Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 16:46
General
-
Target
2024-12-22_05fd4ea72918499b63b900067d1f1cb4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
05fd4ea72918499b63b900067d1f1cb4
-
SHA1
7298795c02057db6457866503688fc22e0d9b299
-
SHA256
7a70ac4983d10a483185ce4c702042b52ff38ecdbc05539f0f8dafdbfd6780d2
-
SHA512
89fcf58ecb4b2763c042924335754fcb32c5e806a47dc8ace3808d08495536bbfc1faf46d7c892194331e43d6e15933e255994aa929af9a3955214e45aa8f662
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibd56utgpPFotBER/mQ32lUb
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 34 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_05fd4ea72918499b63b900067d1f1cb4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_05fd4ea72918499b63b900067d1f1cb4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\JvFfSBs.exeC:\Windows\System\JvFfSBs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NfCCcKO.exeC:\Windows\System\NfCCcKO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xRrlvgc.exeC:\Windows\System\xRrlvgc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hEIksGR.exeC:\Windows\System\hEIksGR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wFIloaZ.exeC:\Windows\System\wFIloaZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rgwZZDX.exeC:\Windows\System\rgwZZDX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cYPluVp.exeC:\Windows\System\cYPluVp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UBztSRs.exeC:\Windows\System\UBztSRs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MBeGLAC.exeC:\Windows\System\MBeGLAC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zZuVlIH.exeC:\Windows\System\zZuVlIH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DThzyff.exeC:\Windows\System\DThzyff.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HlXdmMB.exeC:\Windows\System\HlXdmMB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rWuSHZg.exeC:\Windows\System\rWuSHZg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rHmWplR.exeC:\Windows\System\rHmWplR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CRIlhPh.exeC:\Windows\System\CRIlhPh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bPADdXC.exeC:\Windows\System\bPADdXC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CrnQbKD.exeC:\Windows\System\CrnQbKD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cfxaRfN.exeC:\Windows\System\cfxaRfN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qMpcvAM.exeC:\Windows\System\qMpcvAM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\geguSvU.exeC:\Windows\System\geguSvU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XsMZMHV.exeC:\Windows\System\XsMZMHV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD562864ee1075959562e629c8e052cbc4d
SHA106b0c9ec33b434e7edc1ad9e76b703c50c315b8e
SHA25698fe4c8a0a04830901718dd80682c4ec1327213731fd8ce5e2034b7404b6fc69
SHA51286c5e4d718ab7a751c7b5702d6e8bd18543c60e7e7faa69b06f1c3ab9f23a23456756454c0378e11696aac91a82c25e1f29ae67ce76944f0c56ba935980082c0
-
Filesize
5.2MB
MD5389f4ce0fa74c98521682579bf63919e
SHA1e42ad2de99c660a955dae28696183f87d0962ad6
SHA2567d93800f844e6ee3bf54f9910fe21906294fa853bff0eb898d785e2007fc4edf
SHA512caced95fbd691428f7e4f95346e39973dc3fd20c6114cc57beaa26d581a45387e633d3ee619430cf9c05680f605c073dc7fa297cb62abdcdf1269b3d61d44d63
-
Filesize
5.2MB
MD5a419237a68c77d8a363f5c61e5861635
SHA165439f43c30d12ddefa5974ff5453879f5f61172
SHA256d32474a996b26dc18d7a0148e5342945baf29c50b46710f0539617dfeb316d7b
SHA5129d650a064c2baf9644920c935c28005d6fa7f6d1dd25efea366e07cb44676fb6b950a93dff122428d57bd6fcd87285a977368bc96adaf982b8ec0151c6af89fd
-
Filesize
5.2MB
MD578aa15d3a245e6ff8a8077a134af70da
SHA19f25108402f54cfcebe0e930ca0261cd6981039f
SHA256ead56f5eb89164495df9272ae39bdac96d91a3b345ff3bb98132711b716f2b5a
SHA512f11fa1f9ba65095333ec46cd5beacc79684d37e34b50ab01dc9fdeba0f58bd35ee60e5af2242bab956bd68b9597e9cad6a849d33ff860c9cc767d56e7cc0dcbc
-
Filesize
5.2MB
MD51aa96cfd8fb034d13051e7a16a0a5c3d
SHA193cd8770b44fe30a5e92277f976faae23c85da15
SHA2565a9fb84a937f74698c8f2b3963d21dcd2a0b09cf70eb277bfe7ab184b055d49a
SHA5128e96918b59b42cbdefaee52825f469a159b877b4f623907a835a485fb4b08b6b628b36244a446490650930934cc0fb58d802be2ad162ed4c6999607dd22da8d1
-
Filesize
5.2MB
MD5c300e1586d34cc2ae5ca319e137fb369
SHA1105ff8930dcb17c26d913adea283fff84f385e3f
SHA25645b4775c61dc7525f127f38e9d1c5ed2714d78f776082cfc42ef39b884d9389e
SHA512902a0550e2d03b3f2b46b0e365212c98de8284eb38c92d0d649252d4d1dc828d0ff799684a6ad9fbcd266bcc537fcb272c4ec1df1b4b0b95e26dccd58eb6b307
-
Filesize
5.2MB
MD580d834892309dc49c7d87328b4306b17
SHA1987a7c62dcc23b4afd8788ecd3c971e3a0fc23b5
SHA256bfab271d787b04d4a5721f3cd1fb5e9db0a2e38635d68a431d839aaa1c9f10d9
SHA512e14d3be752ea3bcdf885aa7084e157715d63b38d92eec63f80b048f84562dcdff7c90ca5ecce76a2d8b1d32445ca96ef4d59ac0033f4e1c5b52922c4626640a6
-
Filesize
5.2MB
MD56a4595e03e6b8a74a396418c386a3a4a
SHA199825791f683967982b9b94a397b491a12c6102c
SHA2564d74dff102d1e72ae100c4d9c1a47f28bb231cb61006f55fd4208edb52e0118e
SHA512d9cd31a4e6ac78ac86e10c0f7ee31121f27c9ef4a58c6f854ef660da84e4505663cc701cc3153fa74825e00442c051517ab29d8bfccdcee55b97e41bedfbf114
-
Filesize
5.2MB
MD54703d688b27cc3c5e3f6db6b1d1e2191
SHA1681fc1fe3ebf858c2f7dd123f88b85f39da152f3
SHA256079cc4dcc746bffd43d8666b7f6d870bc8e9c5f350483bd7f655477fdb46be9f
SHA51276dd1e08e6b1f840881e7a1561ac0387df68d9799f1847bb3b180f68e5e98f24f593125ed32432f168c5e54c923cada167927038d977a2666ca9bd956c08dd51
-
Filesize
5.2MB
MD5683646c0c1259b0dac07547a997529f9
SHA1e90911879e41ae6840d678ff1a628d1ae5f9e710
SHA256c8d79d0e0b3e0f32c14343dab4aba21ed2af752d3c2ca920a6373eac783f38df
SHA51238d86ab8509b9355dae6c29cf337068757516b37c9658dad300a061b9a6581e448c28b67d999c303314d85f441400daeef299c2ecd87380c9e73b758a89611dd
-
Filesize
5.2MB
MD58bd2487d295a45ec19def88a9c6d656d
SHA152bb510266d3505b766f9f4dce146521effe2167
SHA256bbdc0e61bad15ea89a30ad2833b592746824fd8bd4463c853a769b1819308787
SHA512828253bd52a2852e29483bf90f296a7d0b49e13e7b83cc85b99184cd4200793fb3a6b69a44a91c04369dba79d7754a9c44cd5e624be256b4d2d47309f83984ff
-
Filesize
5.2MB
MD5f4108e1ed8c17e172c163241c0a38442
SHA142eed62f5f5ed66c4b34bc63aaa30cf3669b953b
SHA25692fec56e342b922ef55bfa9410fb96bfa2372b0949fb377a4c29965fcab3915e
SHA512f0b0937bc12fd2d77b074bbc4f69658409c52b1d5634223141b8f7e41afe0581616ba285f8ec1a12be3d88ce72dc23e9129c7cc3917d6901c9b501f888eecccc
-
Filesize
5.2MB
MD54ab30af0ed3ecb262dccb9a676d35b88
SHA16f349ca59c160ccd3bebaea0f75bab8b9f1db33b
SHA25696ecbc3dfc3656dfd7f8e050d1664f3d6a6f20e243bcaf694534b3269f6a4e9e
SHA512eab5595af1fe1c03b72c2dfdaacdfaed3fa18d7a1f9add7772373134f2971f7a2fcd75567a2b4b37047662f16b1a586faa0b83e830881c577608a35f8b6de0bd
-
Filesize
5.2MB
MD52f5d1d121add3e901cbe2cf8b1480f4f
SHA11201bb3f1e68d00275e3ef76ee033b1a9856f21b
SHA256776f16737c9fd8c3dce186df3da0c4d32a4d2b8dd1393338a087a0008d48547a
SHA512aeb40b2228fc8da841f6c04bd9c4f6e927c1047c7322f14ac58a316bead960bdd69a4539e975871a2a5088f438ea2bc74d0c85f9135ec4c68d73e90b705e567f
-
Filesize
5.2MB
MD5eaaf841bdb86ffd5292ba452c2063f57
SHA1ad3a29374c82f968d1d8edadb33abfa3f3000f7e
SHA25628737dd23d637471069ae3182f2026cffd5ec794640be0d39de3f0e8a5a07b8e
SHA51222c517d25996672144980090450f7de28259ad47828113c508b5597d2458f9e15a0a4b9ecd11409970c740e58dce15b302d5025a27d6f0360eaaef3669894524
-
Filesize
5.2MB
MD56a1ef6ef299239d2200f400baae8c9b4
SHA16ce493de48e9e5974735ee4cb49f87bcae7096de
SHA2562fe5647464cdc8e777a9199af7da87c2d87936478876bf8723c66e79621bc763
SHA51236f1777005ad846685cad938dd55981850d1f857742d37282244a017419217ff1444647854737d62b5c6d5e1e6c0663208f04d61325c3e15e520d4c1e50ce8e5
-
Filesize
5.2MB
MD567ea90ff53b34c95c33d53c5be593e7a
SHA1b971dec575efbd77f6e48700cd0703a20d58b1cd
SHA256cf0eb70a7fb467b4b03c71d430711cb0ec9ac10cf955cae39437a5a1d1d20ca2
SHA512ad42e2c8acd9bfb7ef8cfa901cb4eabdd3e46b0ab5af9ecfe1ae3fcf422fe5982d2545d2314f7cdf86cec9436ee2909943f306af8dc59c7eb7af2267e9fb3298
-
Filesize
5.2MB
MD5470f0df944928bd675ee06aac9cd9227
SHA123cff3c93e6e61067196413774c445b7ac6845f7
SHA25684733fd7f2d61077a561df09c5c1ce49e508408b5dd6a2f05adfca82aacb08c3
SHA5121333f98a2870e30fdd9a2684806c914e6d2477e8e4c86c7c66753ff60353f4143cfbcddd4906b078077b0fa9d0bb7e4ffe2a638cd0d5af8d514f03147c90af8c
-
Filesize
5.2MB
MD55b8e9c63c083554fa70a39017c82548b
SHA151dee51e6826839259d973c91eb9175dbcc84693
SHA256a358120eefd52a842ab61e7f3057202f27b0eb10a05f5831507244a56772e9e9
SHA512bb9c3632e84fd3f6719bc26b1d17c9fb34bcd70960d270cd60f0b7056b1c7c5b966c9bb8a849c0b1af9b9f328c88b36306c4c2110b36fd14f222a483b160423e
-
Filesize
5.2MB
MD56cb4f87433ffc0ef872c5efb2ddb4902
SHA1b45d040c95dd609423dbf8cbed87ae853f24ff96
SHA2567a960dd3c34c473f8f65b75c0a2deca70538281a10f6bbcf97810e5fe130aae8
SHA512804954aa0be4db91ef852537963d4bf7d0a782523ef7ea237f8cda260121cbe8f534a357cab53ed8f716fd934d1c46e8d7b48f410541d327576a4f07db0d6ab1
-
Filesize
5.2MB
MD53896de9e80de41c24d75053104e10889
SHA12a002c442bf25920b1c1f616f04c4afde42200cb
SHA2566605ca152c743c015afb45e389aa2cb734fa2d161982cba27e0a3d5be96a007e
SHA51286c18908ad03c7935b5ca7966ad6fc059565f24ec1145d92dca2d59f4262740284c17b1fa906de7945590720cfaccc6267093069e536d9dca672e013bf981192
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB