Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 02:32
General
-
Target
2024-12-22_6a8338a74de8bdf1a6359a19d0255423_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6a8338a74de8bdf1a6359a19d0255423
-
SHA1
7123bece008f50e5628716fb50caac822e8ad924
-
SHA256
9cb82f9e4b66bb0d2b6366ff484781b6a0c4fc31f0a6059172d36c98c558b2b5
-
SHA512
51dedfacc4dd83369006168888dbd5565eadc69f46bb6d0fabcf6f11241b23180273b5ea2d50762d8917d17b58b57387cd6cea722aab4d17edcdd02468d223bb
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibf56utgpPFotBER/mQ32lUR
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_6a8338a74de8bdf1a6359a19d0255423_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_6a8338a74de8bdf1a6359a19d0255423_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\emDzPdM.exeC:\Windows\System\emDzPdM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gjNxPNm.exeC:\Windows\System\gjNxPNm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jLYmoNN.exeC:\Windows\System\jLYmoNN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QJdTfYj.exeC:\Windows\System\QJdTfYj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PniJwPE.exeC:\Windows\System\PniJwPE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tsrNpSC.exeC:\Windows\System\tsrNpSC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NHplacL.exeC:\Windows\System\NHplacL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eqPONCw.exeC:\Windows\System\eqPONCw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\naipwGp.exeC:\Windows\System\naipwGp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MQkrxwy.exeC:\Windows\System\MQkrxwy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pygXcOy.exeC:\Windows\System\pygXcOy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KvXoSwd.exeC:\Windows\System\KvXoSwd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nZjaZkS.exeC:\Windows\System\nZjaZkS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WOEHhFk.exeC:\Windows\System\WOEHhFk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SAmqQYN.exeC:\Windows\System\SAmqQYN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fNAzPBh.exeC:\Windows\System\fNAzPBh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hBvZLxx.exeC:\Windows\System\hBvZLxx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gUPIvse.exeC:\Windows\System\gUPIvse.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xiBEyJt.exeC:\Windows\System\xiBEyJt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cSRqMUV.exeC:\Windows\System\cSRqMUV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pBGhjXA.exeC:\Windows\System\pBGhjXA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b601ffd6f6f0157ed49bc8fa47886a7e
SHA1082fa5119b17dd0d6a6b5d39809cda60a30f0ffb
SHA256aae95293502e4e72a0f872287a13d5acdc6110596441fc2bc52202bbd4fc79a6
SHA51239a2255521c27a85b16b8043e6403736526c6aceb429191693e6265df5b7a2fb0667c9b236e0ff18cdd491ba67c833061c951c32015c43eb3759920129bc7cea
-
Filesize
5.2MB
MD5963eab1bfa9dc64ab443a8a105ad9170
SHA14015210b23cce82d904d328b6a93bf588d2545c1
SHA25632483892b64f70ab14783f84762d4fc75809c91782b6bf698147e6bfece5c9b1
SHA512882fa310f20bc4d9489b1614cb5eda65ae372394a2944a955d0a683f8145a213479f87dc614f7063bf820e459af6562b553af4bb0da00576f07280e6ef8a886b
-
Filesize
5.2MB
MD5b4083980e13ab3bd53471181bff2047c
SHA11ed33c1338b5e51987a2347d0bf9678049cd2c10
SHA256b3a92458f1e83c960e400bc66fd3022af89695a886b10f467c1c55e632fcaaf8
SHA5125c3bb97a0d1fdc84a59c9b0812a271a28259390ce9761e80b422a525f5ba3adcd8d328f8ab59c4dd184df3281c11c6fde93eaf507a4e81e5c6f05320d701340d
-
Filesize
5.2MB
MD5048713ae9c3325511864f4f8a2a789f5
SHA1b07440e0442f4936f5ab5136f5cfcce88d39fb6b
SHA256df8ad77d36e83fd9f5ac26db52376d6e19abd7e8244ca00135d3aed101a844b4
SHA51269a90c45d360e1f3f7c45d40e6c4b5d1c45642f8e16bf98b82ca2e105c19d8cbb787ed5a43f0589e962d3c843c1c0c6444a2622b77bdf7a266afeb48f90bb957
-
Filesize
5.2MB
MD518e346ea6ad94420906851e9f7212b0a
SHA1df531d2bbdbda78d0cded9a8dfd33cbf8fe07993
SHA256cc17355628079665334ac5f8c2497437f0567f6380661c83f757deb69f5574fd
SHA5126976cd0cf2a8f9d890bad4478d7ef3128f223284e186feda7df9b5d98da4856834e2b585cff5f42284f0e94ddaa23e27a1e033349ab01bc31c3b6a4e8e2b65cf
-
Filesize
5.2MB
MD5cd2209f5c4f9b48f0c1f0994e885157e
SHA17c33f675eea7cc8a0c40bc2bd177d70a102341e7
SHA25644c1abc9a1c93deae0a41ce58080e368a02949b321ae7851922ef0a846fb1d30
SHA512c93d486482e199f9d9779b53a462fce5edc68e4ba88f3666a4dddc7c361caab7952db69a096bd515ade7a64e81d1c2d699b33ee8a03947cdaa36a1f87ebc02c4
-
Filesize
5.2MB
MD5691616f6ca78d8db78815f203e24d845
SHA1ca7fc7e769cf8aece81dc5cbfa649045a236356a
SHA256e99bd05aec0eb537f9fb099daf76a73a90dc2c9f15fa305269f03b4ae970f7f7
SHA5128824fc0233a6ba7d0d06ecba438fc6bd87f256f290af81a2f084af851808b2431f904f1702f6ba6b1df46fdc9881ee08b4eea4d58dfc42b08ecf08882ea71843
-
Filesize
5.2MB
MD5dc3b5f9318f48e2125aa837d87157b9b
SHA1ad2226ef0d67eaa8d0f40f1c0fe4845e995efc2a
SHA2560264b716318e0fdd9553668d2503aaa5dc004fe559451a4234d1ca3201ab53b3
SHA51246c2a27f2a99ea910087d1cc8f62cd8b31f5093f6097144ae786fc3d6d7c9b32955fe53c3217a49c7d59982aec34ae68dd7790295bc820589e8b543b9ba85451
-
Filesize
5.2MB
MD5354685809f7f24750037193d4ff04561
SHA175454c1791f0ebc2400717c34a4843538362b0ba
SHA2562b767d9085038dd4b6abc420c027a0f79448c5151fb856885ade9e7c9b6a0deb
SHA512e4ff3085dba1e78cb3f1fbeee90477ae5f67c19b7c7c0387a2e44b816176bf60af05884d31d84b8845a6d5080f3fd46adb8fe9843c9b8992d9279be6fe769f70
-
Filesize
5.2MB
MD5b27cd947ac9204c22613a90c3ae9c400
SHA117fb02d2c05b5cebbb5b909da4c30caabbab3bae
SHA256c6cf43ce6a0d2fa33ae650bb7ee5b94a4ad4837fd7f469fb942dbe4e2a71399a
SHA5129d1899a18523aee9b2eefd361c967d13f2fc70be5e57583996a50428b36b796765cca1772aad101efb1cad69ecbdcbb0a9a614ed48812568058c6f4c0e3aa65a
-
Filesize
5.2MB
MD528cfcc5f90af684d835b73687de503c0
SHA1c369f7e52f220aefd2310802903392076f952d73
SHA2569deb3c40a2cdea606473225230865094751dda5b950c7fcc6c57ceee65b7c484
SHA512f256e9bd5c33aa4f14f5f2c2d7c43ff0195079a3225be2904acf4d8c79d756f9ba89d5c1fc7af4700d1b6d4412a1ffb64ea2b77a0d4435c3e16f2debc8de2edf
-
Filesize
5.2MB
MD5cf1f0b7bd26a9fa3217de0b0c4e3528c
SHA105f26163aa0f59f0532ff00f1e8cec951d544cd6
SHA256f4925812a9461800f2d2d2d219130ad9766c5526f078fadbf008017747fd135d
SHA512c7b31bee5dfcf3ca4b10fb8424e091a9d53ae4460c6eee0b072b31d4d4971a1360aceee781da51f7a5f109ff92ba4e1602e572ded3dca29a80fe04ba20bebcb0
-
Filesize
5.2MB
MD58e54f9219331aa41c016e1bc1f83eb26
SHA176dde024fcc62cf6d133f0f288c41dc4739e8479
SHA2560df48ce74be1cdbd6afd7b76bb630b0f4aa2154b7fd18133dee0b2fd3ceb55a5
SHA5125beffedb4ccab4402019417db8d09b7d029506e7cd2a97d7b0c896a2c74d9713f60e99e66f2262b443018baeadbfc44ab089f32a49619ceae321c89c05ebb8f2
-
Filesize
5.2MB
MD5a2f4856e525c77990acbc432e69af07e
SHA1edc93c3911e0f7ba387005bb5df24b085d5d6a6a
SHA256211904aff73be10fd323c4829f057214f4d8340ef65e775ab3fb9e66f774e5a7
SHA51244a68572c4f19e2530059c29f40df9374e09a70a539c137851488c3bfbf2a83b6abf8ec40f5c8020afa9255205091878aad5eb5705fd24b98bb2ffd63afe679b
-
Filesize
5.2MB
MD568a26ef3d351d0dc1342561612bcb54d
SHA1d617c38b39f96ddd05bbe89574da8c607893a142
SHA256dd9e744fcf78189da752118d93beb37554654c692abdedd9f557fa9ee21be4c6
SHA512d7cbad6634eebee2b98001e8227db147ef3477efe8d187a56a3cd1b355bce0d3a357386abe0a881421ed58590fd22cba4f2739052a3bb27e8fcc2c1c6f01eafb
-
Filesize
5.2MB
MD5bdc74ed23975c2c098cccfdb69403ba8
SHA1aa9483ca490afbb1e7a2152115c8981c798196ad
SHA256140c93a21a7808a5d52b494125947bf63fc85d803eaedc44592a9f34c9d0edc4
SHA512a6c7368513c686dc4553a35c2e4dbbaf2d348cc3be2e28122c35c8406421d706175d2aa12ad52a63be147f5a939cc7eeaacf0d06db8c7f902058293c2cf57616
-
Filesize
5.2MB
MD5ba8b1ca20312b5b34bc893ca3beb1f95
SHA1c5759083bc20441fd1166e39c151ec2161ee674b
SHA25695f0b59b4bbd2527f164b6f4a1850cbcaa0d53c1acd691ef49ce03d78dc5e4a6
SHA512b2f1710bc34085f068061be6e8d2ce867af2881ea18a127e4eb25d182aa05fdd7ec08e1d599716e2f53a709f6b6fb7125cb0cd5b32681cabef1e8628a8eb1dce
-
Filesize
5.2MB
MD54b850b2184a4341c39c913d1f628ceaf
SHA1bf99f72ecb4a763b4c1e3e38548d376944c774ba
SHA2567b11480d56ae4803006ebef46ff93cbb28b9cccbe1cda9f044650738a84aafe8
SHA51286a4997f532e9dce109aeace77484140e7abeb01e22fe63adaf23223bc3ddb249720faa44a1d5c5e60b19bca3ee40a7fa86300441dcdcfeee52e105487dcabf5
-
Filesize
5.2MB
MD582c09015a6a4f7d614475607e5ddfcfa
SHA1acad6a2af78f8f2cb6b895af8c130802dc6030b1
SHA25621065a6358a97d004c4f424f5af6766300e3b4de5290eeb7c608b1af746a1432
SHA512cf81d2faea8a326b9640404e020bbb06e4d59d2c36c2c47abb37c357661139b6cbd8dc483b3cd6196f8641bb93fdf2b988bc481acda100206410c3dd6717fd47
-
Filesize
5.2MB
MD5e19953c9a4dc129c68da94c49e2fc60f
SHA152c48aa5f58626283789970daa71b80bc56d942f
SHA25693942286ab42c0bf108565d2893758cbcfc9691eff8896caa57f5a324daec130
SHA51242b33dc9b95c8ec317120d8117e8f8a7586858a5f7ef6278f1f21ffe617a8e3c874b9175fc555b35a6f0af6fb8328b850a82197d0d44d08cf070c0a398c11fed
-
Filesize
5.2MB
MD5687b777121f0ad7bc5ccf6177fb0a3c2
SHA18373536864e4c8dd7bfd8bead069347ca5422c44
SHA25610ecb8936535642756fd57352ae8c068c577a663503aab2ae0ba1dd27bbc639e
SHA51292bf646adbb7b50358bb5d325817c53dc065550ddb5c54063aa7ffb9962e82579b497c7c8d15606ff873d580d2fb087866dc4c984a84f18ff73e912d6456f0da
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB