Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 04:22
General
-
Target
2024-12-19_d6b6b2a7f86d0672fae650dbf4589082_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d6b6b2a7f86d0672fae650dbf4589082
-
SHA1
f1f3d52548b22736a36fafe50d49a40905390153
-
SHA256
08b1559f4c4337885ee8a1547aeb313137a721fd9f27cb1a5e31cead3728e3a1
-
SHA512
1b3b29d96ec3c9ad34cda8f15d25e3a97ac19fe190c28f5b0a45c616ba6a43b24cfd71569b7c9f2d825ce799aed3e2a391d98e166617140ee1bcdfd0839ac937
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibd56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_d6b6b2a7f86d0672fae650dbf4589082_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_d6b6b2a7f86d0672fae650dbf4589082_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AIoCtvh.exeC:\Windows\System\AIoCtvh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cgyhNHd.exeC:\Windows\System\cgyhNHd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HzzBBfA.exeC:\Windows\System\HzzBBfA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mFJsEHB.exeC:\Windows\System\mFJsEHB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KdWIUIf.exeC:\Windows\System\KdWIUIf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lVjoYbr.exeC:\Windows\System\lVjoYbr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TZbfWsq.exeC:\Windows\System\TZbfWsq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GvlRLfr.exeC:\Windows\System\GvlRLfr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jcFyHtd.exeC:\Windows\System\jcFyHtd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iwdmzTN.exeC:\Windows\System\iwdmzTN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ELXEciC.exeC:\Windows\System\ELXEciC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VKitRGs.exeC:\Windows\System\VKitRGs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gMFZPiD.exeC:\Windows\System\gMFZPiD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PcNePsk.exeC:\Windows\System\PcNePsk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VIlDiZo.exeC:\Windows\System\VIlDiZo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PuezzTR.exeC:\Windows\System\PuezzTR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BSyulCq.exeC:\Windows\System\BSyulCq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xLabocH.exeC:\Windows\System\xLabocH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GoyTNIl.exeC:\Windows\System\GoyTNIl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZitkUJw.exeC:\Windows\System\ZitkUJw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QBRgZRr.exeC:\Windows\System\QBRgZRr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ad00727e49e469bd36cd6d19825a21a1
SHA198ccf2d2688309f56e7e8fe47248fd1f0bf31c26
SHA256c8015c4d959a1cf15e7f5ff751f6d528243e1da4f8de828769b2e9be80311c4d
SHA512987546f44d140141fcade41a088c92feb7609e8d0c3fdc4e13b8a5c6cd3d3956b6193bc5282264655721b047020c541d65a57269ddd791c9b00d95b6de5c4969
-
Filesize
5.2MB
MD59aa82630365b82a3335c6c36b0aa2e02
SHA1119610123a15df2a2b91d6a98c3aebad70c63132
SHA256a5b4716802ecf2df2e0d13eef0050fc7a86ccf474a9f9a7c0d964a99be7c823c
SHA512d670d8236b18e5c3ccf2cd970683bbc9ac791eed30805d7633868f79726aea8a5280e9436cc58e4bf76cb237862ea1e0018ec56cba75c1c551081bb3deb1c306
-
Filesize
5.2MB
MD5854259f1ffe100f2b5a840c682de066b
SHA1d1bccf70e676408062719ceb7f4ed0e6b1fdec89
SHA25619e8caf419bfe0aa642ed292d8f5312ec476b2ebcd9bc909739d86699b470deb
SHA512011e3f7036655bacae9fed0e139378e3b9f6a3590c3c334bb83f5581e49d1063736c6ddf685e7b145b1545a4cf9d22cc6f9c33597262be1d26ad96b0da739fc6
-
Filesize
5.2MB
MD58f0c073dc51c917994088a5ce8884b66
SHA12e3e96d3347a0d61cc11925963fbfdc69081853d
SHA2560f3741bb72d14816ceeeadb084a15a8c1bb04db820666191382bf624c3f6b364
SHA51279281f655d942dc9a27f919c48ad3b8b5e0b70e7118bfb2fe424d59894df7e61f8e166b63f9f5cd8288bb32491d4d93fd0d85c43d35e535925c9738a9f29ccd5
-
Filesize
5.2MB
MD5d255fedb98aa8e0faaff2642a6b3e8ca
SHA16353021b30d18e16ff1d3c3879ae71c322331d30
SHA256a9220154944d9973b42971a56a53e78b7a661c07c5be9df967aec1e67e81c8d2
SHA512e99a1fd76d7f3b26898cc1a0c8e5b520ebac9224cdccd699cc922add0c6b6d8370e525e570b0f8ff7d3604bc37fe3397358938e225b5687fd331de8770e8108e
-
Filesize
5.2MB
MD53aba8f9370bdb70a4740a6d143648209
SHA1bdca9e81897781af00b30a8848a4f84e6ac6970a
SHA25663c0ac523569e781801a95aad7f72ce1315d7c985a9f314ac2133374425f8b12
SHA512bde264c7c78802f0a592be3abb5962ebebbc2d1a0171a3043555cc2b20e46abde3e47035ef04229fc835ff2c8a2a7fe44038256126792f5972944cd0403e69ff
-
Filesize
5.2MB
MD53519b90a2067331d7b6a08954ced7d50
SHA19cb7540ca142e7bad1bf01f8e40e4e02c233a7c0
SHA25612cd6962b98dfc6c734dd5e6d34decbefaf60e9c0010e0f19f13178330c2b8a5
SHA51276f5f433957aa50823e411a335d270452f3b8b4dfd542b133ce3bb0caf83dc1cb309f17b43124c0697f523f4f22c82c509a6dbf694cca9f635846bf0c59fe3ab
-
Filesize
5.2MB
MD55ef6b7cf73358157c22e62ec5fa96006
SHA140130b452a51eee101c09d63117eb48cdac6c3d7
SHA256acec3350a191035a8cd91a9233e2196f0d12b3f97f71939223a6c22d17a1ae79
SHA5125b755dc84dfa5d7772c2cc628c55d412dd665a347d9a3094f670e99aa0ed1e46401eaeeb6cacb7046f372a47e6209962bad22fdfa91d4b208c2daebf44527c35
-
Filesize
5.2MB
MD556a32bd3d177fcc41b48906c4d2066dc
SHA18da0b5126d1a434778f3bcfe394f27473882fd97
SHA256baba15255a1b14b17d91369b4ba46a39387c7b3a4aa1554625181231d7039023
SHA5124ae46cef66cdd679a40c0a8eccc2a78efc6c4cd0abc6d6726fd976485d2ac41733d90804b95d7f4391f5021cecd050a37ca54e33e564483628be6b9644af4152
-
Filesize
5.2MB
MD59341fd0830decdd1182d6094384dc82f
SHA140cfe0fd8df3208a2034b7cdc7203b3934c3bda2
SHA25665c6a2b9b6daf43c6b068eb87ecac83882e722dcac8633fadcf0b760b351ef63
SHA51285a3792a54191e021b8970c63565a14548212a59aa41b04a0aedc07e0b0b5e89f5ea6b7ab39290a992aff9bb051a6089aa917c60a1d1b6cc334553326834de07
-
Filesize
5.2MB
MD5df2541acdf32a97e225dd015b0320131
SHA15d9eb47587803dae9893d58ef2456ff054fb5e4d
SHA2566cbfa2f2e8ccd96009122a6e94c67562c70268972891d86584c7ec3a10799927
SHA5128b523c8586a0663b490d3e8efcb79c75edae04432743324102d8e034ff7eb86294d81e39733d80cb6fef5648be2a6e2c1c1f225798f622c3bde6413ac1ce6024
-
Filesize
5.2MB
MD597c0d79262c1a00be7bb52dd156aa0df
SHA1dbd778d4bc8aa8ee7d1d15930aa05d9a3b224510
SHA25639e06a69f273a0551d69e83b2c3ab54620b95cf565936ec45f0641857ca220d4
SHA512e27a7a02090ab7bfc62b9196a8e774390078c1839d7c40b9d691f4636b54adc7472cf238b70afead9139bb2610ab036090e9ed1ecc485c592f8ce6822b18cb81
-
Filesize
5.2MB
MD5ef01baadb35ee9bdbb8648d3b7eaec0d
SHA1befbb37d60960631b02e0fd38317acdd92d98c30
SHA256c384b047d1430d293b8ca7c3935dea1726f4ea31c9c10d4bb355fca958f788b6
SHA512701692ce19521dc878549c733cfc362d7b20dbd90151818a9118f4e97c0a644e570fd29c3873d66161825782cf76dcb6cfa0a34211b8fc93710157080f89d67d
-
Filesize
5.2MB
MD55d75e4827008a063d7ff7a7349149764
SHA1bd351ea309a324602bdc1bffe2222a5c857c993d
SHA2568688c5475691b5da35df54f346962815e77757a50299ac3151a0d61de2c4dd01
SHA5123758bf60e25986db9d7bdcd3b247e2438121d8d5ba1ab15f9d9b18d9f58f4a803656765be61679cd8e3b5693d0b6088e86d02b3fc747503c65bd72f496f46b39
-
Filesize
5.2MB
MD5b73270068897e467588ddf02fc88d867
SHA1301d86bd300a7919108817b7401b3f73eaf1bc64
SHA256a03ce9b258d0257a5fd5e934e1c5e8982f6a514afa6df0c5099f55c6fb45d4e3
SHA512d03b11d40c943892dc5f4681dea4185a00403f7f4fafc22cded22a947f0b17b8fca500e5f927ca83d9e3b5c6ef119a4b4c403b7a5e32027233e537d4ee733208
-
Filesize
5.2MB
MD56f9074c5eef3d73080e8a8ca24e587dd
SHA1847268b750d69ee84bd22b2180d02b598a7ac245
SHA2567d816778261f05a1f9027e97e8328fa7c4e7ec552246c9890a6e7690c1dda5ba
SHA51228487fa246573e02813dc1d85e4ea40d914d7d09edcb43640f1505515fa50ac215ce327c03168e00e925a79dc23dba1ed164cab080b087d0bd05502de701938d
-
Filesize
5.2MB
MD5d2f638c134a0fd96ad5aa57dfd180ea1
SHA1de6127249ac47fcefa332ed5f42e10e6ebdc9afc
SHA2563da917b5378fc3e675ff7b8057b190601c76683de3677d667d9d10637e7f750f
SHA512c814bff2c0f9ac2906454a5edea50ef56a194da70b0161359ab64df976ed9f65f01137e9fc72ab6b49a791efc35903ebc348dd3e61aae883d19bc5c9bc900eab
-
Filesize
5.2MB
MD5102ac0cd1c320a84c0254b5823f76dc3
SHA1f56ec44e0486e959110b9f767b24e807c8851ff2
SHA25699b4e50c6d6fcdf5a66403c49288baf21fed31f71d3bc856159b38e89ae95cdf
SHA5128b8b1deecbda7eb13c332fdd9ab2d3e706c758d860bb6b4c142cc99818847a9968938bbd304af54c1871562bafa055ccc56083b16bd78f0bb5e384e8149b37a6
-
Filesize
5.2MB
MD511777f2b6d87ce9f60855da8c65de232
SHA189cd3b4321f4396583bd35c8fdef41f896223674
SHA2567eed51bbe8db35262680ee160365ab8b7ee9ac729b9ff56fec1acbcb5a1b0038
SHA51258be55846d1610284bbc44e51d06731708fa11f52fa10797725da09bb669e44f5555f4222752d5f6d4138ffa044788bc814b368c9e52bc3df125f03555c2fb6a
-
Filesize
5.2MB
MD59a130398eecd97b2b054c9a62de19f69
SHA1ba93151a916b11ad5e2b5a88f439e7d5b8271d58
SHA25693ea781e04915851d7a5a795688d8e989d50e9b8f30545cc3e2411df15fb72ef
SHA5123354ee06cb8e8d05155986eb5b881ce1db68217d02fdee14e0dfd34c9886a64ece982a294da6c70af5aff78cfe85f1992e813a010f1b5313e335c13adedce906
-
Filesize
5.2MB
MD53307e589d465ee2b7694d7397979729c
SHA19878db89548e1c9b53cb5ddb504f7dbc4e83386a
SHA2569dffeef7853934be4fe5c032d5864751ab9e9fb0f8d3203ee9d17da9df9d7eff
SHA512db41330de8b63cf72101b5f0b6eace818ecb8b57905830bbb3de8374e79c139f5267d24b2bff799bdec04d606ca23b3077620b1f9edc1df33f441dd4d4ca9d75
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB