Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 17:17
General
-
Target
2024-12-22_f74e863d74cd4f968e6332750c3550dd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f74e863d74cd4f968e6332750c3550dd
-
SHA1
1701cfc6a432bd2d37f7df94422e1582415afd4d
-
SHA256
45f20c2f71ff2915c864635a4a6837e05aed93a4edf120e73cd04d2a221666de
-
SHA512
fe99ae584b1573b702ae781b5ffb71f25edd4ca820d21e54b8750980548da140e3f302849d6808413b40ae36b040f1553d67341ede63853aad888e6a2d1451e8
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibd56utgpPFotBER/mQ32lU3
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_f74e863d74cd4f968e6332750c3550dd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_f74e863d74cd4f968e6332750c3550dd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PDmeOQa.exeC:\Windows\System\PDmeOQa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ltuMEoS.exeC:\Windows\System\ltuMEoS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WszocdP.exeC:\Windows\System\WszocdP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tZoPyRl.exeC:\Windows\System\tZoPyRl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NdboPJN.exeC:\Windows\System\NdboPJN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TTWcySU.exeC:\Windows\System\TTWcySU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OkkkfrB.exeC:\Windows\System\OkkkfrB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SVlfURQ.exeC:\Windows\System\SVlfURQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XRDIHFL.exeC:\Windows\System\XRDIHFL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\idTkFpy.exeC:\Windows\System\idTkFpy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CMAXeVq.exeC:\Windows\System\CMAXeVq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jVSpzYI.exeC:\Windows\System\jVSpzYI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AAxVybN.exeC:\Windows\System\AAxVybN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xJzvLeO.exeC:\Windows\System\xJzvLeO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zFYQvCn.exeC:\Windows\System\zFYQvCn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AxfFYpd.exeC:\Windows\System\AxfFYpd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GXBGdhp.exeC:\Windows\System\GXBGdhp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xEzOgcV.exeC:\Windows\System\xEzOgcV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vXXNWDG.exeC:\Windows\System\vXXNWDG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DPaSQBb.exeC:\Windows\System\DPaSQBb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lYUfTEC.exeC:\Windows\System\lYUfTEC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c1a24f28f0fceaaa4152bae1d5ec33a8
SHA184f509f603ab30ba500945144256e89296ca28e9
SHA2563fa948f43b0ef1e8eca278d01141e9ab0991ea54f8ab0eea42474a2ee85c7bc8
SHA512ac12a484a3db62865207fe6e979b5422c59dde9e12a464bb3f75d2cde70295c87229fa93d96db190fc3ae90bd60698f3d74c5fac328f23256dae74ce171d0cd9
-
Filesize
5.2MB
MD5a7989bffaeda32c916cd8e20cc7203d7
SHA1deb9dc1d1bb879697ce8183b5d9faf8ae598505a
SHA256780040bf521b56af1bb3b1c66030880aea54e6a399c4cc8aa7b878bfd4191d49
SHA512ea360cc97bfa40347a52b7ab99cc74de78c63c20282da6ca36b4935d386523b2ba692186dc084e3dc2474daa8ffaea9fb1514784c014697f4d3854a5bee42889
-
Filesize
5.2MB
MD5f280e1d17e8ed3697661247e7e959ad4
SHA1400b553de2e59c6e4b5733108c3539911a15de5c
SHA256cf5a085fb3c5cf54c175ecadd26867424280008d01aa9117c992f6402d48d5e1
SHA512c19b1b186e175f4df35e73f90c97accc787036fcb5188788327addce2d845319e9f173aff2c78247949eb72f993d28a8ea8cec531cbabac9f929862dfbb68da8
-
Filesize
5.2MB
MD56f807d23c1049ce235b37127ae28a9b8
SHA11f2081e29dfaf475bd8c5443dc14602a9a73c4e6
SHA25614a8fb8b8ab2075879f07da3c74709fde1b50af1ec1c88ce1bc7fb3c9a7fc8a7
SHA51233e6d0b19c6dc6cb02e2cd06bf4c22581efbb0560cb19c46583ccc7aa599e844caf2b9e2a1d541e33caac87a2101cdf2218df096c740ce50c7325b148812d932
-
Filesize
5.2MB
MD572412e804e0aa322387978d304655871
SHA1b75f354887e354aec409f27e0e17e35ac649cdc0
SHA256a1adfef3cbf62b8a28b9ed538fc9a867f3004137a9aabd56c350040c7a574203
SHA512130cf5c5ade31c8891d1daacc8f864d35130cbef4904327d2f4ab2937bebf65df5e318a0fdef663b0da17d1c6571da9f88f1decbd6a47b076cb755beaf1960f5
-
Filesize
5.2MB
MD5562abe542da73be5a0721df12e4bee4c
SHA150e815669f386314cebcc12679446e75409229fb
SHA256056f945940c1f7c8708381a5de70be5fcfec845061b09088f993ad0b6d3e60ef
SHA512712b147ef9ce908246caa0990fc970ffbdec9f752832015baafa71eb76e7885d868ccd3f153d63633f3f647a752fc2ecc897c2338537f55bacae1d79617665fd
-
Filesize
5.2MB
MD577ff39da86c3d38e6fb846c64aeefda3
SHA1f77e52669a5c50999f281de09519f28bbcfa19c4
SHA256fdb3e6747eb42b53a6694084ce11e825204c34981ccff666bd667cea88f64474
SHA512598a6ea26602c5113895597158866e6ecedb3305f340c20c1d011f1cfb7fc7ff8aa9587715ef358eda8c0875c29e21197e7e26c8f7fa478c23743d981ebad836
-
Filesize
5.2MB
MD50c7a6824026f936ac661296a6e48978c
SHA150a05ffd9d87f0e66a8527fbb7493febf1354854
SHA256656f847cc02b81eff5c63ba8f914545cbc96658993b38fa6906cbf85d7ffa310
SHA512cdb16101f41767a7b00bf5ebdd74de2e045f45b93bf8deb9f92e84e8e02a3ca8a2717fd96d89ad73ffe2437c86a4a167390b415482dfdd0d0b539b0a526beb69
-
Filesize
5.2MB
MD5423fc98a9bba1292da6be784403c0ba5
SHA1a14d41c71773227429f00718bd2c50240ef457c6
SHA2562403c2a33f9534ba65ad57341de1c7100c4e0af024234009cffe9efc0c7209e3
SHA512f4d44b3b811928de413915f7ef563eb2b0098a47403683c40addb9405df01c37615596296093f0d5b64a11c8ab5d660117137c62b4b96f17b6240ef618f7c11e
-
Filesize
5.2MB
MD568baf43c3e7aa2c7a002f439c2d92963
SHA13bb7e807685d3a10df50147b803a95df97763b1d
SHA256a534b99a066de164f14e2e7677749dccadf4eff887de3648af0af724d1d16549
SHA51249709691fc1dfe2afbfb361e14d11560774ba3c6daa1cb9588f61e13422701f9013e06af058c8f5fd005727ac317428fe556d685a5788827251ebf543d3b2361
-
Filesize
5.2MB
MD5edaf79ba44a1b635b8ec0ba10ee853af
SHA1dd16ed578237855927b67c763c0d61a7baa253f1
SHA256c8d13a9aecc607cc49ae904c7e983f10f13351452b1d76e0b6f170f7d2733ee8
SHA512e8ddc89b5756bfead676676c14e7f209d4450b69b3c1151fc6d2d80bd0940f59959c118df679634c8e1fb3628cab66f6fdc7df59db4cdc6d148a12732e50e6a9
-
Filesize
5.2MB
MD507d486a51424df79e1ab643eacd901e9
SHA12faaf15bae4add960509fa219065ed60b6fb30b9
SHA2564ff4c4f478308168fdc416574593c887fb81f3017500a5bafcd756a2eac56cf7
SHA512e7ee6494a6f5b597536fa5ab5dbbe050e1cfd31614ea3747986872c7f68ebebee32bbc544137d503aa99a88ff297b1532f3481a7de5f79bc5431c144b54885f3
-
Filesize
5.2MB
MD59434eda3357ed0bbf645b86ac9ea0cd9
SHA170b773208e17de9d80aadf31bdf2df7c406f48b0
SHA25622e859ef79ce88b96a6fb1e3521093bf7d495a44a84b63cf5a8c295bc11351bb
SHA512f19534edcab3ac463bb8c49d8435543aeb135c7179f92e95d794775e8e5a0e532c2b00397a994554e62edc56d25ccd4a7d9fef29aeb50ced4281bb22715c1d8b
-
Filesize
5.2MB
MD5f22568de980ef50dcb5ad06cc7744b02
SHA12da41816f4a17ea8388c5c15769525a009c673f6
SHA256eab6010eee9b133b3125929560aa669fd4fc11ccb77a5cd782f3ae52c3dc7033
SHA5127e30d4546a430a796c85efa9c2fb44e67fa41bd0cef248a43df4326b22a054c5b568877f35663929bd247a001e78eddff53f97b3e6020b263527534ccf86e061
-
Filesize
5.2MB
MD598ca92f938d893eb220518f74db982f2
SHA12ec724bcb5dd65725807250e15cf43283dbdfd56
SHA2568292610d564773b8f5d50fbc725ac4eda6f04692317fe561d151dfd9af1acba8
SHA512fdf3e3480fcf70c81eb6caa96ade426ace3763eec480bd3916d30d6671928bd38437d858cd83b955a865545261621920f2e45c6c68b09d823c66ce8fae35bbaf
-
Filesize
5.2MB
MD5e19a7fc0b0233282ff6a1a829edd9471
SHA18b12b17202cefefcac57c83f59c1ae90e6265100
SHA25622a563d4cc3c1aaae4d726fc1bacc6f8cebc1e2a5558fd7f09a9690e8fea0773
SHA51203464676af6b219462c1fac96194eba9156a2571223fbd0355ecf1d39cf326e879b590e523c00f1603900143ac7a44e2aecdce74c3075cac9408680043c50f6d
-
Filesize
5.2MB
MD5e402521ed81acb613479b1c552c1ef9f
SHA1e07b4d6f54980595537ad89493752d5ce29d09ef
SHA256debb2370e65c9cd5244de8ec818897c8ea3b88fbd7b11fb1164831cda16e29da
SHA5125ba5a6c178c7095529e68cc304c9d73e0be2d4fb2528cf23afb04ca49f6760ed73a3810f3c2b4922f0df5255b1bf308e74c1733726b626f364ca8a7d71a5ee6f
-
Filesize
5.2MB
MD555ee9a111c45f8a7c7e3e0f721812572
SHA13507a30661e48bc0bec43c832edd02150922ff80
SHA25660e808c6adc76f1c61c2b59f3cfe7b993968b38535db935aa3ea4af1b445afd1
SHA512b89b9894423fd760234de846f4202f589f2efd13227e7751fa44c6a9d02644b5bd63071504739e0e2456315bb3d0d271009a4c2265c7d39b844322afa0f392f6
-
Filesize
5.2MB
MD58be91b6774d0427027b5149d0e51fe4e
SHA180c680e0837cae3f2ebd148259186afe9f6f7221
SHA256e9e42a32980952b88cacf8a6f87edbbf488fd8e2c7a5efa22a7e3de072be2960
SHA5120bf293f7692e9a677df7a2c1b2d297255669c681180a018f87019953edb7e3a0cb6ef7ecd1486a685f8ecc6f1aae31a00b455e3ef0fb2077e90dd845cd1262eb
-
Filesize
5.2MB
MD51c382cbbde0239cf7af8aa29705fb381
SHA18364b50dde4052379915f1b370969a177c60d959
SHA25653756d0cc8bbf4fc8c024e1d09d875aa930519f0a83b2ee20444cc6d2cf79ec7
SHA512fe71a3e88f492e8af2132252347d27f591e90deeb5e049500217e7d02af89dfddbd56615657acf46c3189706aa87b9fbcdebf2322db000bd843f80dfc1468879
-
Filesize
5.2MB
MD531c6a2272d91e94282740b1bb3b1e464
SHA1886a902f42143b782c9afdf94386a082887f8db9
SHA256118b375da14cb1d59c63ec74760ed6c0df1a335636c6b70c5851e6b61d17a359
SHA5122bd372f619f966224f6a7cfb0679d57069e918a2be21fdc26e89ba881b7ab497f960c20c0483a114b4ed0808b489b87694a8ac7d2e95eaa5d89587d2a05e332c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB