Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 02:07
General
-
Target
2024-12-21_f9727614e6a8c10b743986a95cdeec3d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
f9727614e6a8c10b743986a95cdeec3d
-
SHA1
558c94513a37cf0c7b317ecd8a3fe77d63a5531f
-
SHA256
cc0aa886a70f1563cec8e99dcaaa5bb4868203f0f682cd05a0511860dce7a11c
-
SHA512
5acf0afb76e463ac9e9f8c4f5c80a35b905c4d11a9f218dd06c3f7b3520badac16e73e3c830e365706f42979e47e8921bf3e585c5c6289e532b98b01bd848d76
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUI:E+b56utgpPF8u/7I
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_f9727614e6a8c10b743986a95cdeec3d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_f9727614e6a8c10b743986a95cdeec3d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XKenyqW.exeC:\Windows\System\XKenyqW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FfuqYBJ.exeC:\Windows\System\FfuqYBJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xatjiQP.exeC:\Windows\System\xatjiQP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PNeIiZM.exeC:\Windows\System\PNeIiZM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ksiFFGr.exeC:\Windows\System\ksiFFGr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oKLgedZ.exeC:\Windows\System\oKLgedZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KtHYNZv.exeC:\Windows\System\KtHYNZv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZlqpQFt.exeC:\Windows\System\ZlqpQFt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mXUXcNC.exeC:\Windows\System\mXUXcNC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JNGfBCR.exeC:\Windows\System\JNGfBCR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WHtshPk.exeC:\Windows\System\WHtshPk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mjcMvwp.exeC:\Windows\System\mjcMvwp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eumBdPv.exeC:\Windows\System\eumBdPv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GVhIMjH.exeC:\Windows\System\GVhIMjH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FbjFoFX.exeC:\Windows\System\FbjFoFX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CWGWaXp.exeC:\Windows\System\CWGWaXp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eqInPNi.exeC:\Windows\System\eqInPNi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oUuoQDz.exeC:\Windows\System\oUuoQDz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YVeXXQz.exeC:\Windows\System\YVeXXQz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gAgJCtS.exeC:\Windows\System\gAgJCtS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fGpZzCJ.exeC:\Windows\System\fGpZzCJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5f8acdeb5ef89aaabad8b4130bbe7d655
SHA19b6f5e0f84a352b337746f983d3f8caeb09d5937
SHA256472147e4a288d894509292c200891c0337c02d420c7429a2f20282521a37b9c9
SHA512c40a268c5a4b423a6f4a41c3510c6fb6fd580a20b8b9c59078388b7102d98c460d91034c67a2120d05ce22f709241489b3e919d1b21b57b237e8422ce4e7745f
-
Filesize
5.9MB
MD5d96a0467b42306412b1271b682456057
SHA1c20a624daead778f289b24e54a167e7d975a0e3e
SHA25624411ea4cb41e1506b76bf7b422e725e725d2c508837dd498a8fb8c0e2afd469
SHA512579723f9ae3db300b5ea305976564e9f300e10ef0262becf8d4ca86b6cd703915d83d7deb955764e2bbdcd2042bc3f416bfbb6c253efc5dc8f36945d46e9f8be
-
Filesize
5.9MB
MD5c2ec47ed67a78bd12b077c6ff00746ee
SHA14733c87d2ca796d3d982723d6830fa14fc10347d
SHA256d6a128b40b78579be3ef24cdc97786bbc096ba8183fcb3e14f75b97ce710e9be
SHA512025bf5c02a3251550fde0d11175c3a8019a8624859c1d0bf18fd452858a6613cd1ba3168be0506137a158a501fcda6e073315d6a026a6a08e63ec4f3d8c95b93
-
Filesize
5.9MB
MD546456ddfe95df88f8f7204a685dc6ce7
SHA11c5ba3042b5c7b067462b0cb2568d716411b76bb
SHA2563aa4f28d5b47383264b5a3e65e0b662ccd15b0fcbb6ae2cc67ace22459c163f9
SHA51295ff6c328ddc62200e45c7cd22cb05d09fd73f91a8a5477cc54994092ebdc6612cb54f36ab64b6e5383f1ace011fed36eb6627e255d7915714a43b9f8bfc5401
-
Filesize
5.9MB
MD50c71a78381e1c4af2584c9578b823793
SHA1c2b116732fedace94ea2994ef48a281152908f8c
SHA2566d96f478556058452bd1066d687759a59657fe085ad99f0782bddd7aa5b73e1c
SHA51253ee516b4a41a67b1e48c84942c3684142a1e1157874c8d58fc25ef53f882630468a9880f5be5f25f13da27070c9e76778d41b51d602cd9d6e7329087e1bb8ea
-
Filesize
5.9MB
MD5a0189137cd2791b6fa55bf91af358568
SHA104ac781ab5a971545e522fed3d53449030cdc630
SHA2565b7af6d48f8e5570d9a20b212129b4a47563bed77001c91d602507e54d7d2dfe
SHA5121af69c18282bf1dddfe9f15b2fbd6924e773feec78af670e87fabcd390dd11fecafb61fc673b7fafc77b72fab5190a82e773ba369b16b80e5b67286864b7c9cb
-
Filesize
5.9MB
MD5a0db0ae85c0596e6a87ba18581b5cd5d
SHA16881510ae8d78bd7444f894e2e0a57d80eb497c9
SHA25693253d875542deb381c3aea18dc81abeb7651217a5dcdd4212be2bcae484fca7
SHA51271c68a091d4fa2c9b0e41b37e88573ac6c9a2e56fe0984d748b406cedf2e13306c6ef2853047becb3c5bf109889245f1d4c8be19ef1d7323086a21ed3a021786
-
Filesize
5.9MB
MD540e3e84010e6b4fd59f106582be1c347
SHA13b2a5af1a277be79bf186ae49d07618ef9e75e05
SHA2560345fbf4103facadee5efc467a202aa69e95ec581e5b7d6cef28e4c6f198e159
SHA51218b8da84fe7dac1c939defada7273d57168fd4c740cb2b0478296cb7dfea85d7eeb33006a79938e8b0fb403e604b48c035e196b7865d9314e4de07831f3c1e15
-
Filesize
5.9MB
MD54544fe3408760d5621389012e5f0163b
SHA10789eff14168342d6c2498b75a3c7c1942925b2f
SHA25650455c6938325ed9a5535ae31a46f7e54448665b2588090c3940afd480d0888c
SHA512da3573d1a0a8770e5932c9e25511bb25302ce8e80d603ce9e6f183c45e968c745de0a80387609f43b809a14774926c209821df2aaa8df24612a791a51cb54350
-
Filesize
5.9MB
MD58529ff5471a220afa8ed727121a85199
SHA1f9dfbbc79eab6f0c9af0b8efd09c06db3b2081dd
SHA2569c90fa17c9a73bc1e6f0fc159b469d3d68058f9ca45bfdeb28d856cbf268739a
SHA51270303d626f089d6fdb4e066160622b75ede154b45d34e7f03c8aa83192d3ed9647f32924c8ddfec8ac890d7c38f02114e356f473cdcbc65f164fa832f6fca1b9
-
Filesize
5.9MB
MD5c727662e73491d736c7005d087f379d4
SHA1d9fc76d7fc9be0755f5dbff135413818a4ee3d0e
SHA2562c8b9efa3d9019a382650dcb6ea3c0d838f5b61858c496e2eb1bb133f7a1ed88
SHA51268043d6769611c5caacec727f5d3f85fa1e89fa56a62ab9a5ac543070182d6946e722ecd678471d503a9b4ba01ea50e030258f737fb8ac993c8a9e11c326b1d9
-
Filesize
5.9MB
MD509995e4daef6a8b68e9b5ab821692f34
SHA159afdf2ecbfcc4f7fa0ad5fdc3dad92820eae482
SHA25600b9ab3e7bde0b3355552e85e412263d3001a6b96bd2bb107c1d21e441e7e847
SHA51226f0d121761b6bb558a9652a061eaacf0aa275ebc6d351001617448a9801b9c4c9ddf330d98c0937a114d80cadc89014e001150db9909ba54db57a44b14eb7fa
-
Filesize
5.9MB
MD55b9ccce010762acfb03750885e0824cb
SHA11974e0f1cacde1a0dacd390ce015ea7723ed7ae9
SHA2567ede525269bfdf3657f0537c64de2ee9c13c8993fd3e693239864308e36a8ac6
SHA512509641fd303a983c4e6be57b8b95b2f7eb17e6c6678facbd4123675e03735f113d6232407b328c7f192ba566e773bd61ed22cf1697ac365bbaaf02e63865a197
-
Filesize
5.9MB
MD505e6bde80c744ac5f88053e8cf3ba95d
SHA1d00a66cfa829388c90f4991d18891c4e4c3f66b3
SHA25668e998012cb901a125ac35c10eaa4fc1cdab7e5981fd7a5b6debeed451e38cc6
SHA512798539953333c6f56af79280c1bd09ff8a2ed7fd05e2c443d6b0ac9c428517551c2691e693459933c1792fc9cfcfb3763c89537167f74b6c6f449e2296060bb6
-
Filesize
5.9MB
MD54d3263f539842f6341e50505cfd36e2e
SHA127bb3ca5b341247e67b481bd1db7849e54d054cb
SHA25621b25d3d8cfeca7ebe13484b100407a53a1c9273938b634eb1e0e84eb64a7eed
SHA512fc8ff6a05c94a5a5a4c71cef50c0ca6a031cf1a78d486deb530cbd41bfb7bb017f466946578ad8019d6ce344b4fd29b5c8c151e9092bac9ba863452f2e8222eb
-
Filesize
5.9MB
MD550d1fd0826623654c569f5bd0b33cc42
SHA168419e36262bb1e904ffb39e44a44a5fcfcfe887
SHA2565c592ac09abe0f6400e6370f5ed3229b00919f1eb10720bde73e02b5d8c3a6c7
SHA5128101132856dccac0d746e8a517961f6d7ee28bcddb524602a9653925cfb77d094d81dba7aa377449d2f9cefa145afe1216a118346656f3636922ca12fe187bf9
-
Filesize
5.9MB
MD5800c440ca1d95229118e8185d2dab695
SHA11c5f2f6142f5ff9525cc3a2b39745ef85baa2f84
SHA256616d92d29fce4461ce15a187036728c1309b00e52697ebd5cfe8a2053f663576
SHA5124bc89685af8e573e213c3d56fb2a3b0901305a84a23551a03bab0b34870de28e624b54152200561423a651a598db9dadaba27dfcc72903d279b17da709b6c15b
-
Filesize
5.9MB
MD53c144e296ec02b2e70ab9e78b9f72903
SHA118ed63edac488e74def950792fc99873a42c7f61
SHA256a63eac7893c20752b0835fe86f7285278491fd8cc720b03ce9bcd4d3fbcb79fb
SHA5120724840307bdea0a5c8ffee1981349f3629af28f9b85a9a4bebca4b99537000665cad7a45b106c3873c64a7ea38574470c244ccabd2eaeeed91c3aa45f68f324
-
Filesize
5.9MB
MD5066602e723f8961ba20604f19cb18225
SHA1e9becbce898ecac107ef0e1382072c2f82af9cba
SHA2568650def4064f33b3d1056acdee166893409186100bd5c23e2bb9ffc8f895a386
SHA5120404e30cc4a465a50d166a7e83f5a38a1845b105466d01521e2773db23c4d7011d312d571df31c3842b1f4c455f15c77a973d4ca7264c670c34579cf39dfb1c2
-
Filesize
5.9MB
MD5175191cb08ae5a749a2633908796753b
SHA1e20a47e20fd1d2e3eba58e9ec1ddfd631af2b051
SHA256d034abf7128e5ca3a2393a6529013c1689bb808f08ba75820232884c45308a12
SHA512054687254a5b8c3a46d1658bdc10acb62833ad6ac4eb7129d27cd1e7e745e1547c1dd122ee9a13e809ea9436885b7dbedd3231d3ac52bf2e50d50b70ff1e5b25
-
Filesize
5.9MB
MD58b53a0aa7d3dea14033f43afd8fc616f
SHA1af4cfca855e00f8cbf4d0efd3bc45171e89b7b24
SHA2569d279d68c17a0b6ebf31aa890573867057c2f2d593d74b62ce06ed82c31e3eb0
SHA5125f48789082d67a8e19533a915e3b49a3c0b5103321b0930147f0895ffd5b76a61131407c99b726d70e6ed4e213cfb830d573a0bfca7f8dc760c6f8fbbd33c96a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB