Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
25-12-2024 19:33
General
-
Target
2024-12-25_cbabcb9fc163fa7237541ff6a79447bf_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
cbabcb9fc163fa7237541ff6a79447bf
-
SHA1
ace295b60b97d11f5c21905f70fc9b5c750c0cb7
-
SHA256
6d24c5df43ceb63754fd88affb36509db7e51256c2fa0f9bfc3179efa93d76bd
-
SHA512
07d858799eecd0cf773cd22a48c882d34ea7c9c49ca4f345943bc5dce87f3a98b8f3899c061e49232d9c502862e727a35fd882de2f946861a6adff3e50edb54b
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBib+56utgpPFotBER/mQ32lUp
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25_cbabcb9fc163fa7237541ff6a79447bf_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25_cbabcb9fc163fa7237541ff6a79447bf_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\pBpKjdo.exeC:\Windows\System\pBpKjdo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZTdnPKt.exeC:\Windows\System\ZTdnPKt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yeOkgjj.exeC:\Windows\System\yeOkgjj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zcjKGgf.exeC:\Windows\System\zcjKGgf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QCXKAdw.exeC:\Windows\System\QCXKAdw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wjTfxdD.exeC:\Windows\System\wjTfxdD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ThJkTJH.exeC:\Windows\System\ThJkTJH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EacFCaY.exeC:\Windows\System\EacFCaY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RrhcDOX.exeC:\Windows\System\RrhcDOX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IRErsrX.exeC:\Windows\System\IRErsrX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\znVhltI.exeC:\Windows\System\znVhltI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tdEGVbm.exeC:\Windows\System\tdEGVbm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YNuLRrZ.exeC:\Windows\System\YNuLRrZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gGeEgKI.exeC:\Windows\System\gGeEgKI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FrHNraU.exeC:\Windows\System\FrHNraU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WsLjJRf.exeC:\Windows\System\WsLjJRf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xACXiBA.exeC:\Windows\System\xACXiBA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hNMtpjr.exeC:\Windows\System\hNMtpjr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LtdRJeC.exeC:\Windows\System\LtdRJeC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\shXqkUe.exeC:\Windows\System\shXqkUe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xgIZuqm.exeC:\Windows\System\xgIZuqm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a19c74ebb8b5520b32ffee27c2c08d3d
SHA14954797ef0b7bec5966648e3f5fc82fbf2937f35
SHA25691e80d5f95dfeff5548b898d161fd07cc5de44724248544afb59d62d7d9c8474
SHA512bb931d664e6ebe2b620f09c6fcdde9cbdb2023f1882c97a2a342b5fcca8e23eb36fd66796196a301bf703ab0a44738a934d6426a3438c06f698df48328b9618a
-
Filesize
5.2MB
MD51b010b0fbd673559adc3df83f981ede8
SHA1d10dcd2d007611f94f37bab7b57c550f9511a722
SHA256aedd624626a1347625b1a80fccdecef3085cf5c0dcd639fb6237d6a8016152a4
SHA5127016a62ad72fd4550231ff77a98131a6def3e3320439045cb8b4e7985c0447336f311e54d33147dc861ee8ef6ea4b7b1aa07da71e20a87d656c7d75a57ccc4a1
-
Filesize
5.2MB
MD5bddaf3cb3ecd59bca820eff601f8011f
SHA1b033cf5fb337f13c12508ac2b8b8a58088c5830d
SHA25664254a89b8fe11097441e73bd3176e35262e4b29d52290569dbddc6868c695a8
SHA5129c39230aedc303936c13788429ccf6a130dd4d2d231c248569f21652660dfee079def83e13d08e84ca22399d6068b1573c2e87236849dc86ed4202f86b463a1c
-
Filesize
5.2MB
MD5cf9402909b65809ba82df315fc4b00df
SHA14bb4ee05e4ec1e122aff68f19ba0fb74e1d57941
SHA25644bd9cb22beeb047e639c84ba757d97ec1a29fdef0e5d3a766065fd33ca315c3
SHA5124b6ecfd59e40fcb3034a048af420667b4f3900dd440a2443e9624ab41c4a08f7a6cd9706b4a51150e8b4747b1e67ad359606930cc40b65321dea01e1ea947e9a
-
Filesize
5.2MB
MD5e182b0d66ae3aea640d5da048fb64d44
SHA182bb9102d745dee18418cd5f06bd682be33162ad
SHA25687c2093891508add69b3b71bab76e333a265fd2a9179c4d37280afd4f915cd91
SHA512730114eaa5dbda51c1926ecc09e8a65c43d6f54e2ccd9daa36bcd464adb38807a6c78ceb66b3814d94d671f56d3e6145aa84f0a49030f1bd120ebf03fcd9ee9c
-
Filesize
5.2MB
MD505fc06b8a557a51ca8d44099dd5071ff
SHA1447cb3f55ef85c9d62a29d12e167276340a8fce1
SHA2565da88a5230e16ba00cc10ba170dfd80f8d5cb8837e8dfdeeb0ffe435af78f7e1
SHA5123bca19aca1e93a7aa66924caa35904687698ae142793554bab089377011e87b1b77f0e422d09d98b93d891e1e33d28c29149a07bb7ccafd4cdfdf22c2ad86b78
-
Filesize
5.2MB
MD58f7a83c0dd02578c6b719ec8357e064b
SHA18c1e7c85bd033698dffef3b7f035d817c185be93
SHA256fe1357c326c61209b055536b108c8ff3bf1a00aa74e6d249ee5ec658221a2335
SHA5128f81971dec646eef55b62106fd99fa477ae012d2cfa5817e1bcb58fc0c7c530608c56334e7f4ce3bcab841822b77f187fc0d2e1a1d9b8d984585283bff0bf2e0
-
Filesize
5.2MB
MD50531713ce646478a1c85e7b7d377aa1c
SHA186788c97de49a350f788b956c56545433ff8acee
SHA256d2c9c86599420555d2e28dadb2a8704f7083dd99320069682cfcedb6650442a4
SHA512096848fd4f0e1f2ea674b91a9f23c5674b7043979848c4d20ea61af6700d07e654c20e74be39b3222b84c6fade7ce52897e88a615c12658aa4cee7059d479d5b
-
Filesize
5.2MB
MD5da56693454d68b66461bbdb1a0a6b072
SHA177557d240e5e3b5097218f888d73aaa3ee683e0a
SHA25672a30de855c05ed10257eb7e7957774108b589b645dd0fac0740f654f2abe031
SHA512908469db9f16ae10ab2c8a6eb7ad2f3f0ab985309e5e692a958cd2df38c8f486bb91c56e35549a65a2f96340c837183539d279ba1451d536bcf043fde5a85af5
-
Filesize
5.2MB
MD546b42026e5b0758de85fc21b7dee7fff
SHA1c4d88111f80caaed00f0c0124393dc4fff0c1859
SHA25690b2c903e80b09531a0f3b31f41e0eb43eb916e6921de9940ef8a3f6d254daff
SHA512d7ee38d67768d154d7a21b8938b0e83f4c49f957f9d5da072e6f43a822830e7d69e087929c5b5776bc2cc5f59948ac909e4b7ec0acf78eb9405607ec9b39768f
-
Filesize
5.2MB
MD5aa6920e53e89ae0bfb201c9199e34060
SHA15d0215587be7d3183ad4dc738ec11ad889491650
SHA256888e3777b230f369a0d606a84d52232229e553e87987c2649828d37691abb367
SHA51218b87821a45a4bda7ebe508792c075c5e0802c7fda40e984c4b7494714dd35d5f17782ef97e1dcf2e7ac7c5934e4cbe796887149c3bd10a7749742ecf8d3e908
-
Filesize
5.2MB
MD5e349a15558551de289942dc85c8f8d29
SHA1a8576c21f1158cae4d407958d9663a96decd8387
SHA25648871e4d1b58329040f7e22daf0514ed611b6cec57fd5f645c084f9381fc1d4e
SHA5129be2dcdb5cfb5e9704a86e2bfda9899d34e1cb8e572a6afcbb8d0c4b4a47c962ba27b6b75f4125bf269d82b9fbdcbbf375683a60bed74c18667eb2cd78bb627f
-
Filesize
5.2MB
MD551e124896de9cbfdbb6d7fee2e93c1a5
SHA1bf667f352dcfaf3edd81efa3d8a322cd11b14dcd
SHA2563fb12744c78699bb31aa2eb1c6a65a41a89aeea244561860e740d342b2a02965
SHA512afb8931711199b3f6406db8904f38b77d50bd9d02f057a6b1e185ec51ee08da3f554da74bf2fda53968ea670e09aab520c7607122dc3edaaa0ba9d4c6545e656
-
Filesize
5.2MB
MD5378307009802eba2c6cf03a2cfb1c536
SHA184cc3ecbe9e4d8a20eef0530d64e93fd63723489
SHA256ede262d568c0de55db6a742e1e8e55a5296fb67ef83dcb988670918d034998f8
SHA51200af36ab4024bd66e1f31855402714b93adb53c66d5053652a572595013ff84e341f01dea29bb88450d0f43887e1932df75aac352989803ededd768875b5b9df
-
Filesize
5.2MB
MD5a1517d33027b116abd5b5b36f12220fd
SHA1611e15ea837d09de6637b4b5ede9d4d276c8b23e
SHA256ddef8896da5506551a048761c85e0bf6e9aa5ad64d6162493f498d15c7476d04
SHA512a25577887ba15bfa71c51549736c36ead17abbf7f030c4254ae86c3cad339ba2f069c0f81e7f5824fe0d1b7a8128e06d86674503ddddd01d1059e9799c794334
-
Filesize
5.2MB
MD56141614446ed8e5ead2c02d01d2118ab
SHA1a10ecb1d73e16ebc94f6bfd5268f636033a2e442
SHA256a0219278c6198aeeef1377f06ad7336794dd9a2c9e9133e24f01e4a0e7c612db
SHA51201c10b53d30cc1776c903980d015279dc56ee262366ba104164f06fdd6974b1a4985d97efd5b277bc037cb1e4d03f1dbc5da79167e97c0123fcc19b5bea44cba
-
Filesize
5.2MB
MD581748f1431a15dc2cd0895765636d194
SHA1c99c146688913f3e7def3f74e755404846c623bd
SHA256cca2856d255501e40733e49ec6d2eda4550c2d5bce9c5fe1a268e46218ed5345
SHA512317d5d02d7512433886d02697eb1b783e87dc9eca7c4e48f6d19ef9198998df783323b444e9c05c4b0132d9dde57f20889541e22b5ff5f7db3952aea1f904993
-
Filesize
5.2MB
MD57106faefcaea67447f017c88a40af444
SHA15b1f1779c5ff07a57bfa71cffa45dda9fba67b40
SHA2564d780c0f80bdcc1deb64407e4fbc9e91c37c0a7f93e36ffc4b29018adee6d168
SHA5121fbbb19ae8c5641155c6a2d80f5c3502ee6a96020725da2928f681a89529e8cbf88c57799f4464a99bcc056c41bd2badb6f77b590bf03ed6e2f6cd4a208f71c9
-
Filesize
5.2MB
MD5153c07b74b399983c9a77f1bbee78932
SHA193f22e85bbd057f95420ff62c37a16de92e1c5af
SHA25606b5e51432ff1e0f5881822481995b391b136ff0930d1f2dcd414be58bc0fe6b
SHA512f43185ebf0a142d8dee88c87a2594e45d1a2e8b880f78cb801315385eda4690882e1681db419484f0031ad2fb5dc2a6cdd7b6a830beda27d6a84194693de3135
-
Filesize
5.2MB
MD538d0f1421c6ad3130305cf6bc48b0ea4
SHA149a5f6298d3c1f917cb3fb30ef112919a1b6c836
SHA256f46319ba0c488d791b99719837a2a480f2e2418e698e48bc89ca32ebc578c494
SHA5128c6e20b4346108b5a795881d31277e802961465051bf7d3ed8641a70b3f9f3fa4ff1e330ade74cf0e1c1a1719f7284ff3e1c7f8fa0326af1ba4dbea12c058e6d
-
Filesize
5.2MB
MD5c58309af61f30eb561c7930c691e1cd4
SHA149b00db680eeca845cffa36a3643ad22dd9fc187
SHA256ecaadad7f139732805103f68d56ba14f03084457ee72418493b7658268e96175
SHA512a0a9c3b68332fd41da4f26a55f70a261b5bb2fff32ab16cbe3a792b93da0eabf5f25f0821546cc29a4bad446f6445c47c5babb4bad28bbdaff9b06235fff6ed8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB