Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21-12-2024 01:44
General
-
Target
2024-12-21_673556dc3a69b617d31c3ec1cc2f63e8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
673556dc3a69b617d31c3ec1cc2f63e8
-
SHA1
f209c9c01e9fe5a73c74f53d8dc6b4464f673176
-
SHA256
9c7f416e87bc226bb2a1289bb821da5d4ff5e70b39ab8803acd8f89c03553ead
-
SHA512
b996b6ae9e1f3cae516b4ae05069c7d784c56723c28c59e959b72702e343a63446f740d40b9fbc2f02d0a0c35d84aa52f2ae0ae9d502526a3f2dbec3c9e85890
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUQ:E+b56utgpPF8u/7Q
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 57 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_673556dc3a69b617d31c3ec1cc2f63e8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_673556dc3a69b617d31c3ec1cc2f63e8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RGhunbE.exeC:\Windows\System\RGhunbE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AzFgzwQ.exeC:\Windows\System\AzFgzwQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LejBSsn.exeC:\Windows\System\LejBSsn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CiSzVPO.exeC:\Windows\System\CiSzVPO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tUVcmqe.exeC:\Windows\System\tUVcmqe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dLTsHAy.exeC:\Windows\System\dLTsHAy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aDkQNhd.exeC:\Windows\System\aDkQNhd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JvCksTF.exeC:\Windows\System\JvCksTF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CeiQLhV.exeC:\Windows\System\CeiQLhV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jnhZJPO.exeC:\Windows\System\jnhZJPO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\myjmyUL.exeC:\Windows\System\myjmyUL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RNmuzfB.exeC:\Windows\System\RNmuzfB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jlroQhm.exeC:\Windows\System\jlroQhm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\isVlMqQ.exeC:\Windows\System\isVlMqQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aPcznFc.exeC:\Windows\System\aPcznFc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\caGETeq.exeC:\Windows\System\caGETeq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YRxuRPu.exeC:\Windows\System\YRxuRPu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZbktyZw.exeC:\Windows\System\ZbktyZw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ltfTzqZ.exeC:\Windows\System\ltfTzqZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mCIYZcj.exeC:\Windows\System\mCIYZcj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RBsgSzA.exeC:\Windows\System\RBsgSzA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5f6dd467e21980ccacd67a78c4a0a1d6b
SHA1325a9d4ae601ddb17291cb4c9f1e26bcc9a032bf
SHA2563fe1a531d07df88e8e79a7ec0377c70d807f523c3a3b6314e1f597dc5bd05dc2
SHA5129c9c7e559e7a766ea74159b69eff8912b0be391f7d2f103f71df1d929ef9a26ba08f2f677189bddfd8831c2a22e04dee449f4bed3b236d894a6d54d9c0df7d7e
-
Filesize
5.9MB
MD5550c83de95ead6ac7015be73ee48efd7
SHA1fef757fcd9c00c29bd3e80d96d24d909f1d5880f
SHA256fe0e16d6cc33e3ace4fac69aaad290e8ce4ce1fb8b6a76d7c4dde8ca9f9ca192
SHA512329e9081a20729d21042e01f3d0f64eaa659c7fc386e4c1178ed0497cac2fd65290ad14f765dc2e3110867828fb5f3c6199c6ea648030620d84d20a38a705e39
-
Filesize
5.9MB
MD56e153c262aeb031e5b6fddceda62f28e
SHA1b6edcd97bcc8a81c965bb33ed71ad022cbbc8e6f
SHA256013feba3bb90d05a1b57b90bde470cf7bbdee1ba0f7f0a13cdb652a085b1efcb
SHA5125a88fd8e7a0955b72cfd9d7259493dd930b32ba6ec4197e0eef455900b55613adbad500e1f2dab97d48161c101bfcab23455210e6574a5846394c61dd441cfa8
-
Filesize
5.9MB
MD56d15237a7907ea6028377191dffcd8e8
SHA17557f878f5051022a937f600667bc9b3be0ffc18
SHA256ccd22be311e0555f952f9c36aa4d3e4eddb25d2e0d6d7f8cf6a89984bc1398bd
SHA512583d8e283f3963f359517d8e3ff29d2b46e3d3b318f927c9d3cfd67c93f8801293fa3af7e580e4016e015a5dc7dfeb0f30ac0e6d4352e398a9298d3fdea9ec47
-
Filesize
5.9MB
MD5648147402d01a2d43994945f3f7928ad
SHA1e8b169b50a7405ea146274a8a7cebc2a7c005e97
SHA25617497fea7d762542b2ad5db36c2cb364493f7b92128952d59c98393b96f36bcb
SHA512da3775ac1d89e70ccfad9699666479e7b7e44dcd4674c72b90f6f50f5258b1dfcf18f0c9f674d377caa5cba63e1ef41b17fbed8bfb26fb9b4a3ec899b636cda6
-
Filesize
5.9MB
MD5bcd70bb13f8007d3a72fadb65eea32e9
SHA16376f3d3f3579b1590ee360319a332e14b847180
SHA25686766659c2b31e7817c68310f745f95b533eebecad1fe058510b53323b634814
SHA512f387551331708dc311f9abc6cac58ee0c5d770583e665176d4bea54e7f61c13f6e603b0e2b4df919f3eead351e68735b828c4f9c0ba330d971bb1015e75dda68
-
Filesize
5.9MB
MD5426802c52d1b0fc7c67d02d783b6f4b0
SHA159a7610a9f1c6d4770bd88812994fbbff72d4356
SHA25688b3631ce9074f246aedebca635b9b702c5dc1289cbe9bd454d20bf291ba0b58
SHA512fcbaa50ac33070c5ffa0c1f3ff765a375f6cec648195115e1fe5a36e940b02be8efed617888b0c453e29820a8617e9c6fe156997773e4597ae924e02781208ed
-
Filesize
5.9MB
MD5a63f802daf35a30553e30ae3a3ddb597
SHA15f06527a5737b741f0e2418836e50da4aed12463
SHA256858a06ad8e2adf065668b7a215a896fd11a22b2331e386501611f36b781d4fdb
SHA512f3078834fef94dbdedd7b9b0dd65b017b4ed6eec14751f0713596d6e4c8e9adbe2126ef81973142fafdd29eef4953fda5247580b9ce8cc7e26c6175fca5a283f
-
Filesize
5.9MB
MD56734075292cdd2ed324915e36bc5613d
SHA17353a359c258bc30407a2efecbdf35088d9f7748
SHA2564b5a17120de3e678605ba88f30f5e4a4250f5e6f53f18ac85c777e87a19b4a0f
SHA51234a146c2dd1a9f5b5536a1502a1f4519b99ac579f1673589955d54f46795141493a1e82ec3ce6af08efeb499fb0ae55ea86c66a7a026b6e30c6478d62c7e0bce
-
Filesize
5.9MB
MD5c8ed27e5f9fa89cab4bed15441718077
SHA1728c695da42e722fb126644a6742cc409d88c727
SHA256815aa726bc339e296123c1c433cf2f6cf156e565e92e168678dd5198059c8be2
SHA512c99d96e34015c6d21e93797424c4f91c8d6dc3de8f4118fac5841990ce643858f58cca9d96fee9ccc3e36a0583e5ddd35b336e47bfbe91673a7e6fdc52da519a
-
Filesize
5.9MB
MD5d49890d3f274ca8767b55b489bc7811f
SHA1048768a7c2098dbb5cd07a60b153815ef0d6f609
SHA256a4a1d5df954c57d21f4da3476fc6ecf4e9d74be8776addabc9222a35f63bb2ba
SHA5127ee77ce3c3ed0575103d9cb5b2389cb94d77d95e2a4dc2750f935c128a4f2d350140c5677d2c89af6c07b994dfab4767bafb443be57aa7cb1bbc87970cd92fec
-
Filesize
5.9MB
MD5dab83bd836a90afbd9acb8727d821354
SHA1150e747dff7bbc1fd9663cef034be7e696aa251b
SHA2566d3832b9c8b29353572310f6e54f4186a347ecad557e2d6e7e553ac5aa9ad8d9
SHA5128c9118c864f1570a26f0ffb44b908563b67c28b2c09da093098c0811d87d5cf51201d4a26c5160f89a74f51fec02adfb19ac869159e74509e7d5cbe55c34d3fa
-
Filesize
5.9MB
MD5999efbc311eb19a30d1d52d11cef5a80
SHA18aecf9e3823fc455a3fa3a3eca98dd7810316056
SHA256b4c07bb2c2951c1b1983d92f6bd24e2e7dd0ff1a87a20e3f9cf0309beba070d4
SHA512fbc321ec1e2b3fdcfe18d9c487008cddeacb3a5f0010499e1d76c21aea025da05b3f951bd03d59407dfef842fabfa9745d544ce4ee3a1333ec5e40ff171ed971
-
Filesize
5.9MB
MD5aa159cb4028505363b79fe3456224945
SHA1ecd31893ac9103ccfcf82222a242e2f898f9aadc
SHA256552857e47959de3aa3f49d855825d91f2e7edacaeabb6c8f380188baf12293c6
SHA51216741a66a90c9c67a0271df16d06fa1f1b24f15b33d4c583aeca921dc19fbc3cb6b53d751a1ae4072f597fd2f5e0900cd42e350128fb6a0564220a10635f83d1
-
Filesize
5.9MB
MD5228a16e9d5f3dfb6d39b05a4a4144e24
SHA19edf1751bd9c1006b3111adb57bd86aea45f5d3c
SHA25662fe9557ef07e9dfc1b95c0c41e7aeef819b5914225bc26861ead7a616388481
SHA512182a16a967ce0465a8cfaa15e28237197f45a79acc1a1d76e3ff1f7e66ef2c03702ff8dbd1a865096f2de6de2f9c91b658edfad83e9f323afae817cfc36b3942
-
Filesize
5.9MB
MD5d88de8cd77a50e6a165873e1638116a6
SHA1db9153904b975a50d6b93b176dddd0dca6981fdb
SHA256a986f65b455e18087e83391cd8d929c107a815e84a25fd728087cef7d092d6cf
SHA512845a4ca769a38254cbdd47328423e409ebbf24d5ab626c214b1c25cbfc5ab4c5c0e116736122facdb3a8930f4790c4bf6cbbad8913af4e148af21653cb597940
-
Filesize
5.9MB
MD5cde9543da8846b35bfdacfe5df990780
SHA1f3e7921fefc7533398756c3fdcc928ca6ebb0219
SHA256376f3e45a6d3de246b3ae7caa4595fc9903aeb7c77ef821eded0c269b6514299
SHA5128e76eb080cbdbd51fad3bbd714da3b3103642eb20883ae16c08c869af57a036926e9567628331f3cac52d0420e03a69e131b50da3060116d3323fa430f9fb214
-
Filesize
5.9MB
MD5ab3aab9633475f1e23239ebbd604ece2
SHA15086ea564a12e40a9657e6003321e30311b9b694
SHA256cc7071f672e254a2260a3894550f2ff31f41d57ff6cff5ea7729024a7d3c8904
SHA512755841cc9e88f38ec641074eed8a9b43acb5604a935142583bc9b928a4465bb615dc94bcda516f3986a77344dab21968598b17fa1834426d44027d43e878ffbf
-
Filesize
5.9MB
MD56620a69ae9efaaf4c055ff3bcf1a784b
SHA127856d33fdf039c4cc384e3533f3ba662a44b3b7
SHA25653847be4d1c8ef1f1e8e371f01af0b36b61110bb406fadc48d7817b39e219482
SHA5128fc6c898c9c3d614f0f1cdb3e39eac78d7d7b692be21ba66afdc03048c1c380b6c4c7726dd0465785ab26871e5be7476d140a249dfd208ad290d65bd319dc3fa
-
Filesize
5.9MB
MD52b6851be7ec6165ed6cbee6d14069896
SHA1b44925617c6e089dfe4768bf74044838635d5383
SHA256ca86666da6c67e6cd55615c4a4495e747fbbe0acdaf436afb6428e833f0b26f3
SHA5126b083362eb7b52f7dcf89aa2f3eba03913cfc35232fe9e057cfe2c74219897a3dee556195d9642b2d5ae8727caa0c840644e4c58a5cc7c8e43ce03e07be004d6
-
Filesize
5.9MB
MD5fe53e95d6fdf566a78ec0965fbf75ed7
SHA1ce563d8bedb6f6f15465bbffc7553b8d5823538c
SHA2568e5264976fa11721836b56197ed809f96ff22c0851fef6aca83d03237d403ecd
SHA512490e51f3d000c781f40de94f957170ae107c808be0ad6c0b78fa7c5482a8a4407a9d3d1c66a72b360c7515283877c35d35d4dc926ae7c8d9a8a36e024f63aace
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB