Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 16:52
General
-
Target
2024-12-22_3418a214d377330a8f5ceb9410e81f3b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3418a214d377330a8f5ceb9410e81f3b
-
SHA1
835f6ad94c427e2f63e9cb8abf81afc3af79d0c5
-
SHA256
8537847ed705acd6e0297a1475c063685ad2bf020d4433ae6b4bfddb8d1f217a
-
SHA512
409f4412f6624a7ce292b8a7645c9f8729098455652e3935627898bdede7f4646cf192d00b030b47941892b776b3e471a29c2f3e19614f61d16812ccea34bf98
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibd56utgpPFotBER/mQ32lUL
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_3418a214d377330a8f5ceb9410e81f3b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_3418a214d377330a8f5ceb9410e81f3b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oTkmYcA.exeC:\Windows\System\oTkmYcA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\breWJGa.exeC:\Windows\System\breWJGa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XatIkZN.exeC:\Windows\System\XatIkZN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GpgcoGV.exeC:\Windows\System\GpgcoGV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xqHpspw.exeC:\Windows\System\xqHpspw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SFbyzFw.exeC:\Windows\System\SFbyzFw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aoiHQOC.exeC:\Windows\System\aoiHQOC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DkucJoj.exeC:\Windows\System\DkucJoj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qBEOWQW.exeC:\Windows\System\qBEOWQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XisavEG.exeC:\Windows\System\XisavEG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UhKZYAF.exeC:\Windows\System\UhKZYAF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iKtICeB.exeC:\Windows\System\iKtICeB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JqZpBAV.exeC:\Windows\System\JqZpBAV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yBMxdyR.exeC:\Windows\System\yBMxdyR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JFqzCDg.exeC:\Windows\System\JFqzCDg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jNMQqvp.exeC:\Windows\System\jNMQqvp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WvFbkGz.exeC:\Windows\System\WvFbkGz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PekuKTu.exeC:\Windows\System\PekuKTu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VKZIEsR.exeC:\Windows\System\VKZIEsR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gcqVWfI.exeC:\Windows\System\gcqVWfI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EusSFrO.exeC:\Windows\System\EusSFrO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f3695ed9ce7fd82e570ca24107ae38b5
SHA19c892d72860892187cc11dcab83012136a785dbe
SHA2569c9bc570a0c3e38f6464de8f890d4850cfe14a90612f897919ec3682eff7c99b
SHA512609eeb8220a60f56b21058ad8a484ae72b687b64310f2161fea01fef210a1cd4e17e1ff4a1eb1c94a77d1daac09c7bb7e2297090385b3f4673741c1a04f27e68
-
Filesize
5.2MB
MD5b21a9f4bac6e4ef2122980eabc5ba54d
SHA13d1e3539e43718fe3739cad88ba75cb2acf6ec19
SHA2560be48e6419b17e774c154015b59e28be0b65a2a87dffb719d8d0548b669da3eb
SHA512ff8d9ecf3e162909656d58aa51453be3f6be90d7ff06c85096b0fbd1dad78410dfb8c7148c92479518e22f85ebed07e52f6f5eb6f245f4fb1f331baa59fffc1c
-
Filesize
5.2MB
MD56fc8cb7d3bd0f77a44d4e5834ba06f4d
SHA1a8cdef5a67c36bdc6151ff79433150abf6feec89
SHA256b5f91b1821635d1e274bbcd48614b73727ec4031291ae20be82451783e45d4e3
SHA512653b1e0e9aeb8c34dafb9c26138b8f4f469e468bea433ce36125603bfad2339833ed6546ea1830103a9f946d047fcbc585ec0c00ce135de1b91e02b1465b6481
-
Filesize
5.2MB
MD50da626e99ba13e85f4a8d232499798cc
SHA1b2289e4a90c05c5d76b96451d6cac186d557449e
SHA2564b1a5fe5f87edbc4cd8f8fbceca9fbfe51d27ea1357123d4fa253c941af74cd0
SHA5129d4bcbba9326648ea5ea030866c40e9a6b4d630be306b6b5b011b92702af593743020cae0bbb66ca17ea2ea2137b09f0daa28018aa13b0b0b44166b90c7e0719
-
Filesize
5.2MB
MD5e251fa0b7db785b0ce2a6287f08e2403
SHA15a2f9c2ab2bc49f423692b1b681311ae8ef2b421
SHA2563658fc167878215bed47e9a3d156cb5cad725a339c206900f45206692d90b80d
SHA51233a83000e531bdd2b23b95c7ca40270957d628883db4cf3c81d99db906eb7eddaf63934c0b496e34bdfc7bfa01864dbc225329c60075a7f6edebc691bc35e064
-
Filesize
5.2MB
MD530d209c79b4bd487b7c677435e4e668a
SHA15a55912fb61698e78889ce0708fdd2bbbd138405
SHA2561a0e94534a247c2b28c5ba077820083e12048dca31a3df27e4dbe63584939ae3
SHA512cb63412ed32d89d8a8ee660c0ff7eec8560832fb75e224a6337a890b015c3bb213ef49e779abc4cdf0ef2d24fb40d3632da5125403efd0eff7fbd0d53a0e10ce
-
Filesize
5.2MB
MD5deb9bff959c237f9f29ef345e705a759
SHA128dcf2599ac8c2727446d3654a35381e41ff277d
SHA256ee90a4dba870645852f5f273792eaa89654029ebb942cb028d42f8f5f9f120c5
SHA5120447edc3ec0e83955c0ca5b5ac00d98fa8c6a9de791324f4d16189bc69d6f8f89cc9df1c0cdb8d3f613c82efba85e7282942c62de4f58f62df0d98d1dca7da4e
-
Filesize
5.2MB
MD5b49de65b27c482a045ee0122093243a5
SHA1b48d6d9d54906c3815c46226105f52937284521e
SHA2566899e53a68ee0da4c5f88523aafb0823a30f3188f8aad2ed9cebdbec866ac803
SHA5122ac6b51cdbbeb4329a00b3d639de5b85eff1cb9106bf222649a0bd1ef34d8190b376ac13aea004e218c2b9d61226b6c25b9cfe309244dbc1e5d5ec7e45dce8b8
-
Filesize
5.2MB
MD568d52400bd582d9e1641585a6d01538c
SHA1c77d179d1a6ed0bc1217b35c416645deb2831edb
SHA2567e73e82f5841de9bc50c8acc18b357160b766245e49e3042deff9f383070be2f
SHA51251f7ba70ff9d0e32726e598e881c789f9467666cf21a4047d86af240fc508d6bb7a3c6b203e2e1c2b5c4c6e37f99f35f06f26de8292d031b160b762cdb0fe8ea
-
Filesize
5.2MB
MD55a6dd36d8b138deebe87fd0f54362455
SHA1b3a4f49b58072c767d281b5c926d817344e2f66c
SHA256aba0ffa6903373192087cb0c986bbb7a79871e5dbf312c9b17b5692c2ef73565
SHA512f78a7b09125125038c9f2bd9d55b4a5f9ca2522bcadf1f04c723d462a9bc648379d713b4b9e04338f6ec8b68689df2cc0185d802e843467ed2a1e2b2adb03c89
-
Filesize
5.2MB
MD5af586e2eb9224af94e07078450768db5
SHA1214ed01207d8b13321a389c30cc26e300d04300a
SHA25661f9a2774e2c7fb0f661baf7280935fdeec5137a272e418eb5fedd7e1297791b
SHA5120ea3f69357e5d2d5d073d13cf0c07f0d5acf4b0244b1b2c8cac231a285a6b295f590cef564babbd713e610cb7c9d33b11678d5c6fa385d507d170f0057f8a863
-
Filesize
5.2MB
MD593c66b5b95a4fd259b2dc4a74d0dc3fb
SHA1cb3e226b6d0287d4d4148702ccf0ee75d4d78fe8
SHA2562f85a017dff4c14b2891d5076e9e5f0be2c186581fd2bce807ce254a98d060ff
SHA51204bbd76f24299958ac3db0e9ebda4cd09027c55cb0ddc136acb6cfd697b928660f9ffa9fb5d6e05bd20e37236b0681783f638797ddeeb1c24348f52803080830
-
Filesize
5.2MB
MD550f2fd86d937c3d80cd8e8fc8695e30d
SHA16523db4640c6779bbe35f8ef719e0ab9fbd3d286
SHA256ecdc1b09cdc0b79d246683dd8ee4bc97d39502bc5cf752d8e7b95d0903238481
SHA5122c6290ef8e38283ec87d894d9b32622b9105270facb2021788156495cff0b045b534ae33fb947a332ccbf240d74e66d1e1232a5d90dfc20944ffdbcf6f11aa47
-
Filesize
5.2MB
MD5665e9a8d8b9202f012c5cf709c8cb40d
SHA119dd6b4c18a0364efe19925875ea9a46733d8f50
SHA256bb7e1b939ffebc83c0ea7ac0900c607c465fef9f3507db957bec8410772ed0a6
SHA512af4e599994ef075c3833f8faf2c2590d6f25b18f6909be2fc30c035822e209e8083cbb5af017b776129071744cac4b1f66ae18ce75bb529dff3f7fb09bda19cc
-
Filesize
5.2MB
MD508b60b6025943e57a5eb2ecf6f42acf8
SHA176ae54960340aaf1888a5cbd9d52ff8b1ec176bf
SHA25673b8289f8d77fd278609bcaf10bce8288095e2d408ecc9e736d05601227f388a
SHA512ae3c8c4944e8f553862cfca3646fe0c74c61393cc028c3041fad38e90a8e0e7dae6f55ff8038b729792c6efd0c731217d74d0c1a3cb65a25416dd6c3eba4c708
-
Filesize
5.2MB
MD5358b58b9568b86baad7270e115d54bcd
SHA1a2b35f57360fe4349f03da0123ee18ad16101f2d
SHA256e037b6a0fc95c77bbbce266518504fd7c5872d7cdaab94dc3e0f28c450feeee6
SHA51204edbaa727e82a9873324d2bc64e787cd131166b22c85d21b2c10cc97e8e2abeb196e58a92d095a9dfdb8e262ea1e584a75ea098a68c98eb30ea3f8da4dd5d8f
-
Filesize
5.2MB
MD586cf7e3541fb92ea0f0208f60bf72b5b
SHA125c78524f41a3f39364b3a079b5528a757abaadd
SHA2563f1f39e75e061b2793e4d26f5d191e1fdf48489e53708c3bfee355844ee36bf1
SHA5122917f8f13106686d02183266b23b31c11be2da52d2a6a3e33218b1b18d666f03223be96f1b0b66fa4bdcb4ee50aaa6580fc4e273edf0caf6069f51c704b0c76d
-
Filesize
5.2MB
MD52da1189da79d3ced45c5a08eeac8526c
SHA1675327504b990398cd68a80298349dae18e524f6
SHA256fff7af1be8fe671e70db4ca74ae1188a4c48949dc592861396024df43d63e118
SHA51293de1345815fb2bc18e5fa66bb451194985c86edb6b54a2dfe8625010dfb64bcc77aa866f67bfa28fcd56ec1c77583f28b8055fb6a3f8ae64ac07c2bf727cf79
-
Filesize
5.2MB
MD52173b980e1f897140f5c2ca5f30f2ef1
SHA15d852a05d6fcd99ba24f4e2977743bab0e8e2c7e
SHA256835b37c73b330bcbf645fb86c1510cd851e02814c99d7d3fbe1a2a47b98ba292
SHA5129bf693759602f8587b0bc71d537c6b79a71494a5cdf6ed8ac9f679afd8078dceba289f5be94a8032ad6a4644ecb188ef82406dc1624751f197c2e8fcb7a8e15a
-
Filesize
5.2MB
MD53e44dc549404935699e5ae5af252ed0c
SHA11f044fcdcd2b3e85d6a017511f0d41a181325634
SHA256565c5070e4ee8f948f788685a098d3d6ab1dc5f6fce0bbb54d093a0256b68f9d
SHA51263e1a51916f862a1d31a8199f87ba3c7656bc770133c6eaa757858f35944c59d777f07f64f89dbfb23c6637be169fb8944441aa13eba88da0478f888cc287412
-
Filesize
5.2MB
MD5a06ad57d3fc24e6728966be8d9019c8d
SHA1e2cde775c5e2d3f457cd2e6860b5ee8e254351b7
SHA256f4585951df5a3f26195ab14092a6324c94b7403dd0bea0d9716dead416243547
SHA51278dcf9d38da9a1bda60954ff342d09a8aff9c7e4ee075c280a6ed4ba17e3d028e89ed00ce02e3e8d23452f44f3288f60de42ac6eaa7899f0378fe2c33d09386c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB