Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
27-12-2024 03:22
General
-
Target
2024-12-27_02f8258c7dd5a419fa850a0988744e44_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
02f8258c7dd5a419fa850a0988744e44
-
SHA1
eb78d8ff2e8eaaedb7760b9fa230736ffa42678f
-
SHA256
e2999ebfb0d288ffb05404a99dfd7604f8ee0d4ff7b6313e829708fa53e38ba9
-
SHA512
11a45872c93b2a025a465ea48c58f452475feb915b6bf0f388d369fafbfd729b9538dfa295c09ef122717bbb924b7be00d344859dcdd2e106be727e7094782d5
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lS:RWWBibj56utgpPFotBER/mQ32lUu
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_02f8258c7dd5a419fa850a0988744e44_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_02f8258c7dd5a419fa850a0988744e44_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IxEphcq.exeC:\Windows\System\IxEphcq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrKJWvw.exeC:\Windows\System\mrKJWvw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fryNtaK.exeC:\Windows\System\fryNtaK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tuPVBQP.exeC:\Windows\System\tuPVBQP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BMZwZgr.exeC:\Windows\System\BMZwZgr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wqAJrRF.exeC:\Windows\System\wqAJrRF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zTgHRSk.exeC:\Windows\System\zTgHRSk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LuRYoKw.exeC:\Windows\System\LuRYoKw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mNwMWNt.exeC:\Windows\System\mNwMWNt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oIHrlGH.exeC:\Windows\System\oIHrlGH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JLbDmsj.exeC:\Windows\System\JLbDmsj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VkrRfiq.exeC:\Windows\System\VkrRfiq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NbfxXur.exeC:\Windows\System\NbfxXur.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VDvqDJP.exeC:\Windows\System\VDvqDJP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HKBNOPJ.exeC:\Windows\System\HKBNOPJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QblbOEv.exeC:\Windows\System\QblbOEv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SCGqWxp.exeC:\Windows\System\SCGqWxp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AGNGdON.exeC:\Windows\System\AGNGdON.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EbKMVDQ.exeC:\Windows\System\EbKMVDQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dxNIHiQ.exeC:\Windows\System\dxNIHiQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oqVMDTc.exeC:\Windows\System\oqVMDTc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD576041d44da2641cc58013cb83d69b9e3
SHA1e374a49ce5aaa8cb1a06e27518bb7beac3249f3a
SHA25689dfb1ff03f6c55ef46660a79b1a495e9b0383bef675bb254f67aedb9402e7ac
SHA51244d8b5588730eaba3311ec58bebe38b228da5df1a9a69e04bbdb1e38e0db6f61736584be02df21650724a476c713eb9e692b1d472592ee43eb078ae92f31bf72
-
Filesize
5.2MB
MD58d6da5513af6c32c51270cb2384a4b49
SHA16f0db62f07082d958dde154ce09d252d35d0325e
SHA2560afb618e1d51d7e44b6974754bd12652bcd16d6ebc66597b3cd6ed6dbde56660
SHA5127092ab12a8e7899434997d967a9ce5bf8b3eaaa075191509c285ac56cf3b45bad87fbb4cb0b70eaef5c76330c0fa952cbc2ed7533c5defa64f5105f64c67ed56
-
Filesize
5.2MB
MD53b8aa8283494550f4733ffb66cd95ecb
SHA15ba1efe29b79b4e1df9e39b02ae3aa50b10cbc56
SHA2560ec59847c77af565b6a70ec54134b2800712a9225ea5ac7bfd9675a0da3b22b2
SHA5126539a1c0db5483ed8a18b777da1ec82ed68f5bf3e6b77376bfea53e96fb1b278f8b85ad1aa0cb88e8eb41e4612170424bb91cd03d9b6c6b34b50c7eacfacccc6
-
Filesize
5.2MB
MD516983ac043ee6c74389bc695a85301d9
SHA1114789c014943f77bdf8db4bd5383f988a4d7e1e
SHA2568e6bef8ac2867500dd6e828d24dca902a7e9e9eaf62aa52a4856dab4ec04c5f5
SHA512eced923c56d13db2b5498a531d5e60a0def572012b8405a8d1711169abb61b29428fe8963a5f231ef5bcdd877fa4e70fcc4227fb9a95929f0ea1254e86c5d1fe
-
Filesize
5.2MB
MD5745d10c119a1e61e660edb8f3cdeeb99
SHA105e9781f08404b0bce760014d9591752e8a2a035
SHA2564dc74787b96e3d6fe85dce15ca09d45fd6c61411f21f10093bb8d97f0e7a53e0
SHA5125c077b2d85706c041283c35f8814f033a5af2148467922c7bdce50a560c78d053578364c33a26153038d71ee96df4cdb3e6c0740cf2a08fb82ded913145072da
-
Filesize
5.2MB
MD51a2d1d7d8a2735f80111305908570eb4
SHA1d50d6efe3df764f6c2b693f6dbf3c2265c31ccf8
SHA2568c1414c6e2adae7fd09ef930948e8cbe4b3d3f199a1105382c3d51aa2abb4d28
SHA512822a40c3dd30838a0aa9d35cd1e2a5f01b102ab1d8aa5509c80daed92cc86127331f473f8fae87432601e2a5bf61312c592fc2665c4802093e4c1d1daaf7b9d9
-
Filesize
5.2MB
MD5b82978a1160537703f5a735777376259
SHA1f8ad112dce27d9ca73f20277461d65cdb2108da9
SHA256f581ee5f08b62fcce873fc165be7d4c7bb184f92ed8494194aec9e347e6818a6
SHA512e2d70662b01100db401b360a06a02b6c07220b7f86ec19a586c47efa1c60795bf82438a666f753550589c4c6731c71efc4b13da787d18ad82f5a0dab8255b0bd
-
Filesize
5.2MB
MD57bbb4cb0aa9446329dd78b5ae2aab8d6
SHA10e3ac050f8116eb5dc7c77c96f8beaa1df59cedc
SHA256f632d9ee98515d23a267ff0653a2494b99e6bc1e7353bff290072f6a18dafc99
SHA512af2e847947296b951dbca71ab86ad177ab258ac1484c6d26553b5efe9b825e999a705ef633907ed1fb235054784c13d49ab75ca6cbe5dffd4f7bba462f8de662
-
Filesize
5.2MB
MD5546494a03b45a523dfceb2a2a89bec61
SHA13c460b94cae9d277a3529e786df0ad5685e413f9
SHA256e920daa88f9f5729597346b259fba0162c54f8777d70526381b2e71cfbe1d636
SHA5124646f10846b5de091b9e9dc75898dc4d0dd2bd3154e0d6cdb322c5030e77a3b2a5d453916a2f037bdd16300e14aa55554ce119f9929fe8cce8154632f86d985e
-
Filesize
5.2MB
MD5a4ec1b38f1bf1c41c3cdeb4ea36180da
SHA1fb3a3cec9d8990546895d53a2dde9d2c93aed9f5
SHA25638b271246a5c1a31fce0a0a04899a391157483efe48cf2bc511e2712130121ea
SHA512f5f1c5cca7b9c75da07fda062af381c693f8470af4338d3f362c7dad80eab583dfb557bd339ee2bba1d7fe26f2891300ce9f16d1a0977ccc3e30d6549f993045
-
Filesize
5.2MB
MD55b3691d4ae6808489ae03e4f4dbd5cd6
SHA11794973942f6d0cb8a3395f53b417de967e38a22
SHA2560420f3ae678a7480dc5dd40bc50c8557863adabd17eba5b7456bcb86f9ce8c90
SHA512484d4954e37bbb005bb3aa44484ec7f14b91820fa95292149b2c83acb8a204b5c56dac67d2fc62430f1464d90ec14c186a2836e7e7e64a62b5e935604f539912
-
Filesize
5.2MB
MD5c8da688727eb4c17223d63a99b305a40
SHA116076e7d785825799a964559117956ca10c21d26
SHA256ea438f7d1086462255bd1086dc33b5e31abab98f5e84068f8358075660554716
SHA5128739ce760c5f160ad212a8ad5b4539228897967dfb1204299ca6e81f31921a15cdae62b050dea30da7a58b4cea45aa8d4efb18e265459fdee3ef635e8bf8e81b
-
Filesize
5.2MB
MD55f4b7beb12f36454bb74bed9f6cb6001
SHA1679f50ec6b9c1b4d9af717de1e0cf31baa67eb32
SHA25681084db911bb55df128b0b09977b2a169df89f2408889528fb213498139b079e
SHA5128f6c6f3c83c3ca0beb0dfb36561a9180ce5ec21b5a578ba58615d66b89ddd8e507e31dbf39ca2043e5dfbe81b1e906643afb6c036a24dfdc980ec9fc05eefd30
-
Filesize
5.2MB
MD55023c4bb1a301116e30e7307d148b689
SHA12040b52911ae567cba01ebe4d099f3af6d86ed4b
SHA25655b608acd5cf6d3c638070ebf244c2a3ecf38754296563326ff823bbff6fab2c
SHA512158ee54c8680dd5942943a8473f97cf4357e83af7f53e9fea8c15f0feff86293d3aa372b838d5a57ec778febc227987b40579ac649fc0edcac33bca2d403944e
-
Filesize
5.2MB
MD5a114aef89221b3006290f3e828a4b564
SHA1e72da5b71d1a05d2442350479e4426a6fb093587
SHA2568905a35506bfe4fa8e5f48d3f52a8a90bbe7168a224306492ca4975fcbd784e8
SHA512e703dc5c9ffaaacd77379cfbf911932fd5437d8ec49d080d8e82cdfea85991369881cc6262ead033d96a6cd178b70b93ae68e174e281024e43a28a10360edd4f
-
Filesize
5.2MB
MD598913fcf667e1f804dd0e7ebf3515c23
SHA18ad9b0579af5464ebb8642cb20fb1b575293ec01
SHA256d43f41ee9eb23d913f7a870173b223fc3fbffa8e53763efbe1143ee59d185bec
SHA512877bdb736c6f211744e15271c0e63e6eae60f807116d0683f34c4058b036ff068b4b57dc83a3386c2e6d357abc1d436a531acff2807903d95611a117d742c029
-
Filesize
5.2MB
MD5df83d701f060cdd441aced51318c6b25
SHA15656bec39474437f8d7f3b0b50e9df3967cf74d4
SHA2564e9a3ebdea8a3764f4cd5fb96beb5f217f8e7e5abd00e5d44a5188eb1c0f47f0
SHA512972317af5984d9bf86303dd08f2e0d6e888291bee2fa1490f11dbbc7c9750fa8232d68f3057feaff4e399da6acc00d709ae696019b4ac3a17e9bb39c59f3bb1a
-
Filesize
5.2MB
MD5e5cfa1c3831398b9632b9248554f7343
SHA1fb3ebf465dbdccdee1794f9128917b4b6e687f8d
SHA256514ee1af13a01a4bb8d937dc45b57d59ecd6d9ce00335a5f199f88a46284f745
SHA5123510b8c4e04cadb4c608eea6d8a95cd66c21c24e8e0be2df3ae2810794eec6eb93145a0216d1fa4214203e26b6b61a818af04cb1792e04caacfe83a7b3dc673a
-
Filesize
5.2MB
MD5640dc79971d0c3eb02b464c53a6de51c
SHA18cb1c57ce47b7d133778b5b74c56e52b290abd35
SHA256529d76143740c4509ef63c9f5de00fc0c05da4a62f96788d9eb77ba7012a30f2
SHA5125f185c537a8af3f6de37999217c088ccaba0d13184b584834ee0c7cd58503db9328f030bb07297847702a4dbbe750386e47ab37b3f92bae1502089a6f2a3e3d1
-
Filesize
5.2MB
MD5151292926a2008b433233da9ecea34be
SHA16959a3534fc4ac3254799d9f4388a138adc2f534
SHA256a99db6c91bfa016e24d1488e8b51f46fd92a34ffa6686420f2fb039518ba60df
SHA51207a27f561a017afb51a9b9bc3bf5d02a0b1df8ff6916f9e38d4b9e514914683843171bb657977985747b51e677ca8718ba053ea6fc823e7d51743d5c0c0acd6c
-
Filesize
5.2MB
MD53ab7045ba735ec0f2e051d0f20f58054
SHA1214519de9adec817cb51a8b65e980d85de7e35a6
SHA2562aa0e3812d79afc8bb584aa5cb0fc250e310c20ed255e3f25e1a071ccd2f81db
SHA51212101aee78b28c639dcbccf7fe1f0f879f05c2d5495d77981f1e29ddb367adae850e204d06e3a673598caa8295a3b951863b30623e52a562d153292c67ae7209
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB