Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22-12-2024 02:32
General
-
Target
2024-12-22_6fabe8fa37373ceea870dbb7b8f07447_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6fabe8fa37373ceea870dbb7b8f07447
-
SHA1
5d9705daa2851b80d172875e55c7713a379ad242
-
SHA256
68247b8c9c7d210489c91382f131c4c4fac64d9d72dc2f83ff08ac5669fa4bfe
-
SHA512
28714b392b88bb2afe882783465dcb53bc740114014476b504446466a092a7880973d45487b75493fed7ca9c5d599505a684d2a47ad948914aae023f5978fe7c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibf56utgpPFotBER/mQ32lU3
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_6fabe8fa37373ceea870dbb7b8f07447_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_6fabe8fa37373ceea870dbb7b8f07447_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SULJAVE.exeC:\Windows\System\SULJAVE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bapvXDm.exeC:\Windows\System\bapvXDm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EYeFMMk.exeC:\Windows\System\EYeFMMk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BDyOkin.exeC:\Windows\System\BDyOkin.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AbDebet.exeC:\Windows\System\AbDebet.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LLjEZtz.exeC:\Windows\System\LLjEZtz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IJhaJTd.exeC:\Windows\System\IJhaJTd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GRKcXfi.exeC:\Windows\System\GRKcXfi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FFeRXxn.exeC:\Windows\System\FFeRXxn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\akowmgF.exeC:\Windows\System\akowmgF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tRCpUGc.exeC:\Windows\System\tRCpUGc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Diibtwi.exeC:\Windows\System\Diibtwi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FpKESPv.exeC:\Windows\System\FpKESPv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VObyUTy.exeC:\Windows\System\VObyUTy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\msZEYxb.exeC:\Windows\System\msZEYxb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BMLlCUj.exeC:\Windows\System\BMLlCUj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GQMvmKh.exeC:\Windows\System\GQMvmKh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hGZstJc.exeC:\Windows\System\hGZstJc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DQwatvU.exeC:\Windows\System\DQwatvU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NVGvXqQ.exeC:\Windows\System\NVGvXqQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\suyYCSV.exeC:\Windows\System\suyYCSV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55d4470b24d92ad1ecfbb500899e5a5b9
SHA175aa9677281918524d2a1a1f5fcf3da97eb076f0
SHA25698eb2f814692afe6eab14680152b916003809a7ff98df22c5f047a7625405ee1
SHA5129bb9431a815a1f82e6787da7df4d6bd5570ea800cf3a37511ddd7d341c1f31687f40a434153298514399a0d2b7e0a957e67cdbeeb9c5160b640438d87324bd69
-
Filesize
5.2MB
MD53c9d276c0c3366b41e2d18c2507d2874
SHA19aa3114d9ed7075160efb2a7c9e81ea6898ca352
SHA25669c7dc1b8663fc09695b7a1df62d4d04a7c04384c2d83f741e81f7c9a3e1e322
SHA512ae30fad9d386f218d75d454414160589d4d06776d93e2d2d8174b12f1a94e7ee60f25ead345ccf28b6f0767819b36284709b0edf6003e05cb90a8417ad463bd2
-
Filesize
5.2MB
MD5d5114710c44954e724ffdfc649585c63
SHA1525e453a5d731a9a008a3e70fcd411e219f7b755
SHA256c4fdb95b189182665d0e0bcd3844058003e409cc4d1f085a17fff240980984cd
SHA512f8984eb5cdbfbebf727351201ad79c8ca75f4c4a89f5c70d81063f2766c03c69bee50217f9b982af51838e41995ce76da1546ad1c6bf0541474fc2e6a256d060
-
Filesize
5.2MB
MD50198ac5588dfc492d8bcebe5f8741d2e
SHA118a290a6fb756c221a1a9aecf4f60abf605426d7
SHA256e8a3c419a2a2f106da84458f6288317dee45f5e05b86fdda1a4c60566916231c
SHA512bbbe231e3f736e02dafbedcf391ac63e683eb9d093919935e6a2b0c87959c5ad57be00d7669d397432f61e42d1ea7171db75084743aa4ee503bd51e50b02a403
-
Filesize
5.2MB
MD58840836f0a89371070eb92c40491285e
SHA1fc936f9888f389e6b6b84f2f113b0b95856b5366
SHA2568dc2d9d1f28f2e2f3dd18bf5d0cf1ac7b0a5ac06a77b65b000b39a93296a1f2e
SHA5121f7b4aff30fdc4dafa575182144cf0afa649585405c73fb174a3bde6e451f383273169c76072eb725d3e3ff8892e78d0a1b4321bf940b7547f6b3a18886bf505
-
Filesize
5.2MB
MD5d996d2e10d385a2307f81c4437025aca
SHA1cd4e2f130b63643c41cef7070447d5c20f5d3b9f
SHA2568ae878de344f3b9ecbe11c2bbb3c321cc7355568fdd9d531cce8a57ed5391ef3
SHA51287f1d78ced1ec1dea3974601c8a1b5435a85144640904db17fb124de26cc6c7804ce076c335714463c7da807a6af2d0cc69988a5702625f9e8a08d2bf07d0cb1
-
Filesize
5.2MB
MD52896156253443aa7432c6f45511f973b
SHA1bfd35682000e8a40d5c7c39cfda0178771a80127
SHA256556cd77a6a3f6a8f70f54468dbf124e8debc534f0d720ba2a1d6f54f376980b5
SHA5120646da28858a3ef24c0981c405f1384289ffda913689794b65ccdc76a606d7d7db5843a50e0d8302f6bfdd1ace29ce1a51058dc8f6cd4a7995478e76e37d3dda
-
Filesize
5.2MB
MD5ce19cb79816d58ec9519abf83fd4f81a
SHA123bd9c7545aecc2eacda8401dbb843a9b4f0213b
SHA2560240b589d8cadff7890631d1c2de7720dc52027f8251006be6751a32c69ecffd
SHA51219b92f90c8badd10e2bc1a6d09c23bdd31790615ac02ab0af65c6f679147de4d3fb22894488e333165f590fd95a0e356cf77135edce6dd8dd503fba16fe75a08
-
Filesize
5.2MB
MD503b4370750b4fbf3c605660759c8897e
SHA1d4ea6715d962dcdef7c624ea0a29da1168413103
SHA2566477b1d5f202887c3bed11bb142341eae7de809f7af622e97822eb32bf655b67
SHA512694975fe8e4bf4902a6d4753de48c4b6c7f7a1099a3d0450bfb76b5e6a19e715bb22860091b5ef6cc9ad55369ed9063628407f294754baa0a4e5424caef725ff
-
Filesize
5.2MB
MD56d1c6f16abbf0a09c426bd8fcb4eccac
SHA1457d6ec159e7eedc9c76b59ac71d6495aad7ec9f
SHA25690fce314ff299044ee70d33566e58efe3b12d3427626c0aa09c1d0fcc03edf24
SHA512063e759173be4084de627328a5488e730f8906f6bea2de722f032a3ca72a6d3091050970786927043330b836f081f2648dd56ce232beaa4ce9b544262e9da95e
-
Filesize
5.2MB
MD5aef7b2a52e48f4443fba18ae4018330a
SHA1a0f8431688102802e8e1217fcb0bd82d2f8eb9c3
SHA2566146b1f273c3a1c32cbe64cfc67f28a0400448d2545841acb4e2c351cc284d7e
SHA5129efa12b34d74c3fdbd350124e452dbd5c5f02738ff5ed4377ce75953ee55067cb665764e5f36053d5de095b96c42d7eb77e712296ece382cf61a1f85cf0d11a1
-
Filesize
5.2MB
MD5f9546c960d25471baa02250df1898b5c
SHA1c91ede62c6c77f8d1b0a326b76146c48a7cd4468
SHA2566e14ecfbc93d48ce993e3d879a0a80409b7ce9953e282e1539a5919dcefaf3c9
SHA512c37183efd60f1c527edf121e2a2f010ef3a433341ef11026ba542b0aac523524ae0723b599e25bfe50c307e72f17ec7bccdba4c2b9276a380043dc3bee5a695d
-
Filesize
5.2MB
MD528d495c71890d1f34ca5e83a2b63fe7c
SHA1d837f6c9bc04df4c7c94f5ca0c0af1b1b6a5bde2
SHA2561dfe82f904c45f8ab6f8c521c91f777d19df368c284bf6d7013ddac07ff718a1
SHA512e8786550fab91bbbf64071a35568a9bccfbedc5c0860faaa9a7dc206f61b3176873b1154b0dca661ca8059d2c78ac87f9fcd8afa6e61c104520f4e15d76b162c
-
Filesize
5.2MB
MD562a0e5378e0e3f6127492e288dfce7f9
SHA156c391cfb1ae76dedf35db67c27b2c59702ab57e
SHA256dfd22946e71ea22feb7d008f113128a0c1847bf87858f1dfbf36ce858c2e6d1c
SHA512574b4bb2668517efdc41ea2bfef7ed91485386657d2db0d6866bb4be02645e470f1b35b99755301939cdc25d2b2c7f51f56278755cf1d0a2e4796abbb8ed959c
-
Filesize
5.2MB
MD5f845b87ad5114728306a44925aa79c0b
SHA13c1c4460c031e30a8c4f5e92c7c45b203b2a389d
SHA256249fee125ad709f8c9fe12bf41bf59e00feb1df83dc7a51a5ce79f8a2ff1e311
SHA512296acf1d2bdb3bee40a98918c8f67b3e57357f2a8c8c099858fa9fd63b1472c374c84dd32468cb7b3d2759c7063a4c8fc05b8de616bb4458cf36cc4a137757c4
-
Filesize
5.2MB
MD53e30bc6493c9df6b06f06e466360bf81
SHA1fd9a205bcfaac6bcfe7aec088eb3fbbdf1fe06fa
SHA256cf8520dba8d0eb2144765bd33635e9266f6ff1ffa2beac6bd3a2e2a83a3a9f4c
SHA5120bae122c143e63ebf45cebeb60ab60cf085d4926b194439ddaebb5192eb695b95a0c9ec2f8b659b2201896a86db6529915ea6ddef1292625f82dce6328fd902e
-
Filesize
5.2MB
MD5d780aa668d5fd306cdf22c6e5ad8f18f
SHA14a52820fd1471ec53005d5e596e1f3ded1c5829c
SHA256c34714d7e6a070f2a90a99bb52b8d2228170c328741aa6ca1eeb7bac1b2d1773
SHA512352f3b9a6863c1c075db32ed041350fc03040aa60510090d6cb0324faece9c01509dd10a4a31e2abeaf9cab3d06f10a0305092831b5bc0340a923fd4ff00e88f
-
Filesize
5.2MB
MD589a877e06835a26c6168de2320f1b967
SHA1534a9c47d2f9ec8133fdf9fde7613eaa507dac4a
SHA256d7186da9c136da80192c4ba4763964a38e3e06fe1a05ed47f8eceb14f64d8b56
SHA512347dd4869664bd256bc88901da6d8ad7d56f72e2568ff7b3048a3984e0275be0d84a5dc06d6524931ff8c4ff3857649c9c371ec2d3f1d9f8074079f51332c75f
-
Filesize
5.2MB
MD538e1d3e6d9d43fb3fb6911de84062aea
SHA113fd2c51601988adc0ec99097698f6af85f55e31
SHA25673dceecdee59c779202ee1cc7e1ba964a8e43446930180265f81c517a341f648
SHA51233984b1adfda7cf990e7ea591c2809bd1566e12c567a1ff6aeabadf5843d130302da891df851c4000d01090b450aa0c3e76292690f5a38dca93725cfefc8a27a
-
Filesize
5.2MB
MD5ef39a387c5d52f194b336c465f3504b0
SHA1f2f2b883fd53ee2aadf405b0bf4fa66b3ca267fa
SHA256f75e6efe8112e12b5d87b57c60ffe877b486e29eadb36933db933b3153b34b90
SHA5128ce1f0f2a28ce6dcd0dbdd43d79198dbea84e2e286219d95ab6d4d26fb366c0be8ed83787bbe2cd2d71c2ae1d58b6411c9921d990b517d931e912c5ce9f78b47
-
Filesize
5.2MB
MD5d69914f476b237dc6f5ba1e5e79cb822
SHA1bb0d1e3fa74585bd1ad32dff2389e060b0808a6b
SHA256e92cbc9efee1f4fba5344af78c1cdcab5bf70c70c5e521a9e0f9382658128e51
SHA512f106879ad15351b169b2f790ec87aaeae6c6d61cec7757742f2065bbbcb8074f64511bc364ed12e8bd2eae18909009aa0d3091dc283a89fa826cbd3ab110e789
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB