Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 05:04
General
-
Target
2024-12-22_c35f772778347c519ee30bee5df7b598_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
c35f772778347c519ee30bee5df7b598
-
SHA1
0b39f5d0d3c68d0ee05a0754c0a77dabad804f48
-
SHA256
a0c9469b5cc607662e11ae3cce0f52bac719459ce53fdbddc9348faaf10f2650
-
SHA512
f8c95a1c718184ff7549f17f3637eaf2601922e81bcd076d9e557e5780e647e7b807826b59af478eee2abb342cdcef4683b183b3645cd94a1e4a0d90917de83e
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lw:RWWBib+56utgpPFotBER/mQ32lU8
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_c35f772778347c519ee30bee5df7b598_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_c35f772778347c519ee30bee5df7b598_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZgxTpqC.exeC:\Windows\System\ZgxTpqC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FefjdGG.exeC:\Windows\System\FefjdGG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CYpNvBa.exeC:\Windows\System\CYpNvBa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PBpBzwY.exeC:\Windows\System\PBpBzwY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BiIcohq.exeC:\Windows\System\BiIcohq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gseQcSX.exeC:\Windows\System\gseQcSX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OBArAWi.exeC:\Windows\System\OBArAWi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\USyydbj.exeC:\Windows\System\USyydbj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VlIJmlV.exeC:\Windows\System\VlIJmlV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ufVJGer.exeC:\Windows\System\ufVJGer.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lFjbJUO.exeC:\Windows\System\lFjbJUO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XJjhzvy.exeC:\Windows\System\XJjhzvy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ftgbyzZ.exeC:\Windows\System\ftgbyzZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\enaXLXi.exeC:\Windows\System\enaXLXi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HgNQmmP.exeC:\Windows\System\HgNQmmP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lmLdDqi.exeC:\Windows\System\lmLdDqi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pLLzyOe.exeC:\Windows\System\pLLzyOe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\INtFwYF.exeC:\Windows\System\INtFwYF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\psTnUJK.exeC:\Windows\System\psTnUJK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XIJfYXV.exeC:\Windows\System\XIJfYXV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EQWEhSn.exeC:\Windows\System\EQWEhSn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD512ef67cd272eb668e354f9fc7017f45d
SHA1cac5f4fdbd7dacb44d3ed6ee36d2612b3e4ef22a
SHA256c69a623b8ae92c2d284d3a70469813c05e84090ccc2e700e5860687a74028696
SHA5126ac858f0bd9228d598dadd3a1514a4036fd0b81ae9bd3a4b2e312e423f47f2fb4cf4fd94b4d8e7e8162974e9b08d358c5fbab2f18206ffa4f135cdab74a3e081
-
Filesize
5.2MB
MD5fcd57f47cd39754bce50285a255d6e45
SHA1d7eb78691244221278418c09f451490a75908c8b
SHA256fc95fa172eb3e82b52c5e8b4ad9bad9300ade507aa671a650474f573b3ba0b41
SHA5125870a3abab727378c560c0581eb5bbdbd4524f270d45e22fb36b595b8a4f28f23f1b44d376028fbab2a6e4efe279cb48bc672f5f5637acee314506d89c868754
-
Filesize
5.2MB
MD5b05e712f2779197616b895cecd6fbedd
SHA172ea36afffcba6862d073f1488922a0ae1cd06f2
SHA2566eae92a0b62ca03d1f811857ef7d8d527cf22377e7b94df2f21ec187f4a6da2a
SHA5125b8e74858d7c3e6cdcf0b9d92ee183ba487e9d2aaa7de057e3d61a101b6feff436a3968f6395c1726b78938ee75d3ad9f9bd6d22c9ca7f2a7d2b749f95971f1c
-
Filesize
5.2MB
MD5f41beacc8b06de38dc36fe0160c46b74
SHA189dac2cd429797bfa778b307f2fcf5fd9a8d4dd4
SHA2564ac30b731e869c699565311b5a5088c8a5f5784bbf44300b577993ea6765cb2c
SHA5125ed870151cf77791a8be6ac3754e9152af1501be45ed5d1b97584c91b86cdfa5e35d02c84f18a3537ec5ca833e97105e2f48c74ac2ae84596ca3695e9dda49c5
-
Filesize
5.2MB
MD53e68ad0894aac945ab204a13364d64d8
SHA1230a850703d57249e71744a2abf60466844808c7
SHA256bd2e716950ca0adba94dcb5bbc8618460067677025e2b35c7bbb6f29069ce285
SHA5124803a2771df3b3e256dd12611862a5ba08ffc3a5d3ab426efa1b6ba4faf97e5f2f03c4868489fdd8528b3f6fd379cd9288858c4b5e2d6a567a16ffc3466a8325
-
Filesize
5.2MB
MD50f8397e4c2b47e2776551764120e1ba1
SHA1be70725ee252444a7d1014b4122cc96e03d2dbc7
SHA256f6ac3c3ee923a71020af590b078a06813cf1113bccc171e96185d6b510e163e7
SHA5120c9c65252eaf40eb16ea8938c0efd81ca1e09a3c08ed56dee285c871625e1850e216a8e779f65cec35e1bab7a2bec267cad17e0e2db5ca7948cd6f65e2c68770
-
Filesize
5.2MB
MD5e6e5d50c544fd71b27c28a9130036d6d
SHA16d3dd208c7fa51e974cbb936ee03a715f488f0ef
SHA2568cdfb449112e56100e298037026e3424258e015943e34f720da5e9005239f1e8
SHA51208faa8400f3bccda53e7e0f24eb09764c5c5f4f381ac28fa56a6db9d4d25b0f4f6b43b8332d0c00c9fd1b1a0fd3ed0982c5ea071a52389747f373145c5ca61a1
-
Filesize
5.2MB
MD58705bb9394f0bc3456e8dc6bef01fda6
SHA1dfe88a3ede658466843c44845fb9e440689d2033
SHA2561d4922f64253c2b4d856300164c8da1848e21771ce454fca363fd43ef14f8179
SHA512495f4429a2bd06db34f894a0880133f1d8f8686f29104318391215632cc1b3b0360bf6e30b425615a92d462a00b61f18c63e6294ce6cef6b8252cf6715c31e4a
-
Filesize
5.2MB
MD53c76824d18fa9620f7dbf074c713cf7b
SHA11cc80443bac3accf935446f1503e343c0a21e3b3
SHA256ece2aefc0c21f060813ff0a3140229a381f62aac4d6fb48e6f78d3b989b9a4c1
SHA5122bd2dd203eb71f81c6feca6c0aa8ee90575c8d8e0d654bfe33ef0d0ee1236bb79b4efc2c9dd0adab623b2500e6317c5c7303c8d8689234a771ff1ffc6db5e002
-
Filesize
5.2MB
MD54ee52962dafd9ded1cf619580d38c479
SHA14c5378c0589ce59ec1c96624df8d99719a268339
SHA2566bde44146c86ca3e34b2807550d025013f4fa8ed9f5a1d703582a9f106515f07
SHA5121946f5daafce0bcf34ce75b4c9a3acd0a2b036da930c831f0dd05080d4a90b9bf15678b61907fdca203e6bad0da477cde4087b3f887f32d66577cc815578637f
-
Filesize
5.2MB
MD5c55a10d265241e67889c9943748244fb
SHA1ff0772c280e74259929275c11c67f7e2f873d94d
SHA256467f79b3408126d6e997f358bfb506171a33b1360fc83bc57d965aa434a42a90
SHA5122354c6e55c85d255e739f437460b371d39a7cb3061aa1d01ce62d90061857b7480ed4f109e89bea7275f517836ae96e9e3970175d657b8189ee4ab69e2371282
-
Filesize
5.2MB
MD571c53f545a2fc65b9522d657672fdb02
SHA169c481f0378ab0c4807cc15c5d16cfd4bdd00930
SHA2565a0d56ed55308f2b2ccdaede8cecea7110f5fe32450e557d8381281db2b276f2
SHA512e372e1957d9691f06466c2f0a56347e317bcd982b9ac793b3b3326e90b7a44c92df2f5f5db10aae9fc0dcbff7acce16490a99ca60b5f87385fa1316a59aa2d6f
-
Filesize
5.2MB
MD53a0b4b237e46d80f1b96a0f3c32192cf
SHA10d7bd3315fe034bcc3e3a4917a257820bd43eba8
SHA2561f59f169649a62c3fea8a44d1a75b0c8116744d23a455337ab6754e7fbb2a9eb
SHA512ffdb39cdc092ce97a3eafa5db572c28b33dfc4af77ab3bd39066372881de5a450dd3cc601d4237de31cf962c97206c80d1e46791a2e8b319cdbe518cb82e9661
-
Filesize
5.2MB
MD5db49a267e481cf61f6036a14862af447
SHA1e6a57ef3c845ed92851d7dedb6e5e3b0c6397d3f
SHA256c627bc706f911871bbbf3a8eafb7c4b40db95e069affef5c54920a7e51958167
SHA51227945e0d755fed03d58187a12335c78d709da57087e5c1b0d856b29cc472cd7a53e34f8a8df436d42826b70d2d8078d1c7c179d410a4decdbdb39b28b6417f68
-
Filesize
5.2MB
MD508557039834cd3aa6a5846eff6e98023
SHA1793b9ab9c81f26bbacd1156e801a447a112a0c5a
SHA256eba6a6a8daa81d216d9cfcf719a4ce55d2260058b6cdb5ce74f37f291f2a5c43
SHA512b217e43a62a2c8ebb1109bd8be1d7a657cd0558acc4f6029a7405f6bb07ebdd099690b0c5415656dab1609aa465e9c4afbac2b3a24e75f7fbde885315ccb5f6b
-
Filesize
5.2MB
MD5023fd825dd37bedc4dfd78df6bf266db
SHA1c2c0bf12e05fc16ff1fec3a718156ab769157187
SHA256e3eb191faa5210a4ad1c54e80c9fb402f19c2b6b1eee48110908fb92c5ea79aa
SHA51212716bfd5993ff577d38370b00edd61d2c0e9f72a33160d19fde269a1be1118bbb155fa613f8771b2436491d74b3ead51529fd48bcebbb830d8b6ffd1df48846
-
Filesize
5.2MB
MD5842e63576d469bbb537d6c51e855db5d
SHA164653dbb621e761c0163b54c33d7df558a3cdc2d
SHA256289783c4b24c685c105b4a21e61f22ee3ac7080310a033c27da7e1f6e61aea7d
SHA512191b05ab6d1f05cd170b449d9c422ae136ea15d489a2034fdea2a30a07d3fb955ec1ec51c037f639f1c867a63b60f485dc52405183c4bf18949b1f7c15d38de9
-
Filesize
5.2MB
MD5858f855f4d8f45e80727d43bf731e77f
SHA1eeba74c0c0a0ec42ff56b2168e4cd01b32c2b0f9
SHA256401328b5c73b7fef52178582d48a12e85ef34564b7d7667ae9d0e42924b1a00d
SHA5128aa7281529419b6fd3d65b983fc4382fb2815ae84c0a2864b400cc86b860bc88b4f4dc3fb6c0ad5d9ce6e424795bbc8151d9c45b96c8215eed77d5d56d5c2f2e
-
Filesize
5.2MB
MD591203c1e7c4bf7b40311878d5a02bfcb
SHA14df70514d650848d416cd0c290fae206c2138558
SHA256912f487de38eb99863834245bae12c5d4a45973f12fd321225ede37156491180
SHA512bdaca54310695cef7470281828ebd95b29b1c20a48b325fed32a78de0d56e1713d79105dfe20b26eace9cc5d46af7e450c6b3c9fd3e8b0412acd455f25abfcc6
-
Filesize
5.2MB
MD5db9405da2683e8ec2225d4a59ddf765a
SHA17bbb50a36d0ac5578ed468868e7add972a5901d8
SHA256921923417b654572a589e74c49e02e12e3c5c29d27104a1cf947d07f88a1577e
SHA512080a24b3b294687896b2d211cf6242287be4076cbf959b1272f436effad18693c466cad6c72ebc91aa4720d9a9d47ee0392ba433cd99af30d3db2a460033e8fa
-
Filesize
5.2MB
MD52a6ec056006fd797d78eb3a38a6d2e51
SHA1c5bfcaee5092d0fce3a22e0ea9071b2e8793b14d
SHA256b41c594ac5fc46ab5c3d25f9965abe84110fe5b9e11ce70c54bdb0ba765c6132
SHA512b5c89c922a244ac3de07261441922c016750b3626a402f6a4d4e16a4b9f654231c406c373805139c087b3486ea416efb4e0aa1bacb38fe51da310f5cb9817353
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB