Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
27-12-2024 03:22
General
-
Target
2024-12-27_03ed39a625ac91c57841f1e4d78ec48e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
03ed39a625ac91c57841f1e4d78ec48e
-
SHA1
03e9b84fc5ff3472feeee2173a985e25bcadd3df
-
SHA256
72174a0c607a7c98a628b1ee1ffd0365e3966ade8a012a918168be180ba6d20e
-
SHA512
f0b86dbf9b5fe34ab3cf7aef4d80eda37c49a5e13010118e9c8349e6b45dfc567fd0f4c85ded28244bf3d3ebb4b6ed0e1e8e03f913dc7960c09f03d561538522
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibj56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_03ed39a625ac91c57841f1e4d78ec48e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_03ed39a625ac91c57841f1e4d78ec48e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PgPVHaD.exeC:\Windows\System\PgPVHaD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nUywSRO.exeC:\Windows\System\nUywSRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oigzBff.exeC:\Windows\System\oigzBff.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zgCzxLL.exeC:\Windows\System\zgCzxLL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DqzBlAv.exeC:\Windows\System\DqzBlAv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KXfFXiZ.exeC:\Windows\System\KXfFXiZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FxRvOly.exeC:\Windows\System\FxRvOly.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yPskTaV.exeC:\Windows\System\yPskTaV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yvpNClx.exeC:\Windows\System\yvpNClx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OIaVddH.exeC:\Windows\System\OIaVddH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bVgVAux.exeC:\Windows\System\bVgVAux.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wHSEfnd.exeC:\Windows\System\wHSEfnd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IGxRJGB.exeC:\Windows\System\IGxRJGB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\urHXZaa.exeC:\Windows\System\urHXZaa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HxIpslS.exeC:\Windows\System\HxIpslS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mqxWslo.exeC:\Windows\System\mqxWslo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yvKBopD.exeC:\Windows\System\yvKBopD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iJHrsFH.exeC:\Windows\System\iJHrsFH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lwpYLsJ.exeC:\Windows\System\lwpYLsJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RfGZQeU.exeC:\Windows\System\RfGZQeU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dnqGqdQ.exeC:\Windows\System\dnqGqdQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53a5fcaab5cf7b4508b11186b3b41a791
SHA124814d01c0e8bd01d6c65a2e7dcfc4e82c7f027a
SHA25680b729516558fd9bed549add4f45646dc3b86e13ca06089a42266c46acd5e6e9
SHA5123d37d2ea2f8bfd0918fa694a89d2b86c01bc5505684578bd9f0f4b78fd6b366be7a21f45277eef5933beb8fef2732cdc1ab2d67686e30f785b33e59b6b44dc6e
-
Filesize
5.2MB
MD5bca6a33cf8c4077d1919ca32ad6bb478
SHA1506dd1898b9b7faeb3bc788f02f8177d30597ee8
SHA2566168cd0bda9545d2a845d67ed0b66cbf9b533416cf04474dd84ef44221d05c09
SHA512fa7d75231ee9abbd6de2ac31dc092dbe42ae13e6511235ee7a026d681fee91b912b892542289f5adf6f02ee2cfda15dc1ee23ed579abc07b744e74cc33aa0e85
-
Filesize
5.2MB
MD5c80e7cc968d4151c7c2e5ee536122cce
SHA1aad904d23aa37a9e76cd562a77a39e992dc2dab7
SHA256a310ac3529502f323ca5caab86d0e3cb82f1a7878d23480ad96c973698078c77
SHA512a64d4c2f0bb011494e0b56e85313502163af335e0465080a9b1112319035cfaab23b9970c165716cb3e9388abd2f19712b776811d90fd4dee8f7afd4f82bb3ef
-
Filesize
5.2MB
MD53c65dca52ae3b7cec9c8860429dab8e0
SHA11e5a421a4dbefe4c96ddf9b9dd1ec0b411965150
SHA2563ba50f5ab5f87bcd6b9c226cc837688b14f07ea00e8476eda714a07fe2451c92
SHA512ce2e2e78a2383dfc4d0c0c4e6be2dc9cacb2f3bb37e1c1ea9febf6405ec7689b46525dd2e700a2b860adccf02df97669086b7661addd6699f442bf3a2b463dba
-
Filesize
5.2MB
MD5f0adf7a47494707be7e9de43d60ce50e
SHA191aace21ab65a02dbee9deea5cddac057bcfbc83
SHA2564d7638a3e0fabee090f7d383d61ef3dabbf8dc9b9b0338b603cfb44498b30e7c
SHA512be0d0a98186864398dde82f7feec472cd16fb01a8b0cdf95e4dd083edca322692f31f1a240392c8ace9781407f329d17da247cf7c9f77fc3f3efa5c5b33d0294
-
Filesize
5.2MB
MD5cb9fff20fef69e8e0634b77b6fd42a0b
SHA19b5ad250fdf2b59949364117323b6c4130d03402
SHA256dd0319c7a84b86e8ba9ba0614218367e204a7da198e9dcd9bcbd9a0db8a3a4b5
SHA512059716c10e5cb2c97692d80a8eb2b2720b0fc5da166b7b421fd661c84d9a803f178a4a61c66f9ded7866a8671e144f6dee0d4d64f8be47aa2d541c1e7a03179e
-
Filesize
5.2MB
MD5a316f512d3121daf00eaa977066e7e72
SHA113b06fbd553fe931326e7bcff301d5d7ae833fda
SHA2568f900bc4ef9eda4f62e4cf1ad0dad7421419b8ec6f693625f9caf1c577a0ef47
SHA512109f7b524390cc6c4e3f36b3b07fa161babc77e531582ad1615b0fb3c32321bed1c4cfac1da4517918e3207b1b536f3b8af07a450a6b8d162ece89ea37879808
-
Filesize
5.2MB
MD5098a8ad5edb2247b5778ad0fbf68b8b0
SHA116ac580f9a2bbb4de07f517bb1a2cc8e26731703
SHA25618f0381b7b6415568eafa49a5e35fa3acce2a2d08b5d635cafb534f176a54078
SHA512f33123a8fc30369dd4c17cb90341fef6a9671e085e40a18a18d2db952c44759d67f2f15076836e5deeda46c4641521e0d4aa043ab2ecc36552a3f28ed9e9f8ea
-
Filesize
5.2MB
MD5643b225b7d00260a92e631be1a66872f
SHA1a160915b0a4ca6b547a009256c27804bd7f48768
SHA2560cbf827552bae0816434a344d6eb1dcb398a7798c854c930dc9358c68cb1a892
SHA51248f8dde34ab476d467505dcad5be5e9ecc428af1abdb5057ad9f767c9e8f441717b4fd9ae187e825d58e227f96046e2dc48a2facc5b0115da5005cdcdffff86c
-
Filesize
5.2MB
MD538a73daddbba2faaff0813620a33d1a8
SHA175af008baa4c145131328450a1db2a0a8fd65fa1
SHA256fd4fbc35e0f02b745f773391bd57b0f4a5f113d72e3c7c2887c6573d48d4dec8
SHA512b190abb20ac0ebc31e3c1fd52774b1f5909353338ff500419dacbfe227be769ac9eee5a69081de85e6cbde4ed0e5b1d7f91b00518454d932be524912c549862c
-
Filesize
5.2MB
MD5d8ef8fc0a5e736015832986871840563
SHA1df5846ed418585287865372c430325177d5db43e
SHA2560318d3a40279c3022e9b9dc7b30cf443fe6c7def717908411008048c0b720cea
SHA5120bb457611602aaf592f40f3596b7eacde47bbeecceda7960c2818669fbcb56c3f49dcad373a19989067d4c1f17bcdfe9e5b1a232388abf7bd33fce5b512a78b3
-
Filesize
5.2MB
MD5c7103c9fd7875698631b05ea671705d9
SHA197c6e9b3605ecd15ba9661db9b649e609f47582c
SHA256c02c712d768bb8307768e6cb78610995bcc1a4416a90e28806d1a1fcbfa6fe2a
SHA51259dfb891e0eb7ee372b19955a9525128fad0aafbe38ff7062e1adfaa188a16f0b6fda55a60b2c703e2b3444b0baab622c054ae3033dd8a19552a86d6b349d4b5
-
Filesize
5.2MB
MD576d4a5e11a69801d6b3ebec55b347fe9
SHA1cf9434035ab318e63eb32f32ef7f36824aa27b44
SHA2564f080cc67dc70536a5ab81095dde9cc9f881c5d46d7f8e87687aece78cd71d66
SHA5122726e2a7bc4dce92d9ca5c011224ff1901e6a5f9901794c0f928549bcf60487891e3dfd4f4814146837fe5f80f58f986cb110d32bd41f1532fc21b39da81a152
-
Filesize
5.2MB
MD59f42dba413622f532747a30d164e3423
SHA158eaf18bc542389d4005319c19f49b07dc4b8b21
SHA25657bd7419edb2e4e668c2a6f340991d5537c179dbd9285512b58a8bedf70c7b4b
SHA512c5b8f677ef2dc1c74301447c91d7c97f6560ab863863529cb1db984de7b640061bbab50aa29151cd4ffe8f399e659a41a563c8c7de3f6ca7b67eb5b447999040
-
Filesize
5.2MB
MD5eb00308918da3e35122c6cb7e4ecaacd
SHA1f66d3348bd722ab697ac9d4190cd5d98045ce702
SHA256067dde9b26febf4b1a8cf1a3db6edecc863242fc628bf72c71e39e1fdef55562
SHA512e55a045ec406b7b520d4e15e6a6b0e826476bcaab5b07711cb99db72621f1bc519f52581d8dbc616efd8739d5d19d987cbe797e5f57de8f8a24ff47a5d55a98a
-
Filesize
5.2MB
MD52160b08451ece83fa8c3b8cccf33be8c
SHA1b4d33ba9ec8d372893d01afe88358b95b4ba0728
SHA256fc1bf400cacc4da3c55c18fcfcc4c8758cee5387777359b77f10a4a93bdfd9c1
SHA5120fb6ce6937b6f1f1e81858b4642b14a2d73952b6b6e365e6b4ce5b51fcbd380ca3ba455dcc8350645735ede22606347d60a694c000551993de5b271819aea24e
-
Filesize
5.2MB
MD5d3420074a8c8bcc392d23d2aa15f08ca
SHA1425385cab29d32d62db5c22cb792ffa6518de7e5
SHA256109108c365c6257cb58bd8ca84b1b8e6848871db1980c0df4c17a84574c9ea99
SHA51253b571496c874ce6f9e0ce820b9fb4f5ed629e5a65b636585d798ec21a107c8d7f17f2a3cbbe4cd08aa7f5576efe4a37d170d3d25de57b9e68ca40122de3d6df
-
Filesize
5.2MB
MD5d3cec03594b669aab701c37e3afc7036
SHA13627c24c8c110e1303c19dd1910fd2f69426a14c
SHA25634a44d5b9e1eb067d10acaa142b3a7550708ec852c9a57f0647762354038ec5a
SHA512e3b4a8938d464e0d3d413e8dbc92590f60c83ed259caff3b1dc58fadc39646d6de2379f1f6aeae4c4bc660276404cad14ba65f52aa1f20cb5e186581a5d7eed1
-
Filesize
5.2MB
MD53708c16545bcf0cdd60419942901e901
SHA184a208d321bba948c2c38dd140fb220240a8d84e
SHA256cf033fe698e270aa9fa493c80dcf541bb308c1b40295242f2310e121810f4985
SHA51210f36d315d4eeb4e566de97509571e2345ee5548bff687d610b9f89577b0f2657cb3667ccc6a1ddbb91eedf458c88b982221a0cd90681857eed6b645a7c9fce7
-
Filesize
5.2MB
MD5129f8a8c3351e470c031643950a23553
SHA11cb04be93b7b50b051b37197fb784fe663619685
SHA25633591f6cde9e5a145fef7b4289ff77b46a9437fc0a83b4e4c6b1b8fb6bbf8d22
SHA512ccbe75a8e03c82cc133168e9176328c869b11c848bd164e7ce40aea931001de32e1c7487fe152d36f448c87b129001bb993c340842e1cdc0c35c536d619392a3
-
Filesize
5.2MB
MD5b76cc7b11e098c32d95aaba9079e563a
SHA185def2afb22042be79648290794f487e7760ae01
SHA2560c7444058f69aeca94854347daaedf9ad11d37f3c412db9a1b42b01ffb7dcad8
SHA5122858bfe9c9746ec8a6846a8bc54dc167433159a42e9d80e67499c0028972b14453f6f8ede8b5f112051fdf9d1259ad46cc3796fa671ad49a77783591a8a39d94
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB