Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
27-12-2024 03:24
General
-
Target
2024-12-27_60c93f128a07ea4c11fb5b02b9bbab6e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
60c93f128a07ea4c11fb5b02b9bbab6e
-
SHA1
0b81be5de4a4375174f45e435d700fc02b098592
-
SHA256
90c739d312e03c1b17f43c48ea9a662872f60d0ca049a02e170d8f956ef4fdd4
-
SHA512
0844240413f21c5b365f3f07ca26b3a57aeb1df44b5827624bc3126c949d65901531557e5318cdd53e90727296e93fc5a979eec0a0ee0778d078c6b40fa764a3
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibj56utgpPFotBER/mQ32lUG
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_60c93f128a07ea4c11fb5b02b9bbab6e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_60c93f128a07ea4c11fb5b02b9bbab6e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UCGDGey.exeC:\Windows\System\UCGDGey.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SPyUciQ.exeC:\Windows\System\SPyUciQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yCfqDLp.exeC:\Windows\System\yCfqDLp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZeqFBdi.exeC:\Windows\System\ZeqFBdi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rBdwmJJ.exeC:\Windows\System\rBdwmJJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gctwaON.exeC:\Windows\System\gctwaON.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KyLzRls.exeC:\Windows\System\KyLzRls.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IKJCViv.exeC:\Windows\System\IKJCViv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tJsUCkD.exeC:\Windows\System\tJsUCkD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LqCaCGI.exeC:\Windows\System\LqCaCGI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KUIQcRi.exeC:\Windows\System\KUIQcRi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tdefMIX.exeC:\Windows\System\tdefMIX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YQqWoXf.exeC:\Windows\System\YQqWoXf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kgGtUNx.exeC:\Windows\System\kgGtUNx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fFPVsXQ.exeC:\Windows\System\fFPVsXQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VzWQLan.exeC:\Windows\System\VzWQLan.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xnBNVGF.exeC:\Windows\System\xnBNVGF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OJUJIgm.exeC:\Windows\System\OJUJIgm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dkmOsva.exeC:\Windows\System\dkmOsva.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dfxlGBw.exeC:\Windows\System\dfxlGBw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kjqfAtO.exeC:\Windows\System\kjqfAtO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52b8774189fdb336c26a2c582650986bc
SHA1a529538f9fbdfba46eb23b96a344df78bd08c147
SHA256cde7a0f6be7fb47efc35be470b77712d1231cfaae8457a500427b2c8c0714524
SHA5128198f9c97438559f834c24b257e7930aa77315f515b5deccf3d01310365407f23ce09f31d041d19f797059b2a7cdcee6c05ad0f733c8c3a3b9645b318e949513
-
Filesize
5.2MB
MD55445f9db86024bb63702af3f2cdb18b8
SHA1f5fc7568deb3b834de221d3aaa38cd0bb4935e3b
SHA2567ecf35440e9bdd92a2f0786ea6d1ce943c288b4eb83912d76aa070815ffb3db1
SHA512f366ecb590719fbd95f1de8d298bd4a59e520575f8e9e74c303106dfe8957447dec6c449a8cabbe279947ee31aefc130a2369d72536c1e2796a4432afab7966a
-
Filesize
5.2MB
MD51123369d6d8a4808f0854284b172cb61
SHA1c5e4de8fa749c6733b5c02788e1abd3cc73a549e
SHA256bfe59894fbe9767aad8fd33691c1430f4a52aa31516272ce8771fac18e2dfbe2
SHA512c355c369b00bcb4bc16232be337f63160c4c39840ccc0749be02c97ab7ba77aeeb6ecf48ab038eb2850c0919656e01ab75a69a3a13edb9ed307eb6291b865181
-
Filesize
5.2MB
MD529cb38addd20b5fa1210dbc0aeb7f1fa
SHA13ae7a8a667b12bbf725de64f52df277ab0cec6b5
SHA2565565a1e9fbff609645f17929fd731353cacb6f2597c6ac97b6f99b76a088aca8
SHA512aa406243b164902bcf89703a8d7e1fbad8b55ae88b12b3e1dfbfe389fa0fd4dc1e85d4274c8aea221c47d5a2a86100091a876a8223931be9d3acae7eee2f979a
-
Filesize
5.2MB
MD5dbeb2a21470e690cfb5d67c987dd6783
SHA19616ee92aa17c789e3c387d84d48bd06d1c8cbd2
SHA25619429650892e661999549fc286c8826f4a6691d9e4366c5c3059d8791a64b911
SHA512c4e42ea7b3e999f4f5a39f2ac42be673d2f0ee761f9d5a24d7a651fd6c07f5b4231e1a092c1566f39e400fdccb4e7986732992a23c01cd6002a00cc095c1b7d4
-
Filesize
5.2MB
MD5ca88682fe9ac8809f577f4d467a92512
SHA12ba8485d91310b394d573e4205860009c99b0b34
SHA2565f64913849cd6bf6eabae032eff907060e256bbbb125415562f2702619b5458a
SHA5129ab2e81d2e65d332683e608a9552bc94b82602a3ce94e447fc8a665f3d92038620856d16566588a2fbd09c70840fc20acce043078a5302dd1ba787bcbf96f57b
-
Filesize
5.2MB
MD5fc39fcef726c25e911605663425dca27
SHA1b5fc772107c20f2f882dce10348c5f62fae2c219
SHA256d1c5a1b6a8fc5b20ade0d99794ed750a0d9bfee04214163cf62018da973af9b5
SHA51299a586068e46346356496900966d573a37e81c28389baa4d8e7b0610080dc4cd29866a143b5556a78f6f9e203657445e350b076003e5723e4557842504d7aced
-
Filesize
5.2MB
MD51f6a70a373f4e54338dcd0c277fe4bce
SHA13e3052f61896f787f0dfdf5f991fdb25a7e94a0f
SHA2563e7003300feced72db39300d25eecfc6a91f3dfc31fc8bfaed62dfd78ce68dce
SHA51277a50ef585b5fdceb57046dff3b5655996e3b8031d312bb8d52a4226acb309698666172721cd05639fa7863ce27b1da15fa0dcfa5023801e067f7ba104568f84
-
Filesize
5.2MB
MD57dd6221f4c79ba723b667913f325d13f
SHA14c83a5b0996721845eb89ac13867707cd5e60cae
SHA2567f99ba593c7ef49d0b5220335724f7f0171ab64c3ce3c14e4e34d6dd0b73de1f
SHA51258010baa56511fa57715bc7a684f235fefadf222f7b4dd7c7bff529a76133e0925497bf81ac725d3621591bfd080395e37e08099248c3900fcc110ca173a824a
-
Filesize
5.2MB
MD5a8b9f06b53a81809f95e01e8fc78a089
SHA1117517ea324e38d03e88cbaf2b1ee592b8cb8b6e
SHA2565ac3ee4f45917519620d7328ec6290433e73e37f3da311f5689d102ec392a5df
SHA5124a5ebe1927f4bb6c6fbd1cc5f9e9d7f094147c8327df31f2a5658bec82af9bfc9a203ee65e1c53be484c9c232b5ad5325eaeaf588bf7583080a3fc8993fe8f1a
-
Filesize
5.2MB
MD5cf856f402cf1a2c8bdcbc2d297b65f3c
SHA12592a055261502feebfb7db3e7fdd11c22abf408
SHA25696b94c4c18ee6cc2c311ca9cf84e5c9496e2d6d25c85307368069cf28b052d62
SHA51262b8224d5315a233cb8aad13565143334577c735bd487605aa4d7f443321af2f9df5651057275200280a5833b1f95a1dc71debea50882c083bedfdcadac2fab8
-
Filesize
5.2MB
MD55a4593db884fe5a553ce24f8ad55f3e7
SHA140271a3ff2e85823f1a0c4196e8d4ab419d41b2d
SHA25644fdf734f4d48fa8c143be999fd3084010e063da06dc8b15650872b06a47c0b9
SHA512988992406a0202415d0374273e5691ddda14007fa36b5ea61c3146fe83200897137734a78c6bd1924065aaeff7b033c87e5aba76ab7f4c461b6a4c6cbec590f7
-
Filesize
5.2MB
MD553f81836b5427a541b52d3af5e22c497
SHA1ca85d536993f0f930f0f4f82baef96bade490a0e
SHA25606a905982b7a9f0c9006f75c0289781d024f43c8128537c95c867310d326ddad
SHA51279c29b60551daf67f85843bbd2b00afe9a5bd68c04086bcf70ce4e38098c29e90c0f655f61f768f13f740196592c721ec9dbf8ad70f8c750fefc7d03bfa40ac0
-
Filesize
5.2MB
MD59e619d65f4a323410aed50b133128bd4
SHA1ac8b950d3720aec538dfdaea9b9836ad1fc83efe
SHA2561698575c7ad14e112201f8b686b0deb4bebc503f247264b76fe3a1ffb41476a5
SHA51238773863cd896118a0813d0ffb96831401e63686e2294531358f9a809511ca32da835ad7276a8cb5229f34ac5bcdf544a77430f1948d2b72552bd4664b2399a5
-
Filesize
5.2MB
MD57bcb021e29c3fe83911fd97bbb2e04b5
SHA1456e42f8bb8af7a9c8771ce3844e2e574b8e70f2
SHA2564df9454edaa0493a0e2387d830a263a5fcbfde4fcc7837d183d6be52ec4dc18e
SHA51229fa619021927691f971ca4123312f774a2f6714259a3f85426c77087a7cdf70dccf69892808ef1670e1d5cad530855d0163cd9fbae8db007aeff444e7b2889f
-
Filesize
5.2MB
MD59c7680d5610ae9598c7787d9a3a93a78
SHA12f3937b752eb3f1c3094eedbb84ba2e64c8c67ba
SHA256530a8d620093286ee550978afe1ce3a138a9c482f3ffe1721c45f545e23d353d
SHA512147191da74278dde22d577bd47dfbce16cc0597c1b28d9ad207fc79584a49163df2c0ce8a63c45183d94bc51e99e6d181d15e2d0e284527b0e7c4839da90c453
-
Filesize
5.2MB
MD523038686d089c2f57357e6a5d4cd4180
SHA13c998dcf429321e3e14cc8ba968838d4883870ab
SHA2564e8765aae58accd0c1d39edc3c9005ed4645e3e9e8adbf0d8c486d54c615f3ca
SHA512e075752a365e8c8bda6da793e46ce12520cae0b56559749eb93ab200a486ee080a2242babecffa27b7786056bd7651f1218c2f7d61ae0cfbc468483825330292
-
Filesize
5.2MB
MD563b81b12d5f38178a8209bc68b61d0f5
SHA1d3157c4714adf2ef3973e115f66e3fa25f5f9136
SHA2564d70cd631595c5cba98b81eb22b48cb56c109ddf3a7c1bb837689b66387832ba
SHA512ebf490b082e0ab42631b80ade8f24f1ab1b8446d87814c7b58cd68e12078aa93d882811c8e4392fecdfd9b7428bf0064ff6a9b214eef095f22c45d0383d2eb18
-
Filesize
5.2MB
MD5ab9ca01af4578917de4e0e29454c256c
SHA1ec22523b6d0c32d2ba0502a0839946a17d1e472d
SHA2564c788cafd2ec9d94a09b750aaf2877381126247358681736c12fb6e7828a2a92
SHA512342e86cb7a3cbd0d08b087d6a0c0c8a94a559918d030b872c0b8fa26002e7857a2962f433eb8c894a8ba770c408bd4cad4c27502d97900c5bdca96b1f7abbbe5
-
Filesize
5.2MB
MD576201f456cff4a60fee855bec35e07ec
SHA14df85a88409b26cd0f8326db5db8824714f36d5e
SHA256882d6bc3fdc8cb5ae855ee355b56bd60d8a3da1c2d176547a79fdb3cd336c9f3
SHA512b07122cefe0bc4fc9af57d0de201cfbb36eb4bcabe12016bee0427512b2e23b7065e93b6fd2ab19b9c708328d25193b940be9184f05e05e621165873ff2a1ac2
-
Filesize
5.2MB
MD57ebdc1ea3ea70490cff0e327dc573eef
SHA190f98fd214afb67534c84e27139b3b1a88cce996
SHA2564bf34ea6e4c664ae3fb6e89db67835d65d40f29ded8a423c6b58acb0ff3eaffd
SHA5120c7fe159b7a9b18261f2301949a74a40a5898950b9a71420c1f8805824230eed7deb43f14aa3934ee02af80e98c34ae819a63ecbb74a4f85015759c7ee5dba69
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB