Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 04:13
General
-
Target
2024-12-19_aa9466aa73aceeab83d5ca2fafd78901_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
aa9466aa73aceeab83d5ca2fafd78901
-
SHA1
48a27176146b874d5aec6953681197606099f630
-
SHA256
3b93341ef93ca522f712dac237d70887f4c315227c7c4ff28eda54034ab69747
-
SHA512
d66fee4d87dc25c40ebd265ac5a56bef15886fc4d29e93486891b259fe55918cc40c0ba6a7bc15f543c07b594ee9fe6e0777e4e3c818acf2d9df45746e2aa9b7
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibd56utgpPFotBER/mQ32lUR
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 34 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_aa9466aa73aceeab83d5ca2fafd78901_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_aa9466aa73aceeab83d5ca2fafd78901_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lWrxQNv.exeC:\Windows\System\lWrxQNv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SSXbMfR.exeC:\Windows\System\SSXbMfR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PxMMpIH.exeC:\Windows\System\PxMMpIH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jhVdTci.exeC:\Windows\System\jhVdTci.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aNQgrYc.exeC:\Windows\System\aNQgrYc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IqpsdBn.exeC:\Windows\System\IqpsdBn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eahroki.exeC:\Windows\System\eahroki.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HzGJBsQ.exeC:\Windows\System\HzGJBsQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\alsZOGw.exeC:\Windows\System\alsZOGw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PgeSVVO.exeC:\Windows\System\PgeSVVO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hsmqwbw.exeC:\Windows\System\hsmqwbw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jJhfedN.exeC:\Windows\System\jJhfedN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AsJelbk.exeC:\Windows\System\AsJelbk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\spnEazI.exeC:\Windows\System\spnEazI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uNzkseg.exeC:\Windows\System\uNzkseg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QKpPmBp.exeC:\Windows\System\QKpPmBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KqBFXtC.exeC:\Windows\System\KqBFXtC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mBSOiWI.exeC:\Windows\System\mBSOiWI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cKbtxdo.exeC:\Windows\System\cKbtxdo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\blZDtMt.exeC:\Windows\System\blZDtMt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vPBJlQB.exeC:\Windows\System\vPBJlQB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5dc4375ff6860e74afd1965cdef4c4c4f
SHA12bb44bc5a9a4c18dca8dd40c1c08702011f8825c
SHA25660a6deafdc95a17ac446ca328cbcb31074d660e1a63eb74b5254ffc0f8da6280
SHA512cbb0a59a14d2ae1a63d907982a73e8ca617e08208eba06e0b732f5fe3a62d5a2862614aae7049fc656a52f01aef61b2dab3d726f026f9afdbb573a26473a44d4
-
Filesize
5.2MB
MD533cbd37776621e487f552ef17b26b351
SHA1039c4f5c93ea48dfab695af24c069779caa003c5
SHA25607bbf6d5afd26893a46a8ddc858af7864c2b7acbf4b0e00844072f47445351c1
SHA51281dcd5731abab7311a5463a8898ca53070f1fd07603f30c3165bc53c3d5a550d8145d168b7d052ec629c471b7bb8bdf6c060e2177dc5d3152049bff632e1ae27
-
Filesize
5.2MB
MD5d7ee16cc206074506529068a32a9181b
SHA18aa0fabb720c15696e74e322f6f35d99506e6d77
SHA256f8b969a833ad63a29e8d1c1986771b79a3ef33a50201aae6eb2e6082d5441208
SHA512ceeba485b5a9205cd1bdfe24cead6ddf24b8c96d76aadaabc8ed2fa5468baaf22efe0c1b1a5ed29683c8d88ffc52341f76ca725f4554e375adb1975664f7387f
-
Filesize
5.2MB
MD569c13d096f8789e332a2cc5d73250b8d
SHA1575e0744dd9b18ec8071c4f8eb2d10bf24ef6f13
SHA256c64d8feaa2ca9fa7e7e7e1cea7a0c45f8776e0367bebf71aba175671406f5800
SHA512df8182553d4a49a569318ddcf5e22cbef86886356d420cb31279a57556c3e5283bee5cad70ee0bad1af737c7644f321d8d330e84b6f7b0be8db23b00a7add858
-
Filesize
5.2MB
MD59fa49bfc99680b842fb2c742f822af05
SHA1470164ab0538c17431ad43acb07e3143f0045a7d
SHA25671a95b66cf02f3742b1b6877c9532e25c51a3bcb404d48141f684f797eb0b476
SHA512140d58576f1d5ffd33b25bd96e0d83c34f8a18cb5795942c311df34c9dcc6b80aa8c880966e695aece06739c4b2e0348139d7e5ebe7a2e4fb3fa1e57466a5f0c
-
Filesize
5.2MB
MD581d312bba3ba7a5f50fcd2d8b3204b0c
SHA18a4ff574a463c30effeddb7f38e902de9c413dc1
SHA25678c6bdf41b054bc17b54a608d942368c288bc265f167a809c26f168c86c5de12
SHA51207e922da16f4715efdec156591ed509fb44c1fa1351b72146950478f520b4bd3918784a54e70ef9694b8a9b6502424d18cdcf4da4e5c4d64ceed8ad770b1e383
-
Filesize
5.2MB
MD5ecb0a610c29af3022a9279ee8d9b63a0
SHA1812422ac9fdf9917756936e9c2984649c6492f61
SHA2567890cfbfcd27c72791b515b17300738bada04d87934e28283574b7e388afef8a
SHA51247ab30717fde307dc369ce1debc1bc01fd7b7eca2da35b952c5e961d930c4232a4340225b15abebe7345dae744a36482aaa361ee5919c029d170f00299101d9b
-
Filesize
5.2MB
MD5c60e95fa935762ea41d8d569bf545c6e
SHA15091568779218ed211c83b49424aa2b4ce18fd26
SHA25603c4c04af5456475c1c5725fa6a9e8133b0283fc16bfa1ed70caa01c6765cc0b
SHA5124a5a0ff72d540be4789e9f172781319512af64c5a4f5a75806734481f004ec3d95bcd8b282a7fbdfd4237cabd718a8f28fe65d9f70c0b9a699f6f1e78874e650
-
Filesize
5.2MB
MD5ab38a0321af812cf286715f9e50b76fc
SHA131fa50f6546aad0f22f52525651806dc089358ab
SHA256f46340f47bbade641bd1d17f45ac40b0a9e1b07fc79f979c0e3eef7d11b42320
SHA512ee50b9d0a08852953eee5f900e4b3ef67bf830b1d7fdd7d88fcc14998faf571def18bb494961d3956cdcb5f562bf50af6f6da51742dcea92a933581274f80937
-
Filesize
5.2MB
MD581ee2b083a5b0719614639f0ffd6d007
SHA19756dd0f48a5ccc66c6d64b45165e62885d56770
SHA256d40ce08654fe11f81e4023d4a144790dc42b44b81a69eb310cfeceafebcb6c3e
SHA51207d9abad500224da4d80ce69659fa1d650bfbbb0219bd616810fc935d0f77b9d8a6e04e3843f8b74696a2faeb2468135baca0a217fddb5d5e49752ed38956993
-
Filesize
5.2MB
MD5c1b9ac41106b75cc05559b083d2fb1ee
SHA1aef47454fe370e72346c0766e9d3ab0c9179d0b6
SHA2561d9bb9aa10b09e5fce926338760bbfe1377b63bbebf59245c64a20e037beac24
SHA512c64444b4b8d7548fe293b1740a117c5765ece0147073f0089504a2b4e4c4e036af5acc27fcb8b89420cf4fcfb40ba7f97b9c3b38fc4f89f723da57612e322b94
-
Filesize
5.2MB
MD52fd0174a544e2fb26533ff396c696a3c
SHA1ca5c8ad2f52cf95a940c9e0aa190e2f8be9be003
SHA256080ee1375f3d5d50b9b738d16e79aef8f8626d6b59c8add86835b51913c22dab
SHA51213b689224a866ee76c858902d1a2b0b07c9878903356501a4adc738f016aa2f7d8ddbbd760dd4ecce229dca19f24d32eb0bfecff092e74c9f4e7bfce15186ff3
-
Filesize
5.2MB
MD559942411f2d8294e43c46861a5b9869a
SHA18e4775f1e448cae3e0c79faafdce0eab2cbee831
SHA256d83924ee59281911bcdd5a85fbd462a16d45b0d78ebfcbef09c97aadf7a3b251
SHA5124193a5823aaa03e7cda7748701780e0628f6499a435e085f52649b79b59fc072ee4b41158b59ba4c0ba701a61831a8aca076533a307c9eff7b6195a0654987b0
-
Filesize
5.2MB
MD53fa3a34267096f1fe5c64ebe4646eb4c
SHA17e6557ad593b73b69b50541b67ba2e87891af8d3
SHA256c63687e7c1f60de692150756693c4e2d79463505e32114e70e8f809a3a8a7f1b
SHA512a17b617847cd66550319f0e820a2480cf618c9572531fe1ea2b18e477e2f8fc9082b008a32db46ca4c91d9798d7c22735a8e7ea8002588ff5676228f365a7320
-
Filesize
5.2MB
MD5813cbd24e389f425c5ac410c0c3d5e92
SHA1ddc40f41c125fcf92c6a6af4faff48c84a345c36
SHA2560983738096219d734a662282e2d851713073e40386a00ca7700784270ee5354b
SHA51284f8e11a090a3380b38ed44dd579748b6ecd51209af3452e54d2702bfed573e11e033590e9e867b614a8e6ccaf30268e104ab426585d875f9bc663d4531c010b
-
Filesize
5.2MB
MD5265db2c1a2055dbc61f60d22816c06c9
SHA11b5356b100a4d6021e21b9591199e08e1e62d06d
SHA256ad1c51633263c532f469dbde91774590bdf073f9476356c26c67dc101135f8c9
SHA5123d938ca4638ec1964be695af62b55aba5156f95a14d0b3b0ed81ecee140fd6e956b687300daf4fb6ed658bfc1787bbcb4b8cca5b1990e52dc6b94a0c39fdc2e4
-
Filesize
5.2MB
MD54f74b2d5e1550d69354e103b77843344
SHA1e53a279f0050024542583a55f091b6f3a7f0020e
SHA25613262c8fe50ef45fd51209b46fe35e91ca93ee0695ba2a4c0bc511a819e18713
SHA512a020df46bbd582128763f205546bcd8075fe78623f82581dcce6ba9120f45886c210e9d4b6ff9a9b89eb2df9b7f251aa063b2209b3d244e6d2618656952c0c4e
-
Filesize
5.2MB
MD52ed33f22040a356bdcd16bede717a973
SHA158b9719b7c2022395d8ea97a000a4e4992b1abaf
SHA25616d90b9c75b1037171fbc7c2ab7c5af04c1195974fd26a8bbfb14054876889a3
SHA512ba8e01126038580524fbd12370775d82d84941fdb500be047a657b31b032a929bf59eaa61a6d9cce0499b0314fece3bc49e11e28df88c6d3fb64a2eed80c64ed
-
Filesize
5.2MB
MD575ecec60b8e88254d0ab4b3b516e6b9b
SHA1690cf5cc765141549253b598b4c8e2f366b8941d
SHA2568d59fe3747cd7148e02342cbddf3ec618030f8b53990efef8d14d25eb85d8786
SHA5124bbf59b0886e00a2d6317177363c3589f3c3aa4f7716362d80edf12a22bf0ca784ed750c1f3d8341e2b2d78561e7dc0855de0e0c917b234e0cf6c94b171282a4
-
Filesize
5.2MB
MD56805075de433b00b65a22acb3fd20c7f
SHA15c9e6dbbaac002bf295c218e2043e0bd69666383
SHA25667098ba0f36e4d27f0f86e9c82ecb7b05f8d3d889f3ede9ba4617f2b2685e289
SHA5120c3d1f7e9796e15b019cde7ded04492c53b5af1b69ff3fac48622dee8272f6b0e1daaec085ac8e2a7eb33d8d50356357a47dfcadbda1889921b75a4c7538c233
-
Filesize
5.2MB
MD54ed6b3bdd633bf1ccaace0d1bdd2cfde
SHA1108991b3147a51af8198220e56c5db5b2baf5d71
SHA2563d70607d3e4f51506e93e58f23dcd13fd6b6a683fd766eb3573af4d98b2b4a95
SHA5125c241cc94d53ca19513c3da7c213c4f67a6c4c27b46be0b6237d2ffc535ac5cfa6bce2ffaafa98e8055509d1fa4b6f90ffefa2998d6719057f777484dfeedb09
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB