Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 16:48
General
-
Target
2024-12-22_123360685ce32e7d7d936bcbd0c916f9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
123360685ce32e7d7d936bcbd0c916f9
-
SHA1
3a90e0b52b5250be5b1da64fcdd578ad086cf15e
-
SHA256
47b392eec5ca123ede6bee89dd3a818976b6f3a3db8efa079f92811ae5f6072d
-
SHA512
b0ba1e08b6baf07b25964298a0b26a69b5a1bb7ee15c8e690c784b693f7aeec727ad7b080210a199c02c6ee607715a33bc256c834f88f6834a2d2e4ad43354b6
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibd56utgpPFotBER/mQ32lUL
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_123360685ce32e7d7d936bcbd0c916f9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_123360685ce32e7d7d936bcbd0c916f9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BkEkvCa.exeC:\Windows\System\BkEkvCa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VicKVyI.exeC:\Windows\System\VicKVyI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gReIxOR.exeC:\Windows\System\gReIxOR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zmhsIRm.exeC:\Windows\System\zmhsIRm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YwyBPNs.exeC:\Windows\System\YwyBPNs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wjsNPMG.exeC:\Windows\System\wjsNPMG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uxcJlaP.exeC:\Windows\System\uxcJlaP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IKYMQIU.exeC:\Windows\System\IKYMQIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yiGwdYI.exeC:\Windows\System\yiGwdYI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lFNbaUE.exeC:\Windows\System\lFNbaUE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tHdHSfl.exeC:\Windows\System\tHdHSfl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EGAFgIF.exeC:\Windows\System\EGAFgIF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hGacCMF.exeC:\Windows\System\hGacCMF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gLHhMLS.exeC:\Windows\System\gLHhMLS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mIYicLH.exeC:\Windows\System\mIYicLH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZRkZLiy.exeC:\Windows\System\ZRkZLiy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mgzcJnb.exeC:\Windows\System\mgzcJnb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LtImsSN.exeC:\Windows\System\LtImsSN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ieuTyZM.exeC:\Windows\System\ieuTyZM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\khAqeZc.exeC:\Windows\System\khAqeZc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sHhSznw.exeC:\Windows\System\sHhSznw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD567590b57f3fec1226efd972b14681c6b
SHA1db8c5f85de537d9cacdb37feb6bc999e28e5acf9
SHA2563a1fb4f6997d9f41f355f592143678c06ca234ac8da3ed04a221fdaaedd6a618
SHA51243ff270231a927d5c1cdbe403b80f235a3f53779378dda524de195d6049f8ba35041bf848cb8ddf76ec0ece8722ad682fafec65359fe483fd7cc41a51ace3f5a
-
Filesize
5.2MB
MD52e181df230257503eae4727468bb3aa6
SHA13ed0e0e316aeeba866efda95c4d17d9c650af225
SHA256aefb0b9aef0fca78d60159498614ba38ead1803b60fcf984833c463ea7d67562
SHA5124640eb0474e009477cc159a13fd924f529186256f6f0fc1c99554e959a60f2e64d4f8853f66fd818a379cc29ca854cefa853bb5c12ac3f7ce60efda54ebe822d
-
Filesize
5.2MB
MD5a09af1c214c87d234ffd11e6c8aee1a4
SHA19b5fb7fe973362bb2ea50bb53d9d9dd3dc065e78
SHA256f4c833ea54c4d773717eb272af3d62e48885ae00baf61420061cd9ccc972130c
SHA512348b00a6228ca7218e5ccea9a4347db16acd6ab4ac083247d8b084c60d3c1409f4ef89537cb042298a3b393f572003017f08afb243eb3bafbd847673595858a0
-
Filesize
5.2MB
MD5d6c993647c450ab8bf14a8048dc28c4b
SHA10b7eb9d4b1ed3451950e0e57af85ac69b882deba
SHA256433203530484bd94628dada26f60fbd0ea2bc7165aa99d31e8167825f881d448
SHA5126bee68f750b242f5f661667e186c715c8cb231d647a189d4ba210d2f4b4ae23e2df273f1ac7a61b2828c41ddb5455c6f28fc1561d77e81ab20cefa9c4acd634c
-
Filesize
5.2MB
MD58d32e140bd7dbd2bcf0a6899fee067df
SHA1d651abb29903d0fc21a0e572438423880ca58af1
SHA256478bb49a6b294009fad31e55b2195b4b0940d63bda99b7adf323fbe19c62d298
SHA512c837ed68abafbb57f2845d7aed214e1cf55a5725c3594598af78bfaa9966240d8ec1eff66c67ced233044151b47dfe26c9346e0c3111644b174bd908bb6e8254
-
Filesize
5.2MB
MD5918623e3800c608f419309120e685fe4
SHA1063bab0b291c8a01142c6432b1b1dde112c818ae
SHA2562dd65afc80a0eed8f50aa3298abcc508920457f0308a074ae3a64ec3e86ca4c0
SHA5121fc576d5265fa64426bc0404205a1391977808a60189afdd29e6dcc0ff480bcabfe47191e75228d1905cc40a6105bb3c05d611e72cbd099adccf4d4d4d9efe95
-
Filesize
5.2MB
MD5667bbf068a65f940d19a9d3551e97b58
SHA1c4a473f6d77f30d89044a569587e2952ea2e12a6
SHA256091670150f0f93bcb0bcace377263e4dbcde2a11af187c8613747c3719aa8d37
SHA5122428b5ed8f69c1a00f0fa737e0d7312817edc5119de55fff760b0b9d49a1661e8b7c43b8986e8b202695c06c13af85968abadeee9a93dd2f21931ee6fadc2f75
-
Filesize
5.2MB
MD5fc5163f8855dc1f63607e218b5b393ae
SHA1d98a8677f0fec2049b3bcfc44bc0351f90c4536c
SHA25633420788c074cbc8fcc7814be9983ea13d69ddfd66345dfc6edec54224709102
SHA5124d0d979d7e43e5426b7067427184a8594bbb772fbf9372c5307779e1bf281a9f29537ed49dbd31145bc933b6c73e99a75040e6495f529e69b3392df40dfab770
-
Filesize
5.2MB
MD539f75856de5da042ce88de8f0d54cf3a
SHA1ee43ab300ca8a2c90acc83c8d5f4460f5471e130
SHA256a59fd87d73f207fe2428ad809c614ab9c63ce0eb7ed6a4feb957c8fe58ad70bd
SHA512961f25ad1b1f23a6f51abae119931912477c2870024fbe3cdc8e1a2562d8ea6ef43c0412c3d73af37193bfca3ac4ba2687c8d848e65b2a06174818ee1d02b95e
-
Filesize
5.2MB
MD5a4d30c49ff0941302faee28e605cd8fd
SHA11e500824fedf5ec7df642bbfe6193cd158ee9cc8
SHA2564c4ebfb00a725a3772569661fa49c57045f0f3ac2d185c3c818eace1c074fd72
SHA5127c8fea45ab93ef75b614f89e864a511a67a5bfddf503a15e114e213a4b4d9fa05e01a93ba34715081baacc25b3cdc21d33c950c78f055cec7c0c3c6837e0acc2
-
Filesize
5.2MB
MD5428ee582fdcef036edf397bd3b9128ff
SHA1d6bbbfdaf1dc9a1656965196f03f92cfec402723
SHA2560b6b6cf708392f16bb6d9a1ece6b295282bd0fbdf09eb3a7ce6111dc70c8f999
SHA512fb78b11f0288da82c5234d463efcc623e214673d7e6678df9bc03e6334654ae2034194b31e7c1c3a9ac2ac7003a0d50c7b857e03672f409b7e3a9ed8accf236b
-
Filesize
5.2MB
MD5c05a053f017aa5cc77c45b1f97257fc2
SHA118caf86e040a5da80593567d427266efe2372870
SHA256ac527e317a7c61433b69bdfe9e9278b1a949a9c77fddf7de04e59f1b8ceaa4fd
SHA5128d66c103b1fb7b4f598d8cc82ac47dddcc9524764424dd795756261665fe33d89b209b062ce58067fdbcc29b8acab4bee331be60d3e4cc763deb550d879fc505
-
Filesize
5.2MB
MD558fa903dc108ecf01f52bd457e250326
SHA1f262fc65907fbfba7d425b00b498440bfeead924
SHA256bb98f1b1014cdaaaf0431141f52e486efaed0f0007526d53c7ea4a70e0e78c46
SHA512a7e7e7fd8009be255fdf8ffb8b00aea0e606fe4b66c3d1858cb479cda47e74c363c324832cb4a76f48772722500af9d564967b60d5bb5962703bb8f25a6edcf0
-
Filesize
5.2MB
MD535fb3c51cd92556bd6a91d17f2473c37
SHA1d7f7d0fddeea52631824ea1338b197d2a8a88680
SHA25690b804a67ddc3d0446260e608c3b1c96d307143d97625ec3f5710b2fdfe5e2b3
SHA51203dc665161353eaacf004d981ca5c43702ddf708f657a9d7af2bde253e0f4fc20b1a153cabb4429865b08eea109d1c09f94675fff1870ac2001cb376913f0daf
-
Filesize
5.2MB
MD55708fdabdae8ec69242c49e6ac606df9
SHA1909b91e0b47b3b30da64afa0fb27545e03da3921
SHA25609c08ea38e8d9686a0716d4608f629151f5ce900f226f81d4a0fc1b890e14f5c
SHA512335dc5358a52a0c2039a956c229363db1d0934f4fe7503dc21a6a838a081bb24b69577efab23b7f172a2c66bad48003c7afd8c7fe6d83b2c5111690703da4260
-
Filesize
5.2MB
MD503495eb4e097b387dba05e2bc1684a58
SHA1f850092c07a0099f80d230de6d5229227fddd246
SHA256200e12334faa76deb1aed667c5f21bf5d57a6a85571d98abb03e335661bd7909
SHA5120c568823346842706c0f0c0906ee6eee8006c6194a7eb1c81a092145269d0b5139d2ce248e347a721048acf9db57c61cc6960499dd2e62d342a2c202761a186b
-
Filesize
5.2MB
MD5468de38b55f7ddcbf236336cb4463a81
SHA142d3597cb5089808f7dc0c3920fe461256f1b0c5
SHA2568c2efd1a8d5def70fb901751cf15077a6a62af6f39969061d371c66f7039e8ca
SHA5123f989748a2368b4fce95c89303fe48a838a80714d28c3f3b63ccb5d7369fd077345782ccf047c567d23b9fc0cafad4ac2c74eabbbb2e9c115aa80fbb8e9d69b1
-
Filesize
5.2MB
MD55ceaaefde211657fb84bd602847ea762
SHA1b45a3ed94987019d0e29fa5fcea2cd82b12431d4
SHA25605784859e3fa3d9e2244fc4f8eb4eeb9ab957c424244e49b357b29062f5128a4
SHA5125c7bb6144d6085419af2dc6412c03d9dfe023a4be9699b788dfeda4dd44ec14e94c9071480d0dbe9dbe697bd83f50f99c4ef784c2f3e69a65a1e7830d1ebd38c
-
Filesize
5.2MB
MD53aaad30ed0ac57372b0fcb44ca0beef6
SHA1419963a87d9d83b474f62bb8b08d62c69802f8d5
SHA256554ce17f822e00a8400b6983314d23a2e69ca1e36bdaf924b55e8edc760204ae
SHA512f62f53ecc83e63cc317f5309c79c1b0a337d7e64496f8f7b18c6375b0a77fec1745ec9fadca55342e24388738c6bed482601e8ece6a2f85bc8c27c7fc4895921
-
Filesize
5.2MB
MD55963036b5136d0a3c3d0a989665dfb26
SHA17252c346788237f2c4a07b18ed3800098d978045
SHA2560906d46b8ab40a09f2b903bf025ad4ed71d713a9b3a68bd1527a41322dcdfb59
SHA5128b6d96f8b3342a3c577562755c6f1e3b3208061898e80d4b55129e5344305ed16161ddb710c28bc27449de2e8ef231864cb1130ed0a9755e83a89b76db4ed351
-
Filesize
5.2MB
MD5e0a9e8a1d8ecb7d28515ef17a454ded2
SHA13dfe87c60d6636ba28a33236044e16cce4cda241
SHA2561ec515d294e89946a541f4b2f1ddf7ff2fdfc81c31a0304b1320df091b68f94a
SHA512575a8ca0f9528123dbd04d0dfaef78b08db52ea07ab2e437aa9d35fefc80932f61994f34796df4363824dbeda62030360a2588e969875071149dc06b52029c9b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB