Analysis
-
max time kernel
127s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-12-2024 02:04
General
-
Target
2024-12-21_69c96c307780b5410f04bf3e775d8402_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
69c96c307780b5410f04bf3e775d8402
-
SHA1
db922a422be6b0b483d482282ededf86cfb18ff5
-
SHA256
1b6a49625f1e0a80a76c4429582a2ede02339ab0490addfff02a672f639a474b
-
SHA512
34c02772fd143c976424c052b5deecceba6a5967fa32f65e258d589d49d21747f8fa1c694f384a4ad0fb2c77901f9a6fefbb29a5731eff16bbda064f88ea7e8f
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUW:E+b56utgpPF8u/7W
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_69c96c307780b5410f04bf3e775d8402_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_69c96c307780b5410f04bf3e775d8402_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IUItOVe.exeC:\Windows\System\IUItOVe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xYMfZns.exeC:\Windows\System\xYMfZns.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DXlTHdp.exeC:\Windows\System\DXlTHdp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BlRONdI.exeC:\Windows\System\BlRONdI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dcpKXEf.exeC:\Windows\System\dcpKXEf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BGoFpzF.exeC:\Windows\System\BGoFpzF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xmmvVQl.exeC:\Windows\System\xmmvVQl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JHNQfXR.exeC:\Windows\System\JHNQfXR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lzYAPYz.exeC:\Windows\System\lzYAPYz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Zwugaxv.exeC:\Windows\System\Zwugaxv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IugGFDz.exeC:\Windows\System\IugGFDz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WQtIaoi.exeC:\Windows\System\WQtIaoi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VxDYkZV.exeC:\Windows\System\VxDYkZV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YmQbhzD.exeC:\Windows\System\YmQbhzD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pQsHHio.exeC:\Windows\System\pQsHHio.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTndNSt.exeC:\Windows\System\oTndNSt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iwIhmjn.exeC:\Windows\System\iwIhmjn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cUAldNU.exeC:\Windows\System\cUAldNU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NmKJCGY.exeC:\Windows\System\NmKJCGY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhOKHmh.exeC:\Windows\System\RhOKHmh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XbMAvRG.exeC:\Windows\System\XbMAvRG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD53a4eaf4c51359a99e8a89f76a024b3e6
SHA1e6b3cf6c1c4b51a8390da4eccdd3a178f3711400
SHA25602f485ca60a010136e41acdb0acfdf43a3fe48d6869eba6571c0fef3a942372c
SHA5122b06bf228645cd87aa255b5093aa4d8d9297fb82f6b109a4a8261d569d56a5d89c4877a5869a4f1462e55bebb37a159b2ce6d398151a072ff81b3c24b9bf4c96
-
Filesize
5.9MB
MD5e68339abe8128075d8bfd01b84e65768
SHA17d541561f42446e342523dddd80f47c7d731b886
SHA2566be962b6ce6720c21d091ff63bc3a91beb0480a5b02565c2c4d88ccd7ef707d5
SHA512a79b409c25c306472f2ab5906e5abf55d3cbbb0a6a741155a7b7934fe91dc4362b35785a24c68cb851e692885aa74316582cf3b75ff9da8c88693982d08b0bbf
-
Filesize
5.9MB
MD543b111d6a1300a09e893fb8ca3a07124
SHA16d7cbfa0f312aeaba5475c24475856be12562b81
SHA256d4dcc5c3410ab0022f6597ee95fffdf6c3e34638d7ddd8baee1a6c8b46aab02c
SHA51200de6e4c779fa290c126217463aa0f864ae209f162f70c77f6ca5547bec0b1ec267b2db66b086f53d12f3f4004e027ac570c39c15aa57ae7629b66ee12d435b5
-
Filesize
5.9MB
MD5b84e9289266be642c0f0a300daae33e6
SHA1b76d3494f3447bc3451b1f08638ba9b8a5f18251
SHA256585a1105280ac5f18c130184e694a77c988e228febe31bf29aa6c137249b38aa
SHA5123af9122f131f2852744d2ad83a8848cf71dffe40c0004157a80fbb2df64ac9078f0ee961eddcf0e02a6089681279bc6cb92d79e451d9d3f30a96a48247819c80
-
Filesize
5.9MB
MD55adac6f67820e32ca00bbe3742308a55
SHA1cbebd7639ecc2ae8c88727b792fdbb41094a3b7f
SHA2563c44fc771f3f42f5834d82e5def5b7e92afaeb9c32a77f384eee52e92a24e448
SHA51214cdf4548ebbbbd374f44e764db9936d159b02cc72b1b9c5fb2a9f106b98e25f9c8c8e0ec8f2c5bb2ace488d2b3a3f1e9b9a83b7779232aaa3a60b2568c843a1
-
Filesize
5.9MB
MD5968adf752878a12d7d9bf51a4a5da76f
SHA18522b1e2e926e6214796bd54787e5da6091d803e
SHA256aed979dde4ce38002539abd860e34af051cc6724f068cc8dbe3002effd232df7
SHA512fb97fb92f6f24d5674d54b860e48a5957499566aa2179c56ce34c175f0a4734894b04a96434175273a6cd7f74dd2973bc443492bc26764586be44f5c588a5dea
-
Filesize
5.9MB
MD548ad920e15f206e6bbe884d3360ba670
SHA1403515776c8dc643515272d9db858f4ef6e33d37
SHA256a9c6ef08b27f411f62ac03a78e779b2d429ee894d739f6421c294b016629a8c9
SHA51297a03253beb91ec5dceb685a3f0c8b44cc3f1351b1947fc99a5264eff10c1e3b310742bfb5208262933f8846546dab4c4baeff4d394b8d8db1912539f02edef8
-
Filesize
5.9MB
MD519a9bf5ae99c58425cfd20b57bf22ff1
SHA1cf765aa5d6a19dae1cb0f38e407927441fb674d8
SHA25631f8d063a387e11c87db6fa20e44648013204946e3761876c21e244177488f68
SHA5124d724260993f7e4419516ad6ff6f2fc4578dee969a6d87797545ef8a6d69c67f6633c76e47ae31290c43bc5435f1ecb5b280f74360054a80a6bc0a6d3c986b5f
-
Filesize
5.9MB
MD5cebd7821b886241b73684372fa3045aa
SHA160565fe2838dc8dfb5e284ab23d329cb5bd363ad
SHA2563326ad70bbace9029a63dcf89c82422a43ba309317acbed51362283ae866986d
SHA5123b6f29314e6d178b8a4fe7525e458dadc95e5b2fb6b2a23e7a367fa435ee9af383df71d2af608148f250a4b239cae7215a4888130a0e0eea0318f6b9d2d60ca7
-
Filesize
5.9MB
MD58d906699112170107fa9544f4ba371ed
SHA14df04a6fd061c786897ef518e7ad18c074578424
SHA256b6f8f1a7ca95a65762a264b977639d1e9733e1ba9bda0d45423a14ff73dcb530
SHA512166bac9b99bf9a3e1c329b6aa2370760070f76f43e5e54c22f623275fcbb37a28a3256f15c64a4f6e5c168f70cbaabbcb211927748af6d553ef622fcbbd35b99
-
Filesize
5.9MB
MD5ec5108ebe55b942d23352783b153519d
SHA110710a34f3fbc0276fa5e37aee79583c39473ee1
SHA256b454a3cdf1d81b0ecf859f5a9b4857745d42cda593dd9c2e9c135baeefc36fbf
SHA512d476125faa794c54e3c375e521bb0a1c60ff72a66aac59a84edd765e4b6e790311c89a8f3418e16d8f22631d8b8ee14ac87f467597461560c57aa2ca744b113e
-
Filesize
5.9MB
MD5006328f659b3bb6c55f17434fc18362e
SHA1d550907f23b84942550f036368927b5c81eb3941
SHA256c225fae6d1a0f6ac3b095fd3b1e433c6ba670bbf2b8b0374b0b1718d9f59112c
SHA51250a1bb2fb40fde08344bfc86e2bebd6e16fa6ffa02904d80d8ed234ac61c9509ed34a2d7ffbc0b73a365da17b2c9296bb61ec7a164059c9d59a30bc2d1b1abd9
-
Filesize
5.9MB
MD5e3a3e8d5529d5648d77a77b3ee5e38c8
SHA1d055f12d2af5fe93f7b4102b2662da7762c5dd6e
SHA25694a1b98233684123137790571215f90cb47dc209c0e6d46ebece53effbf45f9b
SHA51256e4e0cd11cbb92dada5cca64dadd5b11bff0a39e762a70199aea5b915860addc0d1f4475abd79d36d043062af00ba6bb6f8dc8c414cb02c3e226322d5386a50
-
Filesize
5.9MB
MD588e2ca739963867cb672d03fad9cc154
SHA13d78ff56db7c064dbc1bdc569c677325f07e9ba3
SHA25651f5d45d58c950babca520ae5d64545da5324c5ef3c7ab3fb887c81a20d0902f
SHA512892b42571b1dbe82fb6206bb5fc0b89e36e17baaa85997b59dee0f26a3513fc2eadead7b9f699fb1316fc895192ba7e349ee83e7693a42e0ab870932781628fd
-
Filesize
5.9MB
MD59027a6cc51c573a461d285023d32a33a
SHA1715fd171a0627dfe9eb011d8b98997a5aebc5fad
SHA25615eab8733f7089f40c7b4367c89cbef4d3154bdcb9d20f2fbd2b3f6b478c1bb0
SHA512453c0593429f317fab0e221ad3bee41bb8d1261b874c3a8c7caeb5034f8798e58b76a0980c1118b58a50283f0e19b1814a1f068312400b30d14a625b8d25a836
-
Filesize
5.9MB
MD545d4d7cc7983e72c5f169c361be46f13
SHA15988ba430ed83b41fce6e9f48e957ba2400fb863
SHA256c7208c16470f9408e05c2e9e1169d874190e9b00e983790b5825ac3834e4a822
SHA5120f1059fdcf3251bf4d6814601394980a05b97c616a5d284ec55c65ea564dfb5e3da303477f02613d08d86cd3e04f3efbdef7cf68db1f632694b4a0ca111182f1
-
Filesize
5.9MB
MD5f4f24748d8be2cf9d9af488423eb19b4
SHA1da4d9533ffc9f36ff2554b980a9fd9a1947892f1
SHA256e157f5193dea1b8e3d01b862dea184c691d9b6b31ff749b924acbf2d369e233f
SHA512ff8281d6d7eb377cf6ba3751cb06ad1494f2df8a004113b7037fc9323ed0c1ae990aecd5db8511eb7eaf77de172d6bf52de3159d287c5aa6aec84623c7a4c1b6
-
Filesize
5.9MB
MD5d68b004cb5fea6fe30deb1df12d1a552
SHA13d7f5c46907baa400c5e3143efa3843f5e9b18a1
SHA256e9e255a1dc4c72adc7316ee110b4801a500e5491e07bc5b3fe982645fd498c5e
SHA51247c269bc468dad63e3d8d5ce01bc557583613a40c8e6583c1e13ed96e477198585a24cfb81cd3f788beef54d25da98435e286c2dd6de779577ccd71bd631db8b
-
Filesize
5.9MB
MD52d7ff3d5f232bd2e7a981f4abdebd27c
SHA1a146e80c21e96e1fc14b321b7f4701457e355128
SHA256794a08c9f7fb9d675e67c2e1c443da9723a5df298e68cb52bb4beca66ab35146
SHA5126c0dde8da1af660c3d98708b071c4a46f98dd47dedb1816da09a788e1d3c5d5cb643988313023641845556dc64f8623ae4b0e7070c2e10d57032711825503873
-
Filesize
5.9MB
MD5da07a9bbd96d8612b0e20f085082a1f3
SHA183eb0eb3ae94586c89fe2fb13b246757bcae6b16
SHA25672cf262a00d541b770fb3a6cbaba28ddd655caed70f13578db1f01fd2a6ff07b
SHA51268f90547f1d4d61d09128ef97c8d8c25f5b81529b8e079b2b2143b408a13c88a9d5f7aa78bb103eccb256e2e4b282673bc465da80205e706083b4eb4b6e46806
-
Filesize
5.9MB
MD516fefec08aeb540684f8bbe673e1e759
SHA1c4f02c6ea58516c177769002626a3683a8b10182
SHA256b30575f2b07db2139e3140c609ce2112303be345667be13241af87faa93309b5
SHA512f15b0897a35aa97910e81f4c05f9cd2be9ded93999add8722f3aaa6b70b4e28014a796a2aa869e034364a070ea7cf78cd560ee3fdfbc57e9cfa3b267889cedd3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB