Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21-12-2024 01:44
General
-
Target
2024-12-21_7855ec9260a9ad1053a7393a9cc56963_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
7855ec9260a9ad1053a7393a9cc56963
-
SHA1
1e10364cb18eddc18d562f108c4b245796729a76
-
SHA256
15f45bb96e7017ce6761147ad111fd42217580f6e99899d10f5f0a566f83309e
-
SHA512
41ba3c248403b0a25f6c5b785782f4c1a1f3db5979f14854bb4ae7c361ba34a5a47c4441ff8a5d6294e0bf5bc9aedfd9cc47afc3e2913989cb2a0b6501af0981
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUf:E+b56utgpPF8u/7f
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_7855ec9260a9ad1053a7393a9cc56963_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_7855ec9260a9ad1053a7393a9cc56963_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ChxMBpk.exeC:\Windows\System\ChxMBpk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OvnAOzv.exeC:\Windows\System\OvnAOzv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yriGzwA.exeC:\Windows\System\yriGzwA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrVkxPH.exeC:\Windows\System\OrVkxPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNEfbUK.exeC:\Windows\System\sNEfbUK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cOMbiAg.exeC:\Windows\System\cOMbiAg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JNoBrnq.exeC:\Windows\System\JNoBrnq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RIQjVqw.exeC:\Windows\System\RIQjVqw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RDdGmja.exeC:\Windows\System\RDdGmja.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sqbAXgG.exeC:\Windows\System\sqbAXgG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EjgDPxX.exeC:\Windows\System\EjgDPxX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bDakzIK.exeC:\Windows\System\bDakzIK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TfXKqGy.exeC:\Windows\System\TfXKqGy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lBmisLp.exeC:\Windows\System\lBmisLp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tsmiNeR.exeC:\Windows\System\tsmiNeR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kiuriss.exeC:\Windows\System\kiuriss.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qoYpoFu.exeC:\Windows\System\qoYpoFu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xGfAqYF.exeC:\Windows\System\xGfAqYF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vgnpnHg.exeC:\Windows\System\vgnpnHg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yYlpfzX.exeC:\Windows\System\yYlpfzX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qrPByoy.exeC:\Windows\System\qrPByoy.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e04a9f34ebea55b13d2f8d13ecd6e626
SHA176654bb2b8cc16ac3ae7e9343c46b3dd39072bb5
SHA256ffbaa3a5f898fa87605f13c3bdfe8a51f36305644286d70fa1a4387b2e7a5614
SHA5122a40db2e43f3a30217b7823b30a502f7149247232c71ae013311e4ee6794e24aa9c46704e876ec888c7df1a2cd8400091a33fab22a0e5d1a99e536ca48564dde
-
Filesize
5.9MB
MD524c05e15cbec8a70bf4c8c02893295b9
SHA19a1c2d58c9d0a90f87a9e05f840e48ffa6bd47db
SHA2569775ec2c2044b1063b6a7ebd895c7860e7e7547dea72c1b7c6145bb31c1b846e
SHA5124f093a5b541c9ff27d2fcb12ce53221f812f1ec8b49e4183f3305a7659ac70ef30591b55a65a36866901b47feebfa46b5bdea3876d132f37174533f1ce3cbbdf
-
Filesize
5.9MB
MD58521c93fb0ebc0858b1422308f8b33fd
SHA193137d20baff9e25ff40000719d41d403cfcef83
SHA2567d691ed1eeb81c86cca28e5aab4156f16e515e8c9a9a8a0fca3b0a614a238b88
SHA5121ae2009d395befc0c6589d39351dd04c465ca7fbbadc1faa2f1a53378e7fb3e3e8b484385ccc55712c9f4370493f7bc59990a42c4881a16a178e67f899ee1468
-
Filesize
5.9MB
MD536131b718f448a8e17daae67fff4e912
SHA1d60ccca023bd2affa434be28aa1f03dcefa713b4
SHA256048a8675c99cb31c4ca527df88f689ab4a97d71517131c96b1fe1a274f85d005
SHA5128e1db53613b79abe74a7852e31dcbc12cda7a15e69479da6f606e264a10924cf610fb6b7ece437abb374d0a195cc1674e90bdbca2f70fe1de3481bcc5e405036
-
Filesize
5.9MB
MD550bc8a3f1570448e436bc54f3918043e
SHA19d8131b05914f19f5edd02461ec91bbe396e8cba
SHA256e8ac9790f0f4183abf4837b6a00681348acc301bcc59cabd1eb4ddf87e05ae66
SHA512af9252bf3df944f4dfb34e87a306971ebd195d51ba50e23ee504776e9fa857cae4cd1b34d34605c5fe400cb21fc0959e6cf9e025289161ec7ef181d65c475911
-
Filesize
5.9MB
MD5f0f9a064654a0f293996005d2c613c6b
SHA197f886797cf612917e0e2713879cde258b55f65a
SHA25610124d11afb0ff4c331b12f7f3ac697f0e904d0f08f8c3a33f184c9ebc62a1cf
SHA5121441ac6132df30e2a6b87efe797cf1ad196aa2c44266c1064a0081b0b03ba85fc7faff502f4bbb311142e88209f7bcd41b9ee4441ac882b68126c0fc95a51483
-
Filesize
5.9MB
MD5a871b35e3e63ab44a89eae38d74a0a38
SHA1a5db2c263268f9473e76d7c1291c098a80ddbb9e
SHA256a28c0f80c62b0f4dccfc00c48ac9c5beb5eb36beb0c8ad0e42c18996d25b6eb0
SHA512706c59e396fe4f1687f25e87de49d96ea824bbe9a20bafbd00c743386cd2befe3d7302848ecc5898a97c555c941f03ac5fdd67601df37664821aeb2ff26fb503
-
Filesize
5.9MB
MD58fbda1f4cfa89d5c4ee6787534e3275c
SHA1d0abdaab3f46d483b67303fa96e026fcbacb06f9
SHA256432686185f0d53c0f17a624739eb4ed607c5008ed29b747b3a062ec9eff625a7
SHA5124ddfa1f593357b3423a5018573c88e39ac8319e3676dd2d0916ce89767513ab2d6c909f71014855c67a768f5a56d6031ddac6d900dd1dd39b2f6b60c486a37a2
-
Filesize
5.9MB
MD586350bbd167573542d656fea3c90d89b
SHA1c41875fbb06fb8f9f1e65443156e0e51b87cf20e
SHA2566e2ee5fa00675d33327dc1099d8045c651b289e0d87ee765878dcdd79d8cc6ff
SHA5121ec8bbaea9f784e9731cb37382eb092c64fbb45bcc395ab42991c10dcfaa19d882565791c8cf455e690749d03c60370cdab51b48481d1aea45d5189cd7843ed7
-
Filesize
5.9MB
MD5ca1c8039c1075d0c8ae416307e51ddf5
SHA18d1df2d27a555df4a836f145081e380088721cf5
SHA256ba308f986cef19faafed27cda0234036edee642f1deaa6878dca42a338e9f946
SHA512bf46d91e68340f3178e79ca5ed448961d86ce77bce7e0601ef31a2ffa4645c86868d77520b06ef102d3da089acba2b7ab79eef550cbf6383e1a924ada1894268
-
Filesize
5.9MB
MD5bd18abddfbb1dd8c5cf12e846ffd9ac0
SHA1d26a801f8280f361942b5101c2bab198394af648
SHA256f541c8c25cfbcc4054a84850e7fc8c2edc8c9e9862947ebb861046d9480efbd5
SHA51294098bdc3a22e2ff37a5eddb99b36d34c7b712745cc851fcfa8df4a3acdb48f3c5f35ce8b4a78084fa1dffdf35fe7d4d2a9dbe639662719eaa4c56a1fa0fe412
-
Filesize
5.9MB
MD50035ab2cef83da9594716bda4560407b
SHA16d597c448751dc79df665d29d307b5cf68759e09
SHA256aeafcb77ee6122fd25892297a63019314c615d317620ffe35f4799e84710aa07
SHA5128eaea8b83a31506623bed5e57f49063f8ef02d6f43ba7f87583ffc12f0d721958e269dc2e34ef5f42608131e69dbf9fd341ca160f08b26d806a572217e875456
-
Filesize
5.9MB
MD58c9fff96c85db9243fea1813e4e86346
SHA114a14091732c09f793dcb3ab020219ce0fc5d3e5
SHA256514772d6dc5552d3690a1b587892eff670be33ee6be4b9fd924b62b496eafaea
SHA51261380204f7b9322d4008583ff2c62281cc06899ce65088c91113a5c45b2f3095f2743f130574b325874ef1893df791c1af2c02e751170618a5b8fd2ab9c8a022
-
Filesize
5.9MB
MD5a3c87b303d0919fc52e0c50390255db8
SHA1d6244b7a70e5bd828a5cf1b51e1cdc571942e3e4
SHA256bd25097ef0ab71daa4be5d391e6fa0aafd185920cdfd0870f69161f46a74f1e5
SHA512b305fa48ddcb487422b23b29680a84bf1cbf00a951a4d097bd725a5387013591698717e404be02a247616692a72f9dd67cf7bcca875d53986ae291c4f4b74648
-
Filesize
5.9MB
MD5673b3c99f97b58a048169ead49f05c84
SHA10a2587e36072a55a3b5fd3f343a57937507a5bfd
SHA256760fa9746be5b3e7905f990d4ff34897f337620bf19dbeeb9e253fb25b2ac4a4
SHA512228f7c4a3da549edd9a5ad2505b1b3a85489d3a79ceb8c6550481bc65f497df6d825b4a35354e0cff9da77116c764d76fb331de4f726db6bf7dfbfb6888df5c3
-
Filesize
5.9MB
MD59d9ea4bb69811158ffc4f62032cd4ee0
SHA18d834931ce8f2fc7bc06f164715f69535e7a911b
SHA2567f66a3b313706b7ecab21622614d600de899f5f2a9d86b167817bbca15fbca33
SHA5127d2f8447e89cdc0002f56b2bd2b12660dbaaf139d36294adc0701c0262a745e0b6da99777b0a2d79d4d0ec61fc417722ea07616d982fb24a75df482e9420a2aa
-
Filesize
5.9MB
MD504697aa12984066cf5719cae6cb3f7fe
SHA18da10d0d76c739df32f0cb64783929a73233022b
SHA256aa566d95158d6c06f377d230e23866de025ad5eb1ac70fa6f484e55e195ed03c
SHA512c0a822aea6f0ea125bf267a80883f41b9ce34efd4dcd0ee5912dd6ae8d5ed7aa2ee8d367f7b7e7674e3ffbab76a4107944c94f33caefbcfac3394f0931857352
-
Filesize
5.9MB
MD521d7c750ad45883c3056bb32b9e858aa
SHA1b41db9ca3d4c8d6465ff9e2da78d53117b5e1925
SHA2562a11ef4d27c88a3c05abbac02360d040d717d66f0aec7d91a3d0d7c292dd4502
SHA512e1931252db4317e004b037e1474f4a9ab835e1303682736d4281878df659bcada98b18193a2ee334e7c3ab6deabef1b48ec099a4291f44fab2e4d6ec69245d65
-
Filesize
5.9MB
MD5ed088e66566f2f61fb29177dc5d355b6
SHA15f01da050ad7738595bd0e49bc7a02f702a0c265
SHA256dfe4ec89826347961fe3437171c96429424d984235147eb95515c1a10a4a8cf4
SHA51263df7e96e9e237489318d6fedb0bbf9f9fc5921a36b6f352f3f2f7ffecc321bc93fa3e2786bc545f5f7d2a02fa381f1120fd93564c5e3912c14925844e70000e
-
Filesize
5.9MB
MD5749674f773066ed2f096a239c49f219d
SHA182b7beed1dd233d6206fbe348e26bd8140afa514
SHA256fbf34fc9a7a3cedf72b91b5200a19897dad315f03f1d96ea03c7e91eee9129a0
SHA512553a50c6801d2977a404d442f5b5f96b550f733c03f9cbbce67d7ac3a192257ae7e9fbe8a614b1ecbcda0b9fbbd873b1ee59cdaa55b652f54e50eb3fee6c2334
-
Filesize
5.9MB
MD54fdae61f5ebeae485ea01eb610e657a8
SHA1266ee4bb32017857b14e3cfd3e58e317abed46a9
SHA25603599d76a2a152bfbcf4955a39e09b6b5e1f5430777f1347c075a013ce5e1757
SHA5129686f1288f95437b0acad8caca3a21ceb6b2c5a35669974c471cf0d4f1bde5b1fa02c6dfcaa6d85ab887ba6d358bbd40d3dab96bc634398738df85240cd9db6d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB