Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-12-2024 02:04
General
-
Target
2024-12-21_5c760d6df775a6010867c70e67b65d67_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
5c760d6df775a6010867c70e67b65d67
-
SHA1
0543edda9067b2b9749468d4dcb20988924fab48
-
SHA256
56da61cd89adc0b00443faaead3458397fcc89ee74a851781461a0874a1e266a
-
SHA512
7ff2d891c48d2440a7f37c435fb7e464abce9dabfb80f11eb3a90f22d86230f29d210b967862bdea614b805330e0d7950e7f79de76348e79b59e9b8ce90471ba
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUk:E+b56utgpPF8u/7k
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 63 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_5c760d6df775a6010867c70e67b65d67_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_5c760d6df775a6010867c70e67b65d67_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\eGoueBb.exeC:\Windows\System\eGoueBb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YCRTOCy.exeC:\Windows\System\YCRTOCy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ampYAui.exeC:\Windows\System\ampYAui.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wcVyagm.exeC:\Windows\System\wcVyagm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KtsxZiw.exeC:\Windows\System\KtsxZiw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HnMpzPv.exeC:\Windows\System\HnMpzPv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZqVebhj.exeC:\Windows\System\ZqVebhj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nQeRFUZ.exeC:\Windows\System\nQeRFUZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\anVpJPy.exeC:\Windows\System\anVpJPy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xCadmoI.exeC:\Windows\System\xCadmoI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ipDmOIV.exeC:\Windows\System\ipDmOIV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EbwHmTy.exeC:\Windows\System\EbwHmTy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pULayTp.exeC:\Windows\System\pULayTp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RoKnNpP.exeC:\Windows\System\RoKnNpP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NkwMfmL.exeC:\Windows\System\NkwMfmL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yPcpUPw.exeC:\Windows\System\yPcpUPw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yaANHqF.exeC:\Windows\System\yaANHqF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GiPmBMW.exeC:\Windows\System\GiPmBMW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZGmMDjz.exeC:\Windows\System\ZGmMDjz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jpAAmHv.exeC:\Windows\System\jpAAmHv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OQwRWrp.exeC:\Windows\System\OQwRWrp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e80a08001e4a5386b94aeebe2851debb
SHA19aa6754ed4a2aed6b3385e2d34a4175d6030b0f6
SHA256a3a25bb873d351df57786d18db6356dd79fbd93c2d7788bde64bfbffd80a6d43
SHA512ada2ce756b8c6a6ec7fae0b7905093482d5c608eaec8ce5422f2719c777ec67a26cd2da2d12415fc7adaa2fe11d0edbd37a99dee7c62195a6880496a9530907d
-
Filesize
5.9MB
MD5d629f5552a0081e412d1ebbda7399c53
SHA1ab5ea0fb98e30c3ea4c26356619825420827ccd3
SHA256df8a6dbfa35ca1752424b3e3dd3c7b19ef56d9a45128c72c256fb3bbacbdbc90
SHA5125a221108c17d3584111c5ee48e646ca9096e1c35af0904345f70aa90354d42a5bb9dff7158f0a0e3826ca929a1d4a823972a9bf02e5a3385f0b1f87ee1ecf3b2
-
Filesize
5.9MB
MD5b612d1c70d02fe7c249538558cffa78a
SHA12976cbe0d99bf931bd14ed6ef474fa37cd11294b
SHA25602b979d27bcca4e93816bd00da03c3b96d804231203ddcab149daeb002cc310c
SHA51271eac1843c99ca9435221a99c0858f11bcd93c7b3c93795aba61f01f19b483761aeac49783a123f1053cd402bf6355f8fe798b1c16c07b0aadfba5330f161bba
-
Filesize
5.9MB
MD50dceba7297472ad7ce814ac0e76b9dd7
SHA133b77cde7993d199e210458cf67858fe129a3cb3
SHA2566fd60f435b1259aaa7fe68a7fe9b792f5d0f48456fe94c8920c3fc6723b072e2
SHA512eaa16d034ea56d2a49f3d9e6f09ce93c8bd0bb78b1ea3e0e28e56ec00ac598019fd751f428ac364793e404ed28a9987e0c2384278cd32fc17c107813261b1245
-
Filesize
5.9MB
MD582ddae1bfad6e404f3d82b7417a69078
SHA1fc3e0938a82629c5d263ae1481a19c6da6411226
SHA25657cefbb3c346b2df2c564a9f25542281bc4e14d7566778edac41ce73d3594a49
SHA51283051e42c493125670106a9a7ef93a2de18d0a52c28d9a5abf1c726628119cbb24a439614cb8b342a4d655cfa9ea5656b1ba4c63e4bba50e57781c311d14a756
-
Filesize
5.9MB
MD59aba38d3901bb564f03ee5d8f658a572
SHA14110ff73f5c659698f9fd9cedfd91a8a145aa4cd
SHA25645131ace47f47682bda700f59c609d029609b828f854f29e882ee0fd8678b8d3
SHA512ec87498ce84a40b4ffcb1a82df01dfb6425caa2e935704dfcfa97865e37881835c12f3ae83c1883bec090fe1ccb1737977f8c86a362d604309e8cd6cc6c4ea8b
-
Filesize
5.9MB
MD58083f642aea52220b31b7cd8d7dbe1e6
SHA17afa1a8baef5860daf3338bf78f46390aa155529
SHA256a5c6329dd6e5d3180cf09405bc6a1e1ead79b8acfb0fe5ceb44b3e09102dda37
SHA512780f208638fa43aeb9248e89f2227d77b7b3e5aceb273886001faf8fc7ec9280ee005347b825dd4094851a99f7f5823fd26ee81feaaef4c17aaf3807de99d6c7
-
Filesize
5.9MB
MD574a34914f3845d082d858bc83609fc1b
SHA1967f4c6949d6398190b01025d947738fd58d7627
SHA2562df467d742cc293ac20fed2b4bd2b82eddfe5333035b1763fe3a349949eb01c1
SHA5127d2897a80eac6d5f5613f2b9c85a30f58782737bc9c5968d0f5b06bb94a1b5fc999b6a60efa89729f3ed21a08619358c774189c27fee0ca0f18d345458259e9b
-
Filesize
5.9MB
MD5e260f86b677e9f57e19aee5ead510a2a
SHA12f23fbb1d98dc02473d129b9ac4d4431228e1c2a
SHA2569ac379995dffbbaa6d6d8ec32f434aab754bc051ea2fcf44cae2ae4b7ad115d1
SHA512b713d358e014d42e373c67d27b5d4f6d92144816b2cd5e29189fdf674f3d34a3a49227c2766ea81b96de28953d7e03cd1c40482a7c62115a2d331398dee66842
-
Filesize
5.9MB
MD555a7c2980059b1e35094ce60a9db6672
SHA1c1ab71cc8d7af6342e2b33f9c657262ffd4cbabf
SHA2563bb0fdee56b6a4984e5a3e6c91dca63461475bcdb6a9889df180d06379dea52f
SHA5126a397a7dcfd1a8900c78a980407e74ca97ac512c831c9dc9c49065a749971f88d001a20bb38bde27b57e798b88457200bcceb8663c7db57d94aa723118ed6fbc
-
Filesize
5.9MB
MD5cd6ddf2e5c321e667eba19e2aa1a066c
SHA115f69173ef8896d6d24755c8385986e28dc73ac0
SHA256f83ba4d1bddce1985ba71c4120096d2331b98d6b703bd167cdcece19211bbd42
SHA51290cb94c325e55f074ee59603aca21a1b4eb3d0e6d7680f8bcaa1fa5fd28f9ee88c6475d22581649d7b4272e7fb24c6ecc2fe66c0b005743ca8eb00b34ec05fc7
-
Filesize
5.9MB
MD565d3d5bd70519d3829a7992fb6b2cf5b
SHA1fd9640fb65330ac963fc0adb53a65ec904ecbd02
SHA256c30e9ade8adcfe644bafc12dccf6aaee36e41ae8e76d158babe6fdbd6ee14d22
SHA5128f4dea3ce66dcb477e32b87748e2cf50f4450b55c3a37bae644eeccd3462512fdb0b49f86c6b8f5df5b7f5c38fd2e4d046ff60e7926e4647a8d0bf5619832b41
-
Filesize
5.9MB
MD5fc7af9e28c285c255be1c7f0942b5963
SHA15db4f44b9dc81368127318da8f6062470a645e47
SHA25691310dc78447802ae85930200f4c1c7c61898baa539b9ccf8942224d7f707123
SHA512b5b34fb9dc859c964dcf28e83c183f3f1f65b4dd7d90fbb85545e5e247c200845e0eeea883b2bc36c9b59e192c0080315226a83d434740bfc3ce28a0add6a62d
-
Filesize
5.9MB
MD5ac5c85a1744d6b1166621e646e83b728
SHA11d7b410f79a5e494ab818aa4b69da9f768493208
SHA256309fb76634bbf5d80b431e522fc2c3b6f805960cc2fd358dfb7d6d65f727f873
SHA5120d17b62dbe896b9103133bc355b5364a99f0e5271d25e30be99794cfbb38f5062587fb31fcbf5cc646430141c95563abee7daff7604766a9855c4c978350ecfe
-
Filesize
5.9MB
MD50069138d39e082f64253daabdea02436
SHA1fc99e9d341dc0d8851027a34c7d831e106f35d1c
SHA25634d92bd95be3912335df00eff41bb60c004eaa1a18de0c6b3795a35dd4435dac
SHA51260d1f6e6067081ce55a0f9c797e5828a0393e7e8268dd051d282a04f3d860485c3c41baf7212a41b10220cd15f090d209cbb8998d5afc5649823ded6dee5058f
-
Filesize
5.9MB
MD5b6a6f1f83bbc692b734fbf30b249e615
SHA1cd8ee51e1756f344182f08e80c393e7126a73dc1
SHA2562e0aad5ec85832d6b8e7fe557a63f48039b2ac4036ee09e24f3faa6c4871d248
SHA512f3994e26d9fd1f2e6cc1e62de1f4b81e15f2ce38eff87f6d3bf1a7e59366813210e7bdebde55642d5081ae7c4896b0212dc4d107331bce6fbf6def9673b103cd
-
Filesize
5.9MB
MD5efe545f6a48fc67177f2800fc84c28ea
SHA15912e9a501a036e231663fdad803530f832cd56e
SHA256060ca448d365d1f778f7c909e14ab55c8b0286b61274a61f3765f66ced5608c8
SHA512112dc622f75402abeb9e4824556801f917149b4190d7f5f6ffc6779a532e1e737be29ad15d21bc2dada461810ea273a05c5205a09b72669a3324655bf5f65e5c
-
Filesize
5.9MB
MD52e1051951a147ceae0d565c89b3872f4
SHA170201eceb0e817587042b1d9d5bd29612a900210
SHA256383d837a06dcda5714b4210402217b24e5f3831dc56e1024bdf6e0af3d16753d
SHA512b1265234a931d9fc89920cf1c0b759145b21c4f625707b378710202e5c80412e486dc469b9bdc3ce188d9ad748300abd7f0cb4ce4863a358e9ebbbdf296f7486
-
Filesize
5.9MB
MD54348780c9489af7096c94a756714c357
SHA105265c5be861bf0f918fc30f069c839e18274748
SHA25671329cd51d10853aa0e8c166a6dc79b49f6cc102064199174cd0850a2abd9a3c
SHA51220568f27644a4e4ece668a35ae9f2faa010144c4694df45062617b0dc419a03069eff3bbaa3e24ee90520a8843111e9814d6c018b7bc90edc1910f10b5d3c71f
-
Filesize
5.9MB
MD5b0131a95a2a49ff227af998841e216c6
SHA14897be8c4bacc9981335801006b189d86f409886
SHA2569fa8fd2efd296056edd2c00f5e810861f2f5ee7e242233a53f2ad34bf5012419
SHA512160394efa3db7bd49b16a465caeb22cc8d4098f0eb2805968bbef7c1981e4777d29b43e4bce713f39c8a937a7840b771b0a51dec1923572d019e008a958b41e4
-
Filesize
5.9MB
MD5de18a706de7783e565ef26f45f36c7d1
SHA17b456bcacb7d8a416de312e94e1f0fdd67265a57
SHA2566a79d13d929d2fdbad3c05d5cb1dcf9ddca39bda30f9511e03737e81fd8eadf0
SHA51299ab004384c279ba515d6b6ea4238d42eb3c1f75f840a9f22d5f0d1f746e4ae40829e1d7ef70ecae429ed9d14d03a6467d841e32fe8fbaeca32d6afcbafa3aad
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB