Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/12/2024, 16:58
General
-
Target
2024-12-22_463ef1711d91099378a9c029ce5537e8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
463ef1711d91099378a9c029ce5537e8
-
SHA1
d41a392935c4fbc9c2a02d7329cb23e1c044e738
-
SHA256
f2deccebf844499cea837e8006950a480af60e5b2cfb98eedfb5178759cee737
-
SHA512
b96f7cb716dae61eb448d178382f2c1d5d76c30430b87e8a2dc28fc8e45feaeac18944c6c46966f11dae714e6826d6a0969424b8814cd11cbf4adef45866e1cb
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibd56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_463ef1711d91099378a9c029ce5537e8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_463ef1711d91099378a9c029ce5537e8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BESClmO.exeC:\Windows\System\BESClmO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KTvyupQ.exeC:\Windows\System\KTvyupQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zUixXmP.exeC:\Windows\System\zUixXmP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QUJtGOF.exeC:\Windows\System\QUJtGOF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DNfZdMT.exeC:\Windows\System\DNfZdMT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HViuZbm.exeC:\Windows\System\HViuZbm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BkzFsTf.exeC:\Windows\System\BkzFsTf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MYFQQUW.exeC:\Windows\System\MYFQQUW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pKjLwmt.exeC:\Windows\System\pKjLwmt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nDTTjcP.exeC:\Windows\System\nDTTjcP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hqxcQXL.exeC:\Windows\System\hqxcQXL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tkkmZop.exeC:\Windows\System\tkkmZop.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wSpSzuQ.exeC:\Windows\System\wSpSzuQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HjrGBIu.exeC:\Windows\System\HjrGBIu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ngqoqvi.exeC:\Windows\System\ngqoqvi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uOOzbTY.exeC:\Windows\System\uOOzbTY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rxdZVgN.exeC:\Windows\System\rxdZVgN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tFgpdTy.exeC:\Windows\System\tFgpdTy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dkMkLdP.exeC:\Windows\System\dkMkLdP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vARBIth.exeC:\Windows\System\vARBIth.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZKAZBHe.exeC:\Windows\System\ZKAZBHe.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58317bb4e2f69941172334038e3e421da
SHA19e16b528dbe8e14743f52ddf85bfecfde120706a
SHA256e123d9cc636f58869b92795d1cc4f34c43ddc3e0e9a7a46db183a0917663353b
SHA51251f4e38ee72cd529aec8484486dde7fae342b282cf0945f7bc4bec4406af7221bef51f9101ccf9b987c79fb19a60a096005ffe752b9ab4871b86fc2ed76e64b4
-
Filesize
5.2MB
MD522257c6e0af7318197780a72a8d0f998
SHA11d4cc35c10da568e8c3cf8972755d845e292415d
SHA2564073d16a0368f8b63339e15af9cdaf1d0c7dbe00eb6066bb8fb639db04b55611
SHA51203014a39e920610b4ef3821d6b7730ee191c89736ad44d507b3cd5d095fa9b84882ea9c77f504d7a7c6960882b3709143b4bb37fb43c660827f586156349727d
-
Filesize
5.2MB
MD51a5d0b2e77f2bf3c839c7cee5576c4e0
SHA178f8e88f9b2611a47ee0c32cf98cdb2387d37f24
SHA2562a115e77bfe4b842ca798042baa88c2c1ebb64e8b1b9e29b6c5b089456164962
SHA5120b2744206139fcb060c2329b9d1a3eb08d0982ecc40b9b179e60494685c5e37b0b43a2bda56f2dfd85df2590bda502366d37132de40727a7bcdb1ae025d54b20
-
Filesize
5.2MB
MD5fa0506dd28d7ef2b01567c97083cced6
SHA1a24b7d35812280258dbd08e1d75dca06a74c2ce3
SHA256f846ae3fe739cf4ac8e6cacde8abe8467884ec49bc808c3565fecadac52e7e5d
SHA51266be38f519860bdd913bd8da31929e32cb0b2b3ea8724eff0026680334195c518c11de7c778a4c9044a907bc0686888947db367631c38868f8f3868f543c8b5e
-
Filesize
5.2MB
MD5802ed78929d78d7bad1eeeedaeb11e72
SHA185c912b9e562cccacf40d0dcb20312674ec46559
SHA2565c2d46c2b44d77c29aea776ebdd07bb68ab43a2dcacc3fcb3cd865e02185fcca
SHA512abf49e9337a070d41807ec327e6c96f6cf81b329f3dba5ad177be4c3c7064e8aaba73ffb3a84bc2880dc8b9862c1049e70e28b96fb638ff81f582b655370b5cc
-
Filesize
5.2MB
MD5315e8adb11057d80ae00d04079a4d169
SHA1313702c102a5c9e07c2a3cb453f9dc54836a4440
SHA2564c6211e0a57b72d379d75ed0f8dbb23b2f2b04fc2cb6f61be590bead9c4a6e9a
SHA51248be6639748fde67a4e82d82f7d82a3442755f475780b4247486e319659e27ac872fa4c97bea6ddf4daba34ce21090c45a2fba4d3b4718857f811834e45cb10b
-
Filesize
5.2MB
MD58a90ab91f9e7e1ebef33aadf02baf3e3
SHA1e2047ad192b65458b321824fad8b8e303faf9732
SHA25699d16a5651a0fd2157ed54a81fac00864f3d31d8e3117fa7679cc5a990cc850e
SHA51219f7f1d13613fb1a44e98dd07756f0903fa945bcdd96aa1006375154a0919c441f7c9aebc02fc35596a9abc6408e592190d51c558cee5a3802527549d232238c
-
Filesize
5.2MB
MD5be9cb97e8414133ee25fe45e64031980
SHA1c5cb1cc2a53ace102aa5f83da04aa577403d0318
SHA256cdd64cd239559a74cfc5c85b1b88851e2de7e8aa3f75e6b131374f5eb5b8dab2
SHA512c6ef9ac30c891e05559b2893676d04b72872e3cd2c21104add0b0eec287639ada1f311ac060555e5ac46e082cd178a7c005b25bf7db2a611044bbd91c28f3159
-
Filesize
5.2MB
MD535c3903feb1ce763e8147f79f046e5a2
SHA1f384f790aa2c40179796cc6e170b686bd6ef7e6f
SHA2562ec68217916df400dc39d6086fc4c10ebf32996b0b10e64214ef18e784053e69
SHA5120308df853228eb2b8c9f39f70a6f84cec8bac2b4d555ef661bab7ad2bcebe55d99b8769d2b8466cebdc9fa7572051b381c1526d26d4ea5edaef43ca9afe7da9c
-
Filesize
5.2MB
MD5aa7250d0e5da8f4c357a5b34c69b61df
SHA1f93a4819b9c8e5f686da8a07064044c616e3f44f
SHA25655145a7ad9e313da0ff324396869437cafeebe626b556c97e33cbb2eed5fc3d4
SHA5129039603ab22882efd929b100e9152f827a795b84aabdbe9965a2e025f640181c0757edeccd04b2875bf4e77b30ca52d92b18b556af6518d53fd4dc1b59734ec4
-
Filesize
5.2MB
MD58e25b30ea9cf5b429d674170065b38b6
SHA1a92a23fbea8669bfeffd56ff70f8310d3caeadf4
SHA2564e448dad27e3ef291057f04592f554f9ac55c89cadb4d2e79b7334e1700c123a
SHA5121c730642b0d10c875a8b142a947d64965d972126ba094bd79483da8c314d2767b8fe1009a8bbcd0940f60d065c25a0da85649cfe1bb133e3353a2974e5441581
-
Filesize
5.2MB
MD54b699a8c86b651db7a48d1c3263bb6cf
SHA10dac843d03feca04f1f4d12d1a26745064508809
SHA256c06d858a2547ce8bfeacebe686e2558190f726750babaa0bacfd07520f94e86b
SHA5127f1cffdad799f8e95b284dc45588dea63ee1c261e670f2d3c239b27cc2203d7a4ea2d9349206018d9e0469a1d76016b4e27f1b9b9a732ac036232ec20f96feb4
-
Filesize
5.2MB
MD5bf21453417e9fcb1ef464db1ee25da95
SHA1ec8c6237f2c772d413acf716fdd806368d26ddaa
SHA2562b704ab2bdb47b50ca747b12b767a5a3236b730c2156fd4030960f7dca6e015f
SHA512cdee3583980a3b564f2f76c57bb50ab545c0304c828d7d087c9c136d05d0a2a01a782a6d3354d9c9a56753b49ec8a609f2b9038fdfe502556ecf05878ee1c6a4
-
Filesize
5.2MB
MD5682bf8ccb775924f68799053e19051a4
SHA1b0b53298b72e3ee662b4c3734b180319b8ae5240
SHA256b74982f8f6abea0b2d72a4710cbafe0bf16d03d6492276a827aa6af921067a22
SHA512651db9587da25725965782dc95dd2343b2af98dfe3aa05d531ad04bd7d72954d5c5502b6be83b0cbe0ca516c05d579d91aac2657e1a1dbb2e4017ef30c228366
-
Filesize
5.2MB
MD58c5381d57e5ad3680d2c895dd29de25b
SHA1e8525c9c4a670f41618646be17e675e6566ff774
SHA2563e0496a3393e661daa155b58da7e39853e0506c1417a02941771d4ae669921ab
SHA512342882cd1f1b971776a31e1f838c177535387b8f30bb360b8d32896cddd84685b56f553b08e66a39efdad6cf617971622872e079262f4e31cf7d91ef27bd514f
-
Filesize
5.2MB
MD597039f5c710f326458e0ea455c6b5c3b
SHA1b3ab80e63e9b07a5c4d5b1ab2cb401cf0b8b252c
SHA25679dfeedc6c58fd1e20f997c610b870168cafe76c4040b4334c16f7c08c60ec9a
SHA5127cd5042e36397c092aabdbcb01dd56ea1c8d4536fd8274a262555b8bf3aa1af71f9a5c0fc2f80d9d0fc3f9607c916b1869f4c1e49d7640e0baae8792e49d1c79
-
Filesize
5.2MB
MD514276f86639c50ab1e0da20eaca2a64a
SHA12127a243a1ae8d8cc5521ea5c3abe6f248efd759
SHA25693c56319d4fe6207cb5cab287338c0a7641fe10a678935c73fec6615f1b1d106
SHA512d75723ca646b3e2b30daa205c27ae0d245891495ec85683c7631ddf57182dfe324a61db1d43399830077f2e4f02382dd28c681d1abd04664cd3ee835bd372986
-
Filesize
5.2MB
MD5f2638535b4ea87877c4b1b35b184cd0e
SHA1c1c3ba73b66506b025bd6c6fa125cca8f3e39ff7
SHA256fcc924ad8f7632b2a5fcbd7de0df0eb9a3256d76913ca6c9b9a277e969557b86
SHA51247d133a212f51f687dc423e6cb2c1719c9dfb9912522ebaca24a3465f015f4be0d970a0d7486e1b2753f61ce75fad750c88fe780669bd54672b9e28fc94c30fd
-
Filesize
5.2MB
MD5db5512a0f3f44f2404633ec2099fcf29
SHA1025e46a84c848e84675fa8f9d3e031b510008ddb
SHA256054aa7061b0b647672f6447e3e61190ebe4ea144e5b54caeafc7eed185d579d9
SHA5123a36561e4ce9cb5435e4ccf5cedf731554bfc74c9018904796b9abb40e28363ca5ade129cb1dfd7f7f3cf05704758c49ea9b46a7d635268edbb620b3b93d5bff
-
Filesize
5.2MB
MD55eacc973f22b2105fc9a09ed88700d73
SHA10f831a93dd7eb99e2e5e9542487cf55813638610
SHA25647d634ed7ef7a35f775e175ce11d6f7109a56c1a7214d8cd79ab9dd3429c34de
SHA512f59154f0726280962bb8b6cd9d70cdeccb06cbe8886c1887025e9c033ca2d46828652e2491ea983ecc65104743d0886e7bec8c1171fa5a422d7aa756c4cee0f1
-
Filesize
5.2MB
MD50f88ed32d593a42144ed70f4755d06ee
SHA15873ec890cc9e7e84f0367af20535a4859f43882
SHA25669a3cbaa8aa137bcfee0ffe11f20b0fb96f1251f109c5d85017d00b8a579f3cb
SHA512f9c2e0db341bdbd1243fa3449267b5a240c181a738610673af964ce00eb883878c3fe017a10e0e6e85e7fdd6e5c6cc5a096e15bc66b4822371704426cf595d9b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB