Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 02:25
General
-
Target
2024-12-22_3fea0dddf6745de4fd49e91754345bf8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3fea0dddf6745de4fd49e91754345bf8
-
SHA1
574788e037072fb5f36ec0cb632b6c4462ec6c19
-
SHA256
80a40177f56f98c9afb5c2a5bc0c8211c455be62649065f5c3a12eeee939e72c
-
SHA512
c5cecdcae033ebca1ae6af0c0e08eb76969d8643ef6e10218ed129499cc5e7a3c10357c1150c34664e2275bf7973d991200bf192ac4460aa0ac32aa8da7d7e38
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_3fea0dddf6745de4fd49e91754345bf8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_3fea0dddf6745de4fd49e91754345bf8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rBywmWM.exeC:\Windows\System\rBywmWM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QIlfvYD.exeC:\Windows\System\QIlfvYD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WHzwezA.exeC:\Windows\System\WHzwezA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lqBwgEF.exeC:\Windows\System\lqBwgEF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\twdtVru.exeC:\Windows\System\twdtVru.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LLJbyzb.exeC:\Windows\System\LLJbyzb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nkVWjjt.exeC:\Windows\System\nkVWjjt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YLKEsTM.exeC:\Windows\System\YLKEsTM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XTipdUM.exeC:\Windows\System\XTipdUM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\umOzwEu.exeC:\Windows\System\umOzwEu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AZoxIPu.exeC:\Windows\System\AZoxIPu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FbEdIDj.exeC:\Windows\System\FbEdIDj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AONXToH.exeC:\Windows\System\AONXToH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eaYSutI.exeC:\Windows\System\eaYSutI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AzxWRFU.exeC:\Windows\System\AzxWRFU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iNsDknA.exeC:\Windows\System\iNsDknA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mnsxrHd.exeC:\Windows\System\mnsxrHd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\itMcSPO.exeC:\Windows\System\itMcSPO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kwUFiIC.exeC:\Windows\System\kwUFiIC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cfZdvVM.exeC:\Windows\System\cfZdvVM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ETcQrEm.exeC:\Windows\System\ETcQrEm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c5d916ed6106204c230c3c4e31b6c424
SHA1440b160917e2c3482d26552ee56b879459ffa406
SHA256c25ad9aff34d8498e47deb444289b23dd1f50494adf518a34421c0a25b2bd129
SHA51218d24fc96bb5c609c7dc5ceb8f7eeb69d8b5cdf9a0871852a33a1e22eef66b605ce98519244fa72f1b96d41f117d26daef7c4b4f204005dab63c5f37dbed06e6
-
Filesize
5.2MB
MD510a9498447d92bf21d17a7a601340a65
SHA10e7e0fe1a1a8508a263cb9b8c1dc23f3d8091aeb
SHA2563a65a0a001dc6e65ae047dc81c5df27d433d1584c369df53c955fd8876d739fc
SHA5126db2a3a854c22565705ccf0119b71693565122e166cfbb032510fa9aea43edfcd8681337634c2335be96d863a9d1ea26ecff9349f0ce1ef08a00128f914f4022
-
Filesize
5.2MB
MD554ed96465a0d809a7eccbce44dada1fb
SHA18ba9cb55a5622ce43c80a83bc0be401e9e40692e
SHA25670d32d2e00a15c048a1c38b39927caefa28ca60f20d52f795804a17d336ecf85
SHA512494ea0e157e593d5f0dd8f2dfe0c74d17537f10fe6cedf0e1558d85f110d563a85d9e53bd8158c55b901e3ebcb616b2778008f8609b2385e835998fe4cfbb3a0
-
Filesize
5.2MB
MD5a8cda9fad117895261b5b0eb467a50b2
SHA17cf3d16660612f553b16a568498e63be7722c051
SHA256ac59002f67403446324c8b4bcaff9cfb96f36ad42dccb0cef860db738e299818
SHA512036dadd7ba1c0d746843243c9f7558ec10d1a4f223b33a94b3d0a6277b24d8fe91898958c365dd3b6e8522dd372a19589a9da583a1cee15080a9434af0d5e35f
-
Filesize
5.2MB
MD557c42532f6974f35ef9cb2c3a1ed26a2
SHA1a523625a0edcb36552bf4fdb01c6564666f11f33
SHA256565cc59f905b69031b90c282f59420ed85c3560405143ffc6dd6e0dc50bf992c
SHA512c0989af3aeda135b3728abb9b0d30234dcfa1a03c4d4c613bbccf0be312c925e925bdbbf0d57103ec1855a2bb58db39a9c672b8d157a2cb6f9e2fa6815c0240a
-
Filesize
5.2MB
MD517da6434abd960f10573e3b77dc311e2
SHA151027c3e0ed785b2c895e78d29857f4ab829435c
SHA2563f1d65d96c47c9dfd6a50658194e7fdf749b8734c5d72ff1ec7851008c9ad179
SHA512fd6857957708675667ea99981b43814515c0f565d2940d5238ad82c29e533e2f2fb5453697470de07808d09752a6e36f8640e6dd45918d89de0b3bf0ec403715
-
Filesize
5.2MB
MD5dca11abd6920863f8c309e3f94b95f35
SHA1abd49c3485a43cbb4ac462c46d2ceb40ef421fd7
SHA256b94269d804f02d209ce6946a5617f4507848401b231095285f033c6086f517d4
SHA512309c24833aa9a7654e9d9c118ef7fdee6588721073c44eddce1c43a6315e02633b22d634c4756788178a930faaacc29d6916f47a95209412104e1c4cc5b67003
-
Filesize
5.2MB
MD5421a9453aa52a391902493ada22390f6
SHA1795b2ef21de4214062dc995092c90ac624fff335
SHA25650abb5c82ff05dbc0df930e667f98f22ddeea2548786c7ca17e081e536359d25
SHA512507e58043c94c2046b01e09a34d274debe7512f055729d33f612a505737835bd072b1d9f4bf3ceff8e0fa9b474534bf8625ef7fb85ac624d6f9493f73b05af1e
-
Filesize
5.2MB
MD584ec3a9d32e011dd4b3cc2a6b28c264d
SHA1d3020c60359f5b1e7bcb0fb95ec250a38535e292
SHA256024b95d1b8a7062ed51bd06c8892d73fa23c85b5269c6d30487b349f551e8429
SHA5121f964cdc13a81cbb767d5d7149096ea14ea3566361161e65f01175c5d1d2c2ec98111cbaeb614d2e376256180597b16771ce8bc27dc024de0b826bb8c1389025
-
Filesize
5.2MB
MD592cf5e76515b2619f0e5e314999b5147
SHA171c9d010067e1cf9a1fe9c256a9d4a90ac8473fe
SHA256b03150eb64bccee9df43966396f2795de9c5cf06c2dc2e785f4d6fcc145951bf
SHA51263b22adc3d1bb7651a24816afb4461d2c823769d0306f9a5b15c4703c096a37f9ae19b96e0402341982c2669668d5e2c29c63fa430405efba68e220fab11e1ec
-
Filesize
5.2MB
MD597bd14192ef24ac3ddbd0e77a86e4b99
SHA12c94c1bea498bf4785f374a6f3030d079b26347b
SHA256d9bcbe4defc3990b6c646c8c8681ae65fd50ef59cbaaf323f39b9078a67cc411
SHA512f474917f99edcd3bef1f0225d199d65631012f0cf8126b348a2f1f19f79c97ccc67a33939e1707b73776ff30d4d50a626cf65bb561ac085c3017cd83af82053a
-
Filesize
5.2MB
MD56acee5e93822e35b9ef6e8be14e44ea5
SHA11c2f25513eddf98cc6eb37f1ec630365ef5c0adc
SHA2565e9eb26941db656267c1319c702a92e97535fbf8d0b02a9daba8ec5fd0fe6f87
SHA51279fdc5200a48302bb18298cf69165c5e22434d491391d7405eb967f6e58b36f189ba57fe9cedce11e0e0bcddd9feed6c3cf697a35811524544e3e3b8f099e652
-
Filesize
5.2MB
MD5f4c7b7a1931376339981d4a844396999
SHA1ba04c90893f55b68dfb1b1602971438b5da67887
SHA256c1583a4cc46147c24e1cb21e472bed3318e2759d2454bd186ce0d9e98ea65747
SHA512052cb81735c6f614b7554d066165de33a0c118d105e1baf81da72803632d224035563b51b3c4bc4d0a325624fd17dffd224c1eac35d0c915772fdbecfe1a6564
-
Filesize
5.2MB
MD505a5a09bab3a14726551c8f16d913e36
SHA136efe1f132e3293e101626524967e5273181a878
SHA256a9beaf713843ab2dc95e09f63541c5d7436fc7bf7d5ebbc39c0cfd0aa003b427
SHA512a18fb62716b4b97edf8def6c32b9ea0a2f2676007d1e3eb71c64e9720c2c206dea1aecd83fa400cd0d6760f3ab8f13a3c22b9d5655a568fe4b4ee25f20b14bc8
-
Filesize
5.2MB
MD535e84cfffe2cfdee6c2836f078491f6c
SHA1554e17280959885d80690e4175d703f9e6977ff3
SHA25641f0d5b2c0460f9e77164cd6653147cb0f8a1ba1599e7c807ebf3752879486ce
SHA512aae843400f6b1eae073f92abfa7ca80d302e5b5389d2e340424668c56fb382ccdd232cdf33ab1d47ae31cf18b657473455fdc9b5146ac354417f56410c1fec32
-
Filesize
5.2MB
MD54ad42b3ec86563d2b2d4531970a692ad
SHA1a5b2fccde62916889e7b08da6eeaa3499a97c1ed
SHA256138772c9627b4bb9091632c795cf4769a9d4ca254f655ad146b4a35c42ef1873
SHA5127f0a8a12a462b76072b6e7cbd587ae97f0ac08100edffce9bb262e5302dfd7803277fb832e74896c1737883a6fd76656f9f27d86d52132324e327731bca4cb7e
-
Filesize
5.2MB
MD5d2b1eb71ddeee58c4a94e2cb89db4249
SHA119f0612b29afce2c31eae9052fb1ccb4d3a3ecfb
SHA2565a73aec64901dea81fba0af55cbac9f26dad9c73b7436200671a0731ce8478ad
SHA512203cf236b633a368b54371d6f04f9913f2d4a053a634c571c4b0b25e36fd971def4798225367c84ee5156bf5d953eb493bf4a8d516c943e771783195da76fcae
-
Filesize
5.2MB
MD582d9e493858068b204cd8b9a2b16c6d0
SHA16cfb3cff4c4a24d2c01375c1701911325008ded2
SHA256d4a293c8c8cf9bb58233add542a57c9563a96813c2e01114c0171dcdf87f2018
SHA5129aa317c6032f50890de2d8bcd9cf34aae75f7571f961b6899c7d2d8cec872d96d99bdd4e55b67656432df911c2d49dcba75879894a93e25cff0d7b9d11c0d1e5
-
Filesize
5.2MB
MD5c25c73d01d510258d867f13fc5a17cdd
SHA1fee8da5b0b89f16a605d6024e37e25055fce7544
SHA25621d140ec6fca53a8dfb8d99cfcb7dd3b9a5d0d59c2f748c0d4e7cf70165f62aa
SHA5129412715d2156b9d78c963471c89ab1deba247db6ab77fa7824e1adf9a627d9e142e20dbc84c015229c2da8d52e608d18436c0a5f8ce398047ab128484b5d6526
-
Filesize
5.2MB
MD5c860303982bb41dece15f3bec8d2b293
SHA1c5bb1a05d07c9ad53ff33f418a1b2f617e091817
SHA2564b9dd66a49e12f139d4f4d964890ce2e4bb4d2cdcebd6082483c3a629907c498
SHA5127677f8a0dec8a1239139b6b6e90726ffc820d29f2c68e95f28effb21fc974a54b3c040175829f1e864785b64ce553b86ac932fab0bbc4c50a605b73614269894
-
Filesize
5.2MB
MD519a05bd3c614f77880c83c433465468c
SHA17568818ca9d209b3afd4a246437fa6f2d8918d99
SHA256e2393b01355313eadffc7736dc98dfced180739a96a4f0e915dc6c478488da4e
SHA51297ca56db6d411e2b855d6d32fcad19845828ba3761926b354eddd425674df45eed4d7c88c51df36adcf1a07c11bddee2680d37b5eaeb8b16b8753bfffc2980eb
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB