Analysis
-
max time kernel
126s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-12-2024 02:03
General
-
Target
2024-12-21_11f1e5ddaf503603cb3a53e557d8e416_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
11f1e5ddaf503603cb3a53e557d8e416
-
SHA1
c234a0ee342654fc90c7bdef29e8b16da5713bcd
-
SHA256
f91c63cc8fc909b9c5c1f6be964114d69f34062b5efa651ac00f72215b2020f2
-
SHA512
2e6a6095f86411078d2b9bda4ce6e7ba0a5276d7037d0ab1516dee30a6bfd1a3d72e79d8fb2cfd1b5dbc9ef7d98ac7ab433a0be86b6fd95a460bbf3b8fcc6994
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU9:E+b56utgpPF8u/79
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 63 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_11f1e5ddaf503603cb3a53e557d8e416_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_11f1e5ddaf503603cb3a53e557d8e416_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kxVxSUX.exeC:\Windows\System\kxVxSUX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UiASbqY.exeC:\Windows\System\UiASbqY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FZBKUqh.exeC:\Windows\System\FZBKUqh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FwLZRbm.exeC:\Windows\System\FwLZRbm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YbFfqzC.exeC:\Windows\System\YbFfqzC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bnpJrem.exeC:\Windows\System\bnpJrem.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YSrtvgD.exeC:\Windows\System\YSrtvgD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gLQAIcN.exeC:\Windows\System\gLQAIcN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EaYUCAo.exeC:\Windows\System\EaYUCAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QaDuGhB.exeC:\Windows\System\QaDuGhB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UMVCHOn.exeC:\Windows\System\UMVCHOn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sKSgMPG.exeC:\Windows\System\sKSgMPG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kZSdUcJ.exeC:\Windows\System\kZSdUcJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JAcPwKj.exeC:\Windows\System\JAcPwKj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNKVtyv.exeC:\Windows\System\sNKVtyv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xuNRDYC.exeC:\Windows\System\xuNRDYC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sSfgOmH.exeC:\Windows\System\sSfgOmH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XCCRwEt.exeC:\Windows\System\XCCRwEt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCVWSAo.exeC:\Windows\System\uCVWSAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CLTnapw.exeC:\Windows\System\CLTnapw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dbjhRep.exeC:\Windows\System\dbjhRep.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD58f2a21188077c48de546a669890e4b92
SHA1dd62d2bb62e202f1aaf4e27b758d1b120c666fd4
SHA256c3c7262df5ef70146bf1f56f1cfee2f1978a96c6d2dbc7f294cd386116619ae4
SHA51201a8066b9269321e85f673a3514c14e7d03fd2f4cb4c3b2af59ae47933a143253ddd1418b8ca238735c66754af1a8e2454cfaefdd2f9dd213c435fb803896bd9
-
Filesize
5.9MB
MD5962947df7fac39cac396afa750a918fd
SHA1c1798590c68002f7e677f4c4686fcb584f0e5fdd
SHA256bb828d0006751886a45c3ac815a33b543ba628d220d40f56cdde9cc06a7746c4
SHA51243b65e3d67a2258664cd3608a18bb2369e40e3fb03051d9bea52fd50d26ab90af8bcda9c40befae60ec7576341b7088ff81040ffcb79f53fd7a7667a5b3c38be
-
Filesize
5.9MB
MD56bdf130f5a1a0e248de11dc56d49f142
SHA1777f21f340d659a06b85a5477b5cdefef6173538
SHA256ca3a9e24b6e502f6feb6a8f5ca9a999238399f50a37e563afaa225a75dd8d733
SHA5129ad3abed9a120b2c251f0b7894bf4da2f31b9a3ab0daed182e85d5c14c9a85c2c2941b1b5b441d31ef82ea050e5ca280ad1ec1ccb58ebc0f64f2844061911253
-
Filesize
5.9MB
MD51eb823dd77f525dbf16ec788c1591fa5
SHA1c9440a90bd066778418d84dde8ba4ecdac1c77e5
SHA256532fcc9d84417133ea7e577383a94788df72ea41ca438a729e0b6b095c7f2bdd
SHA512fe01dd0bcdcff2db665b95973df7679247664517ee4185b81fb9af2cdb816704060eb34e3aa8ea8a31f594f12b07ec45f152dfe77af51a5274549ff3ebc66e81
-
Filesize
5.9MB
MD5da94ebe9a831819564ef7c65c133ab72
SHA1936baa7e9098ae8fcd31d42467815be89334b642
SHA2560d3ef421b34aef9c26788437ed57972c41e3ed04c09293b381b61551825f53e5
SHA5125eff040540346aae3b645227c8c7a2136556ccef1876aabb23c40a72ada63d6bc32490c1cd087249de5d46e9a32cc1bd0fa6b62788b48802dd6a378cfda2b9f4
-
Filesize
5.9MB
MD524cfed38c24a9f9918ebc2ab49a080d3
SHA1d0ff4023d3876f04a6f4bbcbe15a8987a8c7ed79
SHA2568b2f4ffc22ad1276f85a4e81d95b0f20d8320ed5ddabfd29f40fe7b3b8c406a0
SHA512f49062031f6a06d1b6ad4fcbb24da55dac5ca4ba2c76c389a312589335b60cd4cf08197761bfd8272b600ba06846d1254d98732150c7fcad4c4a989d8545897b
-
Filesize
5.9MB
MD50c28dbb52a772810904fe58c2bf0250d
SHA11b0c55290a4fdde27b9b278adc03ddba4102eb12
SHA2565af124f84820668f82d01c4f5641271fde0528066c9319c133e6b6a0b96f85b1
SHA5126b8df5ee14198b6f49a111f21b95c616f7242b22d76617f7a4cea421d1378ac314edbcf8cd35f8780249bb13508757fecd7f585f65e7c1aa423230fea2c69319
-
Filesize
5.9MB
MD5388014feb3e43fac0ef5a3beff3dcb91
SHA12ccee7719ea7fb837293680908fd0c0b6c21bb0a
SHA256fc4ebc4f697a7a5679373aab5681fe4571ac1e0985eaf14b950ba2d747d07d2d
SHA5121154f174f6f229a2957ebf04f57db806af61107956cfa071c6c14bf812eece2e2981c0d05637f6adf94f1cc9876cc83a023a9befb04af4758274b49d8dca9b53
-
Filesize
5.9MB
MD52ee8082b63938bd125ba9ae07e602041
SHA12db9331de8ee77d2067c57bb9748e285ced6836d
SHA256b38cfe04e9ddc316a4ac178defdbb6be9a32304e60924adc0797efd9a55c547b
SHA5129f5a6e01de9125bcee577ba3142de461b120610fbcf1ae3e51a0796515b31db9500a9736485f3e921d87329b072e40b485b9fdca7fa111f6be955350675e5cd9
-
Filesize
5.9MB
MD530ee04a34a4358895590053707b00b5f
SHA1511ba6e81cc6296075311def0696e2a196715f7a
SHA2562e79b4af7a43bccb155217b0b20fff727b42ce0af10a665dd6fa893768eed00e
SHA51277eff6fc420e9f9610ad934a5f4400b1626ee4b093aba696f872acc52b40ff08a1975972a965a91bd3b3ed6f399f5af8e5940468b43299c08d4ef8049b5d37de
-
Filesize
5.9MB
MD5bc6bbe250446f8da185b06bbcaf33969
SHA1c9e540fcae989506b7ccb2f3315e86853f955722
SHA256685fcb8bfb4ab629707694bd73a941f2a756f1130421ec325259152257a2a3a7
SHA512c298374caccf5ac283294ed82a370b298f9ab5c7e4a6e1d28f02b30cfad565f8240d69b6cd1356d79be268809699ddcaff9f788fda9d199e99682c069acdd37c
-
Filesize
5.9MB
MD501cf7599aae281ac81bff441e5e6441e
SHA1ae8473a9b391cdccdf36a855a7f7bdad2691d92f
SHA25628b4451a98949c41d14211a3d3fdbd7813f602bb46b7f3c128190d63d62fada7
SHA512e7eb4fb7bf797472fc87884fc3eedbb98103cdfa5d62fdd31687eba35732a2868b74010f19c964dcc1f694f10a7491eafa2fad7d4023c6961a4704fae9d74093
-
Filesize
5.9MB
MD596f8c9279dd8b16e84da4302c77fdcda
SHA1f61776a6c85975c665bc7a4e42a7bbf28779bd9c
SHA256096e55a4196cb8ed9bd0332dc59f765f6c3fa0f9b9a151b116794bacd40850c0
SHA512892de83e0a3b0cfb031f8e115aab2ce8e0e15c11928852edf0b663e0f5a8f83882dcdbc913774d8d1e200379287a9eac49082addcc1048ebd1aafd03789a331b
-
Filesize
5.9MB
MD5b0adbf7879586adec838095cf1099ec6
SHA13684df352983542d6e0e08bf78db4c0937ccd018
SHA2561eb13a7f5a3f3a00e5ae056512964cfe33c097824bc78e41c74450ac7da4a8e5
SHA512b7b67a955601b2907bac6a255248632014b760691409fded0c7df7a03176658e780ffa4120cee599c1787c5b8a73832d42031599dc78abb76db7d4d80ae59ae1
-
Filesize
5.9MB
MD58b98a40190e613f7638e91d7bf3324dc
SHA1b04b6a624b4a58adb08cbec7aac91f6abf1c96bf
SHA256672376432fe3e55a82ea447ec1e2683bba62312a8fa0c7519e7b510a7f95021f
SHA512759906ef5c4052e463af198f5a5d2d177cc7a650eb3e8f5be49cb2ce79d2b93318547dce04e0585eb870411bf86281b841c75decd4be7f5463566bc8a3303c80
-
Filesize
5.9MB
MD502edfa99b2984fdbf748c9387ef05aaf
SHA1978f77309dea06c4a69fd2c724a30e2e1afb4124
SHA256d34691c0356a14313af9bd16e59c2f8f9b3c5eb6cd824b65495c6a2c7bde6f60
SHA512fd7d4725651cf226e5c626b07b8f764292a32408493656e348a5b465daca443786a3678654527ae1960b464e854b503013fcb0d56c971102e81cfe6749294c46
-
Filesize
5.9MB
MD582151e897df13a8576cbcac7325a7275
SHA1142f02f87937fa7e03225ac72b4bf593b1a2fc6f
SHA256883de12f8416f98b41d173a69080f049c15d8d6f67b91e48dfab581eaeabdd34
SHA512324874986759bdc8f62546376fd9d059abea2bfd7bd2aca779a80381bc66649e9636d35787f22f0101b5c4b8460131716aa54b22724dda6192128077fe1e8d0a
-
Filesize
5.9MB
MD54d1b8067ae7c434ca6da187099877428
SHA1199f9e7a8085f8a44f1d42b85d8a574564cb8ffc
SHA256c56eb6b65a3f92b638560033a1ed185f6ac9bbcf15f18bec7840ff534c1b2570
SHA512c06023ba883cc136ea3e4a7965e76bc3df4658357f6093a8591b1e2343627f7876de4509e6c445b5d4a6a3657e882c8d814fda799b56f3173dc6be229a7f9689
-
Filesize
5.9MB
MD5dec4fd352f2715dc5d7b0ae28c11bb03
SHA1b21493f9051a72403ea69b1523676194f2641748
SHA2564137cab9ba7265180d4a64ce13b94e30a874b423e137edd376ecd4dca6b445dd
SHA512011453aab548dc17ce579fe9c716d6ccac95d2d0a310d9f964354a7281ad5dae34c7eab6c0215725f4d90b14d143664238dc13d6cd4958fe5969065cf675ebba
-
Filesize
5.9MB
MD5ea6da23d1aab0e6c039cc6df30d63152
SHA10b56158728f77db380691e8d48cd6dda896a085b
SHA256f0e872005876f99d83dd80f0a971f4f502d2e5e1c78bb2f76be0c6d46b950664
SHA51232ae5b7b0102e8908db0aad629aef4181a03d42fad41de1a42ef893f4479b052939d98edefae6a4a222da0c8119d2a10a5425b65d92aa108187f8fa360963828
-
Filesize
5.9MB
MD5d6fe9abcdbfee86d027bd56916a9484b
SHA1f97b5ab20fdf89e50a19f90bb412b2e77ec8b32a
SHA25603a824f7ff0194af3cc1cba1f3017690cbf905f8ec112812e53635829a8870b4
SHA5122b9a7501966b17f7e9bc2028bcf9d5718fe08722b033e5a6d7d673ba71356c61817da4f7754a3a7f36ff913f9ce7bd977a96d727e744a75a357f0fc86b58d60e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB