Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 02:03
General
-
Target
2024-12-21_04a8e7db48e871245722017c8e0dc753_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
04a8e7db48e871245722017c8e0dc753
-
SHA1
b88036a344e36030263f4f2181e3aa5e03751742
-
SHA256
9ad2715b6fe3877d4f428b18af0e90a75682fb805484e75218520aa8f42ea0be
-
SHA512
67425c4a927acd5c31fbb764ae96919bbd7c70a0fdc1d3d4b3fcc8aeb4914e0fdf257813d969adcb6a751c102ff09851a7bea1cc156a9f98c7b5f85f6260b8c3
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUB:E+b56utgpPF8u/7B
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 56 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_04a8e7db48e871245722017c8e0dc753_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_04a8e7db48e871245722017c8e0dc753_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qZghJWN.exeC:\Windows\System\qZghJWN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ElmzGti.exeC:\Windows\System\ElmzGti.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZlRJwHS.exeC:\Windows\System\ZlRJwHS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KgGBdwc.exeC:\Windows\System\KgGBdwc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Vpfrxhe.exeC:\Windows\System\Vpfrxhe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NIQCbpU.exeC:\Windows\System\NIQCbpU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LJELxNW.exeC:\Windows\System\LJELxNW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VUvOoqC.exeC:\Windows\System\VUvOoqC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qEvdjpt.exeC:\Windows\System\qEvdjpt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QvJlYDa.exeC:\Windows\System\QvJlYDa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nrffVQi.exeC:\Windows\System\nrffVQi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iCrbEux.exeC:\Windows\System\iCrbEux.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gFqYVmg.exeC:\Windows\System\gFqYVmg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZUvexAL.exeC:\Windows\System\ZUvexAL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dABuSxT.exeC:\Windows\System\dABuSxT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NLQJCIz.exeC:\Windows\System\NLQJCIz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cledNkR.exeC:\Windows\System\cledNkR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HabLYzK.exeC:\Windows\System\HabLYzK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MiMVyfa.exeC:\Windows\System\MiMVyfa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Eckkfdt.exeC:\Windows\System\Eckkfdt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PEgDWRk.exeC:\Windows\System\PEgDWRk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5d1da28aa34bf7875d91d68817675bdca
SHA1f6257cbdd1889aba09cd9d22d591df1afa614de4
SHA25640003d99a94e0e75cac52dc4b6cb512108b8340c9d448920fa8d8b5ee11bd9f6
SHA5125d0690dac30c1cdfbf37163103d6b626a2a8414a67f754d455fc80bcec3d8fd9c4a049ccdc3dc12ac42b4bb9f930f7a313880dfa4e14fd1e18be0d1fcb7770e7
-
Filesize
5.9MB
MD5990d517ddbd08c8ad0ae30bbcbb51d33
SHA1ec3d3b5393b0cb69163d63f10faf1c0120266fa8
SHA256062fe70cefc4c15c4c70b76c30c14623313a94e2af14acd93a9c0fb410608795
SHA5126ffd606ffc1ec7dcd9a534d0e5a473c8f4fc75fd717f6dec5f1fc79db9c53addb6758ff12ef2e821f0480c1632f39a2e1d1ebbb34b54a35de2072560a4f47e37
-
Filesize
5.9MB
MD5594321749b9be10467517121276be09e
SHA14dd6156fe4a6333326117935f00cc76d9c48e053
SHA256389e31cbdb6c6e80d3e3d7ada60b8f5b6debfc6e9cdb8312c81fb8cc55dc993c
SHA51233be9baa03cf149a9ec0514fb9ab62eb2899b4c6fdc0358a71a802606aef7425b3a10023939429035916f80d774b0029997047eff1d12e3077d1efa56a74bd7b
-
Filesize
5.9MB
MD5e008189e7ac84bf87ffa5478b63031bc
SHA10c4cc23a12f83d2296a76b4361c0fd9dd1945104
SHA256ee90489a83b670bde14cf36668983d236809479fd55a13b08472bf879cc0b691
SHA512cc7995c9747c9cb77c9b9571287486e8a626c8c1a86f57c59a9a100e40f1dfef2b71169f287a6e96f690ccb9a7dccd4d1fe4680bb27d1c2bf7152cdf8fa5f045
-
Filesize
5.9MB
MD58d55a5d3e7384d54ad232e2dc5b90bc8
SHA19204759e7c10557859b202e1bc7e41da2310da3e
SHA2569cbf4249ed08d8ea0b19f5695ab0b3015b04f794a0d30e8b1cd0ee89dd5edacc
SHA512c9bb5b6e8effb272b28499fc435156d2991036dc956cc2418c96cd82ffdd96aebf34ebad4270edd49f1a9af056cd84f507b93d3ba2cb8d3c037431cf958585d7
-
Filesize
5.9MB
MD5e1705c450bac9e11c871108b3e4826c0
SHA19fe95a48c4af3427f34adce659511634ca70425a
SHA256b25753ae577c01c1b869294496b0c99b5e5b4170483d5d286b75104ee76154f6
SHA51278b685699a992d8b6ab8dbbe7a02ab474e868a40f5c7ef1747106a8269ee51dfb790d3ce7f1b8b1b0e05b2477c9a7e23fa9c0426f6b7377a7bfbad65ee3d9d30
-
Filesize
5.9MB
MD5f1372186559d31fb835fe23fad4ee5e7
SHA1339299417ef9e020ab7f5ef92956657504e8d7f5
SHA25656bd027ba30672a078dd3f6681b66b3987e129b40cc8ac8be08d754abba14a24
SHA512342b0c95cfff0069d698172a2230c8c1c842c0393e7ed5a92199e236eed947dbb5c84008b3a00cd105a920fe3a5dbdb7df3c73266172b1cdd6d43cd6aac8d057
-
Filesize
5.9MB
MD545ef5f7a7809452d61eff71e0b7870e8
SHA1726f03a67fc0231f10c64a97b7414dbcde76af4a
SHA2569c2c4f8af841f85e7eedfbc4298dade6d1301b6a7579230916f80c2e50c09a2d
SHA5121c1e5b2911c3063dca23e964219181be7f8584fd97568b0564ef8f3bd3d0d5ac70857a35e0b8a36fa0bd02ec7e4e3a8ac9889fc006b589698fe50252d87e5d72
-
Filesize
5.9MB
MD547a460940b16d4354684e8186dcd787f
SHA1e05a5b166ee2f0c714e6a74eb53ba8d00ed64f01
SHA256b81efd12d5491bae9cd900782843d8dabfbe49c38ba305018f2c1563eeb9e628
SHA512d6e784f21f0d1a1b47deb10261ba7c919e082866d325af129c67dbe92ca423ce5d45957a3f2e5cb6d61f3bf2b13fda6369862892ffdaa5c9bcb0cba3e91591d2
-
Filesize
5.9MB
MD523d4a3ff6c93129341236731d65a7ac3
SHA1ee890b87c356c449666c1bc89f538514cd2a9476
SHA256f620228c56e834546fbb1e1e7594f552b6fe3b0e576c38b33fd9f4b3e3cd2087
SHA512e15e0505cb6b9af5ad707e0f388d9c72f542a337aeccf1ded9857ea7ead70e936f0cec0d7c3a64c88bd8c42bbc1f780ff6f4ebe494fbb83a9c5ace700b740964
-
Filesize
5.9MB
MD54f610a840da253f8e9edbb8124bc18c7
SHA1b3a27246e105c57c91f74de58aa1b3ffd8548620
SHA25656373573e3e6501faba6ee206891af0a11f421c867103f4ba095183544620e0c
SHA512658d832e4a1c707ec5b53ab81e15e5fa854abfb68b4d8d8acb94e3f64c608f143e163c29447ac0112fd0ae16783b111d0f9d33737a6d3d17211fc7c1e07c7efe
-
Filesize
5.9MB
MD58ab71c3b084e85f4db2f21ec1256a1f2
SHA1f9ae330aed295f60b18c4978c3b91bd26430670b
SHA2565c56329f5d1802ca13ee09b93f1bf98a342fc54f47abef73fd44b815e13feb04
SHA512392862e5be7ccc09bacaab85d9d2130073286fb0438a194c7c8b12dd21f6a393d1026712aa152aa6cb9af7853ef0a93929719e3be2105ae3411ad601a9ab4c9f
-
Filesize
5.9MB
MD5593829f095f806eef4228d0e84c4fd6b
SHA1c2e7f39b8c4f2f47724a497ec9dbe51eb3bfbcfd
SHA256423323c92df72a6ab2fdb0b20cf881204fc0b826686ca45e61d2e9a83c275117
SHA5120680f655121c9dbd75d9f66ac0a189fd7c60b84e0da5d94a88f97db564ec4410cdb8fcb026c410f4d928f842139fa2d743df933791a46a48b89066984335c906
-
Filesize
5.9MB
MD5e0ba93b7a62b3ec44720aebec7f19a8d
SHA1fae27d676420dd7a3a4e97a7267751eb1d31548c
SHA256cf19b5fffd68f33e51ae2ac95406abef9a82e6b515328ce6b014f1fe0c2ff99d
SHA5127087d47be09cdf4a56d395b5598b87bc4e825a5611b15b4bec50f2625776b626a6bab1ccc690b56356e6bb4d915c681127c8b1666b955348dcd16cdb7304e734
-
Filesize
5.9MB
MD5e786d383caf8edfc43e0f7c210efd0b4
SHA16a8bb47eeee08584daaa807d78266973f6533a1f
SHA25633b4624badd43c6d6dd0a1dc0d59953a8c094edf97982ba69a38e9a4cb493d5a
SHA512bbf40a0dd655fbf461f9b794c6778d1388e2ef7f7c844e0041e581c7df1c0ce34063b3869e4c82dde1a247055d3a23d77f65e86ffd6301daa0e1bce2be6ef640
-
Filesize
5.9MB
MD580f173f11537da2d2713c8b49fead8cd
SHA122b7512007242377d5991b9fa7b82d5397b61df0
SHA256d7bf906f31fa3e640346a23c1e87663e22293558d8c01ebe5bc6855b347162ce
SHA512418aa2130ba856c90157ba8fd720fab6a1cec705954c30c3597eff5e070a64875a9fc9d848ffa2fde61ccd4a42eeca31f639ef309f2afe18e0cd1eccf1077025
-
Filesize
5.9MB
MD50d13f119eb79b6e0a51b5a08b0331707
SHA1e7c5ee6346b7ebaa64bb9d271fb57c70ecbfbfc0
SHA256a3f198d362260b75a65289e4f86bbcb2a055f81c4d7ca187519149c4245e7d6a
SHA512757f132032c0fc897880a932dacf6614986b9a2758a0d297dc5ecbc3b503d9a3ea6fe5fd1a6498e473624e32ef6f9592378e8ee0a809552c398808193281b895
-
Filesize
5.9MB
MD5fccba08ca01646fe06ad1069bebf9812
SHA1831feee1c8fd03ec9c0f9245832269ec751428bd
SHA256e9edd56ac7aa1b039ada639bc7f7cfe431c9506f656a5ac168e225521bceb13a
SHA51235ca46bf72d5963e0fc94dcf87570014c92cfc6ff50cfc7ea7086a62cdfebef542f33b0fafab69af024339cd3369c2ae55fcf3293d21890be65d8af2ad8dcee4
-
Filesize
5.9MB
MD5e240451556a23f4f9984c49fda18aea4
SHA1cbca1984a4ab45098178596d2e0eb2fa4ff00bb5
SHA256a7dad88f56182d7348cc7489ed5f979dac541220a5dba7b32a2973807cb27c6a
SHA512a2c5a203eff641f677b4d55edadcc28300548927bb4e58c169570f5307638319ab53512e278136ae788b4ba165b468cdb17b310d410a56b3c905f8f9fdc059fa
-
Filesize
5.9MB
MD580ed8a2f11076ded1be760147f415444
SHA159ad7e096bb6b8f05afd0e13290583b6545ad465
SHA2566d890b4f4d263e7e3588dda5b6c6c59bd3c10c73afb6a7ba6ba21e23284a0b1d
SHA51204077074a90e227efc14b317ab455e3d3b943309a29347240c1002ae2837c335917296fde7fc0be345b8a0af7d3ec2707378a793f4bd18dc8f525267f938c8c7
-
Filesize
5.9MB
MD52f0e4b567e4236abab63c33ca0c6b5b8
SHA1b7097efbaa137d527f4a1040c773a4d8c68791e2
SHA256187222e7a9ad6d9dd0d3040f572ad3caf1c1610ba4de4e7f65dda23d1d12ca2a
SHA512e69b42ea5a5a311998e6c3bf9c27af876090ce5cc5d46125c42f14e075002c53674d4cf6b1bdac4ce2bc379bd4422754b8c722ed7d9a97d30c36f5da2348f6a6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB