Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
22-12-2024 02:31
General
-
Target
2024-12-22_65aa2fc2828856ec41aaad8375ae46aa_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
65aa2fc2828856ec41aaad8375ae46aa
-
SHA1
cc07ab21f31d6470088818934513763e11405763
-
SHA256
31513725d2fcf3e7cd771bd4231c5acf26853afe5ce692b6bfb228b05368dd8f
-
SHA512
37bb6b4bb4da7c622ca9df20e661925d9a046625614e204be206977ec16e29a192511833f3c47036a4dd5d382a8861c3190c393635d14059c881e7a62379ec9e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUF
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_65aa2fc2828856ec41aaad8375ae46aa_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_65aa2fc2828856ec41aaad8375ae46aa_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AnxKkRO.exeC:\Windows\System\AnxKkRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LyQLnVI.exeC:\Windows\System\LyQLnVI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RChXaSk.exeC:\Windows\System\RChXaSk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QkUDPBf.exeC:\Windows\System\QkUDPBf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NQZSPUA.exeC:\Windows\System\NQZSPUA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hLYPGlC.exeC:\Windows\System\hLYPGlC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JoqRzLJ.exeC:\Windows\System\JoqRzLJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UlnlKtu.exeC:\Windows\System\UlnlKtu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TfLIDth.exeC:\Windows\System\TfLIDth.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DhnPKJf.exeC:\Windows\System\DhnPKJf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ikCrYnq.exeC:\Windows\System\ikCrYnq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qxPKMqT.exeC:\Windows\System\qxPKMqT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yUbsAdl.exeC:\Windows\System\yUbsAdl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rRxZCZo.exeC:\Windows\System\rRxZCZo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cLTgWyw.exeC:\Windows\System\cLTgWyw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gXXDyPk.exeC:\Windows\System\gXXDyPk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zFSboDP.exeC:\Windows\System\zFSboDP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rWtvmwm.exeC:\Windows\System\rWtvmwm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EbchqXg.exeC:\Windows\System\EbchqXg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWxWTkf.exeC:\Windows\System\SWxWTkf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CggrINo.exeC:\Windows\System\CggrINo.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58f47738f5096824f09c305f8d9cfa561
SHA13c9788f1f5d5883657d5172f647b166b167dbab2
SHA256e39d0d1ffa775f5d624333f17f447f527869c2af8cbf8c4afb9e4b408fab8e9c
SHA512ead9012b2fa7bc6d5f65437dbaf1c9a251e5cfafae405451799305d4137948b7ea0a4a52e0e899219fc980aee04ef0fbfa1583ba69ef9a22d7467d7b7cef1c60
-
Filesize
5.2MB
MD5c604e9a6483fc71b4829832e9b31fffe
SHA1e7183615ab0ea2f6fed59a009fd252200944b203
SHA2563ab1e8e2abf63b14a93b7f09f017bccce8ee7545f36dc2acd0128eab0c865230
SHA5121c77c4799967c9c15f61c47d88728445e330905b2d9f2c18e7addd2d81e5e5ce44a40e5d811a017d3ee7ff7421e12aa3f6df18c896aa55e4400fde3f283706a0
-
Filesize
5.2MB
MD568db30494ec41655647c3c53cad874cc
SHA1a16a851e5f8463e6b50db83a01fe3c526ea83c5b
SHA256483c5eb8b8b1ba26e2878a7f63213de1bbcd6a4df76f565b51e22ad4ab4a9299
SHA5123f5eb66366820e78063ab7dd2bfd8ce5c997d33fe5266559afdf230bf9299771f64b71b819968ef7b151b8eefb97787c5322b134341744b10d61469645bc92a8
-
Filesize
5.2MB
MD5f74812dc69c2699933b6713b84d2d7b2
SHA169ceb3cb5d3b55da1f1fb3588f5587fac6e9b554
SHA256f87f912252ff4b240381393138c59ebbf7291f0c56a8dc4b72a81c3baf41f5bb
SHA5127c0e02646274920a773026eb2b15906d9dd4a541d6cd6b7bcb7a05cabdcad04aab2952052707ce09b5805561ed47bb057258762cb3510f0ce2068f24cb7940c0
-
Filesize
5.2MB
MD567eac53de8664a2835807e436e5a89af
SHA18c9a49a5a2200e2f6e02e93baa380c7f903bb8ba
SHA256e17ac5298c993a6da6bf0505867d302ec21e43e7fde4bb9f17e25105f1bac26e
SHA5124966c8514d129aed0d38a58f17866f30a3abf18f65f2e96a4e25c139a1eb2162f3ac75ebfc99286071f92ef5023dffa5c6ab999d23857d6f7b415c24e5d6bd1d
-
Filesize
5.2MB
MD58e7233898953e46147d68786020e9dd7
SHA10494c823dc4f959294fd7330b5e92ebd20db8f3f
SHA2561b17003ce8348f4722a5f0a9b2e741b8254a7c14fff936803751a60bd6cafd28
SHA512f53727e7236c8d26e81283e0e06e31e795bf5397dd5695a2b1912f7304f26d489db0847159e49292fe9fe9ea5b2a7a0771396188f2344ca01fea17dcc6c8154f
-
Filesize
5.2MB
MD54b192d1ad49dd778b4ec354943751f04
SHA1c739e8432adcf48cf139046d46acbe200cd03e68
SHA2565517dfcc15bf42b8b5be3c1631ad2d4f5a0e00fd6807e0fe1a3e42e06112946e
SHA5127089c2b1f430dc6626d62200740458cc65d52351af3a302e2361dc5103e48a901ede1c17c7896fa893ee257253d85d2088c79a3176645727e47eb472713c1569
-
Filesize
5.2MB
MD525acfe0262fcba46e762fd7121afbbd8
SHA14c87c13594ee734f4c2e3063af1c75a9f17d58c4
SHA25694da156c04332d84a5ec441a2692628145205b10f17127dfe6057517441c6535
SHA512832e82dddeaa5b1b1c255962281aea9b37667e86dba002af997d7f10d0c46e66c4f168475c101996ed945a09649ade30f560880c2f97c745701b051e5727477a
-
Filesize
5.2MB
MD5713217103ce6c7def363fc421a3b474c
SHA1bd3164d3ea85a83357daf8bc5e6d1e98c43ce3fd
SHA2565c8b69ce0b15179ed4c21cc1206ef912ebc0afe1242fd3c2fa7ef20697e6138a
SHA51264056570962fc3dc3f81708574c3677aafed0d1da02cbf31c632b60b57214be483946e596f9e5c837b9ed212882bdb00c37b0be6e32af70291bd9eb36e975a18
-
Filesize
5.2MB
MD551f36c07a200b7faa11ae249f6d73593
SHA1e3a7ab1723a309ac7eea2703b1947a408ca670d9
SHA2567e9a5da9a0c87bfc31f988b4721c2767c4d7ba99a8b845923d7495c639f3bf3d
SHA51287f8fda7faca1283113cb7379bc9a32fb469d14bc0706ef45289e8ea983a95023917aaf4e1b572abdb3ddda3afafbf64040e423980570d2a9c6c0e8d675386b8
-
Filesize
5.2MB
MD5257a3ebe807e6e3ad12a80ff4284f13c
SHA1b26050a46f7835d7af32b0c5eb24ac3fed393878
SHA256355bd947b8fbeda9bba423f643519a8f85df372a323252d8e6275399e136d842
SHA51231f6b25693876c1416fa7ddf5b44aef69f84de3caa8566589a4428b9cf9f0a5264b242b24e5d310ca20ff67d70a9fa016b85f88368c297f4e07952d2a3f8ef42
-
Filesize
5.2MB
MD5e2a0e23bb1644621fc40370131b5c6d7
SHA14c0b2896584015b61c5ecbbea0b6761957a87657
SHA256788ab0b2665a3cfce36158bd4cf13bb4910602a1cb6ac590a267fe78ae636a6f
SHA512291ed2c3f29a5726abf01c57b7c4ad7ed4daf87ff40b55db1fe50a9fdf9b6f9960c38d61efc706075464e0015285707727d8866979ba79190e8ef22bacac0834
-
Filesize
5.2MB
MD57270c599a2e2a554eb936eac502453a5
SHA1dfd983741d043f07d95d745b4dd0b7323bad0575
SHA2562b3b9f6499b0c393ececa6341079baa121697b4b4ae85e68a501b01347dc9df3
SHA512e8ac5b870c18d26f3e08b3cd92e5d767df1247b6f1a7487c3153838ea481014c7d5bd5facd350395f420649d77187d3bf99d8b35e704755d26aff5147d69bc08
-
Filesize
5.2MB
MD579ef838c3dc729fdbb4ce0c8db5353d7
SHA192f25eb51f9e37a22a8d56253d2c7e12caaec59a
SHA256b812d9bcc6018f4c1499e59fe2a2ad29998431800080b3bb4f726394ec27c93a
SHA512e5d7829545329bf76ac9f36148a6994503d01f45e3c8bef285c4f0a2e47c9144ff4f2952f1dcb1f6312fe6ceffecfdd7c76880286e591e6d5dc461bae1e7ebe2
-
Filesize
5.2MB
MD50a4e3f480f92e19abbce01061ce8be6a
SHA17edee130c5dd6869ce0474fb361bb9dc1c8a9283
SHA256b13394d0a00f58dffa8e29a3c10d1bced39093e518b86b72df2fff532a7b4d4a
SHA5128dac78061f69dac53163ad7d6012f6e2e333e8a502eef7d8f60d64c03d9dd4ee13f747eed1d1fa7ab4420abb389955358ac6777a2874e3a4c0cf7442192def00
-
Filesize
5.2MB
MD529be74a328926126805b70a221ac2a8c
SHA175c02c0866d38492cc1c912976cfa8189064249c
SHA2560458a82b76a8c1d8049be465dd13235cd21b5212d9c99b7ad565da16a72f0992
SHA5122101faa68e9e902db8303a09cfa80f7ce02ec10c875693a174fa5b9abd0ecd607d6b7dcabf578a7e3a1df7c11fc9b80297829fbf1d7474ec9312abec2fa2b218
-
Filesize
5.2MB
MD590555d62fe2a358e87ac4dae362095df
SHA1241c7e5c0bda351e89396f74ee8eb539a5103e0f
SHA256b61ca790e9b958cd60ab7b57d85402cd203c1cfea978e12316ed97e2c813de10
SHA512a2889ca575cbae2c28cb58d8eb57da02651e7e31134530953167900c10609ac44b02ddb6ef6afb814e27b2d9fa71a7ee099dcbc8a1b61430c9e9473ee7d76e7c
-
Filesize
5.2MB
MD502fc2c3b821f05744c874004e7a636ee
SHA10ba6dd7ad2e5f7ba030d9878b3adf0e69e2ac97d
SHA256cc2fe74ec27f633a9bd3e0dc1dc8e59e959a34254da98a15651e83e87c1632a0
SHA5122897a28a92a65c8ce941f895a1570c2aa49252255b9b50ecb8f143396da0b4c26c0109aed439730ff7af6645372098cd2b029b8867483245c9aae2fb85db6de0
-
Filesize
5.2MB
MD5ddc589f2581587647e78e99a1349357e
SHA18c44f3c7c09d2da4ae2a05111faf0cd01b253e18
SHA256956dea5fcaf6cba45425fb2579ef6f45a56123896d57a651573b68ca530b4805
SHA5120753852946b3e434733c081cd49775e83142bd8de525ac9927635d02adab221f2956e94a648e44b57571bbe3d8549824dc9367b04c88ad96a2d23c8490659d49
-
Filesize
5.2MB
MD5b624f0d1182a5e98cc2ec8f5089d2b95
SHA1bfb719c412f899ca26b32079b338e772d9e63ccd
SHA25619b7b4846b16bc87aa5ff9e806c895e831de118399cb635fd960f3bf4bb4d8c1
SHA51267cb1c91adfddaa8a5143a2880a459ba06d2eeff42f3d30f2daa2d595262f47e20f4d0011a63e941cd4fc2ede13149be0aad8599bf46738f44165d9318dab32b
-
Filesize
5.2MB
MD5a7d697aa404f93f76a29c55cbaca4d17
SHA1604fa4df3472edeeec0b02da52d7a228605f1743
SHA2568c743bdb420cd767d9722a76d77a4f7452d9736256a1f81b83e225013cc4edf0
SHA512c80d898cec82e01717e527b8d295a52098bc01a50afda7f5e280f0319fc7d7d6ac166a1e4aa60530c364a57cbacddc7b36657cd2c3738d8b3d33a81716ba4c5b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB