Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22-12-2024 05:27
General
-
Target
2024-12-22_a6fe0a4316b283b5d3b449f59cd130d4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a6fe0a4316b283b5d3b449f59cd130d4
-
SHA1
c1c2aad25819d63f3d03d29b7ddf9b74895f31df
-
SHA256
6a8dce4d3a22006b99d9d52b36efb9b9e3c0d60db18629de2eb3be7b01df4d6d
-
SHA512
05cae500945d2c7bf3ea1abcd2e3f5ff38636fe052607311a675ce1e5be5902d9003d2f3adf24185de868bc2c208236b1b3993df803120103416b035a8aaa960
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBib+56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_a6fe0a4316b283b5d3b449f59cd130d4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_a6fe0a4316b283b5d3b449f59cd130d4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AHMzSpx.exeC:\Windows\System\AHMzSpx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BdYuJPK.exeC:\Windows\System\BdYuJPK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VafQWOo.exeC:\Windows\System\VafQWOo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\atZCLSr.exeC:\Windows\System\atZCLSr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DMAdoOO.exeC:\Windows\System\DMAdoOO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wIQkMJB.exeC:\Windows\System\wIQkMJB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wfeGtkC.exeC:\Windows\System\wfeGtkC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MLGljzw.exeC:\Windows\System\MLGljzw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mwYplku.exeC:\Windows\System\mwYplku.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FNqsktN.exeC:\Windows\System\FNqsktN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nnPeVBC.exeC:\Windows\System\nnPeVBC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HMtjUDp.exeC:\Windows\System\HMtjUDp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ULxBbTe.exeC:\Windows\System\ULxBbTe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kwgqirD.exeC:\Windows\System\kwgqirD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GlmtYxq.exeC:\Windows\System\GlmtYxq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YLYlKSg.exeC:\Windows\System\YLYlKSg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MWffrTY.exeC:\Windows\System\MWffrTY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NJaQoAk.exeC:\Windows\System\NJaQoAk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uiYHlBS.exeC:\Windows\System\uiYHlBS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aPxFIPP.exeC:\Windows\System\aPxFIPP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xRxHLzi.exeC:\Windows\System\xRxHLzi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ff4bd6e7c4c6298ea1c7b2ac5299e54d
SHA1258aff13611d751bdb46a9fa5105adcb674117a4
SHA256bb7335ba12789ba962db38555292d7b4ef651b676b2c52a25e70cfdda9d34a0e
SHA512eae6f93d52d8a1c4acaa09bfd99ba4996db0b829beda5e6684b9eb649e05ec7b03bddd39dad134c8ad4d2ed53d35c4ac43bb8b436be0ed579c49c1556a16dcb6
-
Filesize
5.2MB
MD5f8ebf996a7982b55ec08ad4b6cb034b7
SHA1599ccaf3eb284bc2f72ccca9a1d35e07d341b2a2
SHA256d0ce93a225c64851a7429eb8eea8b8e2f20630971c3be6fb8d17d59e47f11e51
SHA51209002d4bd3d88bb37cbc990f4b5a37a5176d5fdf171131a3ee2f05247abd3c116e0c951c6b99f187525fb02f5a288ee961fc097d1c2d31c65dd2d02307aaab3c
-
Filesize
5.2MB
MD5b0aff01f4e6484667426e92366688730
SHA1e8198f35513b066545f8da51266d140d71eb4e59
SHA256fe2a26c705df3fe60ef14ba4f7f83540fabcf13712db9e6f012e47181dd9f66a
SHA512174fde914f77ed31581d8408e60ebecdbce99aad3064420b9e281f3bbbc2393fbd664f949501ab851746ffe594d6c55a3deb31c8c1444ae6d57d9e3907ecea8d
-
Filesize
5.2MB
MD5826cf90a67e83f024074bbaeffad2c31
SHA1dbff5f7f4c16d27528ec277a0c8e27769e0888b6
SHA256bad0f5c242e5f00b1639eb21b9dc9f54307a05c0809046ec5304dd7effbd4055
SHA51261c59cbb60e04a5946c8362a9d6b9b6d1d40f9419762029a5b9ee8cb11eabcc41bd1b196f138ca8a9f1b11cde0a6a52df42154754351bba10ef2d6636a86a5e1
-
Filesize
5.2MB
MD5ca898ab29e6f733466bf83cfb3b04c33
SHA1b4dc86685b3f2c8afed24bfa86aa82ca8e264670
SHA256dede712540ca08b73aee6e71fff50a3b53a8a8fa65ad947e11d71e85da968394
SHA5128d400ee9a1d7755fc99c81e52079bce626b079de76132d22fefdc2062e2e5a4e4b07029a6b0ff50963586e7ab165d340577fb7f8171d0149cca636ca5e7ca9d3
-
Filesize
5.2MB
MD5a2df26b4cd71ea889a378ce774d1f63e
SHA10a2bcb559b00ead58997fe99da6bb7ebc06a6952
SHA256eddef36535ac80e319f2617fd64d365145acf43e2025ec1512c72f370c6c730f
SHA512b80990e53bd50c9904dbf6ae964083fbaa6cf6cdd4f8041a0f8cb39c15935e18f8956b6163089121c2c2b6653121cff3c24c9b2e5a9278a8f91d2b8966b41f2e
-
Filesize
5.2MB
MD583804b0b8985111232eb4257aaa46f16
SHA11523cc56d12afd8a9c4fe7503b5b2737d809e7c4
SHA256f561a4c263e1507c75e5172efae8d5ac2e6dbe317182db5b06a94b7f923140dc
SHA51244def0afc460f4efc1bd3b12d7fdf4f38b547f295243f4e72d7cf337a8dcb5434a32c430cb7046f62ae0902552f0d0b26301a3321c66f585310334533418f06c
-
Filesize
5.2MB
MD5d573358931569fcb33767ae87298a558
SHA1315b6bc0b278cd5500b5dbac1669a550341827f5
SHA256ef115c73a94c35e9f8e7b117a61c16a245def2ca3abcd0455401d5b179797021
SHA5128cee6ca08c381961ad7d49f86cb4ec8a2f7a2c483f0504765b159baea7186898d9b10e3f1ae5111becd82973675a1f65d184ec047b4918edc8bafc54dc2cf841
-
Filesize
5.2MB
MD5f739894d93dcc0e128c10430028973b2
SHA14855f76cbc9193e73d7794a663af10ce0e8f717f
SHA25623b43fb1ce8ca16c6a6081740623fe587b8178c8ae9b959564c0404f23bd247b
SHA512916a2add515d0c8c663ffc966d97a90f8e9a127defda70f0278437b08e939816bf47961e437d50e00b8310de158d93bc197c098e0df5e2aa54568fa441f61d7a
-
Filesize
5.2MB
MD50fe354ee6a9ef000dd8ae02db3dea8bb
SHA1d68ed8fb56b447769f0cc80b50bc8fed1fe98761
SHA25651803eb2d69b171752653286d76b0178a352c3a60a4e78032dda49e7ac8c204d
SHA51212ed29d48a22ea5ba33d61a29164bf7b665f44380a1605262b28d531f5af0688dc8c344cb05c30f8289aad729a6ef35efb6a3920ce394a844c8ae0ee1319c73b
-
Filesize
5.2MB
MD53418ff5ad8eb0352e1e94c0ee68f5332
SHA160d905f93aa4a718fda9f7f5e0916802282c42bb
SHA256454b65345c780a5aa7632bd6b1a76e2a38e54a03b6e3103e1366a81aedfaf56f
SHA5121f0950ec8a6908936ea981c7b100127a3153a57c437504d46480b451f091b11bb450fced9474bd9cc742d070bcb0b0d3b7427417615554db047b64aec11c3d3c
-
Filesize
5.2MB
MD5e118c30714ae4af61798bf09e6544471
SHA15752d2215fd7e2510edfa57bb060944f32d297bb
SHA2569129db0c15848ecfc9f76b62b774c99fc0ef134e4853048dbb44538247f2becb
SHA5123fb679232e4cd85dbe87d784b10f039f4bcf27a9c4f2a942b51efc84831e6b5d544ee485b701758e072165c56efe61543a27af81d599b25b684ff3fcba3d0eb8
-
Filesize
5.2MB
MD5a82656812dea2ee78da31b82698362d7
SHA13f46e1f9ead048ceb6c478f0272c57973a4e8def
SHA2565642ea2bcfa07c9a6a6e5367b1e0a4ec0da5cb2671c4389b083876ed7b16a5ef
SHA5120b0a116ed0b509246cb41c0390f50046cff628d6e1484e072f5a063e6feaf4461de29bbf57ff0ad0528a808d15e6c2691865c3280470922a7a4fef4977391199
-
Filesize
5.2MB
MD5f349d4e3bda4283d404b66a3a5e62ad5
SHA1ad1d480b6b0e4a14eba7f8415a1ae9507622a94b
SHA256a72deae60eaf40249bf6e23bbf0e93ec541e8bcab30af71b74d9c8a49f2b86b2
SHA512e59222dfe540ae49cbd956f4a500693586e5b9d9011ad078591dea586a0093db26176c56de0b4ab96ba9ce44f46df2c886841b8174f7e5d94e2d31501a7bdc06
-
Filesize
5.2MB
MD538a9d7dd8f6cff8b207322acf736c221
SHA18b4812963509e42ce3e3fa6f627ffb46b9b0f41c
SHA256153af8ee407155883db213358e4d5599a1f1a804befb8b66c9066d6dfdd4ea56
SHA51212432e65b0761fb237b53b29069343c44c1ac4f3fb265969ba0f727f66ede5a679d1165af4d0a7d4c0b4d70c231ee548080acd742a899b7eed46ab54401234b2
-
Filesize
5.2MB
MD5aba0a035861074252170a41081cf156e
SHA12a54cab154edb06f25e5289575095c4b9f9eed1e
SHA256a8deed2e03b3de4e769eb9ed4debb26aa1f1dea8c5e4e0b873cd08c6fdaed325
SHA5121dc041483aeb3e49cf9661c418f356ab42fdd75a7c69d727aeab633598b4bb1a93d6ad182f3ca66bfbb7bbdd2feb9b25b80dd7445683e6addd9d42c1641358fc
-
Filesize
5.2MB
MD585c5b3c3a8263c94e934ddee9aae8c4c
SHA130f85249de29038035265470dbbbef1f3e83293f
SHA2563735d61b36cbec4833f0a8e499747897a7360a4eee55a2d1aafdcc5b1fed77f4
SHA512dba7bcf19e09562b6b6de81a96f7af4cedf0c75d00d421948924c94baf9fc8b80c7d9a467c6dfc7bd452f269ed465279f57fa22182169733c490cb5b87b605e3
-
Filesize
5.2MB
MD5440b2a98ad990a5a0589401a6a6bac5e
SHA13b2f88325e646a66dccf50dd0cbec2c33618428e
SHA256f147c8581c2b565091e79d49c3e0803f57442af93a5fbb72719318c56403acac
SHA512a262c4ae3ebefcc9985b38ece608788a9b2ca61406ab0b1d1d350cd994d7bce826a6a7a78d54806dbceae1d54bacf1d6a957837eb3b1cf567dfe0194ba4d50d9
-
Filesize
5.2MB
MD5539f291e057a4689cc3c0f216c5a9e71
SHA1374bb168e6a39e7c1b9ddc1dc34d281fd4124491
SHA256eb668ddf7c4d08facdd1b301789c41b9b0e05ad01df61fa3d97f0194b25eac78
SHA512b6639001da3b02e9abbbc5c09ecb1c5c2dbb778f3488a21646b01ba9be05ce7f0915152684cbb42553865605c4e33b47fb8c5fea5f95dd306d9ad83b27ea114e
-
Filesize
5.2MB
MD5b56fe665f95a253c9f881859329469c5
SHA1f479bb53ff193daddb8041e2d8f670f25c97eba0
SHA2562c1aad61959f3cd794ea0f0bf9169ec2dbcd8aa3ba080a4a005cca01f2e0efb7
SHA512683732d275813a4f4a58cc3ae1ae07597841406370f26781cf24abd8bd1295dd0ed71d006b02cdafef974338fca599aa16e4fb6aeffd46e764a7833db6425275
-
Filesize
5.2MB
MD50102484ed77901a6229cc6852eb17d44
SHA193953af64099a3dad2bda4baafef1a5bb2fa3f16
SHA25636530279b515e55c164acef3b9a39787850b91bb558ff0bf8be3024b1ac1ffbc
SHA512f4708ee8d7427db5ac928989583360c32fbadf6e76d305c248da2b51e580c8dfb986b83ef3b619cab91becd73edbbf1b9fb40ffd8ad99ee23ccd068456993be8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB