Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 02:37
General
-
Target
2024-12-22_cacd9a28601f32577e420310f8589f41_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
cacd9a28601f32577e420310f8589f41
-
SHA1
94f5c8ab96c8e82794a0abb0e1d29b07fd53dcde
-
SHA256
88290f7aa9cbafa7e2d51ce3ac7edc71d5463f9a6768398ef1bd4c82993c9a15
-
SHA512
76f3a5b3cf5a5326a921976d9d00284511ccbe046dec70858d143e65459e5d10a40bdc00006f08c9d944053c9adb3440200d1cb58a6ead0f07cbb86f43bd0038
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibf56utgpPFotBER/mQ32lUK
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_cacd9a28601f32577e420310f8589f41_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_cacd9a28601f32577e420310f8589f41_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TWNXehu.exeC:\Windows\System\TWNXehu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zhTylDo.exeC:\Windows\System\zhTylDo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MXJuOYe.exeC:\Windows\System\MXJuOYe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\clhxJVW.exeC:\Windows\System\clhxJVW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ddMcVtG.exeC:\Windows\System\ddMcVtG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RwTbNVV.exeC:\Windows\System\RwTbNVV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JrKIqss.exeC:\Windows\System\JrKIqss.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VphGiqx.exeC:\Windows\System\VphGiqx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OgXVdcI.exeC:\Windows\System\OgXVdcI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ENFMjbz.exeC:\Windows\System\ENFMjbz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fuAHCYX.exeC:\Windows\System\fuAHCYX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\amNGXUD.exeC:\Windows\System\amNGXUD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PrtExig.exeC:\Windows\System\PrtExig.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dpucdfb.exeC:\Windows\System\dpucdfb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHwaVZT.exeC:\Windows\System\BHwaVZT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FIDQqkV.exeC:\Windows\System\FIDQqkV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CZSPyUr.exeC:\Windows\System\CZSPyUr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\toGVgsi.exeC:\Windows\System\toGVgsi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nulwezK.exeC:\Windows\System\nulwezK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mRSAaoM.exeC:\Windows\System\mRSAaoM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\baqUpEx.exeC:\Windows\System\baqUpEx.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d3f7a72a3d140935abca1bbd91f67d46
SHA1af941be7fa659195e4aef147fb2a33c7d99b56d1
SHA2569f439e10498e6da9a75ab69c33e82b67f41ae15c175329f14f6d246f2910badd
SHA51290763088dc96eb24cbbcc3c1e73524b0ef6d4e9a641859851eb288f9fc50eac55378acf1206473df3eb948cf5f5c911e5128e72d39467765980c766b06080974
-
Filesize
5.2MB
MD5574a6e09f773f4bccb552d71f6b5174e
SHA12c07aa0efb8c8217bb5f42d9adae6ac7153ef751
SHA2567bf9e347677c970503357093e342446925ca71eb1abb25847ac390cd944c7e3d
SHA5120247a5237ca85fa9a1e74d2d892b68a9290c723eec82a26d6ff90b8342a96edad7338f443785ac86ac945dd6ea6e22454f674f6000b60a3ae6a376700e4320a9
-
Filesize
5.2MB
MD5976a944af78bf8d4966fbe36dbaed1a4
SHA1159122bf20d13b00f630cfeed595a56b8ca19329
SHA2561fd84455cc4ce06ed54e802fc003befd8fddb61f099bc4b7cf8ff152e32a7a92
SHA5120219b8fd7e73d61d0208bb6fac964b63a062dd205711351bea08f97e056af63ceaf28595757fe33bbd4d5cc9fc0d5ad2adbd3573c7fbaf1ea6018ed33eb9eaa9
-
Filesize
5.2MB
MD5ae8de30f38f0981e55e57dc60299a24f
SHA1619681a5596c43589a2b3bf931ab3cc4cdb6982b
SHA2567c09c8210c506337d8d7e09b5d75a0ed43e01a9c5ecf90cd280b13f96d760cff
SHA512a88b2c5e848c6363bf7b2d8da4fb4c5dab17913f00c7baa9ddbe0f09a5dc66adb1c8bf3cd38bb494c9ba30a42f4c68c51c61f0fbdd2fcd47193ff0a2a36b8a57
-
Filesize
5.2MB
MD5710fcc5eadda9d05e62b742fcd377263
SHA15cd505b8bbd38f2003b917458d7a2635134f1099
SHA25630b405a2d5c66a3658b805a535218dec2c5226cd2dc3878d3a28b91b0846e6af
SHA5124a2795e990d5e40c2cab6f9d1b687354ecd66a7bf23a4fd266e3005a043239affe0ca2dbf74e18d72cabdf64e0b58b2416177d39cfb8c1c1ad64a406febdee81
-
Filesize
5.2MB
MD51fbcb020a7b57c2ff4a62c3dadd68fa0
SHA1fc3c79c26d7755d6ba789198f7afcfb73bf79162
SHA256f6674aa6cfcd8a36cebccf924c72c247a0dd06f8291c097bb8178248fb4e43e6
SHA512422bdb09a3169304dd8cbada44a29a59b949f1419c599b451fb5588ad20b59d8f788860d442077cf75b41e614340cdf18f860ae6ac136597091a7af1621de124
-
Filesize
5.2MB
MD5c3446c085c18f1f2cd88e3b1c724ce28
SHA193a3957255a3a6dd69afe6806e061083d09b46c0
SHA256bd4632a445f7ef8ee6c9fef96c45e0e93ddc4c5c6d7590443c565a313dd5beda
SHA5120fd589a8670e20bbf04bda574ebf109a522e23e7931832f8eae28a0a10e08e2d1b69ba7d248476402e7615129535555302babb0b254d86b90904254dce53093d
-
Filesize
5.2MB
MD59d3ca74aed8b87f6cc46759530be36d5
SHA1ab57be8c628b2744a7bc58da79108a81353be705
SHA2569b42f2c04b1bc742c3cfc6ad39aec6e3c3f72eb49bd91a9e3a73b937729f6e0d
SHA512f90d8d25800f69fe0ae6eec935eeefffb7f31236d6a885beac904ce364cba2ec08ee3f9dbbf4eb0e18f9853f1756572181217f6dc4161f8a70d8e41def638061
-
Filesize
5.2MB
MD593f4c0cfa77db0a9f2ce60cb791275e7
SHA1735bc6690afca3f908b7e7be970499e69a87ad42
SHA256615b261c14870b08abd6aad50a0c5f3315e72ab64af26f582a4af248afbc460c
SHA51246221d4f8e267ed83f43826a90e8e7fa7e30b5b74dfce8c4f4fc29eb545f0053d2dd5a420c6d62d1095ceb93fe26feade59656ac3aee3f50575700b652b3c4ca
-
Filesize
5.2MB
MD537ef4d6d66936869f1645653ab8f1706
SHA1169b07dd46e03498ff58e4c05cd3a9d06abcd166
SHA256836d25ceac1365b325c50b72d32bc37adb7480329c889ac917d9ec84a222819f
SHA51281ea3a1ab084f457d73fb7288bb978ccc0414387c2d27ad5606e99d1989636e332f9c04cba6e5cedd576ca39cbb25f583f7b22080151a4b24b035c7b1a1f1806
-
Filesize
5.2MB
MD53b07819bde4bf0edd575f4019d9ee41e
SHA193e4a1e3875df4158e614a5c8860b26e4236b961
SHA256517665b68c503d845c156761d9ddd7a3fdad2d73e6b9fc5429ced60189c73df5
SHA5123589f1cf9f1610b8313df12c45ce1c0d0d3958928eb3e9cd0d76f2e9da63e80c0924d42d2723f4f6f1826beb97fbe85b3f00032349bf2b2cf9b1fb1a061ba79d
-
Filesize
5.2MB
MD5535486a11f9c3140c3975241787e7ed3
SHA13335ff5449453bf324e8c07f99f29c009335e93c
SHA2561e7220e2e503d4bf436650ae8c9ad726f82290c02ab6227f6e70ac21440ce4ff
SHA5129e0cda9c015abea7a949df510cbbbd91f40baf19a46bbb767a8105f217b596df6db41e27a1bc892199f73f722d1138e0ad30278e859597f4979fc89006ee4827
-
Filesize
5.2MB
MD538ff889db1b5fbcdafc90a2435daa965
SHA1eb495cc99faf5e20bb90d80dc2b0f5cd6196cadc
SHA256c3e24835c820cdf40921afb38b90947cf8632be8750a3d974973b3fd716ce211
SHA5128db10ed5d2aa45cfb6e37e6a7eb0f73206e926b7c3de08c58e011d0d9997dd85e446770a7ab247a9e60651db28060d8cfaeae4a4d2a75e6df037fa8475c3da4a
-
Filesize
5.2MB
MD5eb5d87ae72d207d115ffd17974dad5ba
SHA1f58cf7ce738807e9dc24ff83fcebf7d6cf1bf42f
SHA2567ab62b3867860aa1561fed8c50d8400f1e66f09b0c3217373a4b107a50adbdb4
SHA512140765abb65b05f4738d3143a602ab7ff817fa6a98b7ee4d86d80042d4ae095fbdc8c755eaa2f3af239bb1178052f3163e4c476fecb44ba6ceabb3b4401eaf1e
-
Filesize
5.2MB
MD51a45859a9bdefc815ce14f44e12c67e5
SHA1347786be852923ddb681dea61f200758e4cb7f78
SHA256ed02bdb2146a382a10e163dd2c4cff6693c2b97aa0d3ba5a3e2a0e63113d2baf
SHA512fbe7f24a06b716aa1ecd33893888d6bd531b6f6fd3dea28b5fbd6fa657e3d7fa18513df83cc0ae61b4bcd49269976c1f384e9d93c6bf319f6a9d25f713a9f477
-
Filesize
5.2MB
MD5831d01bd9313719f95f620d05fcf283f
SHA15499038df87807efe2c729025b27084806b9aeec
SHA256cee3ea90423a6c31ab83a9326ac9fcabb1335c53adc43b675d4bbca356a6a898
SHA512bc4f047291715da13729f1108203a205fddaf8a0033d18e51f940dc98b9c55ef77f3894a59e5a16ff52d60ab8d75f7d93a5f6e8eb4fa3e70785b6a7654188489
-
Filesize
5.2MB
MD5505787d36969b22c368560614e159d88
SHA14cb91e0956e628cab874dd722d25432a6077667a
SHA256d7deb142940f10164eda58fce5630e2f2fdf32a7692029bf47d900817c7d71c6
SHA512c77de9b191754a9a8664f77b0c7c8c0bf45245e90bbaf0a2a8771f065ec924fc69c1ba41e98e3b733434195fd02e3a6114db113ea59d7c9f569e79838f6d25a4
-
Filesize
5.2MB
MD5cacd6e8bebade66021f2da3797103584
SHA1cabbd8f7aacd91e52aab23bfa44e4b22fa268723
SHA256f7abb77a13c72527714ffced0c617fa50b68120d3bda1a7c91e5d8a967a21bb1
SHA51260a107eb84f44c48bd557bb341f5e8ae42a0bde16c8b78564c2c7c5b8983165de98a17d4bc907bc979faf5879a75e89d650722fcbe6ddb0ccb276ecb534f5da8
-
Filesize
5.2MB
MD577dd5d5ea043417f15bb6865d37c2ab5
SHA1b618b68c049a9931022cd628576059ff8a3bfba0
SHA256911f4b94c3bb4eef4d2a435020168831f4e5bc228f7ffd443c3af7f73e46e094
SHA51238b714b922beaf2e549c64f4ba1f7b015821fda70e09e48d9f4784de5a9f53cf28799cf0bcb470a3ae7ba7300e951189abc4529f4fa9007d2765ec8f0faa27ba
-
Filesize
5.2MB
MD5d1fd778a9dc67a4d2fbd2dc1f3c38ad2
SHA12fb73abdf624dbc093c166e6f7cadba81a8c2209
SHA2569819c643edd46ace08e1ab874210bcfc9ae36b2f3e2645570f344f86779cbf40
SHA512ce1f215c8f3e4bd39d94773d909a2b8ca1b11f5f09bc5934668658d53b74ad602041f5fa35fc3a65ce7c7af15a55e90a221b25d02e4e160fe3e490e2683979a6
-
Filesize
5.2MB
MD552fe600c32b88ffc5bb03e769d041692
SHA13802da6185b149059672de3b288d01d404da4c10
SHA256661c4ffb3bd565a043bbef2a044c86af94db6fffc390f54220e1e8e6d603f193
SHA512f464d4ef51482ec90074f667eaf4970b46d84d28acba28f0293ee3722974a3e623529b40e96fb59b9a6379609701a548ab3a3ac1dd143afb5136ea82adb9c76c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB