Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
22-12-2024 05:12
General
-
Target
2024-12-22_525a1409c4ca2627c47eced46629d1ea_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
525a1409c4ca2627c47eced46629d1ea
-
SHA1
591117ec6979701fc26c97ff89914781c9ef9558
-
SHA256
033898614610168626e825638b8b42f5446c39736b4c084192b5f2c2865336de
-
SHA512
08734caf1f8565db3b3956fd04c28ef9f776b097e16dccb2afbd91f4cb991ec8af1365f2188003fce43baa81cebfaa6b30027e543c72741a4e1cf2e4061e8ff8
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBib+56utgpPFotBER/mQ32lUY
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_525a1409c4ca2627c47eced46629d1ea_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_525a1409c4ca2627c47eced46629d1ea_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tIcjPjk.exeC:\Windows\System\tIcjPjk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EhpnrWz.exeC:\Windows\System\EhpnrWz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZVhoUVa.exeC:\Windows\System\ZVhoUVa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ktLrbOA.exeC:\Windows\System\ktLrbOA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xgcnZaH.exeC:\Windows\System\xgcnZaH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lPIfPHS.exeC:\Windows\System\lPIfPHS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JTRCDWD.exeC:\Windows\System\JTRCDWD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MBYpzWq.exeC:\Windows\System\MBYpzWq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPfNgJs.exeC:\Windows\System\IPfNgJs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZaxuLUj.exeC:\Windows\System\ZaxuLUj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uvdGjpl.exeC:\Windows\System\uvdGjpl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FuyVETu.exeC:\Windows\System\FuyVETu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GSbZyQM.exeC:\Windows\System\GSbZyQM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\llKRjlW.exeC:\Windows\System\llKRjlW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FEMsiuz.exeC:\Windows\System\FEMsiuz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rBsgHZP.exeC:\Windows\System\rBsgHZP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXwIUTT.exeC:\Windows\System\bXwIUTT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kjxqpVb.exeC:\Windows\System\kjxqpVb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oSZezNo.exeC:\Windows\System\oSZezNo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wbvzfCR.exeC:\Windows\System\wbvzfCR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gNhiROV.exeC:\Windows\System\gNhiROV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5731cc1713ef21f3a22402237597e2948
SHA18de0e692b9d35d3ca1c80185e93fd142682ed5b2
SHA25697d3e6409d22596c5e12b1e2f72f6ba93a12c272490ab3f336f068da9ec88c95
SHA51291b15125a97a7de23b2989f017d7a7a867e26e89d3cdd132ec7e269b248a12ee87835ef402c857cb309071c186aa6721a2f279389ccfe9cec5c22f206081d974
-
Filesize
5.2MB
MD529c78513dea399081e542ba32c41cefa
SHA1a0072d18d9ecc630b707300a8f87b9a04f8e4579
SHA2566bc9198883e7b1813816243c905137315b9e9811ebd6878c9323bc9455ba5462
SHA51271d07377a9be0877a7e550f80b25b7ec006b06382565a22f5375ce3fa5910c74bfebff1b627c8c25cdba8d34a182f33da0f5e9b3ff0f450797dc772424918d20
-
Filesize
5.2MB
MD53b51a88b5224cd5fa63bec297e6446be
SHA18ed16aca1da911c0ccd6c84c28760c463fff9498
SHA25676ea89d13066115567673f4323e8e179bb68b5bb54487f6650981483a18116e8
SHA512228d59542a44595ae4d5cc98e0527ae853f8033a49fd7a3c1d16f30b9c1781a7a6afc4292ecf8043f54ed1ad01fc6462ee081085b04e2523f390fb426e5eea4d
-
Filesize
5.2MB
MD5137404d922145d0340dec9e3d882f3db
SHA13cf7dfd4b553fdf581e4dd9be6fb389e92b839fb
SHA256e7f214ef58d6103d54be1587fe0307c08ec883b3a29769b2d1f01ba1a15ed3a8
SHA51206ba06c454f8ff2d83f0c414dbf8ab60688c7f5660c871022070ce47189967abc3a21c0e19b6a550cb5509d2db7e3046c6e3bca1740b1f3f940749fb31fb6894
-
Filesize
5.2MB
MD5d984e0958230b179b2e6309af9781e8f
SHA1a675d08a52114217b2fc40b76a623d152f76f13e
SHA2564c1ca9ab4eca0b21fdf5db0de8c8b146c375bc1f20b146273c09e88d2ac5f1bf
SHA512ff7f3593dc023bf58c8ad50bfdf1b878074ebbbb547d893e825c31de72dbfd7906e11b87175cc3eb4bf69c1ad98015ff3cb3fd8dd13e88073b40066a62e9669a
-
Filesize
5.2MB
MD53e4702d524a1a3941cab4e70d76368ff
SHA1d31d2a0b007dcbe38e55dae3f0178502a16215da
SHA25632c1f5b9a6603085fcb4945878656d034c0d5418cff5a1947eef72a1651dcac7
SHA51253102d1a3248f9d5283dec65575b843f5c047699f3d4692309ec1d43b770403c9c9ba7d6ff2612771a2ff9b8cf8f938c956efb6343bc7d9c90147cb22f5266af
-
Filesize
5.2MB
MD533bc2d794a7eb31e9d5c13063e98e1af
SHA1d37f3d6bbc3fb4195cb1b69e4d4d65f4eb23d866
SHA256129d5415e70f5010ce9678c369127e711002a210450f31f961a1c7d1f195304e
SHA512b8330e02cb47bbcc0da29516ddff10cf748ae2f7de4f03b80bbc2b36e25f86ddfd03fb3a0bb1e858e7a8d196598ec8d12fd723af51306de84d33e26b12138231
-
Filesize
5.2MB
MD5821741aafab65791dc7513d31a2bc249
SHA18f583821ec55af68da083dde3391c368b44f4f30
SHA2561ef28ece565a1090098dca06465eb376ea174f6c7e35f714bc162c422f1a4e08
SHA512ad1db0405b1405568d5c6e582fa09dca909f9b7ce15cdce1a31a185d1480cbc817d5e355cd7bb6373afaae030070f9322b82731e4bcc04dec17e115b9c2ccf8d
-
Filesize
5.2MB
MD514eb638bbb62031621a42517999aa192
SHA1805c09aa80245cb753630070f625244945cd0998
SHA256847268b5b6fb4fd25fae88ec742eda19cfa7c2c83f69db5d0c8ae25eb8a39f18
SHA5120357882cce7c005a9ccb00df121b7fd6f34e276941ffbbfbce52e8740e2d782ef2c938b68798a3067a23e8bf31131a63bc2376a820a3280144820e01c4ab70d8
-
Filesize
5.2MB
MD5b6fe1c90e8d7c8f3fdbc32efa594cbaa
SHA17e79ada91872428414cb30f4e8a790bb184c8c15
SHA25687adef19f26330fdc239e9488ef1d5766cd50fd9e3451ffd9abf09a534d11810
SHA5121960614f2c647dc10dc347615c5dfafcaefbe737b794eb669e7fa0870149a8fbf652eb7f1cb76c66f17e642ba54ebdbc6f5610f26abe5aee94482ab366779171
-
Filesize
5.2MB
MD5626e8a7649f01900d127cb2b0361f6da
SHA125b5d1af5801047e32d22f249c31d02aa929819a
SHA256881f62c55faa238d5c2371d6471b6933645e1098354d3c306a563d92b78b06fe
SHA5126363a11b0229592496232cfcd954ac365f06b52fa390065a59318eb518177fd59348fef25473ac7d11e410a98ae91249f61cd38786f3082d7e0a0bd5fab2acd9
-
Filesize
5.2MB
MD513042d10cbdc90d79760b5b6987261e9
SHA1d96d54a44c6f7a2ed943646084e745d66ffca458
SHA2565e2f7112e25c60ee0c3a1f6a518bcef7077f8f137fd3e886e235dd979a9ba0f5
SHA5128b9edf6ff3d557e6a6b30c62c212f7061c0c143d66c10dcef760f1028ae51d86548eb7c48574b8857518c5384ba8144731a30c08ba6741849537643260a313d1
-
Filesize
5.2MB
MD5fbfa98ce9b6c0046e736cc2ba7eef80b
SHA11abc25cf0b430fe595978fb423c9d1070ccadb93
SHA256174a02d024dbaf2f28f764fe2af2273b91479f4014c9217dff79d5c7a5c3ff1c
SHA512e68039988f406aed8b84db5e43d12607532627d9984168d7b91a81724327c2c3e7d92c0d76d138a3ff539a22e5787dbafddcf5ec590cab70ef88dbc9fc8375e7
-
Filesize
5.2MB
MD5d004b6410c345e423dc0b0d36b32681e
SHA1993727ef80b6e5cc7a8d7b5cc61d0797d77ca468
SHA256741423f31d0e0cae7e4ff9a76dc9408c7d1663e3fe65f0fa9935b87a47cf61dd
SHA512a1aaebfd092ebeca7bd0d669d8464e831f287c530c038b98524cf7594eb4b9bf0033983c86e2355ba34debc06fb2fd297e7836c00ee2af40869c78b0697019b3
-
Filesize
5.2MB
MD5c34d2d92a2870f32bbdca8d07b6f561c
SHA19eba59ce6e1cf975acbee293b69ac5bdef306936
SHA2566db1893c71b37e864e8aa779602ad8842da4a744045de9b791368fd58c0d14b7
SHA512d3134065b5760deb1cee312a5ad639302e31cf30e85eae6ab21ba1e1df25c402fbba62f6c2a3bfb3512e265419a59211208fd167e7ce0328864b07a674409a28
-
Filesize
5.2MB
MD5fff5125c1d2fcc6f07b6642e9ff5e78d
SHA12b89d41775ded481273c1cf0a7a42486eac978a9
SHA256d83b87f8f501ddf19f1d303fa4ddcfcc9d5f53192ae3231bc397bee7bdee1bbc
SHA5127c2fa74715963fa767c769e62f23c94de7d6a7062ba17730bd094af61090b2a1b71da3dd70824ac5941fdeda85d15b5b08266cf10e8f088aede9e8000b8c5623
-
Filesize
5.2MB
MD50997962bd3a12159822298d5521980bf
SHA1f9caa3b3f220229f0a4a02f2dc369eefca7128c9
SHA2568e3557abfc4926755cc11114cb6bb4b90eebc0e868e306e46c8f76371c91b96a
SHA512085f1b53c1c46ccc3a0133c60091d51d97b78d55664b8a03e4375c9d4481e95263cf786072c5f3ea29488045105f95858affecb7c131262b5fb3e14e72ab60ba
-
Filesize
5.2MB
MD544be558084061f20835d645e1b218c90
SHA183b0e901bdb96a20ee7a533edb5773edb9840cd8
SHA2565535753322dab8d3a5236a5ae5d77ad06ce6bc5df5a5014b9eaa489272df2452
SHA512e4b633a983e0ec73356c708b011915f92bd01d9c8142590d0bbe5e8251bcdfba1c5d17565a6e4d6d2de683c4fde3e33d66fddb75025227bfc95af51412d78dd7
-
Filesize
5.2MB
MD5a72e564737b8757c574d4036b1724f4e
SHA1d0ec461717ccf4ea1943a8ec262c9ff35af96c16
SHA256a1501b105a98269d0ef73508bef1e313398be8326764ffc72d8e501b2cb0c4ac
SHA51239e0d4c7af008e26eba49a2a2ab0792b0301123edb5691a169ad547b5af734f03bd31eb6e4f9c6d535e8af8bba714d9d751811acb9e51c7fcd4c2a238a48582b
-
Filesize
5.2MB
MD5f9b142e3732b2a6723aef327c941606b
SHA1de5263ef2a7740dca636ad111ed7efb8c6a42d39
SHA2560ddc9d1fc751d7332fff7166a35d59eef816098a6a8111c2bb9bd4a817ccae9f
SHA512e0afbe3bbc2cdb6f10af5286743875d110f87767ca9729d703a55dbf13811604bc0feceda23892de280befb6f41303dca8b97942722554c73227824ba55bc81f
-
Filesize
5.2MB
MD5908024527cd61d45747d7dcc9f1e3f46
SHA16ca24425696ef1d37f5055c553716f7ab1f8a419
SHA2561fcc0a127ee08aa0950d6f9c94d681d7a09967e5aaca871515e1fcbd57bef4a8
SHA51213fc997ddc8b0b9efe467b929692df23a02e35aa917879d8595e5f6c61cef30d0d5c3ea1d1c85d2755bbcb960915cd0539eb278e697da3fde4f736675e114a3f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB