Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22-12-2024 05:30
General
-
Target
2024-12-22_d13dc3f757198a67d306a5ac93483a0c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d13dc3f757198a67d306a5ac93483a0c
-
SHA1
722a5df16d7af113fdff42d9e4c12d9dad20990d
-
SHA256
d3d90b17c7f422b7978ee194ab8ceb68d3ce6bcb853e02ea61ab0cddbc029ebf
-
SHA512
0619250d308b4b6cc683c1fecf95490b35dd07616f39849ef899905f29e71d1887697e7481c81cf65b5bf220211f758958effd44ede8b782bdb4599fe81db307
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBib+56utgpPFotBER/mQ32lU9
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_d13dc3f757198a67d306a5ac93483a0c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_d13dc3f757198a67d306a5ac93483a0c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dlcRIzY.exeC:\Windows\System\dlcRIzY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oCrkiaA.exeC:\Windows\System\oCrkiaA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mcjomxj.exeC:\Windows\System\mcjomxj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ymtwwvE.exeC:\Windows\System\ymtwwvE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iFawIQy.exeC:\Windows\System\iFawIQy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jZJKJPM.exeC:\Windows\System\jZJKJPM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZtUlJZk.exeC:\Windows\System\ZtUlJZk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FnZIPPz.exeC:\Windows\System\FnZIPPz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NORNdjE.exeC:\Windows\System\NORNdjE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\abQVEPV.exeC:\Windows\System\abQVEPV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sqCsGld.exeC:\Windows\System\sqCsGld.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zKFejJq.exeC:\Windows\System\zKFejJq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ugwGihw.exeC:\Windows\System\ugwGihw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\csTIFOM.exeC:\Windows\System\csTIFOM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZEjdzqq.exeC:\Windows\System\ZEjdzqq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tapFfob.exeC:\Windows\System\tapFfob.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KBPzWhB.exeC:\Windows\System\KBPzWhB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MZBZuiX.exeC:\Windows\System\MZBZuiX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LkgpuzQ.exeC:\Windows\System\LkgpuzQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\koOmeYZ.exeC:\Windows\System\koOmeYZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mxNjUyA.exeC:\Windows\System\mxNjUyA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD537ad79571b97f4d2e68206fbbbfb6f27
SHA12f4e129798f5fbbf85f5f32bf767a4ad80d78cab
SHA256addb5bc588c106cfe546797db77262537bd4c63f0eb210b3f380e99406ba0834
SHA5128cc61a03cc7a479eebd6e30b5d52e0bfebf3b402007c02cd23301955bddc2d200eed45b3281203ac56781a3d3145f93a718f0c525222164e2659b10296b8bd9f
-
Filesize
5.2MB
MD53b74970c93cf65b32ec601600596e22e
SHA186c0aa26c27529be2e0206c28248df8afb48e88f
SHA256b6b0efa4f81686376404bc645f877c171f4799cf460c65f9d589bc2432820197
SHA51250e46c154c64f400e2cce8b2de3f5c5032c798b9a7974599ac03e6a86b1aa80439546a54271bbee48bf9f4056171b3aa7873763a6646613123e681bd02ee396a
-
Filesize
5.2MB
MD5e8db27e13230256327bc75b55609e3ec
SHA11ea931c65b37dfae81388199499a85da1e4faa0c
SHA256c24a3ae7d7ee1aa723d7148d9c38cec1596367d4a1cbca982e4238bc2cdeaa3a
SHA51212e6bb780678c8a040d938da2487cf60c916790eb7241b3963c0b76b70b35e2001c40311e9c90ce834f184f00524c1db8c4658db3d917746a02e8e654486c060
-
Filesize
5.2MB
MD5b3bb424bb3e4d8f7f6c55b356a2b09f4
SHA131e23ea1ff8f78ae6cbc730393c48f6291e3933a
SHA256605131ff7a2d70205874c11cf09621c1360777bccceb2c667a2832bee1160f1e
SHA51239807cf75c8f7a5a3d006ec3d448b74a74dcd0e875685bf7d2ecec6cc24ccace2ea4dc2c82f242eca2b6a6c9ab4d1d20557631053bfa768efbc33978bb19ea73
-
Filesize
5.2MB
MD5264c38060d5749c46ec23f1362ce5e4a
SHA19a74973919a46c11ff7c8f5d5a3e411461995553
SHA256a1681713afd0ad8a6ca4ffb896d96e1febea10b884974a57c0fc6c4648f261f2
SHA5125a53c8a4c0bd0c8e08f83092839a5346343a44ac83f1b24c7436837a9cec66f9ef091f4b6146d6573983bb01740081467f9d478048b6944354871c075fbd8c72
-
Filesize
5.2MB
MD53b398faf918ff867af7d8fe980234948
SHA13d296b88a06be3d258f620af6d753d1c810d844b
SHA2566d1c7224158644aa8dc93a0aa9b8586c569a26851611e437eebca77739e09817
SHA512928ef8b3e62e6a3f2a7f9316f0443e41250770a8589f04b9ba9cc24fb20d4dca7236d2850580dd2d8f7f7f9fbc26e56edcfc94dafb87e51e12f18dc15fc32737
-
Filesize
5.2MB
MD5d8b3968656fa730f55c9a6372b0106e9
SHA1bd704f7406fc66dfc0a7c28bb84f8c94d16acea1
SHA256d5da2a6ee7fa82ac00cb9264cc1ee5ab2169d6595437a95bcfbea2f47d36265a
SHA512ed206f9aade3945066d46023f3cd5324d39e5b6a09e6fafdd5f238f4453363b0668e398df621fff408ba8b376863b5b5b33a08882d95f9076bddeef517889c73
-
Filesize
5.2MB
MD55f17e4597f3bbe160fa20c38244fcf11
SHA16c3c2495366ea091ab04c324101f8e9e896044f9
SHA25630d7a99456bd7ed48be65e71a6e073111063d940a5b1f6b25938d80d2b7ab401
SHA512cedd3803b747a6dfb2d1729c243da9bcece93997fa7f13056f8fd33bacd8fd50d41799d1a3937927791232aa3ebdc685420db8b6320059e7cade042a1b44d52d
-
Filesize
5.2MB
MD533ab8e40952c4d0752f0312dbe43031f
SHA1dc6fcf4353f267e14c5449b8131bfc84e0218a6e
SHA256a4216110a8fd39b88cb4612d05632ad49bb602ef08c2033dd628dac5da277d10
SHA512387be1397cb86aced30a57a8623032ae5a02668e05421844e9d5d08de51605a6ff8be6be5e3dbc268f8217eda70294b46ea380d28c54a4e2b4b5f9840a3a85ac
-
Filesize
5.2MB
MD55bb650e0bad5cdb52092adba9abe5eb6
SHA111eb2f33754283131316ca2baee2d36177816b81
SHA256d9521fee6628e50945804959cbe7e8840ce9caf35d614bcd116e760bc09df32d
SHA512a6335c56464d01de2ea55b17721288aa7ac2250b5b0a9e7dbc36901283467fb0de3e7b96ce5e178f0e0ab7277d53e758dcca432ff23c7ca844aea54a36a3b3c2
-
Filesize
5.2MB
MD586d7d6eb46fd854fa56ae1624b3e1d66
SHA1a69c9903117309590960943fedf013bd01b8d642
SHA25610418562b3b7f6f59ab9b01a73fbf9599594b0604bff924a309997712c31ae3f
SHA5126c2d3f0ac9b4ed63b12619dfbbeff67f7d0c55da3cf69341990a266c9a4d6f68874a09b06ba51a0372c1033d8b6b6766d90a90b6f45c81f77053a05d367c7daf
-
Filesize
5.2MB
MD5cc1007ad09862b46a8e76178ab6ba4f0
SHA1341e7f57bb0ddbfb3c4b8bce3e333f020aa3fb02
SHA2561c1dfdcaa448c028fef86a84ff0fd24ef65b0ccc735fef30f2f5647729ec3621
SHA512e3f00cfed83d553618b1ba5f02f385929a6ec52ec16f4bd7f4b785c28fe57d8a21a96b20dbd12034f144f1dd927848feae1f60ef44a86494e0dc2ad37ea07fb3
-
Filesize
5.2MB
MD51cbca71c5a960209d133175dd6ef0fef
SHA15ab7209ec64574286157cad0d02e174420b67919
SHA256a359151bf7a4511060c0c17cf654197b7e6d84408c338493612146d76202905f
SHA512b345882087ff2f07e0d2620be5528b7e1600e595d8e9f6e7c68b92a8f46203a23c6d8fdd492f6c3ddff9c07d26fb7f1fb30d26d68f155d83b605ebc7a7dc9924
-
Filesize
5.2MB
MD559726be0623218cd5cb2b7b9331d0a28
SHA19c19d9e14756e3c2db9dd624dc6ddd6f58d26879
SHA2560ce26138f6245cb2b264f8fd87a53d65591289e54dbaeb9b0e43a63c81b61838
SHA512a93530f540acc35c5cca4720d12fd849e4553b4975b1c011fd0cc3b36ccf9b6c37227a942b6b66338db4a1140a2ca0a46aaa24b88181b2b79284bbff468e092c
-
Filesize
5.2MB
MD5a3956d2450b020ee7c2dd8fe105f78fc
SHA1ca3f2c4dd2eab0afb8d036cdc86b81ff91871afd
SHA256cd08f71dba25b3512a91abcf2c98e195f712853f7fc3b1cb7b34e4a69b977d65
SHA51219b8ee1878888a60818d8420c33bba667365e7b4deb6b71e335b6c8ca1cd174998943c575908d6a711c182063a6b169980573a12c8cd08e0327409cf63bff6b1
-
Filesize
5.2MB
MD59b1af8b025d9a2eedbd090f112a9ce07
SHA16265a0b18c4b55c70b3335de13a003accfdf2860
SHA25643e2fe475846c784762fca1515b626d89566443aef9970042ee1d4fa6f1a70ca
SHA512159cdc4cb2297aa84673af427893e83db705fb39b174677c45a1cef53b78cfb29b24f33bbff3df155b24330dc871f5ed5031c5028f6ea0015879259d5f860672
-
Filesize
5.2MB
MD5f3c5ba3a9064875ee2c2c335d6f32a34
SHA18d228aab3bc5265ae34c1a1213ec81d5d6ee343f
SHA2568c0dfafad2ac05693bce45cb2ac8d9a461417eec37a064188e5df7360032d7fd
SHA512e41cbf8d9dd14b66b41c8783d2a3ba4ef92febb4a542cff217aa7f433102e79fba3ef422f441e67a513fae4c1e6017e94b08ff5d0b05a3e5d01f7522b11e705b
-
Filesize
5.2MB
MD55732094c29be53aa35814d9568960db7
SHA1ea28461ecbc331062db4f55759b91eaaed2b3eaa
SHA256da83ca112ef4fe1fe72931a152d6904056b79d6e44a468f0e0fc771012f60b42
SHA512f91f953ea9558c66079c82acf14d2a76ed057cb1758ef29d68a9f4f650c06e1db680fc56b3ec47616175e3664a0ec2cecc88d86cb648f503e06255b27f2bfdcf
-
Filesize
5.2MB
MD568aa3a3e07d469404a44256f45a9975b
SHA19b3a6cd8cab370ddd5fb1a72b30674890fcf9b10
SHA256200fec06a157239d135bc00baa871664b2ed0e06b99b879dd4f45bdfdf7b535f
SHA512ee76973e92e3ee9f17abe5399524f878705038f48a5c12002a174184e7982d6bfe5d4724701515ba4cb7295317c289a37df3e852b51133beae1a3413b93e9207
-
Filesize
5.2MB
MD576d637aeb0a4bbe883db513301b3a07c
SHA183cd79cf48b502cca137c0ab42665f07ae06c51c
SHA25623df8a3e795f85bb1173ac12f9dbdc0855e9a1e2d8ea249496a5f706e28aba9d
SHA512fa974840c62554301810caa2503181356a51d13c0124b6c84b9ef188151af7268912468d1805a7bcfb7f02a092d28db97a00e6777b171d036a4ff2f63207fa5d
-
Filesize
5.2MB
MD5555dab0ebdb81f66fce02b870ba6dd05
SHA1b5b96a4ad52760e0d30b9e65b7d0885b6e56a728
SHA2561295a82f80371be0a7fd2e398cfd6b8b1e6626c13373b593c34295b960366ec7
SHA5125b6dc110490b3c58e070412fb104cef6f0cd64369f44ccff7673f7497248cdace14527a2644944736c99667fa11263b03909bca626ed5e497b9788b5c95eb4b3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB