Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 02:07
General
-
Target
2024-12-21_fb5e17187a2d9e9d1ddd9450c91f1c55_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
fb5e17187a2d9e9d1ddd9450c91f1c55
-
SHA1
4520bbd40edc6f9a9f40e5f1e8c2d570445c6e55
-
SHA256
34091f719072437d16b7b23d07946fbddde5b21653862b093f7001650b9480cb
-
SHA512
6951a6067ba9ca5988a3eeee8b04d4591d8e6723b835345a326ea5e78c3a9e16d53cd2e40a87fb76deb5a6440f0d30fc5ba9e7f46eb8b5c40c4c5752af1a7843
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUj:E+b56utgpPF8u/7j
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 55 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_fb5e17187a2d9e9d1ddd9450c91f1c55_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_fb5e17187a2d9e9d1ddd9450c91f1c55_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HlDMTLK.exeC:\Windows\System\HlDMTLK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LbkJnEg.exeC:\Windows\System\LbkJnEg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\knswPcc.exeC:\Windows\System\knswPcc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UVqsDRG.exeC:\Windows\System\UVqsDRG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ilRQujg.exeC:\Windows\System\ilRQujg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vEwXwVG.exeC:\Windows\System\vEwXwVG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BDLJreQ.exeC:\Windows\System\BDLJreQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Yrwotck.exeC:\Windows\System\Yrwotck.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BwONCOH.exeC:\Windows\System\BwONCOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RJIHOTJ.exeC:\Windows\System\RJIHOTJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\osqBHsw.exeC:\Windows\System\osqBHsw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wZICuay.exeC:\Windows\System\wZICuay.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PoKeEhH.exeC:\Windows\System\PoKeEhH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KdyFkLY.exeC:\Windows\System\KdyFkLY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fEtwOfL.exeC:\Windows\System\fEtwOfL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SetJqlr.exeC:\Windows\System\SetJqlr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wFkhuEb.exeC:\Windows\System\wFkhuEb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NypvHuJ.exeC:\Windows\System\NypvHuJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qIuuMhG.exeC:\Windows\System\qIuuMhG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tORiIQF.exeC:\Windows\System\tORiIQF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DEMufqI.exeC:\Windows\System\DEMufqI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5019e2e6f730aa54bbb61609e46dd269c
SHA16abaf22e00b1abadae95d60e4023d0a7173843e6
SHA2567ced085fcf73101f164a24206d13e784f0fc3f4c485dac92a23ca67626865577
SHA51298235bac67508b8140daefa2561687559051bd0dba942c0bf5ac29a096340379722ac65d8e5fe900a7da71e52a4c03b6c61e784c677bf9ede2aa1ca5aaf538a1
-
Filesize
5.9MB
MD5d9a4e375484730732c3df15fb3d21a17
SHA12142fb63d85a6ccd7df36e4ba759daf5b7f58a48
SHA256f70abae64a7446eb5aa01c44b70a0d1fb28292e5621219223f87f0cbe5c71b16
SHA512be7082287e2e42e31cc6eafb0ae0d0d7327a202bed363633c830146445a42c5d06c488321f85e8ff45afafedc6e96fb7a84c3895a4d5492446fa71a8f3842e68
-
Filesize
5.9MB
MD5b14698f871b77381cdb3ac64f4fd4010
SHA1e1a406cdfbdc9374d080ebaa06dea04da2772109
SHA256ac67b843ecb2656f030ea6b06023c3e08f48c884f479038f3d3c73e9d5619d94
SHA512a28bd76a2e6ea20096ac1bc84790127dc85b512e8659102bdc8b89eb2bcab3fdf03381ae775aff25416ea5135a52dc3ed8d21462a2a6065cbf39e13677758cc0
-
Filesize
5.9MB
MD585c3ca6648f0ad5b432db550b0c86e9c
SHA142e7f59336b2cbe860b901357228682622e52ac0
SHA256aea237d5e95961605c502233a72325361c1694c79363dccb6c894fddafa0f17f
SHA5123ed8131acde090f28e15af9f05f5146ea1708cd196a8bc24ba4b223be56efda3b5c770f522dcd2c7919efa934630d663e2daf0002e873fd7e719238ed11b14af
-
Filesize
5.9MB
MD5e3fb9a5904b891bcc9e1b1d97a76edc3
SHA120889dfca142bae0f2387193218a31e403caf47b
SHA2564ac022e740e7b0736275a3dffab87f7197df2017f08561f81812fe2dc68f1394
SHA512362e8416542baad826abc2fc40e6550c6365a4a2aa4f92dec614f75f90f39b210d7ec5e08c180c379d21d598dcca9d2b7be72cfb965d4d5dbcbf90eacdf30e0b
-
Filesize
5.9MB
MD5746117584fa3df4458238efab44bfead
SHA18f2cd00f7f809dcf31dc8e2edb27b3d50a8737aa
SHA2567ce9845b1bd552a5229c976c0bae821774eb161ff730b3e0c159db7e00923d7e
SHA512bde50da2169feb032a5bf78857137866292e20f31dd010dfc61b5f56363e1ca7308468a407eef7e2b5b1cc7428888aa4719ebbd96a7a5ae58502fde8ed0e1310
-
Filesize
5.9MB
MD570701af76a112242bde7c3c6de275998
SHA117db49a93bb68de2ce9edf8a129c56f4fb10eecb
SHA2563f57d85fc7d42dd06422d935398c80c77c29e5142ab8af894f74388ea01563f0
SHA512ba7d907081239ba36e6cf8e56a09b65aef4ceebb4aead53006acb38b7806f07ff3ddc1e75750442e0d74dd65441a080b042ccc0e9bf267d4adf2efa15166a5e6
-
Filesize
5.9MB
MD58829ccbcccb065940e6b65deb4f7b3f5
SHA1fe49846676cfa24c5646a36614a35bea8c24f638
SHA256e50f608292ee951408836c0f00fba304a41cfc1d60f32adc1e60a5f0cf544ce5
SHA51297f84e09c29566926d23f360ff98357ff18f1ca2df06e90afca59523699f941fc2f193ef20c41eb7010e315b6d9bcae67f487a86214e47861a153a771efae948
-
Filesize
5.9MB
MD5dda2ee7439dde974bc3a430c28a51365
SHA1260aa5ccefb632eb18cab2b2f900929d00f2f13a
SHA25614914b0d3a3f47097b6ee21784c9883077cb577336af8b34923f356ae637304d
SHA5126ff7326ee0e3db58a8f4cc3d1420bfd3a03132703798a3c520f03c428ced7ba4731112487179a1e6a08f9a05143631e682cbec775e36954b6ed9965983fcafad
-
Filesize
5.9MB
MD5fd1a9e6a5b68bb5bf3a48607d17f4415
SHA14c5302ea8a81d2c24a93e827c97f6010ef6bd844
SHA2560d8f069dcc0553cf333bbff7a1c176c0cda6311553232f6ce806b1d1f1c34478
SHA51297f78f592c740d0360e151c0d57ca2b1f4a6f28f653016e419c54b817940e6cd5557b49d3afae6005c0f56eff1cb73b28b164827dfd85fe1aa061c940725a850
-
Filesize
5.9MB
MD5eec51e8c4fdb0897a70ce014d6c2c482
SHA1a50f71ad99e7820262112726119dc34babe0fac1
SHA2563139350189da12e314aa7b316eb4ea72ff544f74b58c648b029101fa84c575ec
SHA51228332fa3d551ac69361941dcabb75ea0901bcfcfca218259ac7aadad81276ea94792136e81e9981f2d3ad75d13e88c744c9d3aa47fcc20b215add6a9b19db271
-
Filesize
5.9MB
MD520fc31a1ce9436e8c922e1b324a249c5
SHA119039b41f80d60b0efc90a7ac09bb268175fbb0b
SHA2561e5e5807eb84cdcbf8771f35b986702b9f548fdc2c725853348348cb3c47a1f3
SHA5122501be3032c13630c67c2a42a6e75805976eb977fe5bcc02b2575d70a9eb73b0ac53b556c57080c2c467c21ac00b8cde826c460dcda9674a8885967dda3e7d92
-
Filesize
5.9MB
MD5011afe2b380e7558f735b7a04210e770
SHA1b9d0c479312ac89c8cb2c1013e888993de1d8a69
SHA256c3380416d9c49fb171be922cc3e33a6c41283f7456075b46b539722fce7dcc1a
SHA512e432102a618cde7781e27bfbb43e1d00e2eb1fbdb5c166f02786abe211560bcf90c6d6731989ae78ccef27c004784b65af43c8a06ed6ef678d4713f4fa7b38b4
-
Filesize
5.9MB
MD52e7bc04dda117a3d6e3c7469dabc153d
SHA1b66521c800473a6217e90f2f4bfd96f62364f15d
SHA256f26926f1179612c3be03439d565bbf4f3ececddd30daa58c25fcdca4196874d7
SHA5122ab54fb846f24a04cfa6cfef5b50c9ea49ecd03ebd82c967004c4a3ce55adfd74329887e1f43f4e0d8d493ca5e5f596673bd3694cd79d7bbc6f386a3b33115a5
-
Filesize
5.9MB
MD570fa8e3e9dcb8f349cb79ce970ccc7b1
SHA18da6ef8a5a93d36d7fd4b7b262f02977b722c0ea
SHA2562de65d1847580d082b82b5a4d27c966ba3bff550038780b2bb21ec7723a201f5
SHA5129ccf68e061b48de2395a9c88c8e29a68de999d0bf2275246eb0eac9f0bf5ca09048a40ea28aa14714d7e69bb0af0691e6c5a616aa016e7d7586c8bf9e3065190
-
Filesize
5.9MB
MD5c3766a0fed9b2f6af0118b5a32b20280
SHA16c8952b2ea295e5fc3748397650390dccb288b9b
SHA2560acf55dbe258eb1a6a0b90695a78aa6c431c4da3dea8bbea17d391b59f538f91
SHA512e2206a73b33dc457bad2177f398270ada1c2be697eaa45ae04ee902318d13c9a4b733e86150bd14c206a5e1bdb01c4fc29af1cf22eb81edb77013ca47ea4682b
-
Filesize
5.9MB
MD5d7c6fba486e2e58c41120a6707e6ff4c
SHA120f04ac1284292ba8c05b96b6e7372d72ef4572a
SHA25619c6ab5c9fda67fb9882c5a60f93c450faa4db8814b870b435ad045922cd607a
SHA512c700a9169421592537b0b760a4ecbdf7ea357e5656d314370aef7d832adb9823e173aed01f56875528a7400ea52e9c8c4fa7704a76ead30bb49f78246d3a679a
-
Filesize
5.9MB
MD5b267c0e47caf1e49e6479f95be778fdb
SHA1bd2af884dfb5429dffe3b69accc248f20aac8aa4
SHA256203a2ce7f78300d9938d7f529b4b5e98c5be8822d9856b8f0d631271e2fa3d22
SHA51280dfafaf9ad05dc6302b28d1919f9b897ab16f3548392d6c2de95dd5b10037fa5e4ed6a0df413fcb7aba4f61a798ea371be09d94d85169ebf4241fb3437e7ed6
-
Filesize
5.9MB
MD51e5c40c98bd26b5a3c50ae95d05e135b
SHA1b6c0cf703b8f051c27d952f4a7166b6b259c9ee2
SHA256012dc21697292700bd57e09799f56ddd327d0ab4c580ceac6b9b248be31b3287
SHA512dd80d5320ab10a9a5dbd843bb053d79515cff3cb13c14529464b707c3f65e58f599c0f9623d150b8e1a143f09d1fa5ae4bbca7045cf608a683832497b7c0d6c8
-
Filesize
5.9MB
MD50c96d05a479a70e2f57742735daf2e0e
SHA142cc8fe5a88b325e5db7c74d953cc68f8ac03c64
SHA256efeedccd2f054a4d9f4648ab95078eb97e81f8664c179ff39adf4420061533bb
SHA512757691ad3e3f67c27f3507513eccde6dd19e2755dd30714a601fa25185d9a488f5f5e841e3be6a75d1c0eed215534e06f819772b439cc23d2fbfeaf472a29ec2
-
Filesize
5.9MB
MD53502212075fc86f2bc6cb21d7f66a2ee
SHA19dd01ccbd00063f41eb42791cd16abcf049bf184
SHA2560d1d9cdbff541a6c6cc772e938b63960b9e3eb1656ea4f68e3db52cfcfe53b63
SHA5126ddb7b21edcf8af7b894d7c3c28dddc2bbc32722fc82dab0b088ef97e1a950fedad9dbee02115bed3457f9a334bee8800d0615d821f402c43057f420de696c74
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB