Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22-12-2024 02:34
General
-
Target
2024-12-22_8994ae92d415ab0ac2334077a90f1e44_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8994ae92d415ab0ac2334077a90f1e44
-
SHA1
eb39920e631d8e6031ca320de8a9a42870700bad
-
SHA256
91259be9c86bf8034a3febb5e887dbc77344de37539e9175b028e4899ad4df9f
-
SHA512
2777fb63f8249a845392631b3ad50595b7a331d14a2db6f9de046256aec94b312511695efd36ee237cf53dcf36ea1e59cf33082cb25f7aff9da60264e6742c68
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lU0
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_8994ae92d415ab0ac2334077a90f1e44_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_8994ae92d415ab0ac2334077a90f1e44_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\POGmWdA.exeC:\Windows\System\POGmWdA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IUzxMru.exeC:\Windows\System\IUzxMru.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IcsyIao.exeC:\Windows\System\IcsyIao.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\artyOXY.exeC:\Windows\System\artyOXY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Dcmrgvi.exeC:\Windows\System\Dcmrgvi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uUdZvTU.exeC:\Windows\System\uUdZvTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LSIwhKS.exeC:\Windows\System\LSIwhKS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gdRpRZY.exeC:\Windows\System\gdRpRZY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\euTBClr.exeC:\Windows\System\euTBClr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SnUocAq.exeC:\Windows\System\SnUocAq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eGQqNnO.exeC:\Windows\System\eGQqNnO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PZIsIjI.exeC:\Windows\System\PZIsIjI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YtbNYMU.exeC:\Windows\System\YtbNYMU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OHOAsVA.exeC:\Windows\System\OHOAsVA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FvwsNzb.exeC:\Windows\System\FvwsNzb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DMHVbug.exeC:\Windows\System\DMHVbug.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\khnKBjL.exeC:\Windows\System\khnKBjL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NqQUGpT.exeC:\Windows\System\NqQUGpT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TtNdUoE.exeC:\Windows\System\TtNdUoE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KrNnnEU.exeC:\Windows\System\KrNnnEU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ncTgPpm.exeC:\Windows\System\ncTgPpm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e659fe20507aa317a026d877d707422b
SHA16fb349580bf0517f64fcfb7b77ef9b59e815f18e
SHA25676d11acc0ebc7b049462eb84aff829b9e6011882c8af96e06c011607201fc2e0
SHA512f915486323721c6c4f1cc6e05497c7cee91fd2ecbe0a55333974757e1b2259299483d25e20f317778a7aa746e6ad3db0a0500e6749be24b907729be3ccca2305
-
Filesize
5.2MB
MD5a04562fea7bddf6929a8c505f791e5e0
SHA16190e1ae09d480df794f5adef79e93c69dc4f415
SHA256f68416801c19b504d58d54e10e15e6efa98f91af2e32a7eb96a46e329ac0b314
SHA5126ad8c7ff4ee9cda6c09808d1949c0a6343d9c619f77b045994a01a9588e7ed8f64351986d8a42ce09eaae2d4083aeb4a36ceab865db142fd28c69f304e4a34d9
-
Filesize
5.2MB
MD56e060b6dc9afb8ccf0c9742bc5638879
SHA1edb98e4078e61905186229b9020bd1c29a10a468
SHA256b3bfe35036f41ba674777342588c2ad378009215adbe8046b026992409eeffc6
SHA512079fee414b7ac6c0995df0a86efea4c18eb735dbfd17996d8eb6677b19a1205a14d3d113fd7a895fa2e40b2620ac3379f575f1d9c72b1e0edce213a7394219db
-
Filesize
5.2MB
MD50818a67c661d1b4f2b93856255a104d5
SHA1a2845c684d3e7a1538a4ed4f7bbc93ad5a30babc
SHA2563968f554939e4dc045d86e2949fff64cb7e38793d98706decf71a3612d2fcc14
SHA512fa07b9edbbca2bd3dba639ab4e454875bc7d0e49c179b7f7c73c4a87cb8d53ac11e79c340062df355a2ca1b210c70ce599ca72aca22740d2742ad26597be0b93
-
Filesize
5.2MB
MD5aee47b9e91048ae6da25a2ce4ace2c80
SHA134fc61eacc7a818cbd284d7f86c9472327a2a067
SHA256da09dc1b68252c458e31b12e47a4df09f79780ae1d742aa3add5c3fff10cbe32
SHA512d98d11bb70f350d3b84dab837f503ed3f39467ba585eb26863e5acd514c6d16b71363bfd5b21d9fed396ea9434f0176313b8d498396784925d62bcf343c4fae2
-
Filesize
5.2MB
MD5484ebd4fccd1b443b9d7494d1fc1ec13
SHA1a2375ba87a084dd2e3e765bc527efddf67b097b9
SHA256da73c5412ae85593ac9894523a43bc988a3d9166ee41381d7c5b1ca65dc7fe45
SHA512af5ad20e4ca2ab995776b8abb3548d35fd3ba9e351eaff2409bdd40ed60511f0edf899f89251f657189a8f4a39ae24c54ee55483d36f3c06e7811c40baf619a9
-
Filesize
5.2MB
MD517e96fc6d3af386f175c234e5ae50cfc
SHA1860dc06d9f63daa4e361d0d4f9e04f2c3a281ce5
SHA256cfd84c9d5c23a1e3cc4cb1c787ea1749a7d9f352f998b7b42d3a340222409c31
SHA512c4cb39605c79e49319c39077fa81cdffb920a1e22e2fbd75f92efb77b71475ae806ee1e5f585d05e464defa9d3200d07982cfb344a9db38e7aa2c4e4805ee6aa
-
Filesize
5.2MB
MD5097ec1ea26597b81b924059536b0f99f
SHA18896113e7dd86ee8a10d90d11e86b6f31b873c6d
SHA256af9ee47c61c370c31928e4e60b9491f66d4f2b47630e651ee0a0de2c72bd1fd4
SHA512b85a260e51e0cf8e9c01d459381259e8a7be8b54c6b2d3ca1f836079f32a7b056f52e14f4fd8492387b991bf08d09629cf903a34ee859a6be66d26f7b6541c22
-
Filesize
5.2MB
MD55495f48e48d6a9c32973fb8ee7837ff0
SHA127ffa42b025a50997c7d051865dc5916f31cc04c
SHA25603f1d284d1edb5b5bc73778786c1ea26974a033087ec6c4941888cfc1a636f65
SHA51208720b2e342d431674148db30e42303da30aad03a4c576a03d7fbe9b3f9a4f88c3fc61514d1b8da6c9d39d55da1a8a8ef2e62e7098db6f1e44f0ac23e3a26dd8
-
Filesize
5.2MB
MD55b5ecd580c0fcaea8e0843ba915b1e10
SHA1f45fd800173a7ccf32a282450980aff342f90cbf
SHA256c87ac69277efba90a888c3360a490769028f3d10efc526b8a7af222c35b7a3d2
SHA512b8f186e7655f24c434fc5646c096b3cf6907d668889725746cf820747b91b4d5a30f7ffd1d1c2121f4b49a00a7788b857ab59a33899a86a8b312ded56a38f91a
-
Filesize
5.2MB
MD5c577cda6d631607cb8872270a2851666
SHA1b9eff61f3c6149a5a3870e4cb18be1620f9f5d5d
SHA256729853f0ef79b9c0835aa1ab73eaa0f8a302f24004ab2fd96404aa526ab3f1fd
SHA512dc815e158d8baa7efc38391763bf7d40a575df19ae61947a8c3b61ef1ba2d3638fc85fdcadb27d127149d51d669bead54b91af4e4d75bf895cd7e2bd06528a91
-
Filesize
5.2MB
MD5ba1b5ca2e97afd1f549a51dcbc31c36e
SHA1aed7d3745c5d2f8b72873f4de02f8632cb0b6cb1
SHA256a9376372e606610105b3d78729455bc7f4865a0866f18d3c161a7c077d24b09f
SHA5127642059df69ca4e1b28658efd531520799e4b6bfd989e95659b8910be990eea1078b6e5831ddcdf8d2cb8f5701cb2bef28e537cfeca6e3d185cf02726ab6f586
-
Filesize
5.2MB
MD5fbf4167b22ab4a6eae23ebfd52da546a
SHA1671cb429a3eca1af95701b7587b3bed7475759bb
SHA256edfe6beeaf073c5796793301d14f057ff7e43e6158c382ed5a47ac3142d138c1
SHA5129e4986cfb9467180fec0e67cdc94355d08a93976ac2c0a665ef200344de0f66c5cce1e095161d6cfcf0353adbeff5023e18b7a9cff77ae56fb5421925adfb73f
-
Filesize
5.2MB
MD5f393ab542e4a9e0b3c10f311e2ce74e3
SHA1c8627628c828e43a886a15bb9d413b14b4a7e0bb
SHA25658e33b239636cebe32554c3088f9525d22c92f1c0e861d6860a2b37f271b5852
SHA5127ec064258338ede4a2173fb15de7616bf9b446ffae9af32002883ffae6050f8a0e5c4d409bf69048341282e09b61cb7921b0331d1cd2caa845d8b8fc9d804c09
-
Filesize
5.2MB
MD53d9a9ee67bc609da16ec53418cd392cf
SHA18dc4ec2217eb810abfd3f47c971c1473f3597c53
SHA2568cb2b6f13bf4c81593a0bf2a05208a5399121d2a3654e6c0ee7bc53ac1ce47c1
SHA5129f07dc2697b0bf821c342ee2e42f48b9dee3dea2107a9ddadcc2c1d67763abc2cd57640bcda98ba055b0a93d73cb5c31ccf276f737bda6fe9316f578251c752c
-
Filesize
5.2MB
MD5d6d35d3d9534668e38e8c7fd468cef3b
SHA1521e4e2d3d87c6d1bd0f2ebbd2303110465957b0
SHA256982ff7b97c6fd583356d5d448c35fce4935500dda784146995e7b2cb1c78547f
SHA512265558867cd15b6d7224e880271a0a30b16af8184301fd599ce19c3f799683c9e8628605ae0a58b73aa920934fc6497f736b4f723bed8315994bf59a0cad555b
-
Filesize
5.2MB
MD54310fa3f68cff77e821566a55a4887bc
SHA1a7088f67fc84f7efe37c6050b3c7eaba681cd428
SHA256fbdc8030eef49fb757eb660b882af65607db94224e7d419707fe7f33a521d380
SHA5128c52eea53ac2dce84846d6c2b7776b3d28eb1361112e94a69c53a27dce681c02b710863b1ba62d88d98c5606d13f54ad5acb314f7275a6802e1a338a52ee28b7
-
Filesize
5.2MB
MD5b4ec467186b0e2c1f650aaefdd8f739c
SHA1d7069991f098635389ce12440b2d03c87db055d0
SHA256b53e7cd139b49ceef3142366e5f5e10c6acb069e4ede050eeb7d7640c9d47db3
SHA512ff4bc6e951431e486d9ce97426f15d99b17f3aa87fdd0bb6b5d35a3248d675c30b07b542f8217acdab19b5fddac7261a34a3620c54b23dd4df6cc589b83c83af
-
Filesize
5.2MB
MD5c122f8a13f2eee1fc7e6395f00dda14d
SHA1743302e9f3f8ffa86b12a347acf43d04b0bd8fe9
SHA2569cf4cde6dfd1a7ddca97b3b170373dfd625a01deb6538a6381c8bef812f14940
SHA512c5a01c991342ed780bcd8574acd03b89ad3bfd7b94641465715412e732bd8b5295f4f313c08102f4dabb75eb22535061ff1f862d1ea0a11c62c43fa39231c481
-
Filesize
5.2MB
MD513ec022f71da4805b3e2a5da9e96c14f
SHA12d30e3c88c1c3a8a57490e259a6d5beabb1c97d1
SHA2562725c96fe622bf00a71bc202c3260e751b77c093ea5e6190c201c6034be705c5
SHA51211355c2f5a1fc39ce62a0c1723b5ad66e8d378090b7934af98a046be1de8d042e370ea6fec8efe9d6fb1cfdef9c2e34e84420606dfcb3d20790fddca2939f49d
-
Filesize
5.2MB
MD5a1a8992353ce02fb867d6c2bee504f61
SHA13d12dabe9b75d5c1d0d9ac8493b569457ae91e85
SHA25674902d729cbdbfa9d63d02982d380d350c9b1107cfb3dfc959db1b8661e5f1bf
SHA51230a4e4a632f4ded4592ebf5b1b0aabf1a9239cf328f3e35daa682297c095da4ab8aea90cf504aebe3d97d98ee94b87e2e6e4fc67628773eb22fb0f80b5f5968d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB