Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
22-12-2024 16:49
General
-
Target
2024-12-22_2043dd564c35044b9e7c5994e2a7439f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2043dd564c35044b9e7c5994e2a7439f
-
SHA1
de26334e88c9a9fd100c74f5d5f19d8e6cfb3d9f
-
SHA256
ec9b9ac939f3ffb9c07badee3ebd10e987db8d7deeac9412ad951528313f1622
-
SHA512
14661808de19971110ab01ad042cae8893e8746640d4e8d6b784ee909bc4bf74584a39ddf4f480067fbb75a638cb5752f56482f7fd9d7eab4d6a5e6ccea67595
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibd56utgpPFotBER/mQ32lUt
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_2043dd564c35044b9e7c5994e2a7439f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_2043dd564c35044b9e7c5994e2a7439f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vPlmDfx.exeC:\Windows\System\vPlmDfx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CNtAzGP.exeC:\Windows\System\CNtAzGP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AmpxCug.exeC:\Windows\System\AmpxCug.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vEXSgWC.exeC:\Windows\System\vEXSgWC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YrQhVQA.exeC:\Windows\System\YrQhVQA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\licOUyT.exeC:\Windows\System\licOUyT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\plwNeXq.exeC:\Windows\System\plwNeXq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ROhExwP.exeC:\Windows\System\ROhExwP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dQGgwSS.exeC:\Windows\System\dQGgwSS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LXUYhry.exeC:\Windows\System\LXUYhry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gOMTEtr.exeC:\Windows\System\gOMTEtr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ACWvuJJ.exeC:\Windows\System\ACWvuJJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cPyOdDP.exeC:\Windows\System\cPyOdDP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IUqcmxZ.exeC:\Windows\System\IUqcmxZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JWDGBjV.exeC:\Windows\System\JWDGBjV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XFjjkvx.exeC:\Windows\System\XFjjkvx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfxtcjW.exeC:\Windows\System\qfxtcjW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\isFjvcZ.exeC:\Windows\System\isFjvcZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PvqwjDa.exeC:\Windows\System\PvqwjDa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jQDNOtl.exeC:\Windows\System\jQDNOtl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vFAKknu.exeC:\Windows\System\vFAKknu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53429ea6c6a7ea0a0cb6ef210fa6d795d
SHA1bd4c013133900b56a180082739eceab86e9b798b
SHA25606e579511c8eef409d1a3fcf926fb2b8c57e030dbfa9dff50cbd8f80a30aefd7
SHA512cbfcb2f928e45efae08648d3273089252e37272d43f3a0af7549032ff4524dbb33cea502883142bc963f64aad037784229be99a8a389049b896560ab4c5b3d88
-
Filesize
5.2MB
MD54fc3bbfbada935cb1c2d98734e40535e
SHA100d7ebd16dbb411f19ec81099b45d38acc2bf7b5
SHA25636e2dd8d9b0394ca3e1eafc1b637a3007276d16334d54512234713984548fd64
SHA51207477f06a135453f8edc2e84a551b6e9115bd7d0e90840998f5ad46284505b7bce015a6080ba6099d9461d5a307c2dea0a7a97ff7dfe60547b4cff09048af5b8
-
Filesize
5.2MB
MD56fb6e4eaa27d8dcb63054baf69388323
SHA1ad29846732954cdb905e0e6d5cc0b63f5c3505da
SHA256d285f639bd51e92934cd3d9987c54240955c07e077e1e4a4bdc2319f77528eef
SHA51292db7eef8f2a10f9c952fb04b321cfcc5abaf255f8273f45f3ae97dab2ed43974af5019c32d5dbd9a2d47340cf85c4c1ce3a8a7cf139547b7087ee385cbe0d55
-
Filesize
5.2MB
MD5014992c5b3b182fae0a471f32d350413
SHA1b4d86f4df3e5c0dc84e26b5d99bc8434352507ca
SHA2565c72f3b576faeb29bfe7713c70fa36189ee62defdf7f8146aba7be01c5a61d29
SHA51246d4a35076346ea299cd84123ef71e47216ab7f472e86f43f064e15e216ebe60cfe318033f0bb3d1246c7c587a74eb0fef1e06140ec2e7c5c2fca681b18e3912
-
Filesize
5.2MB
MD5c64ffaaff683cafdd91ddeb4f4a18ec5
SHA1019e1c2870b347efc105fc7b7d72ffcb4b4f0c8e
SHA256c5b2028b2e38557685e3816d808efd405ddcf5b0c9c686f61f21f6a83c8b6a2e
SHA5124fc0a19eeb823770b20f70479431b859b2281c0871aa78aacc5d4571d6ef593b590ea2b486ee210cb62037c8b11e952f058af40785eaeb3f7e7d97a7f3d73841
-
Filesize
5.2MB
MD563690f738f43253f365e5fbc912e4d91
SHA166d7a5fd74c60a461fdb216c7c4537f47d2e8bf6
SHA2561e8d7e02ff11e0f24ca96b85811653610dfe5ff985b05b692e8fd8e49a6517a1
SHA5127318c6b5e63b1712c3a0810019c37115b3aa91e41213514a59695a8d8e382e3ca0d548eef3b4130344d2229f2e9ad5be0d5107d7a6a25e009f9e54bd58bc627a
-
Filesize
5.2MB
MD5b72254d125f9610652f2261522c6f88d
SHA14c21fc33bf395d911001af1c0c95a2d43b0bce5b
SHA256d6b4b3a73e35a50f48032a6a22d1c84c26f3233545789fab62d6e51082d8d546
SHA512a13f08a7b3ce86e654eb696db8ab6a2a2570010b149d32023953445d574f5414c10b81aff0868308ec14062182ba0e5864e03ceea3e88b42b5e4069edb4c0ae8
-
Filesize
5.2MB
MD5ffef09dae65a9c9e62ce04b568803732
SHA1d4f7965d876222ea3ffb07c23adeb25615cce86b
SHA256439727f64c2da7d986ff4cdb7ae453df025ea23f6ce18e62dddd15fdd8c426e0
SHA51278ad7c182787c2cf039b9655037f40dcece655908f676e6450703c95b4285534c0d818e6248fa3bce167da933e983b94b0c01b047efecd0f1eebbf0c28e19332
-
Filesize
5.2MB
MD57b60b076e31c94040b4c75860e0aff8c
SHA1721de12db62c3ef4a707f3969cf6dc21cdf43498
SHA256748a39c33bf0ee984fc474e5d87554a2ba5ceb49557bdaacb5125df2be7076f1
SHA512280d6831f742eb49b1d082672feb9b9c34c1dc75879634f2f8ccd775a6e5270caed576d5cdd1fa92ebcada1f536ca8f4c6bebb07781429df06a356213aac8313
-
Filesize
5.2MB
MD56990c7aa504b6e989ecc01d6ee5b9312
SHA19e0e1f4a87e292449aa05b69cc9038a7c1d3794c
SHA2564f3ca0ae8ea056f09b3f65876378b9e9d8caca877f84daa47e3aebac085be387
SHA51245fe02eeaeb00812d548122203c064ae6de7abb40309f2623b66acce612319e94cd0ae7052585d939085acf35c37846ea323aba4d3f33c4b3f0bf8977e138b13
-
Filesize
5.2MB
MD59eb151594cc87ea91a9bf47cdea116c7
SHA11bfc629ab8efc78565bafc1e7895db38cb6076f0
SHA256bb8eb6bd4059d594201b915fb8e88f84ffad5aebe9575cb625a42b20302fae2d
SHA5122c6a14e8f304c8ba571df268639e0f73a6925bbf10cb8c184e5f0950adce6b9ffe914557fdac44642c2ab22985aa9e354f87afb1e56acb006b8c138b754355cb
-
Filesize
5.2MB
MD57f39e2654e8463dff11aa821f4348399
SHA11fb277189aa0393519c5d2900d89c9ae2b39c2e0
SHA25681c126cf4476971e1d9dbf82e95c449468094df36e328c62458763548a04c9a5
SHA5127a829bd1092fdee4b694b8b73bb56499eadc6afd4acc0dae2436ad2eaa048afe2063ba13799b8527b661cce7fa9f7ffe1331042455d7e9e9e93b1f6f07ed4299
-
Filesize
5.2MB
MD5445510a5a4338bc1a4047d1ec16197dc
SHA15b46300d51be84679892564deedcdf6d4eaec45e
SHA256507c75f9321f911e32f094aa9931a097f1b8876054e9447bc58d8bd2f7757dbe
SHA5123f0b5674c5add69cdc53668fcb0a4c4719dd635f024514795fa4b4519c10508487d4195e1b0b5f2ea64fb62583cc660a45fe1f2efc5e35d0b2314e07c9a20248
-
Filesize
5.2MB
MD508b1d7dc29966bf05b825b676690c8ef
SHA134dfb473a9f40124bab33fef57f34337e75dd0c6
SHA2562bc3ec4b8b0e2ec3c6d1151f2bced03a7390a471a860e69f271e0769f057eefb
SHA5129a5f223865a96d392feb3bff9ada740f3fa3ca91ed3c9de07ea1aa56e18dc89c32eca311d264b1b91db161f326cd6f3549031c19a425ab1d5c69132e3907d2ff
-
Filesize
5.2MB
MD583e1c4ba51d723d0e9b72e668692ee41
SHA11cf3cf0e27705b13d5bbdc176e903b0706464b47
SHA25690e30192d0143f47041ef9dcb45d9e58b7e0001b72fc97db5f65f6d45c1b71cf
SHA512e614d60a39e550f5d0250621057af99b1744c9cec06638571fb8d18fe13c382be0e1aa82f8f54b9c6da1df8fe11d4d1d6ac135f96ef51141c2a257bc3a8ccebd
-
Filesize
5.2MB
MD5bcd5e034b123145404bf22d73b7c6373
SHA158a7b855e6acbef63a462505367c6337e2f6bbd3
SHA2562025d6425bced0f9b8c780ca9d74362e9592e2c8953018b63cbbc953959700fd
SHA512f2497d1f3205fc38cf6313371297eaeff684dc127d7f497a7442f9abba15aeb3aac1dd2a16c131f12b7e2e72b4b6d6f22fb0811dc476ecb364a9dfc0cc54563b
-
Filesize
5.2MB
MD5bdc1bec1b3e41cfbc30b9f8eb0b72e7a
SHA1bde21d6e6ba7d50efc5dd95b0a8955b916f68cbf
SHA256ce00dc8c3d7c3d0b7cdbe96ace88d641143dcdc2e9233717a0e3956104b39326
SHA512e55f9363daf5797d5a3291f9e4293eca3c2833877539c5fd7c2b561791a4f7969cd730bd95bdab187ba6679f2a9a16ec3d90927394cdb85d52eaec33b8e4ae65
-
Filesize
5.2MB
MD5fe769bc38b5d2fc11b3f32c5061c8774
SHA1e681bc3e473b8c336dfef4310f8e00b94eb6cb3c
SHA2564a28642b94c311675adcabf7f3032930d186298b1813fe9a78cdb9211bf5dc18
SHA512e6f38df3e3d7f7fa6e4707e922d877b3f5f2c8dd2f035f8bd7473e9bafc8c83e821bbd87b8e02588b0f066b347348ab50fede4eccd5c42fb32a547d1fd2c5b35
-
Filesize
5.2MB
MD50051753831944e084c9ffa9d4d7c2f1d
SHA13ccf5e38e69f9025539acb296bc42fc231d817a4
SHA2562e8eb55cb0f290573efc31a2b237de7351131b7fa3507c68f3e6b343f136bef9
SHA512495d64d05cf6a896bdeac7348f53813887f992e25a9811fe1fbdb855cbdb195751756efe897d00a5de7e4cbf4d0c79d18522d5e1dca8a99e6d2401b19bf6d070
-
Filesize
5.2MB
MD53da04c09c01af02e351d493366b9a066
SHA17bf4ea84d966795cfae2ce8c7f0a8be0ea8046c5
SHA2565aa1e7d9eaa4b1fc22c2d9e160a9794b41e760fd783410b245f5a843f16e8c7a
SHA51231e792385589d873c00894ba2923beca1f314f9e9c6f053260d56b73cab9680ca6c2ccd4d1b4a3b76efdd6c17057c9ea58c20a757febf75ff0614dc1d6203050
-
Filesize
5.2MB
MD543b5c087c3c03f37625ec42462de1a6e
SHA16f3fd6d8e9e16747529cef249e04d6ea91d837dc
SHA256b1cb9ead8b4733a0947f9b371c46e9e11180d01353bffd86963cd6984e05ec26
SHA5124414d3e1622a236b2b3076dd6ea52546a8322c8c9a56e07e108aedb7fd0a77a8885707fa15f749a70f314e9d0e729b406f92a5e3878849f9a3086d472eb6936d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB