Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 17:02
General
-
Target
2024-12-22_75fa5a01bf418131b9556863a4a2b76b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
75fa5a01bf418131b9556863a4a2b76b
-
SHA1
154ee21fa870cfed33d5e7476a43d574198ec209
-
SHA256
72ddfe11e4ece70e5c253f8371f6eb6940c4257f712989b58de8a18dfd8427f0
-
SHA512
fc5dead7b214913912d57a196e9d7ea74c27be0ccc5d4b9cee3a5e03b5f6e66171388aee419f41d88f4bc67b7f7d85d2986810c2c1641951027af2dc7a6be743
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibd56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_75fa5a01bf418131b9556863a4a2b76b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_75fa5a01bf418131b9556863a4a2b76b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rBEXkqF.exeC:\Windows\System\rBEXkqF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IAqWBci.exeC:\Windows\System\IAqWBci.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aMBBBXA.exeC:\Windows\System\aMBBBXA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AtNusoR.exeC:\Windows\System\AtNusoR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fOFBGBD.exeC:\Windows\System\fOFBGBD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WCaGjIl.exeC:\Windows\System\WCaGjIl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xpMUCBg.exeC:\Windows\System\xpMUCBg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YFYJWzg.exeC:\Windows\System\YFYJWzg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZkXeJZJ.exeC:\Windows\System\ZkXeJZJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zInNoBH.exeC:\Windows\System\zInNoBH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NxJidTE.exeC:\Windows\System\NxJidTE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\obhRwEG.exeC:\Windows\System\obhRwEG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xwZCdnv.exeC:\Windows\System\xwZCdnv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hJBlXMh.exeC:\Windows\System\hJBlXMh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GaBVnIt.exeC:\Windows\System\GaBVnIt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IWvPFBO.exeC:\Windows\System\IWvPFBO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tVNWscU.exeC:\Windows\System\tVNWscU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PbDUEjS.exeC:\Windows\System\PbDUEjS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zkWyHMq.exeC:\Windows\System\zkWyHMq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hiUJYBI.exeC:\Windows\System\hiUJYBI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\miOorhP.exeC:\Windows\System\miOorhP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD534cd3a09063ba7861a65a610f7b2485d
SHA153feef4854741069e986b56cd2aaebd502e6ad89
SHA2569fd9b6348eed90a0a985c7e7448c2f5cc7bcf06a3371a5ea9a8982ecbc258d52
SHA512ee972901a1bed553bfb46db1e8169e58786563ec10884414ff44ec4a6f6138ea38a96384d30e780e141a9a876530f92c7b1e649d64a97aa3f441d53a89c8ee43
-
Filesize
5.2MB
MD5d7f824edfaa1ec86119361e768aa9915
SHA13e2c6ac940a8fb1214802ac68da989ceedc271c1
SHA256d4f66135f15a57c1820a91d32d70d0cb53663e01843b4a689c101b12be6c3fad
SHA512531d73bfa6bc8367744a72e636ad7561d8bdc495d484dc9223ea6a18f5b4764ae66e5f9591a78ad9c174320a4527572fa12c6c505a3a2f02d4cf751a7021a474
-
Filesize
5.2MB
MD545b02da309400717dd67fb4d02af6fc7
SHA1b97d95208b5bf2f43f1a6c1f53e4bd3c0e5d2eb0
SHA2569e40548d31cba2ec1bfee28002003146255d1b9e1791ad9bb6af4b86283d5f8d
SHA512a29c5ec30eeafb55223385cbe2643df104b8b7b69c5596fdd9769c3dd69a227c8fb4dcfaeaa1f20f6acb213d03c16edce84ce6cb420ce18be24b584a46a6dec8
-
Filesize
5.2MB
MD5844fd09a9ecddd7f037b1dc107464539
SHA16851c28069c75b716feb630fda02204d33707b1c
SHA256d5a7155489c58d1eed6b264f6cb76ef45f727d240f236852af0543470c50c560
SHA512f2a628edf8a10a5ff08cd3e4eee50eac08ff995a0b08d373511e1aed1adfbf357b7979ec0df6456b76c888af9d21edf66e19201757d28b0328f53c7e20ff7bea
-
Filesize
5.2MB
MD525f3c9d7cbe2d470d67fe8e9d7385bef
SHA1393ed2b8e81ec6bbbf7f80d6871e0e7e8d5c9db0
SHA256c4590e7056bf4a6cc5fabcd1226aef5df1ede9a7dcd6c6e970438a9db51313b8
SHA5128e9bfeda7d5b37f8f54bf7612e8b78b3fb97a5c130fe4147d06413abb34a354641e7b473ecd5de0dd378294eb8b77c2fd4fef523de27beea1907b90a6391bd50
-
Filesize
5.2MB
MD517b7b287fd075432795af1be0e96065b
SHA1adbdc486021e44596286435d0a661a8c702fe1c2
SHA256dbbb48e6e9fe21d5f43a959bea036dd2509babea5fd285af7c11147d42627872
SHA51210dd9c8651ab91f361a9aff236cc9c27e7345676d251dc2a2180f049ef016f4b07554a29e36986ccae3e56d00505936f3c6399d16223594895aa9690d1fa7055
-
Filesize
5.2MB
MD5427dd6f1df76114ec71b3463c4596e99
SHA13ed5288c5e7d185d1edaeba04e44c582f3fab772
SHA256bd17f98d818929e0f49476da836f88ba4c549fa533fcfb915f401f50f67bccbf
SHA512812debc45eaf870fe926834d8ff0635b6bd61a10feaa540646e6d7e6df6be350de514bd177ad31c54432ff9d57ec308287c74dc0b9208470c63a2d8de9a2a747
-
Filesize
5.2MB
MD5868deaecfc44c37e3851ba7baeddfd16
SHA19e3cae7d79cf8d0bd8e07be70396ba9f001e5a85
SHA256aff1f5a51207f525b64db404bf275ade18bf3e1d43ba76b40f6a564089df226f
SHA5122788c244c88005e8ffd1e31ab8f8931ffec3f71590ed323db258cdbb5356d354fd10f3b6d7d72992f332cc348b7882d2c9bbf47872b2223b24f206b48f6c97f5
-
Filesize
5.2MB
MD5e7bb35c1995ceca8356b8a6c2ee1a91f
SHA1bf269196a250b85ba99625eefe79274e1d3def05
SHA2560f1f0d1075d8c713a84ce383c05c9a1df4e7b56cb6a8efc0d7d872da8a2af99d
SHA512c5fb064cbd523521de6baed7eeae633877a105d6e22e786226d747a59e6921dcfcda711bb95e021c486c1fd9f99fa9946ebcc5e267f3c5e9eeb167ee22db49b7
-
Filesize
5.2MB
MD5f51fd8edd81613feab99bc2a7d10f3eb
SHA1cab9d25e244b0c9b4453f6283d76db99af89cf35
SHA256d80fdac565a63d6e2ce998a3381bfbce57afbc5dca57f7e678ec7ba6021ac333
SHA512ddba8f6cd5fe1fd9948f5266bbf917d4ea4cb21cd8f0f51196a140ef8830afeb10a08d44066405a000321def8c0485f1dc30b8211d87908a7db9a672a1bfdb60
-
Filesize
5.2MB
MD5ef14b3546c6ee2040852145f3ec2d15d
SHA18e0be14307be7f4eb480a8e5ad18d760781d409e
SHA2569a75319acabdb634c459d845137e0adbdc1d8f410f2349652202ed70709ae6c8
SHA512fe022982038f81fafc043e14286a7ab39de74533dd12aba3b0b1562c070e3c380bf70363e11e784983a8931e92351f1c9e769646667266d3ccb2bfb153ce684c
-
Filesize
5.2MB
MD539a8a1c59bdf709ac19e33ad60564c8b
SHA1448618ccd3496f5fb5edff34ad14fc420ee066d9
SHA256fb2ab9ec341c83d5d5211641d2fbcd6be7f7ada3136eb57bc4e018464d819f9e
SHA512799f23fb32ce8f7d1ded60608b7e6c145bd746e3205df8b3cc278b686a21b90163a3e6f1e89f1fd3bb1d5582f73f7474bb2676c687727738b2d7f496172b1d83
-
Filesize
5.2MB
MD5508d5131d785c047ae69a2977acde51e
SHA1799ef88b49d99decc51005921cff55df2ebe0acb
SHA2568b15c9bc603cafec337c3de9f486f823e223d1c5feb010bc8a82c948a49e5746
SHA512fab35e4025eb174f949462c65b95d80472ef0e9bb2d1d13ce83e55ba4f16b05546f5ccca19dada5efa0894b4f89caa8ae741a70f4161ce17ca65e49fc2e10a25
-
Filesize
5.2MB
MD5fea1ddb72647bc1b7b7e987faf139ffd
SHA14c7aaed751201f50eafdcf91316d746a6dc72ec1
SHA25687d381b87dac1dd98dc1eeb4f1478fa90bf91e2bcd78fea7c6b941dfe6ee80a8
SHA512d193e288e25376994171ee4f9b903911d6bc2941f26a21ffcd600611b505d77f83289cbafe0a9044a48864455d93d5b9ecd0f72d1eeb970b26bda92b1926f5f4
-
Filesize
5.2MB
MD5f00da7a33806603dc37d1432c9b3ce24
SHA1d10c53daf87666fe499e84cadb78842320d85a1f
SHA25663b5696c8a8bfd95bd5aea656ffc62910ae15ec44343580c50eae6287b4216ff
SHA512cedd17448eb902bc477adbb74c3f9c56bb676543ab909487d5af37073101dd99f102a50ef9c183325d7bd568f5469c39dc83c0cbe7d777e8646109c4706ff26d
-
Filesize
5.2MB
MD50ea2791d3a77aea84bc682b6d6c441ff
SHA1a42495fe706bf0aba213b34a5551172fc9d16422
SHA256f31acff3a76ebf57495c5b17a2da12735f155741b67ac3d91d019a3d7b9adc7b
SHA512bf0dda9b1c14208929fc2ecbd02e9602a12660c3c9550ff505ff7cc4b3c5f96e13166785bd86d55c93e3b9e76f5e99b877f5427bba690ac53578fb5261a80db8
-
Filesize
5.2MB
MD5a26978421851b78f793f8dad8c412dab
SHA18da62be6c9b96393dc45a6213686a469e115a044
SHA256588c1b119b5d0085cde9aa3217b06e9add8a6678d310feddc7f7d5d125a81022
SHA512ab0ff7e2caa25469ef2ecf7ba488f66ff9479ddf2c90e6b9ee62f7247109b6ed33097cb700f51beb0c8e38247fe36ef3a4c9d961a7cb69ff300094244133fd46
-
Filesize
5.2MB
MD5b17cb62a386c703ff8b02f35d6d3a3fa
SHA1be68bc34a167127afef338a9f06724d6b966ab83
SHA256d7b86d2599fe34d4044eb5c1d0964fd4a89abd33b0e16f5a5574148dca6859d9
SHA5123cf850f9b514f65fa1ac174f6d43a19fbac631373b8761f8c1f749cf68fab10d7c43e59891d48ac977ab220092d96be1bcb91f7944e2941b46b47108b4aaff1a
-
Filesize
5.2MB
MD5cfeb77e7727d70bc185801e15b1cef2b
SHA15beb232ef6cdae31418c80d7ff48ef6a695de751
SHA2564b881bb94de6aac70d34e150af3f8b34f85ebb00548a8dbe427167523f1f5ad3
SHA512d4c9b6d76faf9c01b22b85e134ffc1359c3479789cfb99457d590994072b042298b3d4313b2b4c44e01f12a4943a4155c1ef67c8f8145ee3c7884a8e9c884649
-
Filesize
5.2MB
MD59dcc0e49cfcbbd105c3e300eec408904
SHA12b62931d61535b355097ba520278c9e82a699ddc
SHA2562a756b2747729833ad586cd2802da4e971acc16655b05c0e62b8b4b163385a77
SHA51279aaaaafe49970550f087778f6a66703000cc8b9e0a022f2b937c24573eb6470efac21805c75ca345cb34ec5c65b44d48ded7865e1e84c67ba67efd5b303bbaf
-
Filesize
5.2MB
MD5dd31ce7646608d36ee38cf7b2b2fd6b9
SHA1ac3a3871ef424f67ba90bcc86a9b2ec9ce4b4a5a
SHA256351d070691e0f49030cf229889d8b668e5d28ba5c9e28701fe9b701e5101cf76
SHA5120f677b94dde29d5146333031be55c622caeb1ae43bbf610b0e00d91ee6110e5a17880ebdfd2c0356a703ee7021bdb6f67bb1edb2a083c234ba3b71adc2f416c5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB