Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 05:12
General
-
Target
2024-12-22_ff203b8e89a14c3c43210ff13d7696bc_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ff203b8e89a14c3c43210ff13d7696bc
-
SHA1
4abc3d2f66c326f0af3f266d984cbd32290edf9a
-
SHA256
efc701632c12aa9811bfbe737a0ff208a8fdca3afd3583b80efd60fc68e8e1c3
-
SHA512
a1c7c2d5694a2bd7970228eb9928bc92c16c9f1473c418f61450a749ffe29d2016d7f4601fff48900b7d38a958bb1e4f60d01e19dcc509af74547b42adbc3512
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBib+56utgpPFotBER/mQ32lUE
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_ff203b8e89a14c3c43210ff13d7696bc_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_ff203b8e89a14c3c43210ff13d7696bc_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AcnTylb.exeC:\Windows\System\AcnTylb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wkaMWZI.exeC:\Windows\System\wkaMWZI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tZwmvlD.exeC:\Windows\System\tZwmvlD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pcGTojq.exeC:\Windows\System\pcGTojq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCCzgQj.exeC:\Windows\System\uCCzgQj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XlbhHSz.exeC:\Windows\System\XlbhHSz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pLeTFDW.exeC:\Windows\System\pLeTFDW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BSCDXkf.exeC:\Windows\System\BSCDXkf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vtCWMyp.exeC:\Windows\System\vtCWMyp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZvDlWqI.exeC:\Windows\System\ZvDlWqI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Gbojpjh.exeC:\Windows\System\Gbojpjh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vleYFzl.exeC:\Windows\System\vleYFzl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHrUHai.exeC:\Windows\System\BHrUHai.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Cxcoljy.exeC:\Windows\System\Cxcoljy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qqwRGtX.exeC:\Windows\System\qqwRGtX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ASvYFJM.exeC:\Windows\System\ASvYFJM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LpvFTQd.exeC:\Windows\System\LpvFTQd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UPWkZQt.exeC:\Windows\System\UPWkZQt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GyQdfsZ.exeC:\Windows\System\GyQdfsZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ysMwspW.exeC:\Windows\System\ysMwspW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZqeFWtQ.exeC:\Windows\System\ZqeFWtQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5213165c13a531219a3bc91e9a8cf0cce
SHA16a4a451f601bda75e23f6921b3c651e9ea620368
SHA25697ec356979c0f2a6c2882c6e0ec33b0bcf193101dbf048c6d998e3d0aaafbd9f
SHA512d5d939f0cacba2af58ea37310f65285bcaa565bad40dd8624d50880ab01c92b28fae25d76d293f28a797ec123c09d9e8fda828d8e7444c07dbad8ea9b515718a
-
Filesize
5.2MB
MD58cba2b5dbf4406c507d7b0d0a5355996
SHA1c3dc7ed65020f5e6c0ff8d62fc678001c51c4bc6
SHA256d4e9487ea6f9247e9f6cb32eb0e2dc33e8abe6d191ab659f8e887764eecf25aa
SHA5123ecda34a5f36c637b788c851ee79bc9fef133d91f270d6b5984c123cabda9f561972860b4abf1e7d11884a6aefc591d47446b1ce33a797192f656090b74b20f3
-
Filesize
5.2MB
MD55cbaf26714b55189652e36eb3b891fd3
SHA1607458d806c5e0cdf796281f331b46e11cc7781c
SHA2563ddc839d9e3944c6bbdc36d02d323631fd05d757b0acd66c64478635da4b919e
SHA5120cf17627292afd0fae9b84ad9a59477c2e4db9b756892da7111ce07d47ebfb400f02f9beaa0a27669a91204986b13ab47fae04f7669eb21f99148329dbaf4e4b
-
Filesize
5.2MB
MD5e54d1dbf6b57bef198558621a837a951
SHA1c94446a8f191487c5bcf8575756847e212b35f99
SHA25618dcbd797a36ef4b030448aa5e011702491a3fa9c4188d86d6a12f5354ea49db
SHA5123f6df693b3aad25d5c31eed6446f6fa3a9c567a49b9b650f7f1279e7101c76063866e5cc29e24a575750c138e33f7b23f049868cd0a15b6a009f1260863c556c
-
Filesize
5.2MB
MD532e86d28de7c467830570188c36fc4fd
SHA1915d62ac334055958faab3a7846d6f295748ebe4
SHA2563a79fca1ae0bc22c97dc7f3744ce767d8725f46405b4698e03f1f271c77148ac
SHA51250d6ee41c04202cde3c5c126ee33148314afcbacb7a3c220321ecc43a31575d0e009bade88fd6c4c60b258b07b6c546eff2ff8c204f7fe8f58aafbd037ad7d09
-
Filesize
5.2MB
MD59a6316ea37be3896bb17c367ddfebc76
SHA150009babc7529c22059f0bec97a57c0de656593a
SHA2569ee8824e5446ac1d937b37361d60d4446cbb7575ce623e8f26bf8423bde8f0ea
SHA5129e8a533083bc41a696e60ff172f12768784d476750a614cc4aa5f70189b13e3d9c89f4514a424a2a0d0d9fa536a42be0c6da02280be856775e32f57d643c506c
-
Filesize
5.2MB
MD5a99dbc13ae723176c3837823519ebd49
SHA149f7c7f4a18ce218f92b6090d35c9fb75330a836
SHA25642e0ec07e689825ea044e2a5a6ee5730dee0640823397cd6bd583badf8f63d8f
SHA5129fc73850430ba7deece884a80e98dc725d1af4d766bb6fdf7f6c78dac0c3ddfd13dfc1c4651675fdc6bcce04d3188c09950c4cf9b797402548b19e6f6b2c6a67
-
Filesize
5.2MB
MD503f503c06b6c93536143a491d01098fb
SHA142a9f8496c575d00fb4c066265f61e1a928ba039
SHA256c040289258eba3efb3d4b2133becf85659b0fea866a7740f48cc43bca8e3530f
SHA512da66e93fa3824fe0de1d23946342705355c41bb44ad0af526e683de6306b30ce59830c2fd3c63902939704688e7086fe40c8b8c340bf758d2d1aa6163fe4c8f6
-
Filesize
5.2MB
MD58948354097e0342854eee28e79820a04
SHA1b0e14f599259777c506a0debd9eb45adf4fe13ed
SHA25653d4f2fad7390327d48ccae69a63bdab2be06b1c5767b7675dfab8aa921a0e26
SHA512dfdeabfaf1d982ba458175ef950520054a0d50a799318771dcb345404a0a97157778a111c67f64542c3bbc695351b54d932b67711474e40c19b142f4183887e4
-
Filesize
5.2MB
MD5c3dde88275eb552678da694a4cdaec21
SHA1e650b47b3136f82ec1a5bc53fda8d74352076d02
SHA2564251db0906334dc465e549cc9532c634687f909a46cfaf242b4789b51b1998c0
SHA51292fe45402c0cda1ef96813c8534d612955b399d1d81743c470e47c5798a985b8037759c0b0385fc9335e9d084535e966d33db9462f811e578826c55bfd54af36
-
Filesize
5.2MB
MD5c52c327dfab8236b668b63d637ea73bb
SHA10e475f2de7128c6c2a8b716f74a16facd9907e83
SHA256427764c02f35853f9472cb7d16b08eea969b021fecfe4ca47fe429d5afd9c30b
SHA5128bed5c4fea5f3d0ddbebadc4b5c372d5706d28cfe0d9973422693a1b6b6b126d140d10c1a5e2c704c6921bbc8edad0728d4fbfc4bb522aca1d1254fc8ec08496
-
Filesize
5.2MB
MD5b69ebecec3eaaa42f3a39a331bba898a
SHA1af8af2f11a7bd37f0a7ec8ac25732dbf47fef1a9
SHA25698bb8013eba1a099aab53029dc7bcc36f16e8877d75516e945dc349b5ce735ae
SHA512d68e82bb11ad76923faf91b03ec881a8fc6ceb19d2c84ce153da6ca1f55941380669bd4a428a531a23a9ea4f0b77c29fa5ba68c2e355a41bf8f75e03642c988f
-
Filesize
5.2MB
MD5d59dd65504ae06fb249c61a1eed41e94
SHA1ec4c90fd1e20dcd9aab8ec1287e29cf87403d59c
SHA2568d776a548e69f32e395ab0290ac786421ba3096394be3e1fe7d9f9c3d6d56001
SHA512f191bc4134b02054e763a78a763b17982e8081befce6f04f7980301d368f9f38e1ab2cf36c94b71a4edac54dcd7bcb1203cf19c62c858a18d7e2c4a45735c371
-
Filesize
5.2MB
MD54cf0b8910205b4056d3562168d7a3059
SHA102fa0a740b4b98ae0e9279d14b2bab87c2e088e3
SHA25607075bf7548c1a224ce512588614dfb03ba4c62601ab9121d9fbadccbc261738
SHA512d08fbd06a662081c7caad3cd326314ef34d2c8f50636c51a90d10935ff06b76c415c009e746a63e21bfa3b335b7f28f75cf03651ffbfaf5bda2aa8d75005dfde
-
Filesize
5.2MB
MD521c759d9c41da0b485bde92bc32822fd
SHA160afc127d8f6e7c42bc728549bbe619359f55779
SHA256112352296c7bae71373ff7d6fa99391bdb78fbabf1b8902a72a5d306f40670da
SHA512610f94080b97ef914f90b70e4f4e51e18313cb896357523827488f2c664e73307fff6bd39e73a67f29213f858043df0ed64611407958bbb9b57d3976225a625f
-
Filesize
5.2MB
MD57a378b784f1d1301a0f2758570b4ec00
SHA18005290b0ac83c71631845ade660beb475365dd5
SHA256f692964e587203db363c13f7b1daf48b554f368ec1c2dc60aecb91b2db2b1542
SHA51241bd2ad6fa9f052b0049809fae9b55cf1cc791ba3a0d8edcd9e2e72eb22f6402ba6053249512d5fad1ae89f5f356bfbb7ded272d91d57df7e5d1f8d13afd9cbb
-
Filesize
5.2MB
MD5d070e50359c9f318bcd2bb2f6bc5e635
SHA1c680b1f0d34db6a438c42824d021f5af938e61aa
SHA256b5ef3117e03ebdadee8e415cbf5165c4d0e31d37f452a3c74be238311741c905
SHA51270ada9179e4400d19cde2c9920d9f92b850efdc80cd44f9c4a7c978abd1709b9afc4637e8ac2128719c857dff92ba23f0e7632db042e8937a9420fa9bc58cf22
-
Filesize
5.2MB
MD544de7b69addff20d91d51f71e79fecb1
SHA10007ee271c515c14865aaaafd18f2652be5eb49a
SHA256845e7ae1f5dd84be15d385ec1bfd82b7b3ec45606ceaf3d204ee3f1838dd12a8
SHA512fb51290bf78e8c89b962557b2d8013df4231ec4ac0d1a1360e01a4bc0f03d94b897f802aa909ff5b31de10da759f49cf7d190911cdf1ffb1057486739da2a9b3
-
Filesize
5.2MB
MD547c4f989af0f2b3d1b7cfc26f39698dd
SHA1d6881b60e1921b5527a143a73576a4aa02b2f921
SHA2569527831cbdb2ed848dc0d0de62f92a1afba8640f624a1402ba67a1718d5ed2c9
SHA512571a1d92a3058563ef3ddcc6a4a7d89ac0170ac79224325944a128a8d41a3ab081b452d0640bbf6a8aefaa880b5a9eb8042e5a01cb6be1a3b6113c91913d5ab6
-
Filesize
5.2MB
MD55395dc480c81b8ab5aa8612884747d79
SHA19305c111e3f9038996f1a2e70eadd5d2d9ae982b
SHA256a568db15ae895335290068bfc262379e9cf5571cb53cc0c2aa54949570ca289b
SHA512c3a54536bfe1e5d40b2ad1ca4c32c4d3e705e97a5f2efa87632bdf706bded747c68757da7ce263fc0537ad4711f102ec687d54df335cd4ebf8ac6a4659862011
-
Filesize
5.2MB
MD527c6e2997e14687185911369bbf99281
SHA1696c9c7f10f5f0a9d5707c74320eb3f8d1b78069
SHA2564db70d21837cc97ed46299e7fc39104a75a5d270c508b21ee6ad65234ebd178b
SHA512a328e95afa7afb10017d58a231f94cce7fe9bfc3c03f01d5d0964d155c37f7505408fc589ebf8e3d70a3c36378dfdae90877b33d419213f57813ea8b30c3fe7f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB