Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 16:50
General
-
Target
2024-12-22_32d7bae9a57e0da5d4e081064d258bdb_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
32d7bae9a57e0da5d4e081064d258bdb
-
SHA1
cd532d6b056127c7f563e6e53d2289ba76e2aa36
-
SHA256
e5a096e7ed3ee1d3bd4269492ca8ac1aa131f86213e8772d6e8128c56fe3c043
-
SHA512
06e87a85a4d0ff7ec9b3327d6e710a8434ac268c1c287e1fd71fbdc5a948467dd03c1c8f93e9f079cc08c99dd2235b5cb7a9d03542573ff25b0a5c5bcac01332
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibd56utgpPFotBER/mQ32lUI
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_32d7bae9a57e0da5d4e081064d258bdb_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_32d7bae9a57e0da5d4e081064d258bdb_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZWrbizv.exeC:\Windows\System\ZWrbizv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XyqmjHt.exeC:\Windows\System\XyqmjHt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TvgEQpI.exeC:\Windows\System\TvgEQpI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vdfiosG.exeC:\Windows\System\vdfiosG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bGaYCDE.exeC:\Windows\System\bGaYCDE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yPuECfT.exeC:\Windows\System\yPuECfT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\twohGws.exeC:\Windows\System\twohGws.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kSJhBFQ.exeC:\Windows\System\kSJhBFQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GLdVqeS.exeC:\Windows\System\GLdVqeS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UGRJUlJ.exeC:\Windows\System\UGRJUlJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eUqAPUH.exeC:\Windows\System\eUqAPUH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UAWZBHU.exeC:\Windows\System\UAWZBHU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JVGwDTF.exeC:\Windows\System\JVGwDTF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vSpCRkV.exeC:\Windows\System\vSpCRkV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zEVQDSl.exeC:\Windows\System\zEVQDSl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WwMnBZu.exeC:\Windows\System\WwMnBZu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YcZqIdM.exeC:\Windows\System\YcZqIdM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WqbwLXR.exeC:\Windows\System\WqbwLXR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ICOTrov.exeC:\Windows\System\ICOTrov.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tMPiHdc.exeC:\Windows\System\tMPiHdc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iaiALxG.exeC:\Windows\System\iaiALxG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD545e343b8ef76aca95bafc37de9e05db1
SHA150fd5a55f8d60f516e8d906e1dbd2c37df2dc180
SHA256ec9c8e3f2436f8bef6b9b1845d020263eb1dbb2cac0f5d6fc64b3fdba621c27f
SHA512d417456061baf6e095c666a230182d4af37d9141681e2b9010fbf30c861b7d17d96eebce3e81892e2d0da8ee5b40e0cb6b637b3a51d4fdfcbb9655a535a7d1e0
-
Filesize
5.2MB
MD5e85326422ee76ac99440789b2bb81a68
SHA1e1ea9caba14ee1534f51c42d3291e654fbffd3aa
SHA2563939631a3b1137a011abc16135edc1a606099169397ea42a37b807ff7ce3db3b
SHA51294d246e901cdaf24a69ae7c4986b989bfaa3ae3bb1c8eb179d3f4a661f22ff83c6d63bc3ba99a06e5b8be2d82def6118be4cdb1b76404b47b4727af45bd1f3ba
-
Filesize
5.2MB
MD5ba1728975cfc71722dcb78f3dac726fe
SHA117397471d2a47e41d67f5bf56cb60f420a1f0365
SHA2564b2acc06b24c265a45334bc63a8b1fcb33b02ba2cd07e35cb7d9c3e73f0362ee
SHA5124e8e5f8ea20211d2e52759343b857caac991a08cad47b16a4d3c500e348a950d99b29aeb1f93f45f5dedd1564496db905f2db5407ba0dbf633320a0fc925cd30
-
Filesize
5.2MB
MD57cbaf1b45e0d65c084930ec7aa73e7d6
SHA162e4f88a6df6c2adfaafda80847f033ffff1b04e
SHA2567d02b80f56516bc952976b9adf8add69ae409aee07eae9c62bce32c520cb3fb9
SHA51264a490976bee1e029555c51bb137a000815f0dd78f976cbeee08631699eed348fd28c08770d37ddf1af600b26bb70b4c97cc1d6ea72e92b559c1e705f139c74f
-
Filesize
5.2MB
MD5d22bd7994e18b6311008ead4f3d79d11
SHA18f94907b27b047002d36f785c53d0379a281da76
SHA256bf9724d10208e73c350a3991fc69bade6dcc1e1444b9e102a5c67f015b71b8d3
SHA512a242623068f1c6ab8576a7eea699286f0687504c7dacdd8c23ba93b67a2c34eeaaa77cf829bc5e569d0d397c0cdb7595b3bb6e8ff8f7732e0f102a2644cd819b
-
Filesize
5.2MB
MD5f8ea2823a08fe79520d6d4000b64a38c
SHA1fa976e0fac2aa45c6dd88cd8347a8f4d5f6063a0
SHA256a9dcf5ff1a681c530b1e132d4e55db3b9d987d49ca563a0ab04bd8139e8c5013
SHA5121a87b7c10db1f7fbb1273ad5a771ad1e27b1fe1f97c25e27e13300dcd56b064b0b8cdf1ae41bd63722571906ea639f995ba6d4fe44271539afae1f1748844054
-
Filesize
5.2MB
MD5bf137c397291ee1f0f1fdd74cf8bf9a5
SHA1ddbc7c36b90a703ea56c6d05d2d5c1cb338174cb
SHA2564abe4d98b6b178c8d6511bd19fac971a4f2855887b3837a9c3959be147dae4b7
SHA5127ffc728ce78eeedd88cb2f7a3970eede72c40da4f46ccdf5bf701c5cfac46fd0f9a66ba5c9df187c61c2cf0c6514ad079e0131155b1abbe77d51d420f76f33d3
-
Filesize
5.2MB
MD5aabe60cd09b1831a4027e3d95788a7b5
SHA1ccfeb01be9f92f86674bfe57ccbeceb78f8b9af7
SHA256f0b3237fb0079949449ea674bc12803dd105344cdd3f3a0a2184b2bc4380f66d
SHA51293234baee313df708e82e2d6ca1691d82483fcd422ad5f78e67c054144fa9fae61adf11e2e35517ee46ff16b37067211b0d7d3fc56a438b92a138a056526bd7d
-
Filesize
5.2MB
MD54fc081b4cf998f8703f3331637e8cc31
SHA1006cf3f5ec8bbdbf87ad8a99f60b3c2aeb714545
SHA256aef34f454173ed7d565b53f58a54e10f9bfb75b9cb89faed3dd471505bb5b4bf
SHA512b26db932b9f6f9b5df807ae24b1a19b72d1246c5ead802b47ea933d88a3834e905ccf5af7ff5b7965d10c732bbfcb34cc470ad55fefa5e815ff434fe43ae0272
-
Filesize
5.2MB
MD5f65af72f780b4a82ea3cd3bcd0bea3ab
SHA19d987522ab54418248c3629326db74a3ae7f57e3
SHA256b369439f1c8afb5900ae61e3cab1ec31f902d2f4dc85afe634fc1129cbe87267
SHA512ad9140bdcbfa53b985593ea313907ec23c013c859958bc9762183c78203ca95868aea7190ca54adc6151369cd62c46dcd91b189542d79a47dc0cf06d7929bbc8
-
Filesize
5.2MB
MD5131491575cd95fd7387e10029cc8884c
SHA127bc091e7ab6fb15760dd921558928b2bbe859ed
SHA256ee9a7dcaa809ef3c8315b71002dbb305854068954c19cca7400f9cfafb745294
SHA5128b893a5d08af5a3696ae0c3bf64bd869490117643a7a7c951a814f8933ef8160c88330f2861086a5abee212c416299cff98b6cd99dd829a751ddafe60e97b162
-
Filesize
5.2MB
MD51d002e335f01e38cc54380f821652f72
SHA19157ae9a8909f4e6cdef1de9193ce307880ce48a
SHA25604fb0536b78c5b7e6dca9c6c7c0df37f94e2ac70b9923bdbf2ba2f9182c214df
SHA512039dfe2c02ff8b44332f4d20332949ed2d534b237decb119accc546444463d5c1e8aadb227ff98e2daf03a3cc68e2b2441021cd0619bd70ae955049e5ccdbd99
-
Filesize
5.2MB
MD580d3bb6d1e916061ed941648c30e89cf
SHA1bbade684a79821e665e54cfb36dd8a20fc8b435b
SHA2567b173a215478585edba92a4698a5899a9a0b9806cbf53d857f9d713861c34d0e
SHA5121437a17bd8ff364fcce86eb90750294fe45700ef2b0f14366f6110d8fbcc01be511b5945fba0f8c80d6314ca666db4e08e409cd21cdc10779ce62757c212dbb3
-
Filesize
5.2MB
MD568069328104d7e48438d1913e73b81fd
SHA1c21b2f0eadf62e6d69a84df43f6af5bd77b6908f
SHA256353ebac86e795c40d01e30f71b8f0943870581217f7e0d3f0f18f67ffed7f248
SHA5122913bb14cdf3a39347140ef691eb7fae7c66d39de11aabade0d17feb71e4330acf5f60c746ad64eeb8eb66799ee47ad92130e492c04093f48131a504645ba263
-
Filesize
5.2MB
MD5784c249c64b08282a2728819f1ce57cf
SHA19c3c0bd9db967e307657154387e9b3a90f74227b
SHA2569b2a59f1e5af173e3d056fe41dfb6f7a8865b2679de91976ec13847c735ccc8f
SHA51200f90f9bee09f38c5714b87219a489d83f6b708895ef66a32bd865f01ed1e260a267ef73722c8b0752c51b2d8abe2c4017ef67a565a000496fb6724f3beb37b1
-
Filesize
5.2MB
MD55109e775eadc1f1077539549d29a041e
SHA186aedbd997ea9133740931b39f6f74b43348b7d0
SHA2568d33adc0c0465bd81f21e3d2423388ac7b2006c3577a32ee036257515d041f1b
SHA512103ab4b16f86ddbb5e9df697f193a922f234c23862d624c79c1b31425d86fe764aeeac320c9ab5d2bc22de973ae89b9f09e07f6edf5235e2e85b253b013ceff5
-
Filesize
5.2MB
MD53c1d5e87b7945284f6e0d51045dc187b
SHA1ad828835833ee126659015cf9c31700c4bcd35e9
SHA2564001c2ecc00d622788b7ab5ca36cd1460bf23938011d24b2207c04eb545ebee0
SHA512cc3a67217aa0498a615453d8ba5f812f9a56aecb9aee5184f88280076ac477fd47266102dead07ea01bed55f78bbb0b6526349e38327a525a652b0122efa0041
-
Filesize
5.2MB
MD5518ff7a6ade375d1b32cec667928ef8f
SHA1088a41277c56284089a00f3fb2111c6089a0da7f
SHA2569335d273553f22376892a79c625a46782660b2bec74443a69909b4e29bf85f91
SHA5124bb05de517d492cd267df29ddec2189c027ae928f5042009e0231cbc06af9a22f3203798be49f2b4dc45273224ffdc8da558cc13f6db10c50101926270d620de
-
Filesize
5.2MB
MD5397348ba959034da14cd3a8250872b53
SHA137e3279bef8ce92c665ce90bfe4c2213fed10e64
SHA2560a6bde12cdf2975bf7b1cea5a6e9a2e0b306b7536ba60223a285a9c5765ac6be
SHA512f947501b95c95e1cff3c10e1e6f129f6e5cc2305abe98ca15576a6060c5fa8ebfdfc3c15942c969d817f52dbe8727719cdbd3bbc732b41b30d089cb127e7d7b5
-
Filesize
5.2MB
MD5854384c7b6e7aba48e1e169766161dac
SHA1f195d3233c1c8250ffffcabc3e700ece73547cd9
SHA2560e99f5af7c31ba2b5148bfacf42c76e8d1964cc91fe9bd05e34fbb87b1119deb
SHA51246c6ac54021d89239651b14a55230f9e6191cf79a9e1a67cec543b0b479560fb096953d2b768d0d0382f1a8a67dda83c1aa6f5e51cb8440f6f2b14a424443342
-
Filesize
5.2MB
MD5dd4a90b16185885c29daef1b401d919d
SHA1a9f4b03d6763feb6931b1eb0e4bf032360622c2f
SHA2562b3322bd7bc4005958d68878e0fb7e33ad8b8234b3e0639755ada4a541f8b62f
SHA5120ea563f52d45e9c36a4d1b4d1133cd38e16be9958c3c999eb3f85b4ad683b7e74631d3d8a4f1f657896959ccf328fffb1a5f30d96096b8aaf0228f5d7fc1b284
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB