Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 02:05
General
-
Target
2024-12-21_950793b4abd0bfe85df960df20df5b36_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
950793b4abd0bfe85df960df20df5b36
-
SHA1
baaffdf9621265e2301ae95448a1d5d8537bb690
-
SHA256
781289742f6d375fd5a93b080e86270243d2cb1b86863aa20cf329a8f3786278
-
SHA512
17ef30d79671edec31b5ae2667a95d077164508cbd517996e4e90a7176d5935f8b13abc39000b2dc56410cde13d9f5b6eff4fe179c21866e423d17c4479bdd20
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUt:E+b56utgpPF8u/7t
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 60 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_950793b4abd0bfe85df960df20df5b36_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_950793b4abd0bfe85df960df20df5b36_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\Lbzuesq.exeC:\Windows\System\Lbzuesq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tSGSKaV.exeC:\Windows\System\tSGSKaV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dXkixQH.exeC:\Windows\System\dXkixQH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hXjZovL.exeC:\Windows\System\hXjZovL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HXSUOqo.exeC:\Windows\System\HXSUOqo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NeoFzjM.exeC:\Windows\System\NeoFzjM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tebzatq.exeC:\Windows\System\tebzatq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WVufUkV.exeC:\Windows\System\WVufUkV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wxaeQWA.exeC:\Windows\System\wxaeQWA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fNvCJQK.exeC:\Windows\System\fNvCJQK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ukNHgKJ.exeC:\Windows\System\ukNHgKJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xVQNtLe.exeC:\Windows\System\xVQNtLe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CTFYCfm.exeC:\Windows\System\CTFYCfm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MVWdolA.exeC:\Windows\System\MVWdolA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rXOmxqO.exeC:\Windows\System\rXOmxqO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CSLLlXs.exeC:\Windows\System\CSLLlXs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yoyJiFW.exeC:\Windows\System\yoyJiFW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NaXWbnB.exeC:\Windows\System\NaXWbnB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BhhJBbr.exeC:\Windows\System\BhhJBbr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qXZqLlo.exeC:\Windows\System\qXZqLlo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWZXhQV.exeC:\Windows\System\tWZXhQV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5baa4c981120db433220b1df8be3e8895
SHA17ff00dfd35b86c417cbf743f1d9254b65ecfe780
SHA256192c02fac1b7522d51045b874e19ba0e974acd8dedebcb7ae93f3512a88e9089
SHA512c30e442fb5afef2f7e7ff5d566301af53d64b707b7ab583da7a968ac991d79e2474a80b9ba36bfd354d9c196cc8419f0e135b5aab30a4f9ce6250a366176806a
-
Filesize
5.9MB
MD54308f675f3ff851bb779516e958847e0
SHA1defd132386c5cca06dff43465e1c6c21f098efd7
SHA256880c5443949be7465be567272a3d20e32c83927a215f23bf3ecb7ca4d871a3f7
SHA512dfa18ebd15f33e75750afeece90c3a129f3fedce328755e177657e4cd08c1c088dcb96d43f17914107241ccff9b987e2449350ebb048b6d479076426efb574f7
-
Filesize
5.9MB
MD5c80f9a96859d79c4f3f471781b8beca0
SHA1fa2eae51babc37856ce994304522818343f9f3a7
SHA25637628f8ba58886ca0298484fddd9fb30d0a67beac22d4278bc0d2e8127b6b980
SHA5122696f37607ad09d2e74dfc8ba7572c4478185042be8f1785984624d1958fef66468a9e15b67fb7d1b99f1e29db84b6cd374e84c25a788a33863bab0a3e45279f
-
Filesize
5.9MB
MD503c8c7ef82ebc03e57b40e4ab0c549cc
SHA1bcafd8e11b6554b0057c5dedd227b78028afddc8
SHA256ec4a710e1bfcbc5bcfe0dc2deb839aeaf3485376db37def28f9782962c604686
SHA512671f2b3ae48d18faa1e5405fd9cf9b450a085da11b6bdca748f4e2f52f56aaad403cf2fadfa61037271e532f3f1c7177b5242219e7683eb33d5484b566f6c769
-
Filesize
5.9MB
MD54dc3c13938f1bf78c2ef6f379f32e247
SHA1860cf5721f9dd863092be522033954cb0ff214aa
SHA2564a2c88bfb16914e30f489231de194b68d885c8f6dfc4011f2dc929443fc175e6
SHA51298b49b800a223ac40ff2342e7f7697f6eb4b88a638164691567041bf1d13ee44b030556b27314d6e0221d9840bfe6bdbe6c4c60c87a465c6be9b908e9f6a1e85
-
Filesize
5.9MB
MD5dbcec9f71ca6898b69d0d3c7ee937d23
SHA1de6fde2d138e8e85f695f747f08aa0384d88e44d
SHA256be156a7ab39669e422dc6f50283f8dc7443d111cdcbb3ff5bb558d863c3f1af8
SHA51230eb90a9a07da505493fca57f48f4c64f4cddf5018d9d461efd3cb01d164e25c17c63c9d0443ac56f9b4e5c035b18fe05239102a2d83cbe03a4828ea5ca72523
-
Filesize
5.9MB
MD551c841115d80e6518dbc354009fc0c5e
SHA1ac60d0c269336d0319bd5896ad3ad209a96f5581
SHA256ede5a4bffd346527a8364bd2d0661b1ede1a49f049380403dbdfe3056f464d23
SHA5127100f7b1339e2b223b939317d5efca201657e9abdf2db8bad8553bb02ff7a266f478ee80c29ccd2c66514fb7f0024b955424255d894f0d5fbc6a9e373f195937
-
Filesize
5.9MB
MD59ea8b1c65b7a620acc7458280f255d97
SHA15642393cd18cadf7ebebf4da98ceda20f99918cd
SHA2567443622c91005cf41318d7b6f0eab4bfdafb9fde26e5d826726a41cd31bf2371
SHA5129d59512db55d85acf72c9ca01db0376adc903a9612d50edf5e06b97a2285089b342c3c1ea4d792ca23633d0d4089cf3d4b6030f0ec8092b7954a866a9f0a06bd
-
Filesize
5.9MB
MD5cbbb44e958fb4b24c9935300a656f1f4
SHA163452e8c9116f08eb13c697d4d0c6a1838ed8e2f
SHA256c690537ce7de4a9a097671b5520c7457f14002989edf409067fefe15af98defe
SHA512eb609eec3056e16df0523591d6d43453c7ef50d765d99ac729f64a58a6022ecc8b27431dcf296070a669165d92cdc78808d5864fbf79f336fe6cef04a57ceab3
-
Filesize
5.9MB
MD5b34f680a095205f545a3b4423714d170
SHA1ba51211086a45e5840aac6c8513ac5a40f7865c4
SHA256f61530deb9b1c7a6c00ff3c5ba42ab6e9c03dd7454f7932f2740604e7cd7788e
SHA512752d1b9a82a70f43332bf69fd07cb165388f893ce907b9716a2766ee9a89f677cd74b7fbe2617d07cb5b04fcbc78ce1813939c1a75ccd922bedb7eb7aa40fbc6
-
Filesize
5.9MB
MD52894827e292b59f1d943de84e65e0cc7
SHA1ec860a5d8b85e907f45515e667de953644f947e1
SHA25659fefb36e7b71fe08722a993c9525d339b02ac81a6b50ecdc0b9e53dcfa92dde
SHA51241ecd77a6586a0884c2063ed3df1b385e1da7ad96cb8e34e49242613e4c53a4fb8063815c03ec91c428b6f5a7dc09be0966257f207b3c427e29f283d0748fb40
-
Filesize
5.9MB
MD5cff6245936d8b6f75e1d05dafbbb31ab
SHA193929415947bfd112af2d336876ecd350f13dfa5
SHA2561b3c5e6795ca73416ca289295431bf7464b4899547c439c85be2fb8a71b2d2e2
SHA512283bd3813c5afc7cf3da6ea7f67f514e1684a7e364a5e962f6d078ad5957155174603701ee49d1fb043bff9b9c67ac6833884261160d57594cbbc63727b85c4e
-
Filesize
5.9MB
MD5c03e4725587d4433dcb084c17b7063b9
SHA103cc5941c514ec36d8fbd3aec8d45eaba8b4ad79
SHA256ec3eb4f80fd4160f50607c1ab52b50d8dff4ff7b91735bd7c19adf43fd942c0f
SHA5129238d3e23f57baf8c5c69cf30db1577700ab81a7b7b77d5a5a5a623b0d5f9d2853012e30770c9dc355f366aca0a85f6d912eaa1c5c51e8bf00ad231fe538b369
-
Filesize
5.9MB
MD5e642a28fbe24e8f83ccfdbd77e3c5faa
SHA119ae891c5a515166f9311a845a9fadedf45acf92
SHA25604100bbf503009ee7d0c9e2b55f32b3e21cd407a72811843acfa199e50f9fee6
SHA5128e6f817e06b6d231f9aa2c89f845b58938b2bb199b4bddaecf18a5053d03a8eff9fd6a0f63697101aaae059e9571470be5b1084a1a9cfa5d4c81e5c30c10f4bd
-
Filesize
5.9MB
MD558ca8811bab2055b2161beb90900e69d
SHA1cf0f5a513e35e704da54edc220361650c933a1e6
SHA256dfdc805d08ca05b51b6a54964e9857389239167e6ec94b1e48d78cb4d518902c
SHA51270967801775d2fbb4670740b28e929bbe71e40525fdedf772bdf05a0245b28b2a6871bdab1dee9375133bbecacf0933676159076157e6dd007ca938ecd54d87b
-
Filesize
5.9MB
MD5eea6c3df0e5176b1361a7f60cd9774b4
SHA15f3f54040f1b14f46cdfc1945a2d8a26ded16ea4
SHA256aed52cb3caac9ac82a105c5042b9f54bd625e0d6548d49e9d9373d40ce24c8d6
SHA512b4311bb87b9b05ed84a3caa67117dc8d5ae692260285487548cba1dcebfd5653c45a4a726ab7e3e0e677c5cbfd5fa4f6e3688b1c660b21a6ec9733c6a072feca
-
Filesize
5.9MB
MD596d3304e8b6f2044ce8693a3ae4a7f49
SHA1f2e633a2ee5c02b36c6cbb45c00e3ec5bacb7538
SHA256264885a22f46659d5b209d51cff750596ee16fb17516a96bb5fece1cc9628b20
SHA5120931a6874de45982704fc04434bc0d59d1f4e1de44c841573dd2f63949341a27c6d3f2fa3296e149e5fd8010453af782c9c36f5002153a6317aa4789f0b1691b
-
Filesize
5.9MB
MD59d872ab3f35a9c6eecabd8139570dc8c
SHA1a4ffc457a69de19ec2cfbf4bef41c3905e4e5ebc
SHA2563b353107f4f824a6438868da2a2761b35c82bde93de05b930ee217f4e661b08d
SHA51210c150c1bdcdbd7ccd749c9f588ae11cbfefabad4573cbc1785aefed6a23c24ad46ced3fa40845722bcd99bcbdcdf046cef127fe38d53668e12fa0db25647a7d
-
Filesize
5.9MB
MD54a22f14aedc5a5a9744bfb43be19053e
SHA122a08446c96f3f198576d2be9e0422da41cba742
SHA2569d6c43816bc2ee249c6f32800d71ad9e7ea1e6d315ecca6d6dd1e2d162044421
SHA512635d5544a42b1746e84f63dc9ee051e5eed204fda491e595b54c50e0e897b98aa223c59f07f6a3fa022e128ab38d18995a8e5afbde1f2186ae52da7c98531a59
-
Filesize
5.9MB
MD54f072102ead21fcc8dc5c49de924dbea
SHA19ae21d23394799d692c6b7a02d0739862211839a
SHA256be9a45f7f5bc472d9ad0b37c269e083c09277412a98eca1812d84e8a50681ab4
SHA5124f69cfa8f555da20b71bb555a05fbcbaa1d85b0c292880380c74e3995a5409c050eb8142ed1640c4233343dd479b652ab5a49e672391b46aa5946fdcf82d2ab3
-
Filesize
5.9MB
MD5a33d25cccf2e9426141c7348b8bb4aba
SHA1e0852314bc1b5932d00c55759053bc6bb2444737
SHA2561394772a94395aa94549d1f3eba53413b836ab56a9449b5747ae3fc9cbcd3153
SHA512750c064bbffdffa6c1c06bc566395ced657169225fc19b73546559a12d00c6e9f2fc58c91b7e929752d3aa0ab44ced4e4c87dd966aacf9868ab8f99a5224b1b6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB