Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
22-12-2024 16:50
General
-
Target
2024-12-22_2514ab29a21b597f42f202c60b99a018_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2514ab29a21b597f42f202c60b99a018
-
SHA1
d17c94bed1d8255d819696c83646f1ac8b6c7c45
-
SHA256
e66e5a15b0d1be993098ef8cdfa43c5820eb290295660b8ac7cef894110f1450
-
SHA512
88f80de7c596428dce91a7626f15a1e207a8413597b7b459f2695ca5a3ea3ec6d85e03cbc4091972b37528eb4b6d640ea193a15b6983254b3e4691208e45fb9d
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibd56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_2514ab29a21b597f42f202c60b99a018_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_2514ab29a21b597f42f202c60b99a018_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\JTBkPeu.exeC:\Windows\System\JTBkPeu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sJUvznT.exeC:\Windows\System\sJUvznT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TNhtsUH.exeC:\Windows\System\TNhtsUH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JySRSUV.exeC:\Windows\System\JySRSUV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PXlcQru.exeC:\Windows\System\PXlcQru.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MqHfcXL.exeC:\Windows\System\MqHfcXL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PUUWLVP.exeC:\Windows\System\PUUWLVP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qFeHeXo.exeC:\Windows\System\qFeHeXo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mLrLxZR.exeC:\Windows\System\mLrLxZR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RYObjfw.exeC:\Windows\System\RYObjfw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iwljAdu.exeC:\Windows\System\iwljAdu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SYgHOXN.exeC:\Windows\System\SYgHOXN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cLFxDiy.exeC:\Windows\System\cLFxDiy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mbMSUYd.exeC:\Windows\System\mbMSUYd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HFXWlbq.exeC:\Windows\System\HFXWlbq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UfPullw.exeC:\Windows\System\UfPullw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DiUeuZv.exeC:\Windows\System\DiUeuZv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KoIbaQf.exeC:\Windows\System\KoIbaQf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SfNiNkA.exeC:\Windows\System\SfNiNkA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BTDeIiz.exeC:\Windows\System\BTDeIiz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zokqeTP.exeC:\Windows\System\zokqeTP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD547e618f4ac1bafaf980ab2f93592e76b
SHA112ee8820b1c8690a052717172032ba7a40d7618e
SHA256f9b65b11a19da6eda9fdbedea7a60bd0423d6fc81cfcfc147f512c9d4329c0b8
SHA512c21580d5d9d64a01a3044ff39443e7ca9a180cfece8c6d2044129ad11217b0cf30df43478ceab982d75ea52e9d74b8f61ab9892be9820d000c60bc61ce604895
-
Filesize
5.2MB
MD59576062d00ae8fafda4fc8226e67ea24
SHA1cf6ee53d1bfaab6bca18b0150b6217206a07e3d4
SHA256d437d718ccda87fc0ce01f9e4f5c3e3e90418560c951060250de7da32b919c6f
SHA5122838ded8bd6bde06b4060011f420d88e2b74bd3024fc99fac4688f563c119336d03cbb0111c46c4c20fcb69db35e13690a903c3b57a41ee2a3ba9ea78bc12624
-
Filesize
5.2MB
MD5f7590bb3d34bf971bab05582dabfed36
SHA1dfcb09d44fb5409e3dd994ad2fd9c56718406940
SHA256964c9d4e45fba2de89c4194ad09d90f893e1ac10bb1b0d3a4afe10646b0517ed
SHA51232dd76cb97e9d318f7086153b6502c1eba6b0ee687db4a349a932f9614e811087d4cd0fbd96b7d5bdaac3ca3adc0f0fe40cf927f7133ee57a25253ec40e89802
-
Filesize
5.2MB
MD50bcb6ef7ef3b9f409434d9a4613e8210
SHA18a361cb0e389b880cf2fba48b47a6831d9e57e95
SHA25646724f0c392d6b3de47cbb417c7b95e4a09f1a5a8bef11d8d971db07917a8005
SHA5127ee95d5cc2cd346f12d3d3e7c202f00a89bbea91796f99440ed7a972e4c59fe44f0515c420ecda871fe2c6950b477bf8b672ec2563667b3227210f254c102f61
-
Filesize
5.2MB
MD5d1ece7db2c7fcb82c3c0fd22ed7a4133
SHA17d604c3fe5159e0f536cb79101650bb09777d70e
SHA25642317880b19e95a1fc8a8d3c59b73daf5183857b766186d729b23159b0473c81
SHA5124102b8b49c8265249e4e8e5d40b53c558768d93726e8df576ba1c3952926692c4ed945e32456b7749db71734bdc66a7eba08c02b89dc37313139ae8a00a9c991
-
Filesize
5.2MB
MD53207892917f5d824e3674ae3b4ae5991
SHA14c00507c1c9d1d4b9a01be81d7cba6e6d88c86eb
SHA25656eccd4584a9cb547c406acf0bd43f5550b54d715e6791eefc1ec56499ccd72e
SHA51228b56645ecf5cc536d451b48fdfe681576f580063c62a0c3ef7252c60782b45afcdc77806dd2a5bfd514c98a198e5f7378b1b7387c0974dc89943d6fbd301a6d
-
Filesize
5.2MB
MD5c4ba21ef592c1169c7743d5a8291a85c
SHA181a742baa94c74d26b2eae126e19f574f92aac9e
SHA25612f71c631d3dc9d10f782ca7f54914b92b74ad2b6f46ed64efcd5f8dbb5318a2
SHA512521868b8680c08949deff9922597a7c0be89627094c3099fc532f2d91c7c477f62fd39e326bfb6b4a4869ca5472060e3e33e61dcfc2a52c0cb32aa0549236018
-
Filesize
5.2MB
MD5ed51641eec83fe29cc8b34afbc73e717
SHA11c281531cd05fc04356ec53b6ee72763000a9c73
SHA256f211f20ed24005c68383882cf2a9dc34fe08646893bb7bed20c4e110e0187d6e
SHA512d2ce1387712c17974dbb2e451fe3e98d5bc9c204749da122da24c7a17c5b2161d7dd8850cfe1a0a84eb1d2965c8dc8da4c966887c616d29b7e8fd11a64df2437
-
Filesize
5.2MB
MD5718e588e72bbd229d2de49a10981425b
SHA161957ffa1b0150c4c9f576b065a171595a80c3e3
SHA256d7505a67d578b382695912d2547242668caef5a7b6fbdcd40c860c0e94d71a94
SHA512ea6ca35959896eac9cc4d5283cf48f2a9ccd6213b7acc5fc3d84ed694ed6705b9b9fea9674cdf79c117147af7de028463626ed4a13e0eb115f14eed43e463420
-
Filesize
5.2MB
MD5aea2f4878cfb8aac7895d62ac1ebf944
SHA12f52ed9723251ac7ad09b91f4badcf9fa8094ba5
SHA256f7ab104fbb435cb37b5f2a6d7bb65ad6c73df5b5b980104fce728c23c0f07537
SHA51275727159c7b0cd97fbb8d48516b8cf6b24483c60f5b06b4a08f4a19efbb883e7845cd69f4963f88cbb4ed6bb46c10dd24ea3b34787bacf7a8ada1deaf32bd86b
-
Filesize
5.2MB
MD54427124ba4dac33d463b62c417fb199f
SHA1be6902ec1ee9284f1be873fa33fc36a6f5fc36b0
SHA256c188c35f2a08b111bfc7b27070078fe2e7aaca3a85b0e7d5f4f0f26637fca38c
SHA51256fbc3493ada92fcaed8ab11cde94e88424ad79da0339c3d70c1b247ea2a3ba36d476ad1bef9416aa5efb17b3dafeae9c88c6314d4796ce8210d805eb03030db
-
Filesize
5.2MB
MD530405dcf3f8dbb751e5fd11a4fa17a41
SHA1adbdae5b9f73d3420b571eb6a992196f68e91bef
SHA25650b5013c4a9a2c9d8d98ffd1ac3657d1482b4d61f92ceba1c2fcf7778a5a67cf
SHA5121f1d8ce730d329d12234a185573c4908e75979488cab4b3958def208fa4acb0571fcc8d5f175ad47ea89c84f399043d98ae90e9cf08f3bc91b36a8635946107c
-
Filesize
5.2MB
MD51bc155fa38fc3b9f43fa0d96bfaaeb78
SHA13727b53974bbc24df6057f64ebedfa8107408959
SHA2565c033a9aaba5548131346575327bfd569f3a0f9f4ac794859dfc87686acd1258
SHA512710c94195cc19fb9daf3bfc8123c8de0a3b070e3f9a1cbae7438bd3e8cd87b3c00dfcd27aa16ff43bf489edeee87eb18cbe6380fc37381198ec11d4908a180a8
-
Filesize
5.2MB
MD50647f9f5ea2d957601237c27a0f768c8
SHA1e42a022412841e779104d113380b58effde227d7
SHA25611633ce0bef9617dfc3608239bba21151040fc392bf72750bb43ba9675fa49d8
SHA5129ed64534eba0abf2f6b8c0f27644ae4d8aa3c0abcd94ab7d0f08887357b2842c6faed544f81d2ecc96cb8012fe8496bf669146586a0bfb92566b9f378f3f1715
-
Filesize
5.2MB
MD510127df4b2a623ad25e76d5d2bdd6e5e
SHA1cc5e7687938fa0d062059c6478b9324c3c4837e4
SHA25605b582b87cc9f3fea2125d4417296f36e17eb1da751a176721c49669c983394a
SHA512e89ff78272a656cc1fda58ac36ca4c4332b858a328c0fc622bc36e94c0c1ef7ac56d051d68a9914e2957553111f34dc0992a85c67f8e298411203b28999feb3b
-
Filesize
5.2MB
MD552f407119b5947c427f4c65a01778ecf
SHA16e5276f899fb3b15d57a1a0d7f70f4b67210dfc2
SHA256fcd41df83de14ffb1e21d5f2dd3ad749dc6b1317f44d25723ff133ad661b5b69
SHA512344de371c880ff893b509005008e5086ac8bb5ee879d75ea2e8fcfea005da030f1d87f79ce0091f27ddca495650e147ceb67ad66cf0491beede62e3e5b90e15b
-
Filesize
5.2MB
MD572e6fd720e5b6e6651ca2846ea711f9b
SHA1c2a3c20e05f3a0b626b4a9ffa9f3ffa426d0fe00
SHA256dee4007b2060ca51cc68dc5f1021f0ead4079c3b8b337eacf0bed830811ee696
SHA51286f37b5243aeaf505a27b9a96b09dd43b4d9beb1bc0ac0b3ab20402f6feeeae572df055561cf09d21623b6a98e0557830025e635765a2b9b4fbfdec1ff5d87d1
-
Filesize
5.2MB
MD5e7695417db198661b944369d3075b8f4
SHA1790837d5b62e34c3b742e94f5fdbc35f20b2725a
SHA2563baec73f146dfac7c7ec3d6e87cd169e0e0840155d64862297b23f8c47083e40
SHA512990ccf3a51cdfd62f9ee86dd1dd66a7629868d4fcc6e79548933fbcd7b213f0f114a5a5e319dbeba7673827efe0f2ba4df975f4e764db4ca3aaf0dfe92726290
-
Filesize
5.2MB
MD5c70d1915b62b210ca87e7fe53735b99c
SHA1e8589da69cc51b4ecc8edbf26aae8b2b64e2511f
SHA256ac1662e44188faad0b723e07b0353d7a31a2e9af1b49b1cad9563fda37221498
SHA512f945b60fb51a719410ffca6752625046bbf765c5efa72633dd139dfa61daadd3fcb28cf99777f8f2cde96f8294444950af6acaedb1d39e0fd5e6e539893000d1
-
Filesize
5.2MB
MD512beca0160ce327e2db0d06e791a814d
SHA19f2db388150b4f1f401821f33735776725e4ec88
SHA256bd074326b172f472deac566393e08b82c80010dcba073c9ca00c943341a6de09
SHA512d1156be1736be2e4c4b9edc85fa658e4fb908be50e162e6fee039d7a807ed8f0fdaf5e04e807a697f63adfad1494d8802bcff61f1e9e559b1be47a29002b1465
-
Filesize
5.2MB
MD55105ddc56ba89d4f14df95e9de66b22b
SHA1d3582154f57ace64e831021980e6db224ae5dd7f
SHA25616f3bf25cec7a257ea2fc47db55a6bcf0c9c8fb968e377cc51fcca7854002c8c
SHA512e163bd380440cf88180fcc666f9831165f8645d75e2dd02d834e58cb5393627b9a23039a174e65362745c9e8e71f202f46f5a27ffd2c04e56b4bb1e669d8618a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB