Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 02:06
General
-
Target
2024-12-21_e2d95ea62fe3d1c788493b6e2052c089_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
e2d95ea62fe3d1c788493b6e2052c089
-
SHA1
2e6b4d6b4782faf3a84165052575a8e5f9d05d48
-
SHA256
9ef79a75ee11ea2b398174795fd70eafed75acdf1fb0a5068adb587bca194693
-
SHA512
2d69cb3aaf8c16d52984961cab7f6211708db7184d50fb6dd107a231fc1b0fc9015ed3f6669aa70ab5ae6bc55b463d3f91108201702a7c8a93abfba94795709c
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUj:E+b56utgpPF8u/7j
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 56 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 52 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_e2d95ea62fe3d1c788493b6e2052c089_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_e2d95ea62fe3d1c788493b6e2052c089_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AJHyzXD.exeC:\Windows\System\AJHyzXD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Nbmnabm.exeC:\Windows\System\Nbmnabm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mYPqJLW.exeC:\Windows\System\mYPqJLW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TUpWloV.exeC:\Windows\System\TUpWloV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xTfhyrG.exeC:\Windows\System\xTfhyrG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GJksYIw.exeC:\Windows\System\GJksYIw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HLrTMVL.exeC:\Windows\System\HLrTMVL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oJdqkPA.exeC:\Windows\System\oJdqkPA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fgAqqvF.exeC:\Windows\System\fgAqqvF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MUMuXBk.exeC:\Windows\System\MUMuXBk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xicOYCx.exeC:\Windows\System\xicOYCx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TuWkTke.exeC:\Windows\System\TuWkTke.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KibafUv.exeC:\Windows\System\KibafUv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MqmmEaE.exeC:\Windows\System\MqmmEaE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aHIFLeO.exeC:\Windows\System\aHIFLeO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mVXzvep.exeC:\Windows\System\mVXzvep.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TdMtcLL.exeC:\Windows\System\TdMtcLL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MjLxEAU.exeC:\Windows\System\MjLxEAU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NEPAFfR.exeC:\Windows\System\NEPAFfR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dkiGbPp.exeC:\Windows\System\dkiGbPp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sqhlipa.exeC:\Windows\System\sqhlipa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD51a5df11c8f332170cc0f7916123177b1
SHA15928d9d7f9415943e4cbba4de92bb99f6573c4ed
SHA256cb8114e103186e8fa03227d5c68c13526f427093224c45bb46bce51703aabfb4
SHA5122db41b446720c0dfc15afbbd208e68bc2c62eea434694b34e8a3b3d61e61684896dadc8bb145a3b1d9212aa9af25335f0255a193dd123539fe96f50eb1df504e
-
Filesize
5.9MB
MD54ee4376f742666d2b2b5e3a551a93dc7
SHA1706cc209e5f44994276bde9d2c8efbd1944df0aa
SHA256063e60bdca1c9b334f0e059e998997022286d250379f0aac3d8a9f35ac793769
SHA512c7ffbc46fed2662e593ed012c938fcf76552bfaeba50b9756fe23d2bc5a5cff1e60bfbd65d90f33871697a66238f029e4dcbd6dc746ce1f185032bef3bddcf92
-
Filesize
5.9MB
MD548864183020f6d33645bb3785228cb99
SHA1585c4c214cd52ad3238f34bd64af30788e7cae75
SHA25661e9ba18f009ff1a43eb3a420cd42bc5ce74555097860d72da5b39f090b6577b
SHA512ac773cc89ed3cad75b0356e1af5f87c62e8691a9c69f400edfb849b099f9de9d91d0344059a049d64ea62fb292ef07a4241912c8e0921a677ca68c45283d7fdd
-
Filesize
5.9MB
MD520749d1395f3af196b4cb64c2f65ba42
SHA104ff0cdc709d45aede93ff4f23ab6739e2a843a7
SHA256ef190c69b319e025f2c1e8bdf84a26eb67df1872e593a3ffb04aef3583a04acf
SHA5121d3a6062751749de055c539b29f9af3d604704985aabc798503d0fb0f43dcd27cd5c299157813b4afd7e55c55a47e05ed217f6f075ea5308ba68b46209ce0d80
-
Filesize
5.9MB
MD548075ec3d059b4dd22c135f112296143
SHA1425489275a340167e0f86f585656d9d1389915c7
SHA256a7149a6fe2a2cceb9e2e86f3f0661a5ee0ce9e4396e5a920b401cad5471c4b44
SHA512fd124f9b1af1dfffded2c66e6610921f16bfa47ee6f08578539c0ea66e3f80fe78fd3f7907a75a7eb09594ffbcd1203e8d5d79f5dfc4ceb2892db8851b2683d6
-
Filesize
5.9MB
MD58ee4942b97b743087c33de6e537c1908
SHA134337350565077d0a5cebc816d307cca6e40dc95
SHA25632ea6c056da2bcb72a3ae04618c069310ebd0b93560146216fcbad1e46c4eb74
SHA5122fd4cdca8ce66925d1e85acecf2051b7f4d4a5f315d6b7b91f5aa626204f47eee0e56c1e139a6c0f0a187f08ff9fbbf6ec573341a7205f90145ed65a383cb624
-
Filesize
5.9MB
MD5a07ffb8129ebebeba58fb9299db35ba0
SHA13fef7526d33a2e9b22db6bf7551be9a54a24851c
SHA256d6d9f71daeebfb82826b7c701d4a99b87af050528c1e7046b62cc8c45fca8bce
SHA5122463071b73c363253ee82eac0debb67bffae5e875b4a739aed692ddf0d129676aa136004d3b609c3b38dee3e301fdd72d2735118fe0d5aaa45d24c0dd34dcee5
-
Filesize
5.9MB
MD598781b5f1e5c001ad03c46dac1814ee9
SHA1d4dffdddc534a2688be6102b29beb581e93b4f8a
SHA256773895b8f8d0919f2012aa2e6089e1239a83414db201cdb511a22854ba438830
SHA512f60bfdee11443dd2d306bbb2cd94e658d339d19259cb5a665ad4f5be63957b2c53fa979da15e413b7d070ba1edc105081dd61acb204163195390e0d3796c9630
-
Filesize
5.9MB
MD591031cee7a741dd3828b336ac76d26fc
SHA16a0eba4e4b848bb64d2d0b387fb5b8c61d0a5989
SHA25682dfb8c94302b1af1e0b10f2b4c8d0a2d22091c5853503ad7b3ed32510c5e979
SHA512f48b6f44913156f94efba8a53d168a55b2567ec44cc13d5bfb4f0f8c14aa7d9c8f0747b029fbbf50d8d9c181182a625df100d75bd2faf3861d437cdfecd363f5
-
Filesize
5.9MB
MD55ff20d9df00ecbbbee4d9f41e7d4eb08
SHA1e4b33e04278eaf3de22e399141ba9bab4e5b5af7
SHA256b4ebb46a03cc2ba1ad8235652f9e120880dd15ebb1030abf87e3afe01baabbd2
SHA5120f8939b2d4344065cf81dd3c70b8791d0676f7fdb15fdadccbeccf2eeb9876147bde792944d8ea4d38c2cbc88ee12652ccd3ee4673c29b159e34adb52cc3fded
-
Filesize
5.9MB
MD59147dcbeafc11cce9231846ea0ae202c
SHA183679fd1fb92a75b844b1654b8fa52120273da11
SHA256d43a9b9839b0bb6c30bec59b7ae62c06200dec7b10dd29f55f27b6f2b4a4bdec
SHA5123376b3e452bb983fc11c9d17433dceed421f660e4a773cf8a7e60eedd68a68a962e1630e9efad1a1b7df0d509f8c471bb3b762fa131ebe20cfec77dcc5a51a19
-
Filesize
5.9MB
MD5171b4b259755dde18fecd51f7618c5f5
SHA164461e1afe5b4b469273a6edcda8f8dcf9394330
SHA256e39af6cba5edf2f475af87a1fef710097dfc1d7f76903d39e0c4b0942814fc6f
SHA512a967f4965f319d1c04ab80ebc493c7e7a4ccdb40e55c9660f549515727dfad62b917257f30e59b7ea6055d575b29fa8c0e9c2bf8e36caafe689a931c1a978d53
-
Filesize
5.9MB
MD586659e115888534360429208a7622dbe
SHA1340c4a1950649c19db9bb30699c74ac62f4c413e
SHA25620f861c83e33b016b76fefa36d20f5a2b46ef790cb5e1f9dee175b664ab5a317
SHA5129c89a484b78d424dfbaf43e51384a62e5407852559ff9193994cc64b9e482a18f2f134752262c759ddb351d254e653873c958f703174c2af02192a7c92bf3111
-
Filesize
5.9MB
MD5f58d09da5add3b7c48632820d8e5a414
SHA1a756a318b2f9388255c3572fc99b5c5dd91844cd
SHA256b68854f4ca1f5a7b7df5ad5fc45ea4e12faeb009cb418329ed7cb5e89b663668
SHA51210dbfcdb711bae9b008df06051a6adca15fd12755b9de287592cd876266d01a478f3c25d2bd351bdd287bd66e2a03dc597ca429f5fa460369fbcda1746ea1d5a
-
Filesize
5.9MB
MD5681a14b71c2a1bc44ff89d87fafbcc90
SHA19d4dbc21ae6e09bb44c164ee0d34b92e19ce06a8
SHA2563d04958549b69327b7857ad9112501404b382c2843ed40ad7e541afa5aa41790
SHA51212ab146753f4498e40e98a71695f1bfedf19541b7162cbf800597134aa1702272daa4849ff4d8bcc5885da17f5c4b13d1e555a0d47c5793c3f034f908c2cce09
-
Filesize
5.9MB
MD5e2f220aa991edaa94d17d1356aac26eb
SHA166668a92ec4ed0efd8d842fd52f3b8fd1c156b29
SHA256b24cd3c2c8d3151634e1d203ed54cc5bcbd30cf5da574a1a0b78b5e902c078ca
SHA512eebd4a362214542fd24526a84770ed39d1ef958dffdbc8830ce97770a5fd7cd6e40084ff458ffcea4357324d30fd0dd365c2a6b4f92f05a94497bfece5d15ddb
-
Filesize
5.9MB
MD5e07da36af2cb96444d10eb8bd76ace87
SHA170acc7349320a22c0d09052d97301e9871fd6404
SHA256d2124dfdfc8e871cc359bc38e853f3259151474615b2f5e91fbedd58d92cfae3
SHA5121ffa634ced5def4a28f1b208d9df86eeac4c41ebb6885cde90a09b5119f18a259138342163f85d758d545123f6218dfe3a7c451c97238b68c866e098dcad7b9b
-
Filesize
5.9MB
MD5b72eb05cb227ecd9d1b7253b808d7a80
SHA12d13e3ad13b60d9ecbb1851939540810954930b3
SHA256781f27d977303ecb224a5a8ab72e2ec5326a74b818b68fb39155eaf67cca1454
SHA512bc9ea82bd5d0bcded29143c1c43ceca767889549926748656a65f5311f3323c4edd9506017ff61dee12c7f12996ba9cab0c951c7834f7462af6b24ffc25efc1b
-
Filesize
5.9MB
MD5078159575c4b3fb62dfa684e64f78ccd
SHA103246f74d58d97c11507b824da942bc9f51d1a7b
SHA2568cc5f068a022472b27a214d9c9b102e3bac09da4a09bdcf88a87302c1e4e5039
SHA512c493a8c05b6b47055a88fe57129d19b1a7f7e44053b037ab3cf659a0d2225036901b69bb5cd5438997210c7dd1f47902342296338a8a854431c6544bb80c635b
-
Filesize
5.9MB
MD54baa2961f51883ce917950b5a246a443
SHA1aaa627a6a30ff920e157cf69b521802d098c7ed9
SHA2569c7bc83372b21dd7dcfb37e7dafd9ecdb4be1fb7a656d4e58e90907e4d7c5ebc
SHA512493b8bde3d3df96bc5a0c1abf09104b68a10109a991b4b94763412d374f77e609b336dcf18c8c925ef8cbb95b1c0d8289ab052aa12b5d2354306bec103d14a49
-
Filesize
5.9MB
MD5c77314d4d1c52635321f88189874a3cc
SHA1d7a791b1e4666b4fbb55390cad05d71585976bbc
SHA2568a59c61aa62490b0678a2e52f62057c548202d8ed3e412f70db4bd6f9981e9cb
SHA512994ce104880a41536b25ef4bc02f25725dd36bf8f6c8b6d065e2f60c63454fe05d5c3e28edd4c4354710424e341c03bfba306e0849b281b34d6a73af7934f431
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB