Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 01:44
General
-
Target
2024-12-21_7a19c3b6bf50c336ec023eda12197a47_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
7a19c3b6bf50c336ec023eda12197a47
-
SHA1
eeafdfd6b508c46f3234b8553608df8dd7f65ba6
-
SHA256
0d11ff0768c6b3f95e1cc9da6808be52162baed53cf1d1bed25619dd5f682c06
-
SHA512
3186ba31d3606b587d74da13483f82ce68446bce2a0a615bdc62b4edba7d9298191e6ea0069aaada28bc3153ecd017e7fd94d85186af83fb99092dea8e935ce3
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUl:E+b56utgpPF8u/7l
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 61 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_7a19c3b6bf50c336ec023eda12197a47_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_7a19c3b6bf50c336ec023eda12197a47_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VyBVxpK.exeC:\Windows\System\VyBVxpK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lQBDKqV.exeC:\Windows\System\lQBDKqV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aBlUPzq.exeC:\Windows\System\aBlUPzq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dsgLZYF.exeC:\Windows\System\dsgLZYF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ODKQMBB.exeC:\Windows\System\ODKQMBB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HxIbSnx.exeC:\Windows\System\HxIbSnx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DLGWJIZ.exeC:\Windows\System\DLGWJIZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bWkmEfT.exeC:\Windows\System\bWkmEfT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WTEYrad.exeC:\Windows\System\WTEYrad.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VADVsUK.exeC:\Windows\System\VADVsUK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HpRIlPI.exeC:\Windows\System\HpRIlPI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uacVmen.exeC:\Windows\System\uacVmen.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gjKZNwM.exeC:\Windows\System\gjKZNwM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LbUiuoW.exeC:\Windows\System\LbUiuoW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hnctnrq.exeC:\Windows\System\hnctnrq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zLwKyBp.exeC:\Windows\System\zLwKyBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dsHAGmm.exeC:\Windows\System\dsHAGmm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cDkslCW.exeC:\Windows\System\cDkslCW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cQKAHap.exeC:\Windows\System\cQKAHap.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mvKOSgv.exeC:\Windows\System\mvKOSgv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RNPaHpJ.exeC:\Windows\System\RNPaHpJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD54da6e9be35b51640a5a60b22ef6ef941
SHA18190f7dc1ede62d1a1e65313b89f25bc475b0d59
SHA2560c099d23d7280d7dd0474c8181ed2a6fbf3098e6ef3fd06c81968b80964d2a4e
SHA512dfb03e67b82f2f8019daece19560b32949b0be148e116eca1cb011c9f272e65680bf68019140a6506857b4a8337223fb1e8de652d1fd91f0038ee9e53ebf6212
-
Filesize
5.9MB
MD540151e9b30d71767f3a0b0bf3b239394
SHA165ace21afb35db99ba157487a56bb4eaa5189abe
SHA256a2a31b9330695daa4ab2027726b70185cbeae0b0aefcd62e700c6ce122797d15
SHA512bba16bc4173bd5595d3013c11a9c43ff2a077871792ee25e6186bcb5f45505303ecb0ed4bfb82e3bf24c912716dd0e27a859b40cac4d0c298a876d22719b15fa
-
Filesize
5.9MB
MD558d962326eef7547012522a03b54fb9c
SHA1e8296f7979772c5f46d8e345b99bc5c125c7364f
SHA256a19fb1270d45720479d01f289875744dc418e4a6f682e66b765ef934bd16058e
SHA512f052634fb3fd1809ce86bccbea8a5fe2352822ddc7faac95e63a8af483b024c15c66362ca14c97f3eb28ddaa3187986f2324fe77f699dddc1f3ada79dbbf0559
-
Filesize
5.9MB
MD5eef016041ce0da482572769afc4e626f
SHA100d43eca36f46383ce7c62a88821f37987da0537
SHA256e4c9ca6a807420cd4f6b6a4ddc41c530cf03302496ba344035bbe1dc3ef4478b
SHA512c67e5e0b35211b9b4c1e97a59e66a477931b9da50ae385def625a2e90c84071e719c079968b8753336505b1bf68e175fa883ac9c1bcda5a0fb408d77dafa8960
-
Filesize
5.9MB
MD52479c31545823fe4c06d3c57b19cfb49
SHA194b1c0598be4d3ba9c809428b3352de268132810
SHA256dffb5c28e6ec0b41b77217cdb51808e9a9a5bd06b89ed9fa192b9fa9e848a9eb
SHA512b29282d17b21ef731fbe81d171307a71ce627efdcdb47f1d95c06173400aab888ac64346b0725f54b763c4b6e5e89b5a9cd94eec03cdc044f8bf59bde5167282
-
Filesize
5.9MB
MD59822c209db76c8a7c27ee58894a1e934
SHA1dc5f2d8b6587e2498cf6082a61e4463c80647fa0
SHA256a18f0cd49c2ee12ce17cef71f7b8654f1c1a5d59019b2a7ae98a2dd190f1b076
SHA5124d638beb533cb5cbfa7c93977f7826cea2c80b1eda50559f5093b8e76ccfe39615bc6e2f3e2222531521388a788beec24dbb56e958234e9f5b8ef12b968c4882
-
Filesize
5.9MB
MD51a1ac5c56edf9fc67c52cfc01e15ab79
SHA17f54861e14080d5b653721a6e2e45bb6de32caf3
SHA256aeee339468458f5d93c96e06490dacca51a8ca1b9ee51797a930fa14bef40084
SHA5123e45bd973792dcb56c7a4ac5b7b61529a599027a34580b2e9cc12c3deb5ebe36c7827238abc720252057f9d889c56e4ca2382830b5159055fcf02cf1e2a597a6
-
Filesize
5.9MB
MD55aca426a0bba42ff27dea94f0829fc7b
SHA1005a12eda833ab146b86a225624fd39ce827606b
SHA2566dacc790dfbec24633b5196f3530d7f017a693f333ea1832cda5edfab5e13113
SHA512a19f87fa468804cf3bda4599ed767361033e6fe57ac0be4c4ef302db0ea8a4246deba3bdb651f3c54d6f469bafe7e0466d30b5a9141bf004f56a733a5b36b83a
-
Filesize
5.9MB
MD55c04f3352dde147c8ef20bc6e5e7360c
SHA1f833df0b16a19eff566a3931007eb48bbc4ec09d
SHA2562841812367bad5aeec3e58f183816823ff1fdb15ab722068fe8dff401fe78f8b
SHA5125e831bea6f4b8f52a3cac9b470d70e8999089b586dba0afa63bc6d36f6d61beafdc63d3eacac5d6470649f64deb3a5a690f8e0ff92f0b38682ec541455c896c9
-
Filesize
5.9MB
MD502e6d2ce9f6283f84906d44dba911b27
SHA135b183de4e10886fcacd1697d48b850fe895715a
SHA25655e4d29bf4b944ca0eb67877c56b1f1eb288c990ce746e42345eb15dbe21166d
SHA5125b796c47033269b636c49a68a770b98d481e8cef4e3ffb855e501cb2a97677a019e6b97aa9494ca10d652957e1c648f10176a63a88778269eef176b6320bbe0b
-
Filesize
5.9MB
MD5d7be77f919beae9f35cf203187b92cb0
SHA1684f92b74bd0b75704461331b42684b4736e5a9d
SHA256599f208b86a686a7ef4a5f47999f352665b3add20e3fd30c43605b26c2091ecc
SHA5122e3907057771082713c9456cd3fd8e7ed73aa8550a6cd97541c41d01e9d389368c41888d2f280f75a82d97fc9d57f1c5c4c96c28298a698bf84ed704ee1a7209
-
Filesize
5.9MB
MD5a627e87fccd1a413fd6cec28ade9f377
SHA1edd541d0b1edca03d32c78f1085edba7f88514a4
SHA256a73bf9a32c5d2daf6e08b1dcd1d8f34fb85ec2bf08ac540663152b1f02861d73
SHA512d96b4beec4aa926652d321a2a39a9cfed498a184cd1fb413ac53fb36759afd75b841da191f5e2d1a8778c5623da169372aef3da287d9b4755f34c5a1f4195e18
-
Filesize
5.9MB
MD5b541be5af13e37a15f1e7442e4ce2cf9
SHA1f38cb59e20691bcff11cebbff1d802ddf007d160
SHA25615db15a7433ba4557f4da7c407d07f8d35f7017cab2507b6e2e8368e2f7fb464
SHA512dd40c19f8126b327709df3218edda451807d4ac0ef5e19b55f18b836cf8775d7967f97f4b8a9dd028395d9fdd42bb9290edb2b2a3343ea927839658024baaf19
-
Filesize
5.9MB
MD5c593b2a49becc735d39e7f086aff6c65
SHA10effc8232839f6396c851208cd93b3462769e4af
SHA25609be4629c91598967809519c6692b52eb2a57bab91067220e5854e07fcc3433a
SHA512402adaf7a9a83a18fc53c663eb23313bc9e6bc42e064c9d7db5eab5476327486190343cbd98dbbe63558c55dbb6b48820f2d60d32d690eee160cd3a1e2f05c4f
-
Filesize
5.9MB
MD52e33beab2d5dc553fc35f9d29aa13518
SHA1384290ca3abe6d13bc76f5a4ee53b0799f044b68
SHA25682e8deffd19cb6df0fae20d2b37660b5b00987943fdd00d8110cbde01bd3ce2d
SHA512ec3a768ad62d297bcf9efe7923d42031169207629b2555c7da015e830cd694d987accfa71552fcafb22386adeb4390d0985023abfe43f758b32e487b327a6033
-
Filesize
5.9MB
MD560d78dab82d7ac5dead99aca75c6bc92
SHA11b3877ebe12696eaee02452e55a0c5957d8452d7
SHA2560dad1a8152de857238e2f10dac83588c0f042cd8cf8b1bfaaf4486aa8e5392b9
SHA51290adbfc2310d999a800eb44c928f84be3708627f2b0f75b66f97826f352e4b705b4cfb532a7eee45e54229a5abe136e64ec641a43bf410444bd21cc58e219a0d
-
Filesize
5.9MB
MD5fbd58797fd6c33aa423ee1e17c536432
SHA125c41aaa1d4369db8ef67151a9fb17e363592ae9
SHA25630f0acbaeb6f26bf7d624fb13f379abe1a31cd0e690c07b15757187c25ce8af9
SHA5124922bcbfa62efab53798407ff74ef1226fe9122a966a4705bf73d8f36e58ab6884e75e8bab81cf262527e5187dee3d017a653502dc375881d5f5828c9bc6f954
-
Filesize
5.9MB
MD5d560a8d32070f27c3bf985e6414c212a
SHA1c831388718059c01e529214816876999520b6ae9
SHA25663db0f4d710f0b29729df431650d8647a96d949dc1e97ada96f5d5bacc24a9b2
SHA512c846c61d66530069c6e44ebfae447879fb2c4e6459d34a2c03b6386c8ced459b418b37e20eea099e39601593e949e45c34638253b868c052427d5fef39609104
-
Filesize
5.9MB
MD5d30e92187f79f4bf074336c23b9d14be
SHA134546acd45449402eb19b01667b8670ef933c612
SHA256ffccf0631f4ff184fafcd27a9bc1b1d66a3d9292eaf29b3a9aafa7615764f64f
SHA512706ad1bf49b14066700e43e548466261885fc967d64f30ef8a6f2e48443e65890d4898c5e42ba3616d7c7e814c93f596263ea2631ce563d1a1789216b666c30f
-
Filesize
5.9MB
MD5e61f72569d171d3a7f35b91f2bdc6517
SHA1763a465425accd173bb61dc3ee283e2b04067834
SHA256a26c3f14922e1f867d486202ca806525524184d0eab7107f98e4baf6b7a2a928
SHA5125df1218f6364533fd69adc18f9a4bbffaeac764a6265e2e33f70230ff79fd8b245b927326907407dd34891d345ce36963e9edeea0e966aa4c24ff65532b5344f
-
Filesize
5.9MB
MD5887734112bab513a99ac44e6b956266a
SHA188e811b0a89eb786924e8ca49efd3c2a8b0f6ef5
SHA25687c9b7b924ca507ebdeadf8e44ff0a6fee7e401e63b42785459106f2e6695ad0
SHA5124bad952f410d087e9514b061f48ec5a826ff81a62d94331345a28e8383dac6ba57a3460e8b0097c7c7e4710f6905e13da8e7be51cd172eef8483a786f8328530
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB