Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 02:22
General
-
Target
2024-12-22_2bcd0bb42dda88160e4dcfe1f1550a01_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2bcd0bb42dda88160e4dcfe1f1550a01
-
SHA1
6ecbf2711a10a801779cab160730c8f34eed796a
-
SHA256
28e326c14bb04323f229b845acfe225be043a8ab535b5469afdfb3c65e1eac54
-
SHA512
d89c0ff2591f1ac7b9f91cc187d09ed09beb4c9d614dea794083a281e9638189a138fff2cd8fb63736c4bf266fe5e42368b6c4b72760b0e0bf1c3e5bfc24e281
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_2bcd0bb42dda88160e4dcfe1f1550a01_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_2bcd0bb42dda88160e4dcfe1f1550a01_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SOLMHZr.exeC:\Windows\System\SOLMHZr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PsWDhQT.exeC:\Windows\System\PsWDhQT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\blxsMYI.exeC:\Windows\System\blxsMYI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pzuOAdk.exeC:\Windows\System\pzuOAdk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qmtNbAp.exeC:\Windows\System\qmtNbAp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KXHkDgP.exeC:\Windows\System\KXHkDgP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vmBxPOQ.exeC:\Windows\System\vmBxPOQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EDZjIWP.exeC:\Windows\System\EDZjIWP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XyLQQOC.exeC:\Windows\System\XyLQQOC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlKSDnp.exeC:\Windows\System\TlKSDnp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WMixKaY.exeC:\Windows\System\WMixKaY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pqiJnEU.exeC:\Windows\System\pqiJnEU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gshLSpP.exeC:\Windows\System\gshLSpP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PUjopdw.exeC:\Windows\System\PUjopdw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nvAgqGq.exeC:\Windows\System\nvAgqGq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\liRpupF.exeC:\Windows\System\liRpupF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AjSaARs.exeC:\Windows\System\AjSaARs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fwmSHKK.exeC:\Windows\System\fwmSHKK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KYzFhtU.exeC:\Windows\System\KYzFhtU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cAKtSRN.exeC:\Windows\System\cAKtSRN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WAkZXul.exeC:\Windows\System\WAkZXul.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5731264b30ea3aa1265c8ddbe7b5ac512
SHA1058f3f34a56895f2eaabdd547df894a1a1ecaa77
SHA2569b8fbc10db04576067a018c29e84b5f9a690c544e3156a5bd28e965518b5a585
SHA5125d6a7ba471602ea692443467751582d16c7b921011139b1de1db5db6ae9e7d5acbe83496c28b3049484b44a107d1e02174fa2ebcaa69ef3bc19b3c20d3bf20bf
-
Filesize
5.2MB
MD539d1b99ced94288499fef497fedafa69
SHA1f1361b374f24d2286a9b4bc06eabe6b1c9a7ef2d
SHA2562c1d9ee9b9bb39f70ed78639d35671ef74fbdf619d1f7b86f81e09a0a07054e1
SHA512dfe007bd2189ce6fd4fc35dba604eaa2541227250b3f55723ab48d575811ac178efb38f7119f54f9ad998e989b5d44842744a3e484ffe4b69c21800e76cfd8c9
-
Filesize
5.2MB
MD5b5fcb9264c2fb9db73bd09c461f10fcd
SHA1275b785ea9181e29a349e065c44ab964cb6c62d4
SHA2564abf0c1bb76725927f85974e62ce1845494d3487fd12d346cec53e3a2a2b295b
SHA512e026eb096b8dc7ab2ff2ef53c4deabe17b77d326c21d015e29ac3ec59a49d4b6de6d5d20dfe90c2826686d4ea698b84d91bd10173ab1424bf858969db0c8576e
-
Filesize
5.2MB
MD50aa3a124a39c01c9b6c81b6ff3d5e53a
SHA1ac20c5b206e82b860d28b4806f3be1de603a2cf5
SHA256ee7d25f944c13f037ae10ef20f3eafc858ceb5b616ed8c1ce9e542a53d81f9fa
SHA5120c1982429705378c9c543fb257c0f8bb129b430fb4bd15b4dea168344116bcd3feb8996fd34221536f034fdd4d2daf2aaa397052c208d618a415ad9358904397
-
Filesize
5.2MB
MD5de82f996801b47f580dc2c60b80c0170
SHA1900bc78cb95aadb6e99b3bcb016a8181ca7e52e2
SHA2568d517d7d939a91af16e4f64550d2e92a42bad4485e0e24c6a82d07298b3845d7
SHA512ae9704c19335e39509772317e4470c8458c127e0f151c9d0f8727351cefb5f73324b34bd8da055383ed5c983cca86fb9369e042d2ac8758c88de2dc008a61099
-
Filesize
5.2MB
MD5f881cd079fdcfd75e8615cea2a5e12d3
SHA1e2b091dd4718cab52c40e8befe7f9fac4bba3c1f
SHA2564bfdd0583ec4d6b85e137496283e23921f027d28072c9f05ea800887d15a8b9b
SHA512e72907f45c7b2e3efdcf60c1d34859364afe87b9a4d27e709b691deaf0fef9a922e7b9aaf2077949c95abfe87821b988f00cd6351a509bf52d31c2f1f035839e
-
Filesize
5.2MB
MD5f44442a715bcb309bf03a3fac2368a44
SHA1dce010a6d4318d9aa1f1fc3a13599b4ba8301361
SHA2569d5e4e41d56f7dde1876a426b4979dbcaf4eff5574864309bffa51ec036dfe34
SHA512dc2634bde8853ee870b6bf9b26c7401f097e3bee88704030d5d651fa3870b7abfd89533547e38a2583f9eaacd2592681265219a5e54a034cea1f39cf96ddc202
-
Filesize
5.2MB
MD5c6d4db0c9ff3017e8bc648d3122dae34
SHA1002d3fed68b861b6fa5ffa4a48b3ae80ec29f6fb
SHA256a8bdb6ee46ba4a6dfe5c4cbc859b5384744f404327f92dd51199ae321f479ca9
SHA512ecdb0e9d9bca49cbb6af3e10eb0df695046431fd364154e35971c117c93fbe246c1a75e65a650f1ed9a44ef42287cddf82b71e7668db36989cbfb3c8991cbede
-
Filesize
5.2MB
MD51280f2029bfdb45b51bb03c8faec7147
SHA17120e73cd9f20c01a4cd5a341c0d6196c15c893f
SHA2560088d34522cd6a6939e97f3e314cd0467c87a4806be2b24688fe30575a082715
SHA512f433cec08292ef60efec5429bf38e085fe52177b7ce9798c319bc112ceaa379aff2c47c24a41c965a1c71f3baffd8be27be854b0643ad6b772bbc8fa03fb003c
-
Filesize
5.2MB
MD56dc87838606bda92f4636aa87077c174
SHA16bc6691ba616ba149aff31f651ed0f1fbf0ddafa
SHA256a43f3d7e2826dcbbcd6d9346b64992988eddd722f056b316c87d8b17e80c1f54
SHA5122d6de60fe1e26dd0e9dd790491f4d8ffa656f84dcc733a7a28afe9d27eb261130400610151f6402bf78bf14d2570fde71b12727f756ecf982569fc359c58ce02
-
Filesize
5.2MB
MD577c67b08a3186e20fb2b8312399785d8
SHA1835404267135c91479a60708dcb73f20145add87
SHA2567fff6eb1b12e5823a5a440fda560425c4c3c56f1920f53b08515e0151391dc8e
SHA512b1b5a8aad226fa33b4a2e72ccc009d24a2c3c7338fbc220b18de74833f3e4f18793798dd6359614cae43e9738171f9b74e0a26fbae95e7e932ac8df4bbd84269
-
Filesize
5.2MB
MD5b60f12c5f8ff55adba512950ad4ff9f6
SHA16a15c6cb7d521f9dbfeaeaf4759c783c50c4c1f5
SHA256b349f3e994d0240855f403044c40293e59363d7dc9e9d2c7fdf443d9a6fba386
SHA512bee139940b46adb063c3750b7968c2ec14893b39ac1a37b7c56d9082459aded12dd90e587d853ae8838beda40b92a9e2895d33d616fc6c762e55094df85289de
-
Filesize
5.2MB
MD57c5354e94db6beef98a41a39a0b36386
SHA1e84d9004a0e4824008caeacdf87060a7095c1302
SHA256f19a15fdf0e9570ddd136a3786284c32207f3fec29faecfcff2b6a344dc6083a
SHA512ec213a2d96d13c2339e4d4e7a2c87c5653230a19827660b0e0a55f25b7be510409deecc8d90032b642d2b97046bb8ba56baa55db7743594a693f38fa49013cdd
-
Filesize
5.2MB
MD53f2268d7b1a80d3a48f40f0277f8247b
SHA1cb155030ec0075d9604db3da20660fc54470aaac
SHA256a66828147df4abe29a08c8456c0f5e801219e41c7abe218931dd76a54549c500
SHA5125c490ed3dadf702ef2429cf71841e2969ec79eaa87902a4506bd872eef7a5ddc9b4d10741f8fab5038371334566c1057fd1eeb5b2b5db895ec8d3e7db85c1713
-
Filesize
5.2MB
MD5e8c77dca5f3262371e4c40d38ae3d0c5
SHA1304bbf5d964dec4df46601a2d40e8f8249a63f42
SHA256d167a52007779e74ac79682d9465f38b87180069724665b96a41225b87faec40
SHA5127c9504f3fdb76bf6d2c5a2f9bb6e67f205714f8b62a553e415a3f8a746bf442d7a15260b8e388492956dd19c1a86e5d3bb38438d495f9d84b5ac6d86ab45aeab
-
Filesize
5.2MB
MD5704bc32ad405236b1e8f5bbb3758dce7
SHA173563479d6cf0d8f212095a64d795edbefcc4e18
SHA256c0eb28ae9bd64dc1dc246795896015ded5df230d7ad994c6ce1a23ee72618368
SHA5124fd2cf14727a2f0a6785cb2c71d4f71924524576e88f3317e01272b419bb61bea27c9ba9db0a5d3299cb9779428b4f771b08ac7a2f63d11e801231264d2a6b5c
-
Filesize
5.2MB
MD5ada9c614a4507ad39e37a668eaa9bca7
SHA17e78c75518ab452453919da2fa1d198ef4385437
SHA2562e078ee21f885b86c6537c18840e1935ea7e08a6176f5315e8a738c0e179cbc1
SHA512472f7d8712f1457fefd391be40a31279c8d562348be8b49ded947e9ccafc5a8cfde67bb3546c707eb6bbe00159af194a5e87b58eac873b3d59adf46bf72528cf
-
Filesize
5.2MB
MD5ae66a98baf7f8d84632faf874d63305b
SHA11a381dd8758e130bb7bc4f63990ba9be3d0bae74
SHA25619e559d87be4a695e0071567ff0b860fd95095cece8343d8bb86a5db9807c5b8
SHA512dc6bda1b36c66f11221773bb550082507bfd9e0d29a5565bec9cabe8d0a00b6428a74e8d706f6a413778404516b3789e4ec74a4fa3bfc1aa0c7e48f3315ab80f
-
Filesize
5.2MB
MD51c1c3f273d9ab7aa58b16d7d18849fdb
SHA18ba478171cf1976fc1f87b628b9d42b4c5794457
SHA256ee1ac4e2d14a0fa8c0fff50977972dbb6bd89527ef70f28632dc7e6f32709569
SHA512e1fef6cd091b6b0a62ecfb2dd0d5f3eea132086e5785060976368d6f58811d8c0d186f9b9451093c570af38b9a910a028f02669710c0ae63400c201d44dd2911
-
Filesize
5.2MB
MD51376025697e80c6e68d693105dbfb65b
SHA1a444b9567c610cb47951666e99cd94ce33b91985
SHA2562b5f858f9b11977ce472628ccd4a177f666db2231c131a572b0ae4c096783c3e
SHA5129e1968e0fd1d223e00a3160f906dfa3d2492f3122962d3917c6c5088cdb43b9f017f4206c7bd93bda5c1bcda4f4add202caf029be8b5209e961ac2692c09f78e
-
Filesize
5.2MB
MD5020c07cc4c98f2ae89a47b7877afe4f0
SHA10d36f0a4b4eea259238d59bb6d89e387f39eacd6
SHA256536d737c83f176d1b669a3804114d2dfda8b06a054dd1dac1a5eccf4668f9cbd
SHA51210efb76739686e9cccd1756c06a9d91237ae7a606aff8a8fd50546eba3c4fac8dac075909833c427873d54ff5bcf4ad2a410d8dbe289fa75c148724548019f55
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB