Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19-12-2024 03:59
General
-
Target
2024-12-19_522c94ab509bbf04ecb03696a11b33a2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
522c94ab509bbf04ecb03696a11b33a2
-
SHA1
36e92c74d4c174f0cb2b2b53c8cdb011b0e26945
-
SHA256
e48b40f21510f5d5e67c9b5dd3911b000d68fdba433c0b7074ffb2ec1771e48d
-
SHA512
cd64dbe484b5db2a47e3f6ef4a57381517d4f99e4c32321f8d4169ae6fefe3d4517679624086c5969162d6a7ebfb373ad87fa0b0daf16925ebc275c84beeb61f
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibd56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_522c94ab509bbf04ecb03696a11b33a2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_522c94ab509bbf04ecb03696a11b33a2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\EJWakKr.exeC:\Windows\System\EJWakKr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kmoEUgi.exeC:\Windows\System\kmoEUgi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QGgwVaM.exeC:\Windows\System\QGgwVaM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MKWWgCe.exeC:\Windows\System\MKWWgCe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gBYfWIn.exeC:\Windows\System\gBYfWIn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PCEhIyK.exeC:\Windows\System\PCEhIyK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QLzZRYl.exeC:\Windows\System\QLzZRYl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yUVVYRO.exeC:\Windows\System\yUVVYRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\opyPDMD.exeC:\Windows\System\opyPDMD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VRbnbPV.exeC:\Windows\System\VRbnbPV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KtEIucT.exeC:\Windows\System\KtEIucT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qyTNvDd.exeC:\Windows\System\qyTNvDd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vsyEfPD.exeC:\Windows\System\vsyEfPD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kQRBfMs.exeC:\Windows\System\kQRBfMs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SPzTIeu.exeC:\Windows\System\SPzTIeu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GvWVFtS.exeC:\Windows\System\GvWVFtS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wVApJWy.exeC:\Windows\System\wVApJWy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PwSZORi.exeC:\Windows\System\PwSZORi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WSiSLnV.exeC:\Windows\System\WSiSLnV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vuMSAcQ.exeC:\Windows\System\vuMSAcQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zLihFEu.exeC:\Windows\System\zLihFEu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51ec4d9597927fe607a196fdcf1f1767e
SHA195b5d14a19702482c8aaa34b989ddedbe1feabc6
SHA2569a2443ae3f277ea8ce6e03057119470c9685497dfe776987495d8106bc835a41
SHA5125906e6f9570b900a2a21537382eb87e13120bf1cdc5be6879b2c81bb909fd3b576d6ad9256c3d8fb6e43c054adc0704ccf3381afeaf0459038d97e8497b8d121
-
Filesize
5.2MB
MD58f022fb17611ca54f5306011066aa720
SHA12c0d7edd444196d661006eadc6d88e64afb12906
SHA2565dd69b0273b9f113e110ec73151253128c53f2d5b2e21389c4d91819def89b83
SHA5127c65e1332d745f8945c05ec071fa0336fc8f5fd19ced21e110d92a1e23ef504836aa7a75ec81881a30fdefcda45df4ea2e32647bcc3149277472753a1b25f4f3
-
Filesize
5.2MB
MD5d5e26f04efd856a9ed16963e97dd9aaf
SHA1c1a6bd6e407169cd8b5e62838439dba38a98ad4f
SHA25639411039fd3597a2ef21769b55a31ad5dfa834d54000cfd4e1bdf88ced803692
SHA51299d2a13ffd0f151abc053dab4305726ce59c0a14691c6210e3420689c06a03adf191edc5dad85edd6133cd0d1ae8d00114e5c7f966c489d5e9d58c946644d007
-
Filesize
5.2MB
MD50647ed8000e5d8815e46f9d3da01f547
SHA107b84ba9b92b13bb9eea3a31a065ffe667c204c0
SHA256064520705d3fce2960357053d55dc5bef65ae7fe3bc3f69f241423635f649de2
SHA512cbf479a3421e9ed686d8c51d51afef2c1e8bbcd3890f4d8dd57dd51765e7da06aa75c02f4ebbc2da321e9fe4ae50ec3734c9f8c43b2222a64ba1bea0f66d4c3d
-
Filesize
5.2MB
MD57f20449673c20461a7a7f01dba5191f9
SHA140dec063e3d510fd4df74f0ac34e667290f4e5f9
SHA256cafe214887c150d27114747a455ebb5d38bc1f538eb05ee7fcb26a1a5197c009
SHA512f9396ecb7d376e8faa6fb17eee0d3b05bebf6e86a11ab7b9146c24f3122eecf4c3decfb2fcf384a906f6a8b1a1ae2959b32d28e0acff7b9f40a498df4d2bbba6
-
Filesize
5.2MB
MD5906a1e774a510a5978771f272f789647
SHA1c183e40e5d93d7c66226cd165d61231507594cc1
SHA256f410d469bc1ebadd201498240a084dd0fb2a14d1408f05dd099dcb01ebec1576
SHA512de841a99d8f19a50f4ea7ce2201bebb657f35da9eb05241f509674469107840bd4bd990476da4cafa5771ea227454cd5eb8ceed4d925921d1190349fe933ed62
-
Filesize
5.2MB
MD535eff00332a2e5335e93c91e75434c89
SHA180b1cf9974722502e2a3c419ced47a330694019f
SHA256753a00d404f6e6d3fd1c4460e7b15e2e30d808c0450d284423d83b26a8f5602d
SHA5120920319f8a6d9251ff7998e4687c42c85a2857b2114c06140542ae862c0270a7dce28b553dc552660758e4ee0b09011d40365b09d3693b895ecb2e17a7924ef1
-
Filesize
5.2MB
MD56dc60942560765d5c96a9a6815409c1a
SHA1cd7384c0c20d18920dca8e3a998ecc230b8457c7
SHA256472cc6df5d9cd792b86fddee4eb467ef7e91d4aea9e170ba292a0fce239d4dd9
SHA51249c7efdcd5adc58954f67b7d4242a2f782f1592a055c077d96ca85ad936c5781aad31cceb14059925278469d03c28f4f2dc2f61f49a556d722b807bb0d4e135f
-
Filesize
5.2MB
MD5d7abec87c798edcae842b6341fd96791
SHA1293fba89d0a2d6fdb79775f589e635f4849f8d33
SHA25692cee379544d2009164789a282a4b98e7700187d97b4dac0263a88da1ac40876
SHA51227702d65ecdec50c1e7c89e80ca6915204a0fc60b2bfc598d4a036cae89b7bd234308532ab16a2128ddf849b8c94f3345c5450112a8efd4c72a63466513c6ae6
-
Filesize
5.2MB
MD5dfe797866f5b8a038bb28b474eafc469
SHA19f26343428606d842ecd9f7365625432a999d1fc
SHA25628bc156aed5864f838e05a64f20ef27ca63b3cb426a487aa1dcd45ed08e5a0de
SHA512486d57043df4f50d35d6dbde6e3bb3caab3a1ebb74881f5bbc8d6660f77ae16a9c790c77531bb34a29f527bd40b1d66866395f37aec5dcbb86a04bd6aa3fb7ae
-
Filesize
5.2MB
MD5aecc8e26361b3391ae406f76485bc262
SHA1fa71c4c4eaa3ed426c52c2c5f3f828f9010b2d6a
SHA2568e626fce860ee2c3aefa0cfdbdef2fce2bd09057166dd6249fc24390c04d961d
SHA5126d8c817e2d1fd297fc2ceb193ed054a62f9366a07ce5d68c781b225ef699ca4ec4e4bb9d1d7d0a690cd93845de92d25541a58ebc26955c16c2aa166fc154e476
-
Filesize
5.2MB
MD54d779b38d9cc55c25943ef9783b0e928
SHA1616a2fe615ca55faaeeff250d11a5f52d6719d49
SHA25655f601b63fd086d2f876b5456fd5393467980b03c8ad27109603594ddd5db0f1
SHA5128cbd46cf82ffbd692a15cb922b873a5669407d669f6a0c9f6d4301f60369a605e4e67013b324d2cc2aa129d6fc9215babe29607ec6a0e9b78ccc58cf2becf750
-
Filesize
5.2MB
MD597773ef8353dc748d6efe7a3e71f9158
SHA10e9feb1f3728136a7a81db70138530604eab0a03
SHA256347079265e3b122044ca0afa19bfbe661b960011b4d192f8752396325a182c00
SHA512bdd07b3e40d1688cad09f376bc7162f861e83b70935a0ad06472cccd71ae943cb578dd57514ee8d87775f47547db42c7ab51d2e4a632fff2f939cd156bb6db6b
-
Filesize
5.2MB
MD5c3611bb6fee8192cb5ea4539c511271d
SHA1fc9555bed4c42fc14a44723446061096d9f5e8fa
SHA256dbe785bb351477d199f6d53dbe2529f3f594b3c67922d4b7412474a4577faf03
SHA51213241aed3641a005a8995189196e7088728f04b5e19310de9e1be9cb25128c9e58cb0d8cf18f0d5bc1cce08c8e2a1e00ff501d49f7b293097ebd59a98c3b2563
-
Filesize
5.2MB
MD56228c49590cb55fc789d7d226643388a
SHA12c4a67acd9327c9fb74f710bdfa5eb20d96a5668
SHA256f105babb3d3ad4c0992aa6af12cd63f88799ac5ceb0b6821bb76cc27861e92b0
SHA5120b72a0565df5767206aa54ba6c19467eed7395f1b9bbce39056deedb02058d5eb6de5784228b0d4e572263f69a8cccbd1d023a0d276c0a924478af715a6db99b
-
Filesize
5.2MB
MD590152decbbe190dc927c93b92872c63c
SHA1f782c187b667ec658fddfb721c70645de356610d
SHA256bddc5803f9a16dd83fd588c7b41e14950159d7fcf5c102430af7e4a110fb9fce
SHA512e9645bee7a9b64e2da151bd6f876ed49800924a502e4011dce7c1df81e30dbd22aa83c7cba6442b7174708ed0be8ef27b197e32fc90cae2d5eda813e2f140ec6
-
Filesize
5.2MB
MD52eaca483de18bcb7c904026d265134ab
SHA10282cce7dfe3aecaf7bfe07cef493aac05e71e30
SHA256ed893d39be9f5cdadb9109572137eee2f4691bf9520947034e984e6bbd10af0b
SHA512ccddd4dfbdfade13e0b88df006d95e619b85cb2cda31ea0572d84db0910ae7f30b1d0f6370858af0da88069cc2cc02812a5ac41b922e09cb185e26c81f760746
-
Filesize
5.2MB
MD5bfed45c7ba93721a1da2af95e1a59a7a
SHA19a8c093b1b710e6ed1ffed2a25f7178ec350d147
SHA2563357e20c361aa36f02b39b7453b558e58a5963937c00fe8420e08ee09a7c566b
SHA512003ed7d0253b1185b40d162a26fda25ed1377a4ff9f0305b2968b8570f81c5a0321a49bdbd59c571e5c6d792da32d827c4c87d2e21a7c01cc66c08da424a5813
-
Filesize
5.2MB
MD53396a7d4db011d615db808ba60b54b64
SHA1109de6265c2030766c9d5ad81ab0053b6f4c68b1
SHA256e8b6acb9faf4ea078610d254169e4db1f5331193252720cfe0f0d8bdbbb633cf
SHA51279439f418f580ca70f94c343a3be5ba75db8d54fbb913a002d7b433f0939904f1d495e77c9a1ce6ed754fb885dc5818310e9d70d397fb79811b8dce9f23097ac
-
Filesize
5.2MB
MD56d80d775fd89a715de9cca1970ef2725
SHA1e2186907663c7dc760c23a2d55edda89cff41fb0
SHA256717bd310eeb4805d1ca1c9c9bc430d52292f4f07a5e5210d1be3cb937c56f8f7
SHA51286cdb8b4357fa264a8b75f8031906fd91422acb37c6d6402fc592ee7a047a2c0e735470daa1be683f16e8168178ca2252d26fef2810ed62298c3171c3b667918
-
Filesize
5.2MB
MD5ed7ee419376314298f8fee956d9af023
SHA10af5fcbc11f606f266a5811126c31ec636bac0cb
SHA2567424651e610dc594715ffde3c0b7b1b41ac64d078d714f706c6661e1ddc8787a
SHA512aa4db120764eefa6858e98a09a2fbd9950270f8d006893e49d1e097ea27bab1d51238902e2e8ce7ff4ccaedb3d2dd614e1fa666eba25b5bd7b5cad16e3377eca
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB