Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19-12-2024 04:05
General
-
Target
2024-12-19_714a5c92b117a7d4ef7bb250a759fe5b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
714a5c92b117a7d4ef7bb250a759fe5b
-
SHA1
834ecc8000d9928c6357eff7f4211949678f8da6
-
SHA256
aea94fe149b68f4f3f80957fe06945ded169db114a3a917d434381d3630bae2d
-
SHA512
a27bf26df3648bbd0c9fa9a013b37a11ec03d05d1d803c6feef1642261da07a203bcfc819b7f433fe69a5066a56bdd5def061c4ba2d30423c62095a5b68e2117
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibd56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_714a5c92b117a7d4ef7bb250a759fe5b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_714a5c92b117a7d4ef7bb250a759fe5b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AkrZRyy.exeC:\Windows\System\AkrZRyy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lolQuDb.exeC:\Windows\System\lolQuDb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qxYmqfq.exeC:\Windows\System\qxYmqfq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fjyfybT.exeC:\Windows\System\fjyfybT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BVUvEjV.exeC:\Windows\System\BVUvEjV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kzOnIQj.exeC:\Windows\System\kzOnIQj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tumOZsb.exeC:\Windows\System\tumOZsb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SQuemOi.exeC:\Windows\System\SQuemOi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lpDhQgX.exeC:\Windows\System\lpDhQgX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FAcZeSh.exeC:\Windows\System\FAcZeSh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QfnHivG.exeC:\Windows\System\QfnHivG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KFfDGFl.exeC:\Windows\System\KFfDGFl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CedaYiA.exeC:\Windows\System\CedaYiA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IIUMYml.exeC:\Windows\System\IIUMYml.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RBfcEJo.exeC:\Windows\System\RBfcEJo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RJmjiFD.exeC:\Windows\System\RJmjiFD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tTXNgdE.exeC:\Windows\System\tTXNgdE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HpYOkMC.exeC:\Windows\System\HpYOkMC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\swcryjN.exeC:\Windows\System\swcryjN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ndZxLzZ.exeC:\Windows\System\ndZxLzZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzLkfZW.exeC:\Windows\System\WzLkfZW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5607c31bb3c917b528a860ac20980df9b
SHA11213095412b735b8abc588771de5b6a439fb2788
SHA2567df7371477355c87a91c8ec11ba035f8540b9e8b22e070d79ad63ea141bee2a7
SHA5123d796cd0eaafdee9334686b512a3786290501cedecf6e8a18d64d4a6aba952ba87ffc68f0cdf8d4feb0c6d2d97bfcb8e3c5e301014b0709842ea9964aca6ef1e
-
Filesize
5.2MB
MD5301d2b13f9bee9b4a3b5c4aacf8cf7f1
SHA139af591473c4399e34ec48d3b841e703573212f2
SHA2563b08eb195ce12557e769fb98c344068031daf31bc6653475f1cdeae98afc99c1
SHA5122a627c74feb23b546cb7982410f53c49435c3f5218f8d8ef572a179b0f5d5278b8788b4d7467b3d0de2b2ceb059a07a812b9151084055fddea09b9850f7fa337
-
Filesize
5.2MB
MD568b3eb12f995a4a155a8878836f55ff2
SHA18b4d72dad14012dfafdaeae00794b175e6883ed3
SHA256ba69eecd045c9987d02e86935b7db2cd355f62874cfe9d2426a15a7b46e15f29
SHA5121f80390bb2d5cb77560a288142926c797c59f6e1f1e961e42139fd21ce4b85815dd34ead701fd2868a74431569425519786d87f9e3107b48599c482ac2e41990
-
Filesize
5.2MB
MD598141451ff5745d19060f84135da5251
SHA1bfd74858650c8e6b9eada57d9aa42fe143d7e64a
SHA2568418dc0909eb287fb5210547d3ccf56e6d5f87a47527bf20d41be02cc69165a9
SHA5124c8c7acd9a6a4afe1c045043f3cd20608ee116414bdcbb602abb458d8b62fc03182ffd720b85251039d14e7e0f8b78120213dc65c8b79a4186e2ed606700d44a
-
Filesize
5.2MB
MD572d1a80594de4e67af749ef039fa96ff
SHA1ca280a6fe8622fabe7fd27291dafc7da790c21f1
SHA2560362648898d5525a6363ce6ff19ec3250560c9ec5f6945cbd72e69f8c360c02e
SHA51257e922ca969aeac59587ab0f9d6088d5a473f18e7b036c8779a2f9c6329326b85e2c3562de83b8242a2d2bbd5f5c5f6e2824d68e5255564f2df3c8a9b0012cfa
-
Filesize
5.2MB
MD5baad52c1fdf61bd58383179bdc8de944
SHA123511eec5049b28bdec49c4e3081beb907e5e3df
SHA2562380dd7737d01961a2e9a6cb45a17fe559d30688f22f5f0be70d29e637b4ea2a
SHA512a61806a05ee39d27613f59e3701ba67015a84128107eff0089b0a3aa1ab3658df6775a5106e345e58567c8e7f46787f05189be2499bd689e2489c35c474d00af
-
Filesize
5.2MB
MD5e6fec2ed09d9e76ca6cfc452d2fc1283
SHA18f0b6be5aefabb9e0fd163c1467cfb1340d67ce1
SHA2560aa02aafe9c8ca0395fbcd48afb30e6466c65eb4f21526a2e85db8804657669b
SHA512c8229b07c892d86318aaddb2086f4b3371277bf3be61b4d8988fdb3c9bdaea321d2c7f73d06540c417ac30c1e23690a549f6c5e1e632ca90006195d941761d60
-
Filesize
5.2MB
MD51a81600e1bacd70beab56e0e33951e35
SHA1547497234d32f5d2f14e5a22134e5cf930484de3
SHA256b0ee12c8c8826b836ef8136c34c38f41267eaa30b743b74b0439b26aa66dbb3f
SHA512017d2f53b9085a78157f438f40ed90488d50eae90f841d563c88bfa29ec14782d6c5d9a171815d9f7d18b711af7fe4214467507bfcbebf3c08e786c3d3cfe984
-
Filesize
5.2MB
MD5dd47a7593ab7771bba20f7f84f79d9ea
SHA18660ccf0ea35e9c05384922570bc91f2a0326a0b
SHA256b6f715f949635507ae80409d3f3a706d45692239347a486496da3b80a876a38a
SHA5121219c34d5bdb9a1438275d5cc87140d91f65631de18578fbcb8192c527cde0301bdc3726e2d19ce0d56af2d0806b4a6fa22880e6d2fd1ed3520bc5ab203ad28d
-
Filesize
5.2MB
MD5f06b7145b8f62288f290391051d6e511
SHA1574601055bb34bc330c0e51011209abe5c2eba5e
SHA2565024b8ccf5f0715cbfbd8e21f3f2d0f1e600f39e65e209d3dc061784ba279f4a
SHA51247ecc3dc6ef9bca4843b1c15aa2862852ec393bbd0e1feb9c6e807ccabe803dceccb0e932023c7b0dfb5bb971527287841d1b69bd2c5e0e0f2303120fce5032b
-
Filesize
5.2MB
MD50a839945c75c84a6f333468bd7c6f8e9
SHA123ef2470c3b5a4489bea696b1abf2ceec9c671db
SHA256766e376992a046db9c41d98a833703ba2c1f72aec2373448c05b42c9c01137fe
SHA5122976672e7cdfb97d7f082f38357620caa4722b5e064379d01ff96ca8c5d68cfead731e5dbdd971384892ecde849aa39d5b8cacaca1b9bda4cd98a967994282a5
-
Filesize
5.2MB
MD5c0b0cd9e415ce6f479b73aa3db4b27a6
SHA11cf65356c27588db6495409d01499ace89ae19d8
SHA256dd21f704421cfea966d1fa44af960a08fd36c3226dc5227ddbdb57e318598561
SHA512e04d675cd87e677de00cf54bdccede9deec9e954cb4498aeb0ce04629990a04c7b2ddb07aca8b2e6aa3cb2625d5a5538fc4c64dc2a40554da264c037bc0e3068
-
Filesize
5.2MB
MD51c18e8be9900c1241c65e61b24913879
SHA18c06b5eae05a78dc3f8490a69564c0fd2597c30d
SHA256d9c7b0f92ae24a9d5c96871176104aa13a31cb2fc226e69d7c1fe4e21423e03b
SHA5123ec22b0cd58322fc73f273fed8f4c4d3c5986956d2eb1cc240e20d0c69eb0fef4d3862aa96b3a73f1a8f4e469d28c9b70e9eeca81b705bfd767b75dd52a061a5
-
Filesize
5.2MB
MD5dea0752e2eca2222fca033a47c602946
SHA14754f5fdd0abdf00e0e6a49a1977ded292b93e44
SHA2562fa694968f8d360a4f09c2b1bf419a563dfdae72975fcf5dda0e268d3e119e33
SHA51236cb04d06214d11aa7e317f6a5eaef7f4fba59a02899488e65692d08220446a135ec119b645fe107c2d983d54465f4a511cc55c004a33baa4122c6b595241421
-
Filesize
5.2MB
MD56c913bbe0af83e8d6239be34a334f43c
SHA176dfec3874d475b253c78b073ffa374b99871928
SHA2565504883f7e874dbfd5f79ba206844e570e7e69dc71ba5d0f85988cbb17f7196b
SHA51214f0c21beacd3013c27b54b150f351bddbc268cc32c38f4a54b08b312e95472002ee66086ec404170cf1d41d6eaff179ff8aaad1cc34ed38f26ef4e84c8f2d8c
-
Filesize
5.2MB
MD54c2d042355e2d2c7f63135512c80bfb8
SHA1838c0c83892d1cea4175bdf722435357fe833097
SHA2563c031278432994c7cdf21e16eb4960387d8cef73130f5637a6768ad269f15986
SHA5129e7be9a9009f8da95cb2df5b9c1b55730edef832a324907fb0635bad8bd5ab0977de9143d45c8edc911b6a42f133a1aabd33b0d0a8a5e0bc3f10da223ad7a898
-
Filesize
5.2MB
MD5722ba16c9a799a13b408a23a63f63a88
SHA1b2070b9d424b8355b0563fb2d24a5232612177e3
SHA25691e6cab51ccd8ec90a9bf01626f8827be2a556b5f5416f50d9a8c3c344a91237
SHA512dc049e062973a4be0aba80cadb5ba5e0f8ece879a9468e8050f08534772c5a69cec7253be7323e6508bd8acb51bf32a9f3ae98ec8aba32ce5a089dca20f7617e
-
Filesize
5.2MB
MD518f9f6a46dc01517e34829613d4d23bf
SHA1587cd0652cb8a97a39fdbe476ec3b63f8e6a2da0
SHA2561fe6734cdff9095ee9c48e323afd46ab94460fd498c8450c8b98bab9fcf8016c
SHA512820166511cb0b19947d2df4c1a709d6ce386f9de858ae4434c3f710c763e93dc61e4446d15b69197fbe9b40e13f56c4916cb7ebb4e2ab77edb4bdf0324fe0c75
-
Filesize
5.2MB
MD53b4fc7641331431ab77890d56437c045
SHA1246dffbfdfa5256e7db7d3d22d2c87697dc22468
SHA2561ef986bdabfb17663c5286bdcdadbd83b63b1f141372db92c47f7dba5e0344f4
SHA5127e2eb36a8fdc1f32e48ff33f74d810b960334d9c4bea42232c912b06b2ff4f069fb73abcbf6f56b9b0d2c2886f54ebaf66b6db8964c570c4ce36002eaa36a2bd
-
Filesize
5.2MB
MD5692b19164180e7f41ab5f6cbf8c192a8
SHA1b9466d3f7455c0ad229952703a26f14d025fbb9f
SHA256f9d0d46bdb43b8d7c20df0a19d88aecc508c9e5f43be02127c3a6f6a2213d1f6
SHA512bf57078a4e634256f345a11387f5177b9f5fc07536837453fd0b0523df73be55607308d9a2b3189ef16172f43b8a00b081d7c5e5ca67e152c11ca28e9b8244c1
-
Filesize
5.2MB
MD52913a5cd74985d0953dd456daba6bf2d
SHA15b502e22ba272bea54746925b3ac853b1bbc0ee7
SHA2563408d9b3b4a721dad542451a9d299a59b2a96fe65f8bfb54b4f798c80495cd66
SHA51205f9018845fce92e111438033ee98df6b2f2b028b32c4f444b08f97762d29ff14107acabb60d1874fa49e125ccd3c1151078c6bca20540e7c2e836d7baa8e8e5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB