Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 05:06
General
-
Target
2024-12-22_cea1352d9437e158c82ace75d5ebe4bb_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
cea1352d9437e158c82ace75d5ebe4bb
-
SHA1
361888f55a2276c8f895d9d6c0d05a87cee6acd7
-
SHA256
6d98a3859a3629a55d679bcb922b2a824df293cba6f02cd436d251eec152930b
-
SHA512
f7b9802833adb75fd14c23cad086e4dd37367794088a01c84d554747a95e4e50c4e5cb3c647c7e81e35b52ba64e0f1ca1e6ad64aad5841b43a3d2cdc5d873e01
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBib+56utgpPFotBER/mQ32lUW
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_cea1352d9437e158c82ace75d5ebe4bb_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_cea1352d9437e158c82ace75d5ebe4bb_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BgqdqKo.exeC:\Windows\System\BgqdqKo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zSmPCmr.exeC:\Windows\System\zSmPCmr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZevNxKO.exeC:\Windows\System\ZevNxKO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wGkBlIW.exeC:\Windows\System\wGkBlIW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OHBoali.exeC:\Windows\System\OHBoali.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jiqihYA.exeC:\Windows\System\jiqihYA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dUaYAfR.exeC:\Windows\System\dUaYAfR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NbgwTfa.exeC:\Windows\System\NbgwTfa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OVUiTmZ.exeC:\Windows\System\OVUiTmZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vQydrkm.exeC:\Windows\System\vQydrkm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cAbQOlQ.exeC:\Windows\System\cAbQOlQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MyRdUgq.exeC:\Windows\System\MyRdUgq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fCyTeLn.exeC:\Windows\System\fCyTeLn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CdNIFFa.exeC:\Windows\System\CdNIFFa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IRCOUPf.exeC:\Windows\System\IRCOUPf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mdAItCc.exeC:\Windows\System\mdAItCc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tYPMthq.exeC:\Windows\System\tYPMthq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dwHmZAo.exeC:\Windows\System\dwHmZAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GkJNLvQ.exeC:\Windows\System\GkJNLvQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dakrZVP.exeC:\Windows\System\dakrZVP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mcRBdrQ.exeC:\Windows\System\mcRBdrQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56c4166d5b66f39171d67ff038fce1241
SHA178f92b219f689b6778c13536540c71a29505d495
SHA256964ae1bb2ea9e4cb984c4f8418571eaed39b3c3fe0973b77f0c31e8cce4c04c2
SHA512c8783ac50634e673e2134097063b82de50d88eff4ee5cce9a029c9819b39cfa70826bef2472cab5221f1a8721cb8e174f92bf3a93d34c178a2d739f7b85ddab5
-
Filesize
5.2MB
MD5d6988e1f0bddf34596aa50c2076bb73e
SHA12e7257596e29efb3a20e00edd59959dc0176127f
SHA2560e867da26e89c8defba0b4f42e96053952de8103b12e5a8bdab76c2a9a153f13
SHA512fa6b4ea9f148fc949e7dd0a2657fa4299add5ee9b8a3c57edd8f86f8fcdc1985b3c52c0ff75dc34746282e25f7175dd2534ab7cd1d7ee4774c6129b5881d9ce4
-
Filesize
5.2MB
MD56719b62c37d3d4f8849e7802b20f0a59
SHA129ee462d37e6d143f323b0f3c188131426713d50
SHA256c95108c9a24a6b3e9509d3c020ccfde7470597b7874e13da4ca5b738e222e9c0
SHA512308c7931287f34790f25a8e5923e19531cd352c46939dd2d1f366bdafb1cec85046a0fdb23dc505cb9ce0895b1d27521330e36935973d74565f14b6e6323ce2c
-
Filesize
5.2MB
MD5905861e479910a43d512ba643b497372
SHA1360f4b80ad535f6c958971a0cfd818d7f11b9ebb
SHA2564f4c6a8324f18989da480fe2c6bfe6d1a8302ecc8b080143497db9a7164643ba
SHA512acdb6fd3b073c013803923f94870046ae7e0ace13e553c0b988dbd468a09a74e355b946ccd082f13418852f5618926cb8cc318159acce8854e7d9357d0fe1969
-
Filesize
5.2MB
MD5d8cdd73d6f0630f824832409e9b3cd5b
SHA1effc94bc017eb4e9cf11af61d877e2a51ac37689
SHA25697e8dc14b926c21887e4fb29f3e48ae50f32082bf80d1366c315fb98c98e537e
SHA51268c59292b228fd2507269ce23a6090d3565bdc745de22d10fc81941a9419ab56486311333178645f2ab54fa3ab571c149062b2fbe965d58c0af55e28be689a43
-
Filesize
5.2MB
MD59a9516b16024bcb2aea63a3e9c575ba0
SHA1ba15a430ec8ae78e3ad00422e48113a08c7a8e81
SHA25678d4e0696e3492fe81c058c4c57450d07ffd716e2512b639ba4ed1aade3f4662
SHA5127ed892ef19f324fb21cfd37ccd9b99bc26357bd8c338330286d40b24dbae2912be2992c72b274c2b8b96fc03f132ad7c1c01b453cf2c74b2e58373bf6c44a558
-
Filesize
5.2MB
MD54db254dc6f2b198f73e78aacd136b292
SHA197157d069b38fcc13741f9067517fa90daa1a351
SHA256542151bf4456df1e375950115820f5dec1f41aefdcae9b339700396a3b2d84cc
SHA512f1d5d03f629bae10a91fc83d552c1739be9cb28e7f3a2ce8bd2aa689f042e2080576cbd18e346733091b6f6317cdbe494c43d86a124ecc9fba78108a641254f8
-
Filesize
5.2MB
MD56aa9ca007eea61f61616de31ef6cdee4
SHA1f297e834f66e2476ae6401dc0b584f884765f7d2
SHA25636caefb4e883d7ce75cac937240b99b556956c0fdf5ff66df498aec2c6bf8d21
SHA51253d9d37f0920c93658949c975c681c41f140809e9ecbb3492424bd989bb00b320b2b36c9aa272171c5ee861997c5a0e4c3796583a88b434fac149526124139c9
-
Filesize
5.2MB
MD5db9951d863b0c1e43dbf77c1b093e0bf
SHA1b841644b543744a0a0cfc4c82f9cfa874e397519
SHA256d0dad27713b097e75b07f8fed2ead52ac57acb924fa08e026979a0f309497f99
SHA51232609c0b37305e30318a4713a26bedd9e4c4aeab052bcac6ce07f760254f4ab1d46185d9d9b0d67d74a18a9526941ae2c974243bad1f04230b6313d2889a359e
-
Filesize
5.2MB
MD5e48fe3730a84ef381157ceff6fae9d56
SHA13728a3e6e1f817b22b21399f7d8186bf1a65454c
SHA256e8facd1669c2582a68cde42765e5bb8f31c04a700322956ef47dafe4837c87ca
SHA512fd63576f4c388c3193f727fb0c213172a17b61df1fe757a18375275c375cd76045cadf37184c1d2b2e3a13a7c3b95e0c52f64e19f322b592113a95ee3fd40ceb
-
Filesize
5.2MB
MD504af70734e422eb719ff667a804a07e5
SHA1164125167723533f932c9f53a651c48ddda1560e
SHA256ef6fa367837424c446e85b055fefe345646ac574dc5cc8886c5c3a0fe5122f7e
SHA512f891a8d7bc7be08094af7bf3790ddd8dbff08460c5d11ba508a8670a531ae8dd0879b82154d7d4b26ae4e4437494f36a82fa04e582178fa68f539996a1773256
-
Filesize
5.2MB
MD53f2080241297b9eb8626e918cdd21636
SHA1ac57c9aa7d3ab19fa345da8b6ea106b8b19dcb17
SHA256297e8b8c99675ca5417f7761b7d5a1cb9c7d6840bd69121c573dd1ea397b31e0
SHA512f8f5e9f1b50255ffa4031f5e024eb9927273bf82fde41e968ab01b7184d93527a738e4fcceb02f5dcd57bac22f43167652d5eba91a868e23c53856ae4e9364e9
-
Filesize
5.2MB
MD5777ac06d1e3f05882f6bc478c467f0f7
SHA19338581a684986686de6938603c7b76bc512bc23
SHA25678965fa8ae5a76b38db222949098957243918d7f2a9238b5b4120ceaabf962cf
SHA5128387535ede339c68427d8aa7647ca4b78294045b555c2d0a36994737d5e063f30ce070900efacd0e3aec3fcbd1aef80e656a42cb3e85da6808971f8451ab5c85
-
Filesize
5.2MB
MD5058144f5b14b4d3b2041591a1af496c4
SHA1a4b06ecbcb33ce14dbb1e4f44370dc3d62f6ee2c
SHA2560844c8e38753f43d3c49b21182c49f578922f00123e7f754deb6f77ec379e350
SHA512f6e96921d4263319dd6e18001898828417b40c7d54e906de30132d018d4791ab6840629b955193d3727d0c3157ecce6d8cda3c87a9e076900185f81659124071
-
Filesize
5.2MB
MD52294a96a68767a3b975b5c9577fb8de2
SHA1bc82cedf0b91c9b71e86672769009881a2bc83a5
SHA256fdfa58e9dc98ceaf3159a691e7029795cc7c8aaaa0b17620d76c12ea92c5b5ad
SHA512001bbd354da1c02dbe6f4a089414636057c2ce8ddbb3f0f7dee719b9a23052dca504eaa305de750ac9be207852b931afe1f3453c6af4c9dbf0d07a85d4476caf
-
Filesize
5.2MB
MD57f5d182d5fa7a070fa906c25c75fa7f2
SHA1a5ed76ad91405aa40dd3e531651e0705d90fc18b
SHA256497d7856357816db2a886fe071dcc360e3c6087a75af3e3ac4c0db64d4f9bf16
SHA512bb913590f24be3fecd5e7139f93c5610bab8affadd1a77461bb16bbb7782b00e8a48c9707835d692e5e59c062802a208ecb8757323ca65f62b45b0bc930e06d4
-
Filesize
5.2MB
MD524e89cbd3d1f315824b881b78c82db33
SHA163748e8920da651dcb1b8bdfada7e8e7e3289aa4
SHA256f448b45930492998046366ebb32064a53f95e8487bede076f4fd3a7b506ca69f
SHA512ae7c8650667ec5f270f448d37ede0f6befafeac3a4a6e7c608794bc3eed68bc5c2d346496222488645bcdcfda2b445207aa23c7dce9cea2ec26de42157110f57
-
Filesize
5.2MB
MD569ff7bafd440d6b94b01a333850c0527
SHA1ff704eb45be770c76ddfd09589b36f462ef04ab0
SHA2569e4fb3e6b1ab4e80a04230b58f64763b5a852dbf2c9e0855e293275e42a7fae6
SHA512cd643d229651cdb7dfed0fbe11503aa6649befa5f4cf5b20ecee3479f6ce5bcda8c3583626b6eccdd5b1c2aa81dc13e913aa5584b093d3e500007da30364e91d
-
Filesize
5.2MB
MD5f011b75140eda4ee674d3291807b8844
SHA1b10401526f99220fd029a1197744c2ade6fe04d1
SHA256a7c60a1bfb20ba384b0a4aeeda5fbf985712fba1fd2083a63c76a6877728bbd2
SHA512054f6dea65081a3d4dce8383e13047119a77eef04a38cfbf5c8a4036fa39107e7c7c1fe4b7945a095403d598fe7bef43a2f224cbe1f89815427c18f8b8e2335e
-
Filesize
5.2MB
MD51366861547c2b4b00bb4f7b00fb65c69
SHA1a1f2acc73b66348702467e82e3c65d4e3948ef84
SHA256fb9e5ad559b1132d2354469747e01e9faceb572a8559511c6fa61f1bce03479e
SHA51244f7712d8d5619114f143371499a818ecc33cbb216a02484ab261cecc2fc719182afa8a44649fd9819363a0b11b3e2b2cc08c7b91a4357a4c3e97de3695acec3
-
Filesize
5.2MB
MD597ec60e9323078dfbff3e0c30cfe4182
SHA14e2d64d910cb61b4746996d9a7ed44ef08e58b6a
SHA2568b1495f3e28f71cd965de2b0ad459b9257ed76725eb222a572086921b7ed7705
SHA512c9f21b158261e7db62e876d0b1d9e647a6b7fa6ee118c6236bff2fb864a70e3aa3c0ec389e4ebb15d1bac140c1d3daac491cf84c4a07b8d84baa3a1aec667e2c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB