1f6966e234712b0377064fc70cc2506ed13c535
SHA2567703aa1aab490660651fe18babbacc2cce5ce3cb71951abbd7b9b82087ae2e50
SHA512d7fa5bcf031aa3ada06b811db0d687670d69548494f90bea3ac67c72e16204acc4428ce72dd8d7807e11a37b6d4df1cc210f78e24f50edff2865bf0facec6b81
-
Filesize
5.2MB
MD5a785d27de016c4fbae7d916397b9c468
SHA1bd6db4f56ede1daaaafbdd4d4e00818aa9630daf
SHA2566954d700e106c51d36d91b9cdebdfe133243b908beb10a9469c194ce7fd88d50
SHA51228a4149dd7ff33f681008b194b5abf18f478975a1a90ba00f005ba2e153a8d924187f3151d45528cf8e1cd7c900ac4a7bd01d99a539d207e3e15c6c00397947a
-
Filesize
5.2MB
MD54abee39af96ea2885add75304d94f2bc
SHA1b62d9d0a0af71523ddbdbca1568cac27f2848d8e
SHA256524d36e8ca63d7def7a93bbd8094ea93b8e129bf30c46639da1fe6e2205bcb3b
SHA512723435d7532c8fa80fce8c487452da9c4eb376a224c514d5fd16feebf4b95092f6fcd323d3a355cf8aaa02773321d3610ce4e7f77c7457fd2f5cf8e95a4203dc
-
Filesize
5.2MB
MD5fe28069fb16968e61c08809aeee2fdf2
SHA1612cba5858614b1b7b2dabbe8689d182d9670f53
SHA2569a7f310208bd0398cfe627b6250993a609f181df52d6d431b8af5a93e3198122
SHA51274eef66fe400ced21fe7f76d6b1ac5aa0feac232c42633aa919f8e23f3e49a839b77d8451ed27097906adf8b473224bfaba98eb33cc252ba65ae69a3e6cb5ed7
-
Filesize
5.2MB
MD51d454f645743d2c5f639e2627ba15ca6
SHA1d0db5a4eefedc4beb1d47e8039ce146919ced387
SHA2560b6aeaba8720c5d739b275c5fd103fee6c8f30e7af1b155db920de81f61b56b8
SHA512e6337291d85a34f98c7fa7e542024bdf75750b6998331386b0fabce07d9a1da4ce58fc50425f5ec086b7d7a9a64b14662576cc3e2ed1510a834fa710b4e2c5e5
-
Filesize
5.2MB
MD55ebdabc852374e4c28a4c6759559af19
SHA143d3022fd95bd5da9ec67ed25dcf8c71d58a68c1
SHA256424d1fb5fb6ea8144922e2053ecef2db4961641520785f132d188d19204291eb
SHA5120607e0ccceb9d5248bd39b3b487c6d5e824294235a5e97a60cfb7f0b98b5880f489794a341c177e4d5e5cfb7b5feda66f99cd46c75b9a24abadc9af01156f2b2
-
Filesize
5.2MB
MD5a620a324569070556b6a9582ed32f872
SHA1535d2b5c2d26021afdf08a53ed5a9fe89ef65217
SHA2560c3eb33df3bffaf47f61ac6fbdadb588ef7368572727fc3b0758546a5da20319
SHA51274a482f38e22ac07d236aa6bcb5469a8282d92a2c0ade361dde13133da49ac9a0b10b086556e49f65ecc4d84be3ab49ef9b9503c7bb39eb7e00ac42ef02a258d
-
Filesize
5.2MB
MD5beed51913eea25098b9330084f52f528
SHA142847fbb0cfb116338f17520e3c253fdaf907dd5
SHA2565f0a2f62d35786356a8b2d3b8db2cf093b02f7b989e1ea4139e06ddfc6c4fced
SHA512492bd532b60911f251b87fbde42a04158ba15373d7d2093df190b6d0d30c6f07f66b22a66e72da804512778be34c51e482a5bcc96e4c0743aa4193429704e07b
-
Filesize
5.2MB
MD559f648fc976944af40bb602d1d2f66fa
SHA1027a5480413b73c9046d58d8f8e609a4d92202aa
SHA256d616dda09f93f53bac340acd2e897b73181a7a55f70e34a0e8bb86f0bc2ffb06
SHA5121b7e8224dc80ae377b0c9ec32445153a3dc806f202df9b09580c9f794f54527c33b59f476bd79f5b3e8b547b21f556211f632af8332b39649c11979aa04d5f3b
-
Filesize
5.2MB
MD50517539f0126cb08adcc8c9f395d9e1a
SHA1de1822f729b9d72634c5dc3421868f2ce9b1f0ea
SHA2568cd7c65f4fd1c529e4c7571b00161d9c25ec6fb41ab5a95464a9a381fa526446
SHA5127d05baad84547721a35fd873da0271d0438eda7f27054609814a9655124421aa0c15c5c71a48326efc49afe916141bedb88765f13da4a09bd645cb5a321e5e4c
-
Filesize
5.2MB
MD52bea07bd6d76d1065c1d1b7ad2477522
SHA13cd018f65bfd889e3fd82f1a045087e902f2ed6e
SHA256c6d18cd87510d1ed23201d67e68938ed2e70707d2f18a54c8e8fcd51e4e6790c
SHA512c45ea1bb6fd2019e0c9553fb63db342a14497479310e1c20b5ed8c79bcf6af55724480680ba8538741f959b7cc9a7e7278272d0f3d0cf73242d0be496f9c3451
-
Filesize
5.2MB
MD5367936f7d3b781a61e9ed9e5b5568124
SHA17cfba2cb82e70c4837e3807f6584cb824991839e
SHA256956b55dec9d99bea86b1aee4a2bde30f82334e06f7bc278c546bac7f40776434
SHA512df92cb31b5d1a032c038b65243b1abd8b6fcb9a5e825aa968b5cbcce5373a72aea9c1d4b1a4fe3cc4b382b4f0f1ad4a33f05017ec8f8adb15ba5055b0e02ce98
-
Filesize
5.2MB
MD5d99683e28410d29304499cc1ea90b911
SHA18dc4d5b148a8a6ee8673f48e7dc497e2b540bc0a
SHA2560027cb371fbda9cac4b10a147717bb1d6d0e9c82f66d36ddfac0390836002ed2
SHA5126b7099b90a03b10b85569bba28c37010d94cebd269f4ee6df0d9417b99391a75ebc18c21f50c77a4daf2237c9ec08973a280a64f2dd333415d302f81a8b96661
-
Filesize
5.2MB
MD53ef37a377786bfd0f6cb66f5c729aa4d
SHA1866d64bc23937a36761e6753756575efd1ee4d11
SHA256e71347c039f363d0471e6cec8b8e3e0311f3a0b8431c4e39aaac8bf9ffd9a42f
SHA5122394f02af4cf56d3a92feebb851645aa6b370ce1a0f7863d6a32f58e18a92d1c3b597a00ef9b717c7ca74dade120785ce91dab8a6e71f6d725888f64b94c2998
-
Filesize
5.2MB
MD5301102b269d3ee0dc29696c6f71c9bcd
SHA1d54933a86c087ebe0d8fdde3268416ae824fa981
SHA25611b29073aa9c8b6538b8c6cbed6b3e668ec68269ddf61a20190df1af06ce5ebf
SHA512886ee29dede159c03fda62a2ba21902cce195afaf533f9c9ad70a9266e61a4f595226b7eecacd2a9203ac7aeb71a8048bc733d65e20e426bffcd1d7afdfc0bd8
-
Filesize
5.2MB
MD5097d806fcf0f7af56eb2050dfe9e7db5
SHA13421856377c717b6d8b4e64e840b6885d40e378b
SHA2561e5ddea5652315dec229545dc65512f842ef18497343135c0b583ca5492d9b08
SHA512f5a743cf72487a808496062df6ebe03ab23100e27fa3c02b2aa6c965e03fc0fb0f4a041d944f3f6d6cd5e14a0fdc708e8f0904a4ccf4bcb16eac93c38418f112
-
Filesize
5.2MB
MD5dbdb23f4e5f48d937a5b779f8817c834
SHA1ab771f3822f89d3ade51ac3e2f93aa862048bc96
SHA256cbea4364f6e10382453778c99d28101eafecde14ca1f35f7ab37091b3118d4de
SHA5129ab14c3004aa3f8db942e10219df2c52fb29f8a8383a47118ebd6e66f4a87894563d9847c6ade2133e100acb7f314b749586462a2b5d6342dd3a9af84dd3d0e6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB