Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 16:49
General
-
Target
2024-12-22_1de191c82f3e204c5fd32b43ecec08cb_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1de191c82f3e204c5fd32b43ecec08cb
-
SHA1
4272caa5ff8957cd04c7f9bb6de4e8230e375a78
-
SHA256
e8f5710e58d782e89e0be2946e455b93039bc0b0eb2231e7fff2fffb21289872
-
SHA512
e76c632a877a0f6696c50443de4e45d02a9f4386a4c3d8711a858fe5718b34ad2b806cc05d2f933b4d8c9280a021dd120f719b5234aff38d7ac34631ca257d69
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibd56utgpPFotBER/mQ32lUu
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 36 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_1de191c82f3e204c5fd32b43ecec08cb_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_1de191c82f3e204c5fd32b43ecec08cb_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ixPjvtp.exeC:\Windows\System\ixPjvtp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jHRRRWf.exeC:\Windows\System\jHRRRWf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jDZSvsi.exeC:\Windows\System\jDZSvsi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jZnTfYK.exeC:\Windows\System\jZnTfYK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cjYYwds.exeC:\Windows\System\cjYYwds.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CTUdQYX.exeC:\Windows\System\CTUdQYX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VmaekmW.exeC:\Windows\System\VmaekmW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qQoZgRQ.exeC:\Windows\System\qQoZgRQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UALljfL.exeC:\Windows\System\UALljfL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UYjHFwG.exeC:\Windows\System\UYjHFwG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FCmbcpY.exeC:\Windows\System\FCmbcpY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yAULnzl.exeC:\Windows\System\yAULnzl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uGMaygC.exeC:\Windows\System\uGMaygC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bsTPwPC.exeC:\Windows\System\bsTPwPC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QvqJmHB.exeC:\Windows\System\QvqJmHB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dMTvbiu.exeC:\Windows\System\dMTvbiu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mmxXsBs.exeC:\Windows\System\mmxXsBs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SmROals.exeC:\Windows\System\SmROals.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SxoQwSw.exeC:\Windows\System\SxoQwSw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zQZnEuV.exeC:\Windows\System\zQZnEuV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YUSXCMc.exeC:\Windows\System\YUSXCMc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d26856c46acbc8b74a3e03be482052af
SHA1ee19f3aac390d03ecad85a575de639ffca1a8a9b
SHA2563810d33af5bce9e42e48cb67f9f79b645c0c83c2fd02779550b269eb6ef14f2f
SHA5122ccdf32ee1c6e4074a3631f5a3c8baf9a6f68c5a98e2b2a3dfd0061763d17d9735509e5a4cf2fcd20323fdbf077970de9d21d1b5219ae8adb6e429e6f646d633
-
Filesize
5.2MB
MD58937919f1b333cd35673f12bc32d6ac6
SHA1d5e5dbd3080212b97b652b7c082b71f3aee2be46
SHA256a1c8c82263ce96977d675098519fa7322fe85ed3d62610d4bcff16869d23b35a
SHA5122709992e6b07d85d6dbed69ccac6d8ac050d2e8ba5fa9704701547aa7e1d52d958f07454e11efa3aea1e43411f93bbf7a768a7932789729c494efb0fb7c6b4c6
-
Filesize
5.2MB
MD5481136486788fd49d4b4942c05da88ba
SHA1943d12ecb680500c923ccdab1ffa3dedd6b79f0d
SHA256f61cd406bf61143cad743cb78a2848af5a3d5e250982e186cc77fb15f83f8db0
SHA51201c036ea9ba0deddbb122e3af7d33b8a33ae64d6cf4945e79f662ed0470e30605621b3e2a1af96488d99151cc2f0376af858afc8b74574a18bec5bb034b301ae
-
Filesize
5.2MB
MD53dccc0e5079245f80944613b9d57b3fb
SHA1ca81f4446194ac6768d996fb703b919f483b8577
SHA256a6deee7e83a8aa7e6c3bc7cfc4436f1cde75a7dad75668cfe4e188fcf32584e9
SHA512fc13bf96267e46f95ae27ba5302b890d3c301a58ded73dc690862381cb05873b2f6ab2142c1455644ba00738bffc6349d44c5937c4378b9d47c3161f67da652a
-
Filesize
5.2MB
MD5e307e5291576f2b00b3f4ab5e2acb6f7
SHA1867f7a0bb81de8cf07fcc00eee19afd74edd5c5f
SHA2567b71d810351b11c2c465998b059d6e5b8c18e72734dc3202e0f327e8d8b0fa58
SHA5121f667bac61e1421fc7dac7923db7a76690bf490fb22f38b822d8fa8c0ae7a2797ef9ee7ae82196eb0b97517b39612839de4e33ef4fa8635a8a92e7d7c95c39c5
-
Filesize
5.2MB
MD50f65495ae704dfe4f60be1d1fb235d64
SHA1c4015f3324dc67ab4870d4257588b9054cc20c16
SHA25640247b18a8311935303f64c03c6082d3ea5f272ea95686bce5059827ce8234bd
SHA512684f0d72d4af3f71711300c697211e1be5da0f3bd7c3242724ef63da47b01904a71b975bf9f8c73158d586dadf540e624ba89ce2fe8771176f7d82a1523823d6
-
Filesize
5.2MB
MD5022414f98afed5914daa0731e5d98516
SHA1f0f0e5b682405cf297cec28e241ff43101400ce1
SHA2566c7c78babbe956a8a96ee4848372b9ef6e8cc241e9449ebe56846b066bb97c48
SHA5125e76a553b1b57266a2591ad36993f23e6bcc95860a5a918f37ba545a28874a30c5bbb663cca6a889c28d254e49fbf97f3f6cbd59eb099ea62ebc7c8660c9026b
-
Filesize
5.2MB
MD5202cd4a9f2fa681d129d6d50f126635a
SHA10b79eaf37db6d7e566fa2bf0bdef0b159b065c81
SHA256db82154ee56d7f62eef492fcbb5f54e3e0e07a9dabbfd505dce4eafe34d879cc
SHA5128e6020bc1b5009a66af67dcf24f3b409a31d68cadc862fef99eb955ab050f4cac42ebdc7dd6a9da860f2e4709d38e25a926013512894cee2efa31aa43f81321d
-
Filesize
5.2MB
MD5079d27e0e3746733f02d5d981f036191
SHA16d312488a7aa7dbbb3bd7e03a9a97252ff05c49f
SHA256912f3843e84e7098dd8d9b0d3e7f65fcd6d9ed64c4af4630e2578b79574ca24e
SHA51298ff6f21716c1bf70feb89ec86871c9fb53e296720ee6895edfff97520c4e9cf2dea1051c8d504ef16eb3860cec9dd5d2308a7f4b24eea78e02168e30c80b071
-
Filesize
5.2MB
MD504f2087e7a8e0a4aa1ccfd70ed6f9ebb
SHA19ee433b4fa1384b9255ec717a1ddedeed89c5a70
SHA256fda8036b50a39c26834c9771155d0ca73ba984e59a6e272dea8a698100482d9f
SHA512d0f7ca88079ef9bce01294eb55ddc08b0beb9240df75d9c8f1ca5c2e561b4df173514d0e22d50dd2c963138ba7ba8fbcb477d9513d8bb2885b4acbf29a7dd4cb
-
Filesize
5.2MB
MD5d397966a537990db36bae87b6ee4b378
SHA1277ce559e47ef61789ae6c1a29f83ea5dd7f70f8
SHA256ded1f6bb4658c053f8565d47d6f698820358d70a919eecd3f9e59a8e4f23974b
SHA512445fa652effed445b85e8222bfd060dd5aa5727fab3220430a89a5439e292500f24114c1fa9e0cdb845d4274bfa502eaf6e75c1e941ae00cf9d8f7bf7a11bd3b
-
Filesize
5.2MB
MD5773110a37d4d5566ccca387ca50da50f
SHA1971096c959466688e6bcf502d9cbcaf2cee9fa2b
SHA2567eec62b09567b1641f42147a477a0453d00c6b2559538d792d54a90eba719c37
SHA51239463a7ac9f0a2966b052ac681455ff88d726f867821b0c1f4f885405faf8207c226bc680917c4332c164cebbb9c6e65c6ba7263b1280e6461faeec34cef6401
-
Filesize
5.2MB
MD57cdf33b1515a5590252dc708b6c5b19a
SHA1e34142c2868116e260ee887dce1de15ba166a5a6
SHA2569a855630f2dfd1bc21e62d298dd1228c93553ae5be6ef7a8705e9e718eb2cc06
SHA5127f2cdfad5942d08e1ebe8d88d86c34b817debb944d87ed3d7ed1c1d3c0bf8a5a984ec6fc91d6d768095d3c246ac3b91690aecf5d1dce094e9cd1407abe3abec2
-
Filesize
5.2MB
MD5a65c129321c7f2cf8185ed70e64aace6
SHA12474a61678e20464d4bb16111e892c1a03007d6b
SHA256dae03a147673a9869890edfb352a66064cfb0f43dd2f9da8d76fcfa55b1845ce
SHA512fb6338c5de20a83eba050ebab98f29ecb91a387a5e828856506bc20a4ba568c56da3f6c4cd0b5e3745960aa71a93cf2919787896a95fcfad8dc161b9ae73b953
-
Filesize
5.2MB
MD5d63c286d739b1af2141907130cac1314
SHA1680429273c1d4504fd7ef741460e96e8f7e43594
SHA256490b6fe468b4769f7fa44546a217bb99cd8a07fb65be5f00101903b6b3e293b0
SHA512ff685d078c3b214e499110b95af22fbc6c0d94841da66b23be394f764dfee659cadf3120386e2056cc4c1937e0dbfcb40fb6e35910845ba7e47cabaf1a993984
-
Filesize
5.2MB
MD5f60c76ab32814d1c879ded11f5ac62cf
SHA18bf86d3495c337f250450583374116de7e4bb3fb
SHA2568fdf9c19eadf33d9c29aec97453c8c447fba1802bed858b5ad2c67d8fc3bdede
SHA51238de96e1497c526f33c533ad3efd87cfd5aa3778222d46d492821ae0f773eec0ef228be03b59a592fdbfef86d4beb5203e41e2c435f2f6134e808c1c83eeb977
-
Filesize
5.2MB
MD5bb1cdde9cd2aa7ba16f1af3e58b00d37
SHA1f58fc1a63a4064d57aa8ab8f869bbcb977019d04
SHA256c961cd3cef0625b4234623e773783382e3ddab3b90fbf4f519da70fdeab78aba
SHA512f69798f69371bd4ef2fc4aaa51ff832d530b3e1a668255f20f97a2950ae36122df9f775d3580852e7ec646085c43ea47d8698158224424745da4fc51d3473e6d
-
Filesize
5.2MB
MD5281706c997fe284e20e0960d98e0c47f
SHA15af48570465460a3f1720da0f3748db89f8314a6
SHA25660024e7151d6d42b91668f244be3c5b64d4fa5e0b763c009b8e4d3dff9d402b6
SHA51247e584c3519b6cdb77c5a85587e9759f112d2091abf0affe058bd1f7a015237a1c529545b840fd578d6187ca86677ebcf39b7056efde5c3af0795ec992b9026d
-
Filesize
5.2MB
MD57c9b21010f7ddeaef379f5564d721dc6
SHA12793ed3f52ef4c40c036e93b006d911c2780d9da
SHA256404b83b7ebc6001b900d895d7f7303dde02d82ce04fd94d3a1973ede15dfd1c0
SHA5122641593d4e4bc1037ba568c5f8c80e48deba67175ece292daaabc965de068f467d6bc4fe2c5c3f202f5db750228f551194487d6fb6d3577b71f71ecf3716b019
-
Filesize
5.2MB
MD5aa85f579424bfcdfcb318def659b8a91
SHA1760923844d1366b453322e27b3aa7c48065ebc63
SHA25609e2139b4e01df9369b6e6ddcd10f5b04d59caf51d9d6284782b77495bc59ad3
SHA512064e5f4498f63eee33ad528bcf2a7019175ca2effbdcfb2c6d4a0354184e2066b911b38b3474e54bcd442881dc94f72fcd4d898d910db3c1a7f3ad551dd94576
-
Filesize
5.2MB
MD5e99baae04ebe629742e340efbf9f45ad
SHA1be399e427b188370a8b72be0c96c49d469967464
SHA2562ba596a29c2d127ed978301604cfd3d8b8d3e4ede8f757ec16cf577d4a66ae60
SHA5120ec0aca1cc926b47c56aeb4f909799a6f76b231263344e8b327e3f736cc94b2d729ca5cde35e06dac1226ab6fbc33fde0ea016f9ed7375dc285106921b5cc036
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB