Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
22-12-2024 02:28
General
-
Target
2024-12-22_5829cffce24d914ada9fbc61241c52c8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5829cffce24d914ada9fbc61241c52c8
-
SHA1
deaf3865b72e44d1ba5422843e5da5e3cffa6cf6
-
SHA256
e358300f6934b36adc1acf0f03cfd66282cfecd7402d3b21542939ad978243dc
-
SHA512
378b2df2d346df6206143380d2c7bf719fb38a9ff11273dcac97833250138cf7ed73c10b94543b093518d92ed18232700d5f38cb99ac04dbb3dbd3721e6b31f9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibf56utgpPFotBER/mQ32lUc
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_5829cffce24d914ada9fbc61241c52c8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_5829cffce24d914ada9fbc61241c52c8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hjsdtfq.exeC:\Windows\System\hjsdtfq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xOdplAF.exeC:\Windows\System\xOdplAF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JUsMdvt.exeC:\Windows\System\JUsMdvt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UMMwiEL.exeC:\Windows\System\UMMwiEL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YoCVtuB.exeC:\Windows\System\YoCVtuB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zYzrLao.exeC:\Windows\System\zYzrLao.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QSAPygA.exeC:\Windows\System\QSAPygA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lghzkEd.exeC:\Windows\System\lghzkEd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pxrPrYW.exeC:\Windows\System\pxrPrYW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oNNGjcT.exeC:\Windows\System\oNNGjcT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iCGOUEd.exeC:\Windows\System\iCGOUEd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OoPPQmN.exeC:\Windows\System\OoPPQmN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RCCiMfG.exeC:\Windows\System\RCCiMfG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LXifoeE.exeC:\Windows\System\LXifoeE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EskzCDu.exeC:\Windows\System\EskzCDu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qQYJrZu.exeC:\Windows\System\qQYJrZu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AlfYwJf.exeC:\Windows\System\AlfYwJf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xtGQOjF.exeC:\Windows\System\xtGQOjF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AAqrMaf.exeC:\Windows\System\AAqrMaf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cEIYXNg.exeC:\Windows\System\cEIYXNg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cYSQjzn.exeC:\Windows\System\cYSQjzn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a3df7baf1be4575e5b4a477a41d2d76f
SHA12109c0a13f8556352a8aa5c31638426232e89a58
SHA25675e60095658b48dc58260aa1bec4ed437c8e8624631939a652352efd20dbaeb2
SHA5128584ab7d0e3c4f5e53804dad313b924d01baa3acf7b229c4ed8cccc416499eb71bfd729f5adf011ec45a18b3a1eaade709cfe6844089b9ff3d4d23facc08fc9e
-
Filesize
5.2MB
MD55d392c934001d6a0dc33d07f20506d10
SHA1d8f38ee28bcf3d8d56ee9b9a016c8c0583fb5714
SHA256e6dcfad669195896fc60cdadb32a6c2c87b421bf653ce7c9877bd9fb5029150f
SHA512cabbf5e2083e5d05ffc0a448f1f1d2125633c3019d4402ca06238e4b3e01cf4496bc88ec5c7b19a29067c3a9a3860b05dca00078f6ce4a9f0660cc634d810b40
-
Filesize
5.2MB
MD5533baf28b49f5ca643a427abf1086ed2
SHA1e6326a4f4efbe5b7b211b62cacdc334a77da539d
SHA256d908297bdeac82de81c6505743cfeef8babfcf5c2a4cff7a0a252b9fa7fc96c3
SHA5120afd1284f21d70a80787489e697db610f5d80d5ba082d9f5d3d4c702dc6d0354aa49099b625ac0c65d7d651881e15a069963c79847ddbc878368a19000e1fdec
-
Filesize
5.2MB
MD54bc42a82af908d0b3315d1332f98a144
SHA1d35f3277231a768e47d9c73125eb04e13882bd5b
SHA2567af1be8e8d8f5ac70d51e7d163a2d5183ea5fd510e181bd33dbbc3c8381a2aea
SHA512273dc2471303a13f250973c29e36c27295b270da5c6357ebc72abddfa1f059593a97ab075337cf88adfbe3f93845e1f7f353f2d605f8f925cb8eabf06df98257
-
Filesize
5.2MB
MD50efc1978674d8574d729428194f20545
SHA14580123f236576eddabc640f92eed2bd504a9446
SHA2561ebce22344b4d213fc51978dd440d733c0e1c9a282182a08f73998529e7f02c2
SHA512a83a5e34981348edb6cc7c005b1bd0129304120cc70510aa28264395f535b219ff152c52a947a3d9b27dbdd41f83eb20a818c15aa4762ac89443522084db1ef7
-
Filesize
5.2MB
MD5a7d22784376c950b72ea9fd57e68c42e
SHA1ec9627532b06b2472cfeebd3fb31c8074efaede7
SHA256bd3fe010168e11bf99610533bcb85e4a32ab1ff3198d5284b37132d27ede4dbb
SHA512f8c4b90b5836ca969aba3cf4d6e0e1cd4315165c4a4554f7ae3cec7b4d6d950e9605a936b31f038722d3679c4c0974afa223c295bb9cfdf2fa042fcff9ca30ab
-
Filesize
5.2MB
MD543ae4692ca1971ab4c2ce15e493d4f74
SHA1238ac2221220a751dd14fe7c603a409311280fad
SHA2568037c293ca30feb437702ecc6e1d12be675b11762ad5de99d0b7fd1994deb9d7
SHA51281c61d4e49f97847652eea682c9b3d9794f5f7c650767c991196263bfa1799703d842bdb2eecfb71000c48e7aa5d12a785acf24bc4e55251acfbddebde62ba86
-
Filesize
5.2MB
MD5e39706ce772d6541f94e4dece14d84a7
SHA163660e0f177dcc8c681ad315950720cce82db971
SHA256c7bd7906e41eee1c06ec0a8191d9ccfd3897ad1b5acc73e1181cedf2a0df9ac5
SHA51265fe580b71cc3538c0d58f73c5d010db90ee5a1a837a37d99174925e37d1c4a4d163e22c381244216db259943aaeb3e6bfd8b1a5a4f63557768f9da22489fd8c
-
Filesize
5.2MB
MD550d5f803ada3df633ae60d34495093a7
SHA1b00fea2921164ce70f6e8b1a8c69858de9bed0ba
SHA256b4f165710b6225c474529926681600365b757c5b980156152eb5e286877053ec
SHA51296ee011bc1eee07f0ee8f2dce15b624cd63a05b0594530b80e24e44c7ec7e953b32e23c5c89fbe247a8f3af4249be30cc166aea1c088d5dafc9757970ba3cc35
-
Filesize
5.2MB
MD5639e9dc1b130b4345d4e34733414fa87
SHA1bb5d05b9ba456eb19288da237dc94164be89b580
SHA25650d7f9af16ff93d3198240281eb8a192e7949d5738b378a7887f0b80a273dd1b
SHA51208b7be09d5beddc05270206ad01d2e189badbc73b5c68e3e1b93d0b4e35b832e4b107482b2f8f88141fa59515c8d5a28cbf8fd06e509b5ace714deb635fa8539
-
Filesize
5.2MB
MD5fd0a6344194abb64497e7dbb29f30194
SHA19810b2c01b6576a8a9327471d080d5ec27073f7a
SHA2563260703d6fdd6635f786bdc65955d52d2e343fdcabb100e5edfc1099e34f4634
SHA512f8a75eb8d116d55d8d8857c743c63542b7f0fb7bdab199519ba88b09c36141ec79f5ea4ae14657164f2141994297e1208b6bf84d6a1962df09706d49b4d4d9f9
-
Filesize
5.2MB
MD55b843cd47e4eb56dcc352ab94866b720
SHA13d8ba53f3b768deed95927e811bbb2987dd340d3
SHA256256259c1ed32cc9b0095adb733821e0de4097f04bccbb88ad86745a73ee2dc25
SHA512198e3b9e6cbafccb1b713ecd22c9c50c9753f6156cb8bde3b27b25b465b2ac714e9c58d0a59fa6ea92711a7042b9d52688d19652f79a535270caf5413e7b21ab
-
Filesize
5.2MB
MD5a26249e0538a83a49dfc8410eb76dcd7
SHA136fb2ec3f0425f49915d43f92dbaa0bd7f81c5ca
SHA256ce3a5b122e152f9fc6dfbb342165bfa6b716c1f399814183fc3a8cb9589d9332
SHA51298966d9451911d2e0b8e08fa95a4ae2d0d8c0eefc32188eedae03773f7da523313a82b97319866d6f9e1e5c20395a2d384cb3d5c2e535a234e9e17cbd0240838
-
Filesize
5.2MB
MD5acff3a1a836c7c255283781ff527ef5e
SHA11afa788faf86dbabc7923d2f6ac28f5371f5e981
SHA2566fb68fb51c4037c57c0f6158f034f5f07891eaa6c491d2e69b6c775a56431282
SHA512bc268b034b3e71523658d757a97681d139841a9c19fc04f75f27f83c3da9e4b242434463fb1f4ff516406d986a8583263e7cdaae7273b464a204b23bfc31627c
-
Filesize
5.2MB
MD505a8d64021b9c6504e3ae4fff2a0ee8b
SHA101844aaa775774ca05d8479e43579f20e48ba3a6
SHA2569a60d7838eaf1090b6a28c5c651cf8db557fd6a5734a30576c852d1933fa1680
SHA512cad7d543780536006f02a203793548f9904cae550660f872bbc394ab6e75f3c580739f0c91e25653a83cf872758f9d07c10805a0c4ceea0df5c4843185940847
-
Filesize
5.2MB
MD52bb9f4e7264ea96afd434bbc27137f99
SHA1d7c1752a02207087dcd564883fe96c04a58f0117
SHA256dc33cbd0091163c0328e96c60a4702957a46cc8830c2a73102538f0e19a31109
SHA5126d10dab1310b73cf33dae5b080cc08f42ac911c69432352db6a00ef197ac05eb6c2300a35e70c07e4fbb107a45d34cb4342cbaeb98446d2b1afe3975d6be65d0
-
Filesize
5.2MB
MD576948d5756c68d8b7ebe1c302b5db726
SHA1abbb06b4e52b1286cff58a896a3ab0e87a08001f
SHA2567c6108d00411c8d7a4dd1dcf5626d07724661f2ab82cfed5951f756f34be6165
SHA512facb5360880198222e8ab1c5dde194755d028a7bf751f51940e472b8728c6e728ef408d37ca13bd6a0c9a2e223bcc730ef3c489a7f350fb09a128c6370a483fc
-
Filesize
5.2MB
MD5aa83147532e00aa79822b2a8da48b894
SHA1148a6d2b1ab66e595d6b9eb4d6b3ba56521d6c11
SHA256d9d355dd8ab7f260add1407e3ec064834f5b191e51df938e8db4c6292cf4cb01
SHA512a1fbb7bada80a052bbb986be41a51d9fc7abd63f14b832cfaa56e46ac3c513b8762a40a1960dfcf09542fc630345f6eb76be0d22cf92bb828fb375da65847c49
-
Filesize
5.2MB
MD5a8efdb9962c399c1a4b4777361e884f0
SHA18925363b3d6b1fe0d34d71b456c26403988bd382
SHA2568e44150192301295b0daaf992817d7a1d1e54676a70c741a3d2cd3a6f372ca6c
SHA512f0398bd938d3b385b2276f5b34650e68d5df9a9cae213678a41ac17d2d6121de800867c4a012cff9328874220f66bec2e7c0376b8de5c703ea22b34b4f16f9d7
-
Filesize
5.2MB
MD51cfefaf404f62906e361694de247b2d9
SHA1d15b47e582a3668380273a8d83d0532b51f384f9
SHA256d4411083eb726a768ec4d102e260b0e9ac54615d94e08639366989a3ae0ba9db
SHA5124874270edfc663113924b1e691edeb43e8933e09b27a70a705c6e23ecd8ac1ef2334ffbfa6d1ae815568b431d7fb8d875c3bbd93163d5e0f595a64b0dda02397
-
Filesize
5.2MB
MD51193768986ec23ff1e60528f4e099cb4
SHA1d3b41a3233da4e4b113d21f573b42465614422cc
SHA256a7e4c5114fa9aa790cc121b9a9e26e554dd60f88eaec818b33571c27e81f7f8d
SHA5121e2d4723fe7a5a9dd9ef7e4f809bddbe876ba6f65a3ff52fe944ceae3037f9ca78cf27959dd79576079ca4d6b7db88a8f7b4f8e9b36c0ede8e8eebb7a58a61bb
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB