Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
21-12-2024 01:43
General
-
Target
2024-12-21_4b5c15f29bdf21a3bf2fe333815de6e8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
4b5c15f29bdf21a3bf2fe333815de6e8
-
SHA1
dad2eb49e7bd5f6a4d558fec649358689c13fc1b
-
SHA256
685215f1c93b956c739e89da089fe42caf87666438dc1331d3072d1bc430d65c
-
SHA512
91d62116ac8fe31baad1ad0c00e0a9cddbb8058392e31519c5734562633da50040356ac5662b98ce1bd62e4aac087617b333c32b03058f65c664aefacb8b08b5
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUK:E+b56utgpPF8u/7K
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 60 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_4b5c15f29bdf21a3bf2fe333815de6e8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_4b5c15f29bdf21a3bf2fe333815de6e8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rdhbVat.exeC:\Windows\System\rdhbVat.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wLDdzmL.exeC:\Windows\System\wLDdzmL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RkWdcUr.exeC:\Windows\System\RkWdcUr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fhrCCCl.exeC:\Windows\System\fhrCCCl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qLUCKBp.exeC:\Windows\System\qLUCKBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mJVQnFB.exeC:\Windows\System\mJVQnFB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NkYbMob.exeC:\Windows\System\NkYbMob.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OLMpPSr.exeC:\Windows\System\OLMpPSr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tCXUlqW.exeC:\Windows\System\tCXUlqW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aTWfXSF.exeC:\Windows\System\aTWfXSF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rNnrCUd.exeC:\Windows\System\rNnrCUd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yxscssH.exeC:\Windows\System\yxscssH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RIYCxgA.exeC:\Windows\System\RIYCxgA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MAVcGCz.exeC:\Windows\System\MAVcGCz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pPRBHXj.exeC:\Windows\System\pPRBHXj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vBcdZCw.exeC:\Windows\System\vBcdZCw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wEvRIsr.exeC:\Windows\System\wEvRIsr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AuVCeFD.exeC:\Windows\System\AuVCeFD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hvHirmZ.exeC:\Windows\System\hvHirmZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LCUsJCC.exeC:\Windows\System\LCUsJCC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TjcdtkI.exeC:\Windows\System\TjcdtkI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c59896605eb7f069e829144017189be8
SHA162d451d5619468dbac3b38ee4c141f001f162ca6
SHA2569b8fc0d1926dc63100d4cf72978168f46cbac7a2f4366836616fb8fcdf8dd7f9
SHA5124c27f6df1473f9047200f95fc120398203caf0b989a9b11d844ab06fd7beffdd5d8e44ace3051ab1fa5d4a5f5e65f6b40aeba4f10f526cd4bfd20e170509607d
-
Filesize
5.9MB
MD5adae130c261d40d2b53648089cb25b21
SHA16aa3c91afd893b2aa8f2cd8a70cdbe5613cde8c0
SHA25646e3041c02e763729f552d4ee60296b1a35d15956d2d44370d7084bc54b39816
SHA512516da5b7777e73d4d8738b1c37369411dc9753ae551403c5c19315ae0ea2c21f38558a5cb59c742733ca2faa3c9117725e39b5649719506255a2a6cf5f766e9b
-
Filesize
5.9MB
MD5ba22ac6e6aa77c7f86349c4c874114b9
SHA1f27c3fadf11064016882913f43e64730c0807201
SHA256e1d5499bddde298df6687624db799827618fbd644d1fc7986ba20affcff3e88c
SHA51201dec90378e75add565e2a17800ab3afd3359feedd48cf0948a8dbc4ab322f3e9879cee4efd69b94d5e0aeeee31d5222a4d739ed7832cadcf49c3155f1acb555
-
Filesize
5.9MB
MD5869e0bcb05b0df5948c1a2c0ca7befa3
SHA18ceb3ec99878681ab442512f26a7729bf4306829
SHA256870bc8e1f37ae42bb0888846f9899a3bca58fb65cfd919ffd3f6ba21f341d11d
SHA512fee7c4daadf465763d282338ac6f12d3ae1f7dff57565d106cf8e510f45b2ce187ae34da804a6a082149c76dfdca5e6f23ae798f20a73a47b300c57c567716e6
-
Filesize
5.9MB
MD53fe9a99c125afc4b5c553bbc8583827a
SHA1047889f4d82260ea384d3a92d843a3fd90ced85d
SHA256faa36b6f8dbaafc864a6417b6808abf1f222d9b4e9a6e3e8f5635598887be7eb
SHA512e08c3b1a5edf2726fdd80f14d28217351fc66fdb7ef8097fbe7e47a5d7433d9b3abde4ba7ee7657ef516e208a806d501b8e5a09c98a0872eed833fdf6895b07f
-
Filesize
5.9MB
MD5cb6c45b03d51b936f6a01d38bddb3883
SHA18806a0253d49b4c0728aeb9edec35ce8db46caa2
SHA2561acd6e6b88b80176c027706e56efa87cb5e15c249667c7e9e4cd93caa410c5db
SHA5122f65d5c44d03319aa4ec792f3a4386def3482b4e61b9a5c072eafb60c4dab0ca317c6113178881325cef4406e51bf624f0e8be55644dad294e318789af7c7f2a
-
Filesize
5.9MB
MD5e3df8594f5a7ab2e2397142cae724954
SHA1334edde0804affed46d0a6732b4288caa4acc4a8
SHA2563db1ff2dddcf267e8d679737d12d91880aeaad71257fe7197194af0a1c1a2393
SHA512b42d4935ac8a2e16a66d21efc1fe6a2ff383fdd6937a46fc4a4d95925fa43063b8156e53f0e12bd9d359062d4643f754228b0acade6a1c77b417b7a401de47a5
-
Filesize
5.9MB
MD5939e0acd15e3cc318c1d029b754f921e
SHA199e4b08df6d26e979ef0fbd8b72a8fa8ca428851
SHA2567e67426b884db0e6e7c0e095124a27d9d13067a6de56d4e2e239e9ca0d16f80c
SHA512e9cdfc250bfb94c5e7c431fa260ccee78bb384b8bf8ad22c180ba4715c1d898644ccbcc4ae3656de719b6cc47587501cbd23f66f3e4fde687b7e57b7856095a2
-
Filesize
5.9MB
MD5fe7103f560d0d080d628b0b678552ede
SHA172989a95d832a5e35c7d5814bce45f3af8872025
SHA2567555e05e884f95e0ca759acbe1509beb0c74ace8dc3ffacbc48a0e70735364be
SHA51269eb974dfc036c6287c6ffd1e3094f0d16dc13127a0e004401a52059837bfcb8840fd6d2646e6959c9b9c950112f978fbf10d5449e9d83cfaefd09c7c59efce1
-
Filesize
5.9MB
MD52258e9b03ee13bfaa2bd86248272cbb6
SHA159cb7fb95c13dc2ede0ab1a128132b4437353095
SHA2565bc717a6d983c1dee496e99dea3cb9240013650df97da9caa71d656775d42b06
SHA512dc39f1dd600cd07a5f2ee64e7260db99dc7e85b5e2f182fcbe15a047786a41a5661e5efe7dd37613418f3225314064ca4290e6f5d29c359172f7b81bc17fb4df
-
Filesize
5.9MB
MD509e36f384545807a7fbefbb43d64067e
SHA172a40037cc237a9082d1e56f6e42dfb0c0959577
SHA256d9a539a702a956bc7d0908810d63a385fbafa9a56d5c89fd3a3ac6514c31338e
SHA5120b9cdc545e9646ffa12edd00e557404171b268b85f25dec22785e9fe01fe5bc2b969d2fd85d4db9717cfde9645ed423654e49fb0463abeed4105ee2e60649872
-
Filesize
5.9MB
MD54fb988ee4a77e77515fafd4d43e53480
SHA119472a807ab1696da10d1fcd99d76eb2e6227199
SHA256f223d0654c497fe903610e3ea1523d541ec74056af30cf1629e9f997fc53dc3b
SHA512185299c2d560183bdff450a44bd373c15669835049192d158304c31e2936c932adea4f69022bc0aa5d08dcfe79601d9fd9a94d088fb9378c605fabbc3dc69625
-
Filesize
5.9MB
MD5ad6c463b92b5ed46610b73cd6212f1ea
SHA1bdfbac4064d1b61a88f7011a3418331b3cd543b8
SHA256c17164419b0d7c20c5bb5c11aae3d17bca5980003e1954995e8654c99f04bc49
SHA512fec6868173c104b2fd0ecf1b7587396395a51ee2085ba8d923a7df46e42fccd7f633c73f74a148f7f565795a96430d6cf332fff8d495efe2cab489da58c50385
-
Filesize
5.9MB
MD59a040c53166d08b1708276e66c29cb81
SHA110fecdbc7e7142f2579c788124569bf5024eb484
SHA256ddb115810ede51faad979c773c5296e7496a56ffd3767c8ba2b2b869847c54fa
SHA512820d447adf46c030833904fdb9ada109be367b183c83c89ddc42685be59c3420db807421d7b2d1f4b75c860fec748a48e61ac36672debfb63dc41c654d9a3930
-
Filesize
5.9MB
MD58a843339cb9b4f02dde156aec49e12ed
SHA16a8daed1e4f1fa8d29c67639023f9b28010c3247
SHA2566e2d9506aebadb7a87214a382605bc5a040ce576d45c3984f5d8d92667573e76
SHA512d583597ba8573bf2ceacf53f582283f19b99cef8d0fe7980f0ca978bd7c2747c7a44555c181ffa6c470c298feb3d1a4881dfc939b3bf5d96af109983daa8e946
-
Filesize
5.9MB
MD562977681c1ae5602b9d3ffd0824e4bfa
SHA18caa68669cd01ea26f10febb10baecf09a4bbc5d
SHA256f6fc539c9e34c50cfca9462fc0ecbc32892d340056c8fcda8828f1ee851c719e
SHA512b909ec87241ae2d8d69885b07dcdf3c42520777da6c299de7cb26ae44b86dfed17b21dca8652a03d5effb21fd5392a8205e5f717b88504d51541940213170f15
-
Filesize
5.9MB
MD51a82c1d89aa842564cb75bda35e60555
SHA134299b57b959565b27741a7bdf3fc38502c16679
SHA256f549509bb376ea36077557dfadc99da8c8b5697ba7ee70493f9434febdc8928f
SHA5126fd4341e373ab0e426a7ff5737c2226171adbb26bf31c06965e5f14a4814107bd8869b756fa664d76badbcbd19f489938d91698ae8c27bb308231c41390dea19
-
Filesize
5.9MB
MD5218aadde58ce75062e87a2c9393f647c
SHA1d6b47e71b24e9ab9e70ee8ee08dbf549f2916afc
SHA2565c48fee7f104a9591cfc46dcd8559b738aff5048a03ea2a3c24ae449b71e3250
SHA512ddd04e7f28e4eedf7a65373777dbb120285513f4abdb9a7771b6405632ffd4b3c3d50e667373b4fd500591410f1b1ae039be57202eb58a2fc0e9cb312acb4461
-
Filesize
5.9MB
MD547a062ca58f7227a521d33998e8b2dcb
SHA172dd60ce7cda0ef2c67df677e238ae013ec36b01
SHA256812ce4f177a4c3d7512966fe96c8457ad8049fa80f005a123375a3f7eb68eb95
SHA5124900021b69b56e27ea6177301f52b617454e1d062bcfc3fd519818ac43a67e6555ab537ec4affab384b3084e2582c585eafee6cc88659f1d144c6c6e97930923
-
Filesize
5.9MB
MD51233eade3e9778ed4b365355957d3969
SHA1441a95b5b3ae2f0a3532260a0256b083eb9de9bd
SHA2565228d6e428eb8174f046183935c1c71483ed917cf564046cac4b0d927e0ea68d
SHA512894dd23a044c01b6d88474da467134235103bf4324ace82722cdfd32e3db99373c108d64642ccd40af20338ab1180b680d5ce5f729caab0647eb7e7b58cc41e2
-
Filesize
5.9MB
MD5c5c2bdadccfdf2d957a8543ae2d1ea04
SHA1fb0e5c40da2a0d4d527e3b26111602dde6660726
SHA256d55265c42f4c6134fe98772bb3bdf00b017aceeb6ec5915b2f340577877d11cd
SHA512113ce9af0b033bfed7e303ba9d747dbac6e4fe72f7f7fdfef80821393a8196c40c882a14e56808b2b599baa1a9824874db378265c15ad7bcaa9b55d8cd8bddc6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB