Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 01:45
General
-
Target
2024-12-21_859788c7070eb1a24743321bf54a598a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
859788c7070eb1a24743321bf54a598a
-
SHA1
73e1a7a24fa8ce4207908a48c5739c01dbd22bd6
-
SHA256
1076ecf2257a451527a91e53f31e12f38e7f9f941d9bc35c0497c66128d559d6
-
SHA512
593a4c667cba0548c4e6f5709f3f7603818d6253bf1ce6870be666711eb6c09d58de80ed207f320675386b75c1d564c7c0588b11d925cfd4270464e2f797eba8
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUs:E+b56utgpPF8u/7s
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_859788c7070eb1a24743321bf54a598a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_859788c7070eb1a24743321bf54a598a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tsZJwId.exeC:\Windows\System\tsZJwId.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dMJGQQk.exeC:\Windows\System\dMJGQQk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tDPNoFb.exeC:\Windows\System\tDPNoFb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZldyXJx.exeC:\Windows\System\ZldyXJx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BcNnTQu.exeC:\Windows\System\BcNnTQu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xqkHYJh.exeC:\Windows\System\xqkHYJh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GtebKLR.exeC:\Windows\System\GtebKLR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DrplkdM.exeC:\Windows\System\DrplkdM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dSYxkzb.exeC:\Windows\System\dSYxkzb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SlwGVUy.exeC:\Windows\System\SlwGVUy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fOidCcw.exeC:\Windows\System\fOidCcw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MPhFFry.exeC:\Windows\System\MPhFFry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rEOzLrN.exeC:\Windows\System\rEOzLrN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FGPEuEZ.exeC:\Windows\System\FGPEuEZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MHCBRSH.exeC:\Windows\System\MHCBRSH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PMmhcuo.exeC:\Windows\System\PMmhcuo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gEwutnJ.exeC:\Windows\System\gEwutnJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EoUkwFB.exeC:\Windows\System\EoUkwFB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\noiYZMX.exeC:\Windows\System\noiYZMX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yMIQuSX.exeC:\Windows\System\yMIQuSX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EdPPQtk.exeC:\Windows\System\EdPPQtk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e67d32a1a284296b1694530bd4bd1cdb
SHA16d0fb56d823225c038617f871ba32af779ee5304
SHA256490ad3df76969d6c1f69e51c620678477992436942643d732fadd561736e9a51
SHA512db3dc611dddf37fdde2dd951bbd0bab98ffabe2ac0a760f1772d472b23c4b50ad4bdd1ca38333d7a92d5434095470c0a84e801a26d218da419e22de0de7bcc14
-
Filesize
5.9MB
MD52104a10c6715b7ecb07b0ab31eea76ee
SHA1209b8b50458395bd0c5a22bb6667deb29bce1dc4
SHA256a9879e0e0ade51f90c1d6cf72ce077b32bc0aee509350304a9104985f3834cf7
SHA5122a28716d3d8cd381569459171e6b3acea0753bf53326f127d1ddc1d1de4c1e0fa389081d4f13794175c55179d6fbc1a6124866faa9f0097139c138d3b035c9a0
-
Filesize
5.9MB
MD552cb9eccf9a7af379d5c235c7632c580
SHA12db5767b78dba45e67499526e8ede0bfc7eb9e36
SHA2568b7ffc32142eb95dcccdbc715846c0900b908f0d2ea4c62128fc61323ca60f6a
SHA5124daff534e3ff9402cb8ad031de576e0daa947b4c3933fe2525c2341d366a1e1d0f782879d38f6c70d8d4f47c465ab426a5ee5b06fa4e43804ca8e7c7d27adab5
-
Filesize
5.9MB
MD58862ef5782d182180fc448c030aa6479
SHA1995f71710034fe94eccc6f37e875fb5e9c48c688
SHA2568fd76be367ee22aaf926d598e861924cb1381aaa704931f2b05457d2cf86deff
SHA5129862e2b8b7b77d5754d367b53ccd8e974c72806ca7a96f7b0f4a9d8f2324f055561ef6445c42cd2f1dbe99609f15baf138764b6389eb9af9738629a63b980d09
-
Filesize
5.9MB
MD516a76afa0a54afcbd6b4d4314fc91f2e
SHA130a31dc3f1042618229ea893253403e8cc8ac672
SHA256934e178f3ee49ce28881cf8868586f198f4a520c2f5975fb81e65e4285334aa9
SHA512d5362997be3b057d7aa89a153dea4f12af02de3a7ca282ecec49c20e40c91e3863a946e842a69fa3c281884293c3d0b5612ac32b53cbfbd978d0df2483b77ef0
-
Filesize
5.9MB
MD59701c19cf629d78d4114dfe6f5b099c9
SHA17cfd742bf1aa4a985b892d91a4459e084f44b1c8
SHA2565f404da81023ccd969ae6c5873c70cdd4b70bdd63ffad95ca8383924d9aa035e
SHA5120585273a5ee39daebbba8b801b0e98266ea8138cce79502f703736ff42a2821a389eaaf6bc79e2a44393ea1737e7502cbd7e41e7b15651a6a2e933fc09ec2bea
-
Filesize
5.9MB
MD5636a2ba1a3bc82b32a30ae355c76649c
SHA1fa1ca759a2efae7c1fdc71cc38c10db29bd303d3
SHA256e7dfd7cb900d3c61ddc788d4105affb617d0db2b744354604f68bda7ad26f72b
SHA512a011aeb59890c2ebdc0f0e9d8990bfaf9e58d7d836adf87692d86cd992983694e90d309d584a73b91e64fbb6e5cb3b3eae69ab7d2debcaccd91cf655a3b093da
-
Filesize
5.9MB
MD53f0825d78a6a918b5ab18ed4a060e255
SHA16817af8daa2c069594bb1ee9dfae514af21d3cbc
SHA2564b5dbfcf72c3fc7578974e1ef13e930535a4d9368a26f8b99d5d36c487ddea62
SHA512f88df71d124516132ce24ca1379ad71ade33de97bb0034a9e4ed07d25e50e8ac2788bf727eb1bd0084fbaf9348225fb385baf167888fa3f1d75d9080f14faaa6
-
Filesize
5.9MB
MD517e8295314dd8cd6d31dc259ad504406
SHA159af892a700c17cd4ce9508fd620e7da60a969b4
SHA2565c15a6cdfdc39db833d93918d6b453c4f372bb4ff97ab96587dd904b2a985fc8
SHA512469ee7fc215927b698d11968f598194b2bad728347aa4a234d4c55277c95bdaace84f47888a9aaffdda298e9395eaa30c921bcd7a72a40307a474b174ea65b88
-
Filesize
5.9MB
MD5b6fb965cfc4134ee1dfc0427afb7274d
SHA16a9f8b7537380c79408e0bf217d64f13d97533c0
SHA256e63b55c3ac375e215683671c19adf3be015b35029135f490172986088c6b23f3
SHA5128f094426d0940e4bf8e2617ac1b16dc8194d95c58ba42e05ef0daab3b86eef96118336cf34d1afcc57624893e43b4cddb2cf5d9c81ccf11e2f5196cc46d10710
-
Filesize
5.9MB
MD57ca48b5f69de630d3b5c7443b109b590
SHA11855280d54b99edd38bef05c46682a7649281b0e
SHA2563dc81cd9deb3c3b0fec8dc1457847827305ae60b90b4da16094c54a81d9ee81b
SHA5127c476ef3a2e7c991090996dd0734966e6511745cadeb07610f3213a655ffef9d1722d0030a305e5a92a487040460db2fc0dc5c19ffe08feaafd875370543c719
-
Filesize
5.9MB
MD5222e37a50f144f94620ae0c257d19471
SHA1f23abd356f4e5bfc39724c2b43a0c62079f4542b
SHA256714e45cba9eb21cc44d8ba36ea9950c5d1b66a8c46d4c64effe1556ef3379f67
SHA512cd0a50ff7139afa0393bc4555fc5d11bf2aa4f677330a37ec07af85ca5477822d355e5aba62b02e3842775819ac62d226eedb12ee38e563909bbc271b9a5408d
-
Filesize
5.9MB
MD52fd30c6da6893e07495a2496a58b20e5
SHA1547d46fc4d841aede5a2679604b1433305e0acd0
SHA256199ab7f837c74fd045cd4dde26fd4b56e0d08ff46f7af93bf7a8ad2c27fba4d4
SHA512edb79a3061d9b09af294fbb680e0f7dd4090c22db2530add27288d59c7cc9fe0163455e356da0c54cf897e35a5c841f2c01ff5c31ad9dddc306699fabfc02dae
-
Filesize
5.9MB
MD52f02ae2dc1c13b7de9be55b5b8705b55
SHA1a9f7b8ca5e504a78816df94d76bbe13b8cef5fd2
SHA2560390b49c9fbe83202d0c2b5f57dd1d5e206f850ac680fa8e6c05b613eb381efb
SHA5128741d46557f989370bc262342682b345294393b1529644c98c1411df02a33e79837b7eb475d674d101c10bc464b3fe74803377aa941d41dfa028f516bfd4b8cf
-
Filesize
5.9MB
MD5259162c7d5b013640da83dc861ea5ee9
SHA16212bc485e8de5a6fcf967aae45f93cd210b3c1a
SHA256a4ea78127cdd6da1201f5b1daba75d1e30d703de5dc7f124c7a4d87d2b3851df
SHA512f1075575ef55f3d126c5e6d91594976b8f3ed704e37d634654906d2100e300c00a67b9cc248cf882ec037d1fa1b46060d70085a4a5607e49512ec905620daad5
-
Filesize
5.9MB
MD54608b919921dcaaf75ba634a6c7f14b2
SHA1c1a8e6a12f3b1fb225e1612a985c863207199c2e
SHA256033722636e7e985e17da0c2f4cb95b94fc66774765e2bfcc00fff44bd79afdc4
SHA512b736288ea62f175c129a63561957f33e62ffe62abb2c3f29814687315777c12d380164dad95ea51a6f2bdc5ebd09ff2271b6ebba9a1cfe4822a04440e7194041
-
Filesize
5.9MB
MD5afed64570fd0121d0bad5f8748da9f05
SHA1df63648fca7e1baa233c4e7d13dcd5dca332ebae
SHA25682dd6813eeeb4ed886ff4cd606591919066aaa82d640f0d94038611a9a2a5a68
SHA512a34058062b8e68650e62d6b2ac0d903d28f5ca0d90b1a19db52083be591e411aaa8f7fa76ab5b2efe5c86b995a90c4b243a7046df07fbe006c5d78a280514c95
-
Filesize
5.9MB
MD5cd417749a6b67c14138395137fdaed89
SHA1218cd63562b1b2fd01057a20874d01715820679c
SHA2567b6f98357e2da85f647721d3e72926442f050b0acac0bef594ab8e8020c922d6
SHA512d35d55df2b3fcbba6552427bd09e4c0cf3e64000a74f5634030d6af512f9d15853666e2e6839ec9cc326f149e3a77f901eb7941d68e47563fd7f7402e045701d
-
Filesize
5.9MB
MD5c84317cc9ac702b33de9f26392ad1d44
SHA1b78d1c16f17e6cb9f1e9f168be1f3c00fdc91892
SHA256088e3b624bf58af995ab25e4ad592c6a040d075e2e3ad11cb132592b67db04d7
SHA512568f8b13f287ebb3ba87e93d4f8b7ea2b6948652a980ff537e6f8d428f9442962665a7f17be66fe9f8bfe88d42a26fe674712003e93cf078b53c5ef9d5b0f25a
-
Filesize
5.9MB
MD53ee64f2eb564e6c3ed8c45212449f0b0
SHA1c2762f068713665723dfe2279b2cc96f7d66e2ee
SHA256802ba28de1ebbd508536ca364469914ca93da36c9ae65fc069eb55f3dfeada0f
SHA5127533801a065cddc87f79466e7a4e2b0ac8cdeb9bdd36291e4c622b05df2f1e187cb93aac1f4341aef499b120060705e192b1f1b27a56a3308c4b3e856989e3c6
-
Filesize
5.9MB
MD5e960cd1f64c72b095c2c9ad5a4419ef3
SHA1e739bad91367727ac05788ff877551ba125af2b3
SHA2568efe6122a8beaf93042fdb6d50a08d4cc45031246e0b347cb3314dfbb2f5e100
SHA51235a830cd8d3a96bb63b39d4593b3f4082e9b825f103a9aca7ed04d48acd34cb80e4fce087a0cce21b7755dbbe0d187258aa4f344c16bc7eb9a93fd6a56f976d3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB