Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 04:00
General
-
Target
2024-12-19_599eba5b286bf2eee8aff30b1971f836_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
599eba5b286bf2eee8aff30b1971f836
-
SHA1
2927ca819d1fab11565a9d6f3aa20dcef15ef6f1
-
SHA256
ae39574922e57a0bc2f12d0c089a0e10155443c14ea647aa83e112a0f74ed35e
-
SHA512
c6c7d56cf401374cbd830c4ce49cd19d57b555f4eeed5d853c5d448406d524967773592420bb3f2d030987c6d675860948916d9353c66b9964192dbcfe5f647d
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibd56utgpPFotBER/mQ32lUH
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_599eba5b286bf2eee8aff30b1971f836_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_599eba5b286bf2eee8aff30b1971f836_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fgzcwuw.exeC:\Windows\System\fgzcwuw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\torrCxP.exeC:\Windows\System\torrCxP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IYogSLl.exeC:\Windows\System\IYogSLl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mjBUTxw.exeC:\Windows\System\mjBUTxw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SpsjhWx.exeC:\Windows\System\SpsjhWx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZZsrcxq.exeC:\Windows\System\ZZsrcxq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KtBJtHd.exeC:\Windows\System\KtBJtHd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yRLLXQu.exeC:\Windows\System\yRLLXQu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OIVpJHB.exeC:\Windows\System\OIVpJHB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JZGHNxD.exeC:\Windows\System\JZGHNxD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nnCPKYo.exeC:\Windows\System\nnCPKYo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LVgJVSN.exeC:\Windows\System\LVgJVSN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WxqakZG.exeC:\Windows\System\WxqakZG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uISxEUS.exeC:\Windows\System\uISxEUS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BYggHya.exeC:\Windows\System\BYggHya.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pFSVPwU.exeC:\Windows\System\pFSVPwU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OROESuB.exeC:\Windows\System\OROESuB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GyKfOoV.exeC:\Windows\System\GyKfOoV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\esPldyR.exeC:\Windows\System\esPldyR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qyqJEHB.exeC:\Windows\System\qyqJEHB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\amAIYDp.exeC:\Windows\System\amAIYDp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD510209a3e67473e3bed3905812bc71753
SHA1609adb91b1f5abe855fce4e29e2e4fd0b9f7cff0
SHA25690c62a6c7a70820dd9fd2043898c30a1623e09ae78b860845bbe7cc255ba7012
SHA51292c58ec8eef526933369c90e3de34f4b234e7423c98809dcee14e90e985c1bdc887c1384b1d7a44a269a458cc1d7bde451484774af51f859524db160286966d3
-
Filesize
5.2MB
MD55e2ae85f84c4cdcc61b1ddd4cc1989e0
SHA19425f5620e49edf2a506d72dc747036d2c2d6330
SHA256be57f0e09e248e42f5c75d1f9742ef7366e05feb1f12c2452b6b2f5bfa5fdc51
SHA512ad1b30017ff09327208dc3d8c9b4049ff85456b85cb5e8acca7f9c439a4f0aef5e48c933b427493d525b2f698658035b148b7b61d681add4580a2f556789f5a0
-
Filesize
5.2MB
MD5344fa32ef2a02f6243933f8977db1c60
SHA1cddd5384cdf36a78ab00a46ea5a71ac4a5194811
SHA2564c0ac91995be6e24d698def5b904a3f3e6c5c31d1ff5fc607a8f1715a518f67f
SHA51256c52e6431e6f43612bd843ff99043e6c1a009707e7fff8f15595d33fcfed9f2f2de96a068d197ddbf17f95d4530578a523c0e87576f05b4a5b26a22251293eb
-
Filesize
5.2MB
MD5741a1fc8e376c2c32acfb62811eda914
SHA1b05f038567cdb0aedc8adcefce203c69a1285289
SHA2568ae882d42d0c73bbaa77548088d275239adcd5c3fffe2d470c6602869a416d78
SHA51272620b9e2bfa8ae6a44c5f02760fe80025855806ae80bbbd479a2c4e858e551af3b95046f84866b1cb5091fe60abb74df4da68dd2e1dbd56b6afde29e844db38
-
Filesize
5.2MB
MD5f6460efae57e1a4bece95c0fbf4789da
SHA1d2848502fd17c2d42efdb4d5f75732b4ae55aa2a
SHA2563ae5ef986f10a1da4520d34d8aa2ef89b4a352ae9f2599a099e7c101ea14e222
SHA512769bcf472e93ebcc89f0824cc8d6c1c2d030cadcad5f827a760f70a7e1d867da85ef5bf12d7a2a5d317c6e54129e63a378c807a01d65dc9a1babdb43b55e25e6
-
Filesize
5.2MB
MD5bf69e8a55002d11fb1ad3b079ffbae8f
SHA1c4bec9f8265ac887ccfa1123a53a697817a2e8c0
SHA2561d9f2264ed37e2ecadc7accdbf73f6c4074029ca49a36c23db648d8de16a5752
SHA512dd4749cbcd4e6d412771a893a2c05c7842768ec3d7f28652de1e4dfb2a27e0b22ada6f417da2a23cd7064bb8f5dbbae85292214993993c6aa0ec993ce91ab393
-
Filesize
5.2MB
MD58ba0c80a92eb7b5a571af8145975c0a9
SHA184616103c12d7a17f6e84c32cc611062b9d271b6
SHA2563bd849bfa48e230bafb9432ca0ae82e319a04809fcebebaadda57d997d33966c
SHA5121f3da74925305a7bc7c3634e77193bde238272920bec0b21228d7eae71cbd4f4cec086da8505fba3136e0f6391b0df24b52645dd68f854959d5cef319cd63872
-
Filesize
5.2MB
MD56f01b11f189659b50704194c3eeeb471
SHA163e774cf177a7ae0618ea115096e75a688d16d10
SHA25640e70d776cbabc35189f44adc63073ad9c55f8d9e57ee18cdf419a61a5a8d31e
SHA5127e0fbc1c9315eadb1b545b4a9823a7a3c218075ee0bafda0f63516558d4c29970c238c0d7d3d1f16fab394276cc9a92270e022fd90d89b4a3a5133b59a9b0af2
-
Filesize
5.2MB
MD597feb1272aa9418babbc65487df213bd
SHA1fe77430d2607406712a05e33d22400a1a28872fa
SHA25614221b62e184beddc082703b956d48d8fc1beb0a0fa454ed6caea72227a2b8a0
SHA51201896498dd3afd3907341b17e4ea9d748ceeb9a42479a92b933877691f3ce4916aea053cf140e5220c00b20aed1f3b7ff2531f3d5c64b6a10316196a817e3ed6
-
Filesize
5.2MB
MD56b55b2d55526b9ed1cbb2d4ab9c0ca6a
SHA1260de194b8dcdb0d083321f4ac2de941f447dca3
SHA256add43afab3132833c9487a8e75a5c27dad4565568cc0ef16cf5af844f8fafd30
SHA512fdbc6772c014a497b3ba2ee96e7a2b07d4b914fb739955f2325b1a18f2555f0de277ba92808548394c2368942d2f5885033a34b7a83e693cd473a93be9e448df
-
Filesize
5.2MB
MD5f1a8808a4d86ad31af6f6141976c06be
SHA1e05b2d8695f7caba23c0e00fff2a1d055f6b27b6
SHA2563eae21124a01dac774f5c44a8fe7ddd0bf65e015c9e3596f59be8a48a9664749
SHA512b10c4f89edfe3bbd60a11fe2dfcd3ad58614ab7e29e9cb89524729d3e3bfeea8b78ab2f2797c7891de7a6188b2b61544a09772a4f4559e6992d98df5930babb2
-
Filesize
5.2MB
MD55d8b50f000fa1dc2faaecb8fd1330059
SHA1cb1848d3fb03f801761328b724ae73d575aa8eed
SHA256c89f6de7b19db0f496fedf945a04887010ae3c50ddfd693a53672f621ba3b492
SHA512db75ec020eafe45013028212de0db6c20ee7126668a5d1170c906400969e9e332462d788ac12ba224782cad105a7d4b18ad2b386febaf85da75491959477131f
-
Filesize
5.2MB
MD56e098d2a162eb944301339e352190d94
SHA165997db35dbbdb4abd47a730cfdbd9a55ca71a1a
SHA2563e21d5b33ae6d0a897069341654f64fe32141bcee272419c13455af935f2e6fb
SHA5122cc944f202eeb87fc2192d50b2a4117bbdc0b1d956ab874200dfba2dae9605eba20575190593fc80ea92258d30c1bcb2e3b603aa242518ba86567514662e8ea3
-
Filesize
5.2MB
MD544e8beca326da95087e5b4debddd66aa
SHA14b9b8470a12ab1091aaa51c832b2fae73ed58c46
SHA256b04a571e4f93f6c5f2fa33fa3bc2ad4fe844601b70f5b9c739aa717b798103e8
SHA5125b538fb853cf681a50f42bc0a59823875ae5adff213a22f259a4aae6ad8fc41112c72e05ba7b2fd91b474734f6fc39def40ca8f34afe94379073963a681255b8
-
Filesize
5.2MB
MD5132db157c5f63080ab04d3ec6fdf8d80
SHA17bf8940c9d86c402d8864827412b709f89abc58f
SHA2567a3b25ed6a8b7062669bbbfa9ec8f65475237ef63a756b1442d7a355d55ed5a2
SHA5123b7aa02bcd8175ec9071872e96f9e7992f08ea3e2e37b834888c4834fbbe2626072465e9f6a3d2a8e1662eb1bf9c3e626ef724669574170a83b1a5b66b17e14b
-
Filesize
5.2MB
MD5ad0ee393017ab5e917c5bc732a800173
SHA196ad1047bde721c8d502d7eb578598fa1ed167e0
SHA25639b6891b593f0d80df5ed19812abfba05a2965834fcb8084732e5089fba93b4f
SHA512398d76b8aa814cec4a28f2f016a64f417340af133630905e29e4374260038cc112538e0ac2ef7eb0af6a3cecd2b40715c2ba7c24d0aa2ea7f93f1b6e4c63663c
-
Filesize
5.2MB
MD59f1b449583a8cd0efd960c9838e5d6b7
SHA12330b255d03090f6d9814d599e250a36f9d2168b
SHA2566a29865a21e3e567ef6c29faa26a0384d7700db16e8f65cfb8d7adf54e4a5fc3
SHA51249d18d5dd9153cb07003e8e61d2d527ec88721fc9606bf6ac15318fbe06869705af0fe3b32c9c0c6566ddf3a773a24c2b94417f5be641c3db821b2bf96d9fa8a
-
Filesize
5.2MB
MD53877c4f70fd9638a8503a537fd22db9e
SHA1211645e3822142e5464654212985d26ef90e3e7f
SHA2561f8e14a82b406c7dabf4f91afc840d72cede5e2d8d8832b5164e028e5a7c323f
SHA512e873914315686ecc4ce8a96227330cb983ed982b44eef6bd1238cf48f330af961a69767790e256eec701f257a5257c3ccbbd29c4ba55e2421714cde07bd4bc16
-
Filesize
5.2MB
MD510c09e7a732973a2d07680e49d15ed5a
SHA110c5121b53f92a673e95b0da62cd306179e3dc72
SHA256fa6a8401eff0150a5a040c333b21d3b7d47c867d95354575a503fb3824dd8ea8
SHA5125a3ff3bf2a0ec22c3918c4de27764fcd34f8e08562ca8fff1847e82ab21bcb7867b128017f879e64c5590975e0594b73eb8901dee007cc4adba3b147dfdccd21
-
Filesize
5.2MB
MD540f5fdd94f0bba997f7003d6103ef03b
SHA19aaefb9631857cb310ec72ed7c9ba7f4c6cf067a
SHA256a58987a426c188441a98e0863e428343ec0756311f0dc26b08df84c756532111
SHA5129fda66a8d92b6daad8e78b3b65da9724f9d42b92dd6079522d68cfb818ef583b58d8a2772303ee6b355f3c22f25c37479ad23b6b72e1bdb18006ffb078619e6a
-
Filesize
5.2MB
MD5b4616d79e141cae94aa3484061272f11
SHA1a09cbb491adc0168834fd85f696c1fd426b5ef8c
SHA256102ecbf477553a049b51dacf0a4739e70238fd070ab63da4447fb8c039a84640
SHA512b7bfd2de3ddced1f1c6c1be2230eba897d224a1c4b89bffa3d3e0e1592760d709b4ff7159d4d233a3e4760a83a2e2033044c5786444c77b15474e727eac8b029
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB