Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 02:23
General
-
Target
2024-12-22_37b8631b25d6cfba39ea63f9c6856cd4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
37b8631b25d6cfba39ea63f9c6856cd4
-
SHA1
2810a54efde37e6db3608e19e7323fdb4c18c6a5
-
SHA256
371e10530b032b62fb618d5a53467fa4900f7e78dbd5d6161a4a9092ef5a8908
-
SHA512
d8ff9eef1d609605c90e63cbf16da0d74325fbf8d73f26398df4494d326e4ddf0ff0fce4f4e4ed2e7e2228a8a907e9e2fd06ddb06f86f72c6c990fd96e7ae1c4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lUV
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_37b8631b25d6cfba39ea63f9c6856cd4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_37b8631b25d6cfba39ea63f9c6856cd4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GLhrhNK.exeC:\Windows\System\GLhrhNK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\muAxXKP.exeC:\Windows\System\muAxXKP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nOawRyu.exeC:\Windows\System\nOawRyu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XfwKTnF.exeC:\Windows\System\XfwKTnF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\puupccl.exeC:\Windows\System\puupccl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dxNpkBH.exeC:\Windows\System\dxNpkBH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dwkOLsd.exeC:\Windows\System\dwkOLsd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\alQQKuk.exeC:\Windows\System\alQQKuk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yqRHLkI.exeC:\Windows\System\yqRHLkI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TEykRmj.exeC:\Windows\System\TEykRmj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sKFrimZ.exeC:\Windows\System\sKFrimZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KHVDuBm.exeC:\Windows\System\KHVDuBm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gemcINW.exeC:\Windows\System\gemcINW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\apGLuxA.exeC:\Windows\System\apGLuxA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWQjmRC.exeC:\Windows\System\SWQjmRC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MADFpVC.exeC:\Windows\System\MADFpVC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gqUouWY.exeC:\Windows\System\gqUouWY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TswmvUb.exeC:\Windows\System\TswmvUb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SMROcjw.exeC:\Windows\System\SMROcjw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fJczsqK.exeC:\Windows\System\fJczsqK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jCiYVcv.exeC:\Windows\System\jCiYVcv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53c57ac80bef66d4613c15b06ae0ca72c
SHA1bcbedc9d3b913f3596cd838cc08b71850fca4de8
SHA256cebfbf2cee6a74e120d5d675f100c229aedce87a265e2ff76a1542a5f096f8ef
SHA5124b6b75a99566a504b9eb9640656e3f503773ad41b08e659bb5151d3e4e91c5f1622df4106d16c0cf6e774ac52fb0ffd0617b8b564f69f988ff7eb3e44d90f046
-
Filesize
5.2MB
MD5c8b9807a0dd9f7c460c9cbc75998e445
SHA128e468e94034c6da9d30ae351e09b15708d410ec
SHA2566327151797bd65e2f73e2ad7b7a075e7e877014634276814e5a7641027d4c81e
SHA5122346bdac0c6a09892d31ee164bf9e438cd145a6404c62fd2a32ec3da52ba82e597e39ef2e443039115bbeb3ef4a850ee4a0f2e945759abf4e43553916313a9f6
-
Filesize
5.2MB
MD54c7f41b770114812c3412a1ccdf61aef
SHA1b7641d0b5ce72c2bad5bdb2914ed6d1225f9e7e3
SHA256d192b0df304a012b97b1f219ba193f464b72f70a89c5dba7b01dbc333c538b25
SHA512eda59f9f7a3d1a2b4cbdf1cb39e91194737d6b23b1e7390d30245126664f14617379bf0043aa794553c69796af4fa0e9390fb1a921b72369bf28d2e57948ee60
-
Filesize
5.2MB
MD51075f403306220330c84dd6c1655d749
SHA1e4f9399fbeab9a75c37081e3bcb19c417f1b548f
SHA256fee2a690c8d35f39bb738c394a85fb269e62adf28c5d66ab6ee9fb883d679297
SHA5120517e57c92c6b5ee7218c2952329c88885dbba4aa6b5236dcd968328fe79561e63a832f043d5fcb0804bbc4748de3abcd4c03308d78c53043958ac57727bf187
-
Filesize
5.2MB
MD5cbb5a309c828617f8cb5b17530cbed57
SHA181adf6a1be6818819e8258f548d2c0b1b96096c4
SHA2564e53bc4bd4409874e36ce1df7879348737c10971e20cb771983323d3e5782434
SHA512e89891b16ddc5f6ee7baf56210275bf301e09f604ffc96d38d09448a6a937018b265e9b2c8dbbf2194e598189db0ca0a4600d9e1c3f03dca455866f46460cba6
-
Filesize
5.2MB
MD58c4afaab1f1adef7da1710e3a6547eb8
SHA13d3ddce7b571b38a582fb729e8d42ab0be63035c
SHA25617ac185fb31e30adf1f13d25b94e29b2c3a1928db250b50382840459148d3fe1
SHA512f050082c791bea4c0a02001ca0d59038a2f73c647fc22ac8c013ee91c918674b09ec3e2d05d3a1c40de73372d570bb4d2057518bcf46f38b3191a34ca337b4c9
-
Filesize
5.2MB
MD539fe31ad861cab118eb3e3275f15471c
SHA13ae4d0de9ff78e1f5eccf1d0be89a60a42239a51
SHA256e66880f19a8555d248b7614aea757076cfeb787bb1e246be96c59db61ee276a8
SHA512eeb38ddaa5ac2150345c2e9a94dced5649d150cffbf9cc356f121b566a0f752a281b09dcfd67b67eec5ab1057c669875edfa408c31009c7ed1a043f7ae4e63bd
-
Filesize
5.2MB
MD5e80dc39ef9c74f2f7eda86336b8071a7
SHA1b3ff4488b0a72fe1d9465829a6611cb2b7cbe85e
SHA2561969be2fa929376341fd080823924f9b89492a6b724080eda1cc4ae194675ea6
SHA512f05e632c40e289aaeeb337bc078d617d91d2fdc742ad94d247bc2c61dcb497aa14ee887da71fbb0c2497f9d5ab37a47268f229816447aa9551543d0bd8cf1cf2
-
Filesize
5.2MB
MD53604a6e412c76288b83c4537b2d86ed0
SHA1d1116b101b6e2d0b8f88e4b5a8a22eaddd3f77ce
SHA256db8b6d5d05360c833366f8aa4bb4f9de9072588eb8820705bed9d49d90cd44f3
SHA512df57352d5ad2a56e6557d3f1726c7d6d883b25b1e2df05b5c569b5ca6d30b7f8b0f05a6a2cf48f9e698d722708622dcb18973a66858cf8948a57e6c16356f4b7
-
Filesize
5.2MB
MD5b5116e53ef984180d965e3b251ea52a5
SHA171bd1c83948d8bf8e67fdc2b0a1f603dbe48bea8
SHA2561348b409839c7744f50b5204e133527d657fdcdb87e9257b070479221c23b836
SHA5123ee322eafa271f2228a90ab90615a4692401594e417e0d61134e2731c4211a9e71508e9e700e5fcc0c4496f4fd24bf95ab1f08ba9565fcd9d13f13b52c3a69d3
-
Filesize
5.2MB
MD5a1e99d3c7fb8c9b2ce96b9844733f823
SHA1fbab21831c1e57e81284b4d072ad6aa22978ae24
SHA256add7c96dea5458714a3eaa4118b7f52291b0db3a8bcfa9313a905965dfe80248
SHA51228b0385c0327f277ba8ec07c019894d229de344ca503d8a288ec9a30ab9538144db0fb02d8554bce75ced01c2cec349d889020c3968fd9a8a39cea5dff518496
-
Filesize
5.2MB
MD5988b4ecdc8229aa5811dee3e26c7aa7c
SHA1cbee37415bc6e84c4468e284a8e4d1b02fc99977
SHA256f957239ea8ff02e2fbff2c050b3ff060cadae5612b8665bbbe4a06ce7e3f608d
SHA5120e796b5e05717070baf23d8aab2af6d59f71321129d399fb7ec011018b468ca2c539cbe1eee271c3a3f49d278665e835490a2a703100ea1aa21a0d068986764a
-
Filesize
5.2MB
MD5a084ea4ae6c34175506399bdcaa0c621
SHA1130ac4f24a730ab059a61a379243607e08c2107c
SHA25662b3c97fb645354a29cb19c2bf6d602ebebefedcf1f03c3ce03adb35811cc34c
SHA51206860b9d2d373d5b63d6113ac25763aeb3a5c41a16664c6edd9d5078cb6fc76a09a9def854d945ac052a8be08a0e71dd1dc103e5f7c18935714d49280558aafc
-
Filesize
5.2MB
MD5a7ca30bd5ddc04ee8dd9960a7e2c7ad3
SHA18af6de4dc4c344ffd84ac1d214f169c5819884fa
SHA256c34e8f39fb8ac3b770ede925e4743f5548155820ffeaae4cf549ea6dde87281d
SHA5126b765d20ea121b56786f7010031b0052c2e4cc646a7b6c17652161d0e05b0a8b68d9f3de87fcb8b3144cc4331327c9a05f9f8373fc5b991c8d4bcd08edf5aafa
-
Filesize
5.2MB
MD577073ce719edbd1192e0c012ebacfe3a
SHA1fcd7373270519f77be919b335780605dd44dfa1f
SHA25688286be97c6b5f5f2b0a17ac6e4392a6718cb0d22fbe5d3f00cd3425ce73547f
SHA5126f6aae55ffa5a4bd5efaa29ce2f827c687fde3678981986b88b4ca16593121507e8090985acba75edf309919fa0f43761eeaa82874d8a228497b0b03e16356c5
-
Filesize
5.2MB
MD54ee957abba9c83f056e16fad70fe6297
SHA15467197476af6c6ab0266fee2b82927fff4785ee
SHA256735b0abc60130d2a0a09a0f371ee989d967e29a626823f0a5a68ee5670feea6e
SHA512ea37688e9866aff9369665ba986a4698a5de79dcb3d98debfeb92ec5c3815e9eb25a57dbeb049b9534ce2e8b972e1790404e2ba20f2ee9ae462fa54c5a9efc29
-
Filesize
5.2MB
MD5a46a20c1c5952f1df7a9425ea7cde1ac
SHA1fcd45f9cc9358c8fc16e8b2f3f04f6045399a185
SHA256848c7145552661b4d46887bfc72b010e15858a2e88a0a563f993d2ffdc6f7c99
SHA51254a62ec614e8fbcadb5dde0f4347759cd93367d2c8d056e2aba2ff97869925eaf87a0b363734aa94cebeb990d27556308114eb7bb60e1289063231577fc94fd0
-
Filesize
5.2MB
MD5333aff35cea41970c3abb4ccf4d88ff2
SHA1d5bd551669c13c74d3e6164e54b434c8f3f52dc5
SHA256df2b3f9cafb03cf1c740f27a012e40b90d61c653a7490c8761b5470759eb94c6
SHA5123445453a384e9434ceb1be9efd59a00df6503f6fc7c02f4553737b0e25b44853653551236d78f6914d92540c329d5153ef7911a278c44fbf861d5b478c8df7a1
-
Filesize
5.2MB
MD5624000ce7b9c17fe0083167c4dfaeb9d
SHA1351b5f5a305c4b9fff440d49ca29df68fac729b0
SHA256f2344d22562830a43e74928443e08ebe330b26dd5250203c5378dc0ac8e79c0d
SHA512efe008147ea47da0252536a9f21e20332771f29025b923ee3c62de5121fa97b5753f68004be29085100064f3bfa9b21c22a6406bf4949f0b09b8dd05d7f00442
-
Filesize
5.2MB
MD5ba9f356e76221e799152b757a2766d92
SHA157d17568a2dbcfa4fe3ca500e0236fbc251f9bf2
SHA25646497c904e6adffab10288b60be6c4c8ddd0c6c1e9c77163c4c80548b551272f
SHA512ed056928ca47f10e6e5f12de9e3eec8e467ba53f7023dbbcfdaf0fa197addcba1802ced9b3580f5673a13436c776a86f9df9b1a99269d2e5db2da11cd8547b59
-
Filesize
5.2MB
MD58002ff9269168c7914d59434e7860e7a
SHA18f512b9c684e00dac417f9c4557edf2229bbbd8d
SHA256dfbdc5e0d793eab588ce7d63c01bdc1db374b63e78e5632c7c0fc8739ca6c209
SHA51230f23af548c88addca9a0a1256ea1e03e1e20aa93c30a9809162ef46aaef2089e9191ff7d5e83311dee0cb9bd30af9416d8612f7696a500dead953b86b38b293
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB