Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 05:59
General
-
Target
2024-12-22_e0931a2189b2f9e05fb3f0a0ed4fb9e7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e0931a2189b2f9e05fb3f0a0ed4fb9e7
-
SHA1
e6bad048ea57532cf2ab7299d802c4d8fae1ca5a
-
SHA256
120169afc5a05029ce89f44c5f8fb1779fcfca66e2a9273c563b71148d5d9107
-
SHA512
db3f7e8609cdd4754312a56d3962ae3dab14d48785b8aebc5fa24d8a1bc18eb7711e2a6109043f899e92843be5f4d472421d82eabc84d0dbd5ecbd27cebc89ff
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lS:RWWBib+56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_e0931a2189b2f9e05fb3f0a0ed4fb9e7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_e0931a2189b2f9e05fb3f0a0ed4fb9e7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yoVrCSd.exeC:\Windows\System\yoVrCSd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NryZLmc.exeC:\Windows\System\NryZLmc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\luuOYRC.exeC:\Windows\System\luuOYRC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zTxoixH.exeC:\Windows\System\zTxoixH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZPdoLYX.exeC:\Windows\System\ZPdoLYX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cqJWQmt.exeC:\Windows\System\cqJWQmt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HANAIQk.exeC:\Windows\System\HANAIQk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uaNmGgU.exeC:\Windows\System\uaNmGgU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qYPSooK.exeC:\Windows\System\qYPSooK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gzxQTQH.exeC:\Windows\System\gzxQTQH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Dqeaoeo.exeC:\Windows\System\Dqeaoeo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FCqKCWg.exeC:\Windows\System\FCqKCWg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sMmTQHH.exeC:\Windows\System\sMmTQHH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SfWDZxT.exeC:\Windows\System\SfWDZxT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mgqoDvg.exeC:\Windows\System\mgqoDvg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qcngXbH.exeC:\Windows\System\qcngXbH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CsMwQae.exeC:\Windows\System\CsMwQae.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fmmmpbR.exeC:\Windows\System\fmmmpbR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xyvwPaD.exeC:\Windows\System\xyvwPaD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rxhgJEc.exeC:\Windows\System\rxhgJEc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VKUqagu.exeC:\Windows\System\VKUqagu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD566103c8b768fb4354785d5f65befdf2e
SHA1611fd8eda45349f2cda5761069ab706ac0501187
SHA256f7d519c3cec9127d487524606a5531f4e1aa0c509e46bcd083b5214f071260f8
SHA51262582b11ac5bd75d14e312d23921828015e92088bfc37c1a37d2153cd1848bec443377befa5cbb156ba4d5d66335050046bf2d2baea0506f2945d1d714a827fe
-
Filesize
5.2MB
MD5cde5909d1d231dea92c35b2322767c14
SHA15824097aed1f10d9686cb0a954df07053d4647f2
SHA256767dc86a45df90521660c34d837b74a89c62189e84a5388a9511294c769496c1
SHA5129226c80a74bdefc4de7e86e962a35b969f26defdcf1d6031a0984640fdec2857197348e96cd15161735509af64ff713ec19a2d3457b7d16716cd5dac254e9ec1
-
Filesize
5.2MB
MD5857b33f6713db3917694416e848c7545
SHA15d076c3b7ed0b0781a6e1296ad540a79a8439eae
SHA256e51c8dfbc1beb9abadb674c611d6d276e987fd0622b1f71e95c9512bbefd8442
SHA512a296868257d32b6a7737dc47c3e463c5bd63d0f16506511e83a61a1d22e50e4f24d2f6a74a6431bceb117dbfa4b0426aaa62718832529907e3d53c258907bcaf
-
Filesize
5.2MB
MD51a1b92047282c2d9f50e765471f32b26
SHA1df5c7527a6fd57a113820143b6ca2c8a32a5b5a7
SHA256c0e0201f4f9c3ba65ae3554c5ef07109b7345aa1abebd518c06665bab73e31e8
SHA512e09af19dd194ce18c45e176df559ad841425f0dd81175b590770a2d69d1fc98da7cc6c876bf3635c3346172db944fca97ec6b9dc178d4a0dafe9044f7272cafd
-
Filesize
5.2MB
MD51948cbd93d63054f6f2f576a19b03596
SHA193212a3388cd45fbed2e3edfbbd7bfcfdf94fdfb
SHA256adcf842edfb57d3fe3a553b5989a7104d6b9cfe940bdfcecd78e62d5ae2098e0
SHA512f6420249d8de4da89bcba6d8459c1e1d9a12a65d8190831d7b0226bc2a779370f0ec3ca1974ba5fca9c2b07f82872d3d9bf5f5853690f81df594fad9d50a9bbd
-
Filesize
5.2MB
MD531122c3a014abf50df591b9f72ade2ca
SHA179594fd3c32cdbb06e4aa1a0a871b8a926fb076d
SHA256e5381eceb21e47c0837fe79915de2e6c8acf2274e5eed79598314665c2489507
SHA5129969d6d669ebaf0c935262fb7d61b0e2c491c99fc4a4e506e4d31baee89c336af50ac5e8c86971ba7f3b82254659bbed9a5691a07de744c2e4ef1184316a0b58
-
Filesize
5.2MB
MD59ad9aba9533a06325247e9aea976390a
SHA11c261a6470b70b4605d781b9343a00ebb5b5dc38
SHA25627dac970ef18c03d187c9ff16b1e69e528be4f380fda1696440408729a2f3e30
SHA512a2c2154d1b89d5e7a02e2f25c28e7c060c7731120998efec196107164ca7106480578cab73f801278e572bab9aee397339ac77622036b0a748e920830d3262c0
-
Filesize
5.2MB
MD518440d737de8fa12d5b6a37bbd9a38fd
SHA1022774e5397b1a0beecbacb9a5d4d82066d7bc2f
SHA256ba6ebdc87edd326228d6524c31474f3cbf56b211f935a8acb3d68aaaf468b7c4
SHA5122dcf2053262a5b51f51d7a299ba1c2b1c3dfa0477857bb34f959af99a6efad86aea376854f97ca942fee957a807890b428b9e4521f7219d13d027d1275ddd27c
-
Filesize
5.2MB
MD5329764cbbe9d8d94467caca5ed0cd2f4
SHA158aaef9c6fb6405b513c8f162dedc6c6eea048ba
SHA25670303d3691a452ef6c22e57cdcae1127aaac0f2e484d6ea699d4d5600249793a
SHA5129a7352551a8a88d9d46e08355f82a9e68bbe987024c1acdf8a8a38bc17b9928e590dd18caa053ed97ec534bbfda5ed5ad0a7d2179df136a4425634791407333a
-
Filesize
5.2MB
MD5f2c55991826ca6f6001daddede0f41dc
SHA1e5b8b49ffd4cbd4e8076fab0035c133fc89ec720
SHA2563218caf873d4e6fbc99110d895826baa89c4fd5f51a40303be0e5dd2fcc65223
SHA512f1e44f9b4be0336bfefc092ee26060adc232720aad22a5a59db7ad1020fd627e8a2697461d1ba55ae267b6d8be44e9cb1671e1fd2d461b538a0252dc9b36a370
-
Filesize
5.2MB
MD590463adfa08f61fae3474cbf99d2fec8
SHA1be09ec178b9e3efa39f7704fac685c0acdf49135
SHA25682f5eed16a5eed850053bec6439355bf3c0e2f402a08bbd02de39f36d235c477
SHA5124cd8a4963972bce483eb66c07236195ef74ec3a9e7879a7ca90eab82e41a302c1f751771b8c3a517a287c76cba5331b61eecc1eaaab4e139b1166bfbf44aaa5b
-
Filesize
5.2MB
MD5799b9786f5fea822093231289b2ea748
SHA11bcf338b26de15f6a6fbd218eb5e654fbe72b410
SHA25619f55cf6925760117a8df1e003f507ac8a04dbd4057707c41f0e1fa360b090ee
SHA51255e77999bbe9d7c117ddb69e9273712c7e820f5c971b93b620b1061841f9ef0f944bf4b2a0ac8b33fa2b8c9614d87f6a9995af23b36ce97456e4ccba8c7102f1
-
Filesize
5.2MB
MD5ecf7c4bed8da65ce4622c7bed295fa51
SHA1dd0470fa907ddf6bf65f1bf8d01d9d0da0304326
SHA2567a1275ea19113cebaece303606838adbae8c3782b2c66d3c41a022c9c8b19487
SHA512580e0ea93c3b06eb430013283710e71848315dd9f8b1e9070684a41c8ea4e137d28ae42007cac3cbf8520ba0d88892a52d918657a9abb42eb5468a5493a70a55
-
Filesize
5.2MB
MD5949467fed0e16aa5d6328293280d5203
SHA186931011b812eca1a82a45b6822e9bc255c2564f
SHA25637ce661c81783e137aaab6845424ef57a2b254e03ff2ee00062818f428d9cc38
SHA5120960f88190c2063eb8d274e896b5316985ca6dee31697025067e152b2dbeeabecab83f9d45922eff477c08648a3233b86f376a10cd84d4cfa9e71e0e1e43bef3
-
Filesize
5.2MB
MD55b708d59a29712e6c1d143d1b0f3dfde
SHA18f51b0c047eb6e971121946c8935d89bb0f1647d
SHA25669de5663296bb20577238c35e84992ce31ed3f37a31e087eb53f09ef56c6ead3
SHA5125aa9e9394678a9dd993e118132eca676782911638af247d980c5d8e38f4895abe14d2a541cef595904ff746c1b8e26afb30d98689796ff552c2bbb50dd75cc2e
-
Filesize
5.2MB
MD5303c1e883fb573d78a531a2ee18b65cf
SHA1b6909fbf44046d2cb191da72158360c5a711d819
SHA2568bc3c93980faeedc0c8eea0808c98d6a18be0e9775cb97691c8b4f301a071459
SHA51225310bf0480418e0889f038546909baec17f1583d9f5df17ebe5806e1dde8b02b2caa226165e918ed0461d1b058211ea293b7bdabd7592ebe6f00260614e4259
-
Filesize
5.2MB
MD5419fe04cdcc0c936fa7d06cbbba1de84
SHA1c55bb6b4f432dba7f0a91b1ad6b9439ee4b12c46
SHA256d0fe684fa1767c912582622418eb80890468a22db9b6f3298b5a95a9025fdd86
SHA512c63a05e409c1a49c507d236c9e0dea04ef2a63e2f043dfb913d75686cea0f141e91ea2932d9e9902d8780af6822fed09f1a9edb3e0f2d0fb14ca62a0623b4fb0
-
Filesize
5.2MB
MD5fb9a4c6daa7bd3917106a71a34b2a9c3
SHA10dfcc2969884614f4eccbb1ab60147ba92e5934b
SHA256f1e18adb7ca81992177e4fddeef0c215464068fc481fb081c8af201b1b190e23
SHA512f91affbb0dabf8386da73e49b227af0b1dc170004665f72ca1b8f00b2b0d89563465b7ea787b936a0b6aa536eb95318a8b8abe3ff60732cab1b520c3c1044e84
-
Filesize
5.2MB
MD598adb278d34700b61c7799d98f1f44f3
SHA194ccf564bfb08646f26d20241457aaeb7008a556
SHA2563bb105e999b0310603dd2812b2dec408811ad49b28c70bcbebbba3c8e08200e9
SHA5120469d2d8505652df1532bf068f62830ee7202d164300a016a8a08e4af221a27ef86e4cd3478e2e5c30e12690c102b8f13f7a48205d6a8850c115eb12b35c8fcb
-
Filesize
5.2MB
MD573bf383761222b00a63ca32dc55dbcd9
SHA165ab616353f94eb136a6623690d5be5cadcd956e
SHA25681fbd11cb955e89ebe89ee17dfb837aaa9b0b02bcf0fefd292eeeb244d88ef54
SHA512c37c69885a90972b6a8ba078a494c5f80556b2482f2dd1d296733c38ca24dff9d1962bc9fe17d4de66f584ea01155958202019dc8298c78725bab9d08506e3ab
-
Filesize
5.2MB
MD5eec24e6ec84404fe93a319ee4ade29de
SHA1fe1ec08b67364ecf07148678f4a43deb869769e8
SHA25643fbad9ddcebe2de6be229b2f65d223a44860e89ba4929f1f19d668ef3d4ecbb
SHA5123559a6822ea34794fa64f0f8d0c43452aee5da20e949cff80f310c7cfdbb20988796bcdad2fff2dea7966f9b171fab216c88b766132b742f65536a9c36113916
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB