Analysis
-
max time kernel
138s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 02:05
General
-
Target
2024-12-21_a063af4c5e6422ef3900dd0de5e1548f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
a063af4c5e6422ef3900dd0de5e1548f
-
SHA1
176dfb210398368b52f90439e42434891ee71f6f
-
SHA256
58a53f3e1486d752148649875958dc7518404cc7d5f0d561ac191607773630f0
-
SHA512
190273d05600922f61cb9a8658eb7acdec10a7ebebd5bc69e7c243b9e751802ee535decee0909afde7d31dbe59fd98e48ac113cb9abe8a3f033816194d3a4d3a
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUv:E+b56utgpPF8u/7v
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 59 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_a063af4c5e6422ef3900dd0de5e1548f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_a063af4c5e6422ef3900dd0de5e1548f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zfsqKoX.exeC:\Windows\System\zfsqKoX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UxilbEp.exeC:\Windows\System\UxilbEp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zcSawmP.exeC:\Windows\System\zcSawmP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UgYcmPy.exeC:\Windows\System\UgYcmPy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eryaYBP.exeC:\Windows\System\eryaYBP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WqLkgIG.exeC:\Windows\System\WqLkgIG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uRUVwoN.exeC:\Windows\System\uRUVwoN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wqtauKh.exeC:\Windows\System\wqtauKh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FGTrWpz.exeC:\Windows\System\FGTrWpz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ArPuglf.exeC:\Windows\System\ArPuglf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jhipkiY.exeC:\Windows\System\jhipkiY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HlBlhXW.exeC:\Windows\System\HlBlhXW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWCNFKj.exeC:\Windows\System\tWCNFKj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\srtwatn.exeC:\Windows\System\srtwatn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IgITTWe.exeC:\Windows\System\IgITTWe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TxfKQUp.exeC:\Windows\System\TxfKQUp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gMfmjRC.exeC:\Windows\System\gMfmjRC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jBpVjuQ.exeC:\Windows\System\jBpVjuQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FuxsoLP.exeC:\Windows\System\FuxsoLP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RdklOEh.exeC:\Windows\System\RdklOEh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lOMOVPs.exeC:\Windows\System\lOMOVPs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD50fbb24404d80ac6d74bf2d0ba2fbf311
SHA18e732835863b9dfcc652210abe60e61d9c05ebf1
SHA2562531be9fab02b40e11ad6493c323b8590db20b6bf40b0b926a768a90cf91e88a
SHA512660cb199dbdef3c736513c2b657778812bc7d2d59f83951cddeb5ba966bbbf7670a1765a87ff6be8c9dc2be61ee00c5159a7d250981e644356fafc7e9144ecbe
-
Filesize
5.9MB
MD511c44e355f1c60150467a5d49cd31966
SHA102e5afa01488461c285c799dfbe7dfdecd381e80
SHA2563a46d0e11843afe44c39aa598666fb3c72893a92c59e2b68ded92dcd70229971
SHA512dca821576271dddc52cb5413fcd6988e0381f2db3dfd8cdd0b99fb9182c84a1b6c4fff9530694f752ded8da46a9b15bdf4371b5973f47df07a1993388a13a236
-
Filesize
5.9MB
MD5c2a81d3fdedac4b2e58f27d959d80ae7
SHA1cc84fccdc6cab3321940755857830a61cc3f12ed
SHA256c144252545e3d03d11aa1df9f124f28f85ef5cf0db79e0a33b1861328e91a0d5
SHA5128ec3fa952ca17b5e8f390c36b0c8fe038de49b99f520f181788a13c41f2397515e40e89c360c328f22f26f8c866420adcf256781f76f07db8b00f63af9d77ead
-
Filesize
5.9MB
MD550663ccd15082c1d22ec1a30e95b608f
SHA1ed6fe307a0210da1d5430d6bae34d1955e73c0bd
SHA2568a533f1550e662c1b12f0138615c89a00fd1485914a3d6d31de7c0adacdbfde9
SHA512916dd8bcd6b752a7c3c54778093f8db7ab0541f93796d42edf22c8414c6fef72974db6ca9990b8e88ac183c2e14339d16fa0a30ee9935848980bd730d90c0057
-
Filesize
5.9MB
MD5f408d2ca70b5c8044cab48cfecf3ec57
SHA151e17e2f8272124db5b2faed4edb70ee5d0fe401
SHA25699a0a466fd532b48be0bbcd91fa5df019ff8846d903e8da9f283186ff471d73c
SHA512e9aad93082015138d917eff96e4f9b76aa8ccd5abf8a6d93c818fafdc90f7f5081657bb4f076dc827d2245b9c554c34d335204d3346b330816e634696061f88b
-
Filesize
5.9MB
MD5a3961908c26cb601abf859d6271b9731
SHA11d987ad61f59211cd37b43f00b2ea5bb45f63f88
SHA25673fd4cc18ddae5b299490f738587f95c96a2395f2f9c329dcc6eb6bfcd4b6198
SHA5121a8436ac4bc4644fb73cb532ebe80c44c261e9cedf51639ce0efd7275714aabd91efc65a1a5f750cb8d1a3eb92659e5647ef81ab931db71e60a2f422c096a676
-
Filesize
5.9MB
MD5e57a35da7e53745451d76e75f6e54641
SHA15cf4a5b242ac0019a2548e6523cacf3020bd9128
SHA256d4867b4537378292b79e432aad2bce0f17616b6b1e43ee5b594d0e8105f3b251
SHA51253ae0a3ac5a83f4ee2cd57e5f5e6f9dbbd0ff91f4f20a8c60815c6fee13c604afa1a971c03b11358b7892ae309a45cc759aa52f4038705bd96909e75e88509f1
-
Filesize
5.9MB
MD5cc49f266d442c9a02410d7f4e7357b31
SHA11c11f1f5a062ae379c83b4a75dabc106d49cd131
SHA256827e01ba8217cdc90e05103acaac4e446910dd729c5a84db5d74161f591f5494
SHA512c937976e741f5da980355fa5ab928aaf779c4f68270ffd15d24aa92ee2087cc8d6d97efcbf11202b7ef81b4c440874df1b0cb4b00ecce07217f58a9b783fbc76
-
Filesize
5.9MB
MD56edf4d82a74c069a4cdc7e74cd8bf130
SHA1b7200032a926d4d0d980cf5c318f17bb1e093c3b
SHA2568566f448e48bbf6e26a634168978be353de7c0ed85acbbe0e430aa73abf7bb89
SHA512c2470dde29d7429e90282463fd763e860ed2314524cf59f6c8892311603260335ac6f757ed95e64b9f2deffc10239b4066ffc458a049a2254210d2dce3f76d4b
-
Filesize
5.9MB
MD532c98c7a3f80aefc2670cc85c6a2726d
SHA125542e63401e1075f0fe268302999ca3c66b92b7
SHA256ec021b15b477239caf2f69f7485531de178806fdb6aedce67eb51936f4429af2
SHA5128edfea5b143851704a327330bc5d4d83f8782cd3d13648cc486c4e273fa6e59fb78b9ff615766b34d7f0b8589ed7fa365094b649098bccebf037f390c179699b
-
Filesize
5.9MB
MD564fecdc2a94904da82510a0fd2eef214
SHA1e4258a9744f5a962c8f949fc3666bdc34ca48e57
SHA256af665cace632361c3e835318a226867e5ea43fb595a1b25c9f2164593533fad9
SHA512d0bc88a2a4d57210d853032544dfe682f2cefee79f16dbd05d0cb88230f51c8b7e1e79adfdce812909f4385819aa95bb16befc72b7b02b5b80824b54a91f76c3
-
Filesize
5.9MB
MD527ecf5070bb3b518083f8b7d37b9d44b
SHA1952b3abf58194fd38e2f40e1024e0a044e756ca0
SHA256a29129bb96e86b27eb1ee1fa902f48328b286aa6d9438af2a119a4723e78fe81
SHA512ba3388e3deda5a14779e54a8a2fa3127b9273a75ddd405de87bbcad1306fe8e80d83930aebb15d9d22f37359bc31c26f59fa2264ff3964db24e220ef18185f2c
-
Filesize
5.9MB
MD531dd4cf7358ca4dcaf2d12405f7bb7b3
SHA190547923c87abbfec95284b78884de6ed27ebe41
SHA2567e03a8af01107b8f766f92fade9311001c75141dd9b4847939f4bbfe3755c532
SHA5128fe7da9aa2970ee02760dfe2ecfb012bb6fb628e51115d3ca6dde16ed00c628838cf73bf538fe44cac73079689e9e2432b8d7ee986569ac8a2fe0539b43a1639
-
Filesize
5.9MB
MD5e90523b92a0443579e738df17d8aec26
SHA110d99ad092c0303bad2e924874fb6b6bd677cabc
SHA256566a4e9628704150f9849ba613c762762cee0dcc4aef2caf4b853edc19a8ab00
SHA512af0e1f49d6138a877c718800ceb539e7f43d9359bc6a8c2f9aa554116eebf3e15a4230d25767849b7eccca4447388be04ba4a1728e04ee8e3750e365917f892f
-
Filesize
5.9MB
MD510ba508db24da38d8a7c05f937c28c72
SHA1f31235ebf7cfbb043addb537a29cbe1c82518732
SHA256a6e470285e83edb83b26c9a7d50e45d560215b8381e21129515980169cb87ceb
SHA51249c8c4705926adebaa7f8fe0358ca6c10d9c5b2ab544bf97599782a1c2d9959e809d7bd8b1036017bbcc89bc094f862bbe1569a4f59ebe03a0e59aa0670aafa2
-
Filesize
5.9MB
MD52f456c38d8c229c67293678056cc425d
SHA1cca611a9fc3cad077873ee6e379aab6c924f229b
SHA2568ea6a7adf89ad97a69fe20ec2a2572ee7bec489bb7693b15a6910055872371f0
SHA5125ba8530668ac88dd5a7ab8810f5fd96b738bf92f56152c5c56f655e24015e31a1e1944abdff1b079035d868a1f4b940dc32cf2b76b6706f226632d353b280733
-
Filesize
5.9MB
MD52e4f5f96ee2540b415aa93fe8bd41be2
SHA1eaa1c2af745e5aa20472fdddc2f288cba2af9ef8
SHA2568946e270fe756aed7aaa30bfc29e216ba58ca462241c6d6fd1084660338a1f81
SHA5120317fb6607b5ee7f63f88462b0b1fc369eebde6fbd57f47198b3d6aab23ef87108eef872372a9a7785eb6ab875d0e26f9d103ea3e18056b4659ac737863f66ac
-
Filesize
5.9MB
MD5d080c47aaa42f8840da920cc32c8643d
SHA1b216be36c8091c8058dd2377db2fb7fa4f836598
SHA2561e36d1dc792dd2c939e418b2ee5c3e377f0bcdf438f65903e5f0dba3e19a1298
SHA512803d8af15c9377fb586eee62e1ece9fc703e83cd6543d9d38a37489ad363ef590be3d337ae64f0902c2115ba221fc5a831ebf93b62503b665bf6f2f1a3f2f0c0
-
Filesize
5.9MB
MD5ba98ed8e779026c81a466ed1d8b6e77c
SHA1a2ae88b2b0c2c41205d08e743007aadc5ceb7d3c
SHA256a88346c65ebbfc3f5ec10b1e61d2b1b28b658adfbce0cf182faedea576fdf56c
SHA512ff9c89f1e61460b061c0d219c052dcc6c935f88c5af01cb099bf8cda66d4e44cca38d5e78e5f7221d6bb5357e9ad6c8ceff0b5d22e9e8cba422784eea456baf5
-
Filesize
5.9MB
MD505717091c5fef1482ba70256aa3020c9
SHA133e4bca0d4acfcfe57fd9a013de1c8a92c165849
SHA256dc883a3349410dc635fd1f86f29e9f47f0e47485b80c987946362ad381e073fd
SHA512ac099d5e14f35d0bdffbabd0afdebd9a434e56f512fe55b8ab9f2b33fbe420108d1fe029ec70566175b97eb9fb1f13c3c1988713e19e42cb122fb0e1a6af3f66
-
Filesize
5.9MB
MD5b3ac2fc0900cc3344051a034460fd60d
SHA1310a6bf9a5d88ea1c0fc6b9e97dbf069c4f733d9
SHA256f138809d1be7b4dd5fc9bb9df9607d9b632ecf8e0fedcb1f93bf7fb204e981a3
SHA512020740053c0577dc5b25118ca9812a8b5cbc98356d0fde3e0580ec8e27cf85cffb6658fed0024947f7b6a7d5addf6f62b1d4ec76c53cfd2d805d976a18c209d1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB