Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/12/2024, 01:46
General
-
Target
2024-12-21_b63a83a92c6ab46e654ccdf09f49ebd2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
b63a83a92c6ab46e654ccdf09f49ebd2
-
SHA1
90e34e786460f4123b057c32082248a4881af4f4
-
SHA256
534fb11dd59745078f7207750da9ed9f5f8e659bb8b56552bf03a15624c3737d
-
SHA512
4d103a04f821bd5e738b5dc6ee68846c6353d21e9a02725999dc27273330a6d69f7242580ddeac84d4ca2d742b0fe2141a256a9a35cec008c4ce761acec0b071
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUk:E+b56utgpPF8u/7k
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 58 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_b63a83a92c6ab46e654ccdf09f49ebd2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_b63a83a92c6ab46e654ccdf09f49ebd2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DwqCkXU.exeC:\Windows\System\DwqCkXU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DvscfdU.exeC:\Windows\System\DvscfdU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aLiqThk.exeC:\Windows\System\aLiqThk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JvHnROU.exeC:\Windows\System\JvHnROU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CdxQkjO.exeC:\Windows\System\CdxQkjO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nuaRSDE.exeC:\Windows\System\nuaRSDE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LWuupKf.exeC:\Windows\System\LWuupKf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GhAeptR.exeC:\Windows\System\GhAeptR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BUdrlkf.exeC:\Windows\System\BUdrlkf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kIBbOis.exeC:\Windows\System\kIBbOis.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\slUpYFq.exeC:\Windows\System\slUpYFq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUPFMHB.exeC:\Windows\System\pUPFMHB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CTNPEJT.exeC:\Windows\System\CTNPEJT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nHgKgMP.exeC:\Windows\System\nHgKgMP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QkYiYZo.exeC:\Windows\System\QkYiYZo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EAxwmkk.exeC:\Windows\System\EAxwmkk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\apaZZtE.exeC:\Windows\System\apaZZtE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tIdizYD.exeC:\Windows\System\tIdizYD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JSOXWhd.exeC:\Windows\System\JSOXWhd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dihVQPs.exeC:\Windows\System\dihVQPs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ilCvVFj.exeC:\Windows\System\ilCvVFj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD55d74cf4b7d62169f25698308473a919d
SHA1192f93107254db830ac4cb37aab2b64799bf8b5d
SHA256719166f0c7f5c59c8b1f2a00e0cc41d2ec0661d8ac9ab91285ece42b7b1ba969
SHA512d1e999d1b80a31a91362349269d5c603794c2aca32770fe290319c3317bbf1f8ed1f5518f31f4ae3d58e0573f409ee07c234076b16706862ff294633819ee886
-
Filesize
5.9MB
MD5534df031d849e159c234790d20c6d003
SHA1ae2e5fba4271a3fa5a4ca0b008d98e579f336984
SHA25692b8f96b6d56dc61e2a274b042ca2d405275287dd0ba5403776f7a10acb85583
SHA5120e3350b29ccac66feb3ab6e7d44f0e5fd7c164894af3a0b9e20530ce339ad2cff755513e5528539441223ae18ecb9e90ef7e3bf63d13488ce35f5386e4995238
-
Filesize
5.9MB
MD561aa76d29d0bfa9aef2317bccb646134
SHA115aaa91de222c5dff6ea05fc139d48b6fab5729a
SHA2566c38b77db4229add5dd75835783a69a8e7730a359f34ff24b2f2461e00dc6522
SHA512bb9998cfae071e39a802a90d910ab70968d3c878e6db3e1731d8bcdb5f8a43e403ddba99ac022c6c414b456e1f0b2472402f8bf277fc7baa6319234c6792a751
-
Filesize
5.9MB
MD58088214e1cce6b4009270695f7eec92d
SHA194725ffd7ae27916ac9e50d0ce2bb003c5d2623c
SHA2560b1528c927b447fbd76f861ffdb95f7447dafc7f180d1bc45757833d8ab54482
SHA512cb821d70863afcd5999d972cdfd1f44e3abe93e9b9fef01960b8cb0abc4d96fa39b0f7227a6b52bc9f4dd767cf1e93a4e81a60dc615d239ae85122647df5750b
-
Filesize
5.9MB
MD5b1ae87bf4d788e51124a23855e26cc22
SHA18dc257711b2dbd22cbe69fd87d43d64d1e7f30de
SHA2565d6ffe26cc3447dfbd1ff198bd683f331541c7df826f532566f68e14973f2880
SHA5127c183c36f1a28ef21d0cd5f12ef87cd0614464c9702d962c2f1fd9b93af794214bc3d335ac5f2acd014f2c05a3050fefddbd1f835353594bfdbd1f54d3433333
-
Filesize
5.9MB
MD5546cdd3bd6b6f519afb2bd44bae108ce
SHA10b1b9e10f7ad8e7d7523f7d6c148969474cc0793
SHA256e60e3317d44d5b808f3ef44ceedff2043184ae6c5c241380215703b8daf46a06
SHA512e5d88a5ae5ce23a92ba2dfe65b81b1622174989ddfc58fc37c52d23d8827314da195ee04cfe547d7e2d33a1319dc7afd19e348aa6fc8b861806c28f751b0f18c
-
Filesize
5.9MB
MD5f6bbe6de44fecde2aa83cb5864810d49
SHA198ecfdec875b9b0117d435d303700d0f0193afd5
SHA2561fb72f1f1747a43fad7c408b2ba469dcdb019a9f834ec614c9ed931285c29a09
SHA51299322e0e94069e7f30e193223dc617c5578c7160f7cf32c20d678d3bd5323c350944d2aba440c4bd579cd6de89f6b5a5b6d4606ad1fc00ee999bbc5a7e4ba770
-
Filesize
5.9MB
MD5751ddb613699e6c6058f354ddda39bfd
SHA19880c3a83660fe74637a9fae4fada44b289d0476
SHA2569580dc9d6ad2812118a472c8fcc1fa3462258b0830b82e7e64b49205db853d52
SHA5128bf034e9712764edbef5829be8c57e691d4920424c7cf4a37b20a1c234f502f2f4db3175459f287ebd578c3448edf663064151450c7f3a4bc9c70665c8637619
-
Filesize
5.9MB
MD532b953d2caeba6514febd10822f7bc47
SHA1f58fda5e0808d9197a50b2caa93c84f5f84376a5
SHA256eef0d7d42d2d32b2e2fa35d5700ae0f499bffa0b616dc76f83582dd634fb1386
SHA5120e966c69e7ad281f60d4a5c00e94a52fd03c912e20b4094f8588a7c8fb36c2cbe3b875c23955757b942ba28c27963bd30213a9c7fb30f552210d91c60e3205d1
-
Filesize
5.9MB
MD5461d1e496252caedf5d435a021f4a87a
SHA13e49383b6acef02242ab0d82758c599646949a0d
SHA256e61baa400c9c490a63ddfacb002b55a67a0ca0ac38a386da51d2e36e24377d68
SHA512ad95a22bad34589aa70a8759f5a6b74947a5185d2d6b1ea9a994fc981aad033c8f8f1cf2948e1a301263ced17d330e90e63cb46e2aad09d51d3111a8893f1452
-
Filesize
5.9MB
MD597bcc825bd6b62978e4cf3c10f56947c
SHA14269a4532826ab71c026afb26066757dd43dcfbd
SHA2568aa88fe5b6f0fc951494ba4bf4d93849d050cf6063bde193bdcf87ff9362de4b
SHA51225c860fb47f0680dda75e944def7577490df7511582d3c9e51ca18db55e9df6e61291a0dc6fef9368231f4b9605028967d29ba5a6cf16e97793a7546a523a6ac
-
Filesize
5.9MB
MD5d237d3b11fceb42ee43afdd0d4231484
SHA198897cfe9066bd80b0742a574fe0b05983a2329e
SHA256c084270ac08b48e7394f8b847759e74d5afae5e77e5f379b478f06d2b3630722
SHA5126bf6333ffed7b1198bc20a13a923dbe56f7a35022381b2136e6d3c7b0b30fb1f77c5e664528bdd6c3beb88dab126d636bd26b684d72679751e3946adb336c3c1
-
Filesize
5.9MB
MD50f0b59c9f6481824560d9165dc2d8c9a
SHA152b58bb86b2ef9f68305f4592211bf58d535452a
SHA256b050c1b1ddedc8ad40e0de3cfb0b39e45dbabb12061e1e5cfd30fdf068e86d91
SHA5127666d5f4b77785f80a31cf0b6f5661d0e7e0b98d5cee949f74b64f957f4b61b19755ad895af40c826dd6acb3ea34995609eb8521664352344b61dd890c4fa9a1
-
Filesize
5.9MB
MD5edc86b3e95e27cafb24553cf3d768765
SHA15d4cf4b8076f85e79c5024c64efc72c17a0ab95d
SHA256899d3e57885c24ffdc699e922db8e7f5e0b4e6f1f3a28ea15e433260fe14dd60
SHA512ed618c7dec7d5359ca2df33ba89a941dff712e3da1054783966dec4ae2d7d39157a6db34ef7809d043a5f349605d8bef0b8e405fc39fbd02aaf0ef7df397c138
-
Filesize
5.9MB
MD5cee98e76b246b10cad1216e0119d87e4
SHA181fe6831854095c932de7fd8f5c8d1c32c94a65c
SHA256198fc936175214ce0acca7d657b79f6d22e36b3cc95e4392a573b10776d8708c
SHA5122367a92f69edfcfbb15e050d3962433eec5e86ba7da4162e7e63087d2803ff286d10c143b10d05097390624c07a4208c3761b01fa22ea6233040ca95e6fe182b
-
Filesize
5.9MB
MD5d0aa2fc4780076fe7252238be8225be0
SHA1774c0c39f9075d3ba758ee130dc0d6012913b8a3
SHA2563ec15539074a78c268c270299a2a1eb0343557e4d53ccab170b2d5d27ba049e8
SHA51296bb3eebbff534c2a07813506ef3bebb9f592d3428803221632f9c3b11bf13b959036dc77aa3da99cef3ccc917f8483e04e1450b928f65e6d7a70387462cacc9
-
Filesize
5.9MB
MD57bae5d11c40bf3f780db61dd8f2d3940
SHA1688ed5357a6e86e4c071811945d86a04ef396824
SHA2560a2f1f8507dd0e76204547f83b2d73418de18ba4e3d39fbc5765a3e8c23e0f5c
SHA5124c51004338a5f8d42b78a474647e0695a9c77cdc369d0ea854540f36ec275101e18e1fdcbaa585d0e134b788698cfcad6698fc6fce6890936bed94b42943ab3c
-
Filesize
5.9MB
MD545e6bd98f043e7c52d3c9223edb320a9
SHA13c61b2d85d863ddf6723fe6ba66c77d45a7d7114
SHA2564663b53542cbffb1072316489f9b360084b5e808d1489b1a88c38687f6385ae8
SHA51274cb125073b9776b6eb2ea2668e4bf9921e11bf4343fccd95e77a134c93ed54f9616cf5c3444a6fb5d3dad7c82cc91de97113003be6bbd8c7cbc616ccae4bc24
-
Filesize
5.9MB
MD548509331d4bd54c681414429b1af97c3
SHA124603c14d4c23322ac7aa672207978469b6c83f6
SHA256609335efe6479698cd592164ba8cde62905a543b342169c818657c0bcf023f53
SHA5129ca04dca5e5266d8960c660c7403a6a24a195138f10be4ac7d05b174a9cee8ec9c886edcba9a1dc2d14bbbe9fbcbbd670711394d803808b1ad61c3edb9d33851
-
Filesize
5.9MB
MD555c7d0965538cddbb0dbe7c965fb07c2
SHA1dc512ad4d75d35ab06665cd0607802aa0ccf48f8
SHA2563f48a0b003ee71410c0e73f5230067e043e1fc029e3639ac36bd5b71aaf3406b
SHA5125ffa64f68a92abea8a0b57a4c412f5ef393cc1c25dfb22a3194b4c0a2c9384abfaf5b3946207c7ecefcc671231e702aac74b88b44c538fcfee1063263cc96aa3
-
Filesize
5.9MB
MD51f0681f8279920314e52f9b80cab6c0b
SHA1ad135fa36af9e075954959057050c1dac426967c
SHA256e9ca62ef88af871412b29adb545308a5edc68331d59ad51527a6dff5ee097014
SHA5127bd6200456d0b815ec462dc3c9654ca1a4f17ffeee7a3b991366daf4ae10f1b8bd2b61bf83971857d664a160af1d429b80e6132c976799abf03357fe41509fdd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB