Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-12-2024 03:22
General
-
Target
2024-12-27_20de294bc562ce9b884ed98bd9172835_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
20de294bc562ce9b884ed98bd9172835
-
SHA1
780775b89ab987a5ecc297e4322acf1487d1052f
-
SHA256
5cff8b8f68b2e64bbdb396668d32229629b9b690cef166d6acca6ac0c1bc0705
-
SHA512
b52bfc43cd45d5f3d92a0883019278c7d81edcb94da1a702cbb3732ff5325f14a82864ea6de62e82f5e3f5b64f1f91f9e5cd9b90194bff84ea3ab99814dd5679
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibj56utgpPFotBER/mQ32lUH
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_20de294bc562ce9b884ed98bd9172835_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_20de294bc562ce9b884ed98bd9172835_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gNzqlzk.exeC:\Windows\System\gNzqlzk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yGTzLhz.exeC:\Windows\System\yGTzLhz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pBAiAQS.exeC:\Windows\System\pBAiAQS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\najIFsY.exeC:\Windows\System\najIFsY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BFIrBIr.exeC:\Windows\System\BFIrBIr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vpxJCpm.exeC:\Windows\System\vpxJCpm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oRufoQg.exeC:\Windows\System\oRufoQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWaqFEP.exeC:\Windows\System\qWaqFEP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BaaIbKy.exeC:\Windows\System\BaaIbKy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XrlpoVh.exeC:\Windows\System\XrlpoVh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HOlJjZu.exeC:\Windows\System\HOlJjZu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XEYHejX.exeC:\Windows\System\XEYHejX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PKUULqW.exeC:\Windows\System\PKUULqW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rEjkNYs.exeC:\Windows\System\rEjkNYs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wNNDXjQ.exeC:\Windows\System\wNNDXjQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kvKcALq.exeC:\Windows\System\kvKcALq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UyfdjAQ.exeC:\Windows\System\UyfdjAQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HBhjfST.exeC:\Windows\System\HBhjfST.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YNEXosB.exeC:\Windows\System\YNEXosB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zToUzXu.exeC:\Windows\System\zToUzXu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tPaQrTB.exeC:\Windows\System\tPaQrTB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5336c0deaacc1d31afd6315c7d4fcf6dd
SHA142e8574a596d2ba2751b8049a3477f9359830d35
SHA2565e40ca368597e3f38c9ad82b0903657428df1726ccfdc6a443226079fa512c40
SHA512275d5c411389bf0be470f455a1be480bfddc2fc027a29b14eb234d3ca909fa366f5d0f91b37a40d853a0d16b980301ba843e88a7ba716577bafe0dbd555c499f
-
Filesize
5.2MB
MD5b7440e62c7d63150d3439c58a8fb54e1
SHA1c3ad1d9e06f008cbaa5a36ab6b959519501dcaf3
SHA2567d06ea5d1ccea74b80373bed5d294049faabb7b357ffaf42cbdc70baf7bd7ae0
SHA512c56fd6bcbbc0b1a21e3a00be606f99d038f07b093cd565ec6cc28bc62a098bae75acae352bff09e9388171af08cf73aa9b92a540d944e02ee9c02c4e48c8f43b
-
Filesize
5.2MB
MD54321a6217bfb3473eee6c26435371a82
SHA165643ceee90c6b194a15caa0a44765347098a3da
SHA256b29a672e97c41dba0d8b11e3ea97947fd7978d8830af2abfc107e245c62a36c0
SHA512a08498f8836540d2c36afc2ccf0f062dedf6ed411d876bf5de1dc1f8ebd6cb7bfadacea13ffd5a51dbb0e7f83662c997f61c74dd43169ab2d0d3f05ef85880bc
-
Filesize
5.2MB
MD57586d396c57ac0675efccc59a5989c7a
SHA166e8a38d9e41bebb707944480a287031e959bb0e
SHA25604b05f81c6333ee25f63cc13816bd80cee9092e7068b931af1ea1b8ddc51256d
SHA51289ce85143ef9df016505f3573c570abb6dea0f99ad13b56f92a03ce576b3e8e8a75dd28630cb33ce7f904b5fe08ce2984833b21ccc66423fb8961899d2ad2871
-
Filesize
5.2MB
MD55988b5222c0f7cccf4f864d0175c7aad
SHA1367afd5a275f0babc0c1d6fa2f257c220fdc36ec
SHA256c94c44b53138ad9cb316d6d3ed70df3de30e43f77745a2900b312e50e9e2d536
SHA512600cc7236568b8b17b994631ab7a41df77c2daf7960169cc117e3f51162f09f3ca106141964ff34d012956496202987eb05a3224cab6098920b3266c369c9132
-
Filesize
5.2MB
MD56934e85c9d9c07890787431923d57a73
SHA1a99c269443aafca50d8df23ac1ac553257e59433
SHA25603352c91104979464d35d20fb2d9207e52083243cc4c90623749f6d77c76ec2d
SHA512fda3acea27668807c3cd747b69b94d7a21a9dbc72f76f3c6f1d51f353e792b6874eb0f7719d9a321899650e12b6a54af5543c33dd1f15cc9565b48af42817cd9
-
Filesize
5.2MB
MD5283e6748271dfdc4b4ddf97d4165224c
SHA11ae52f75211ba42548d5d0f9c5ec34822ba35d52
SHA256fcc81e8a3a11b6475169aec957ffb7d893ed1eda303708e294bc45818a845819
SHA512fed172bb6a4b46b586d1b13c4ef3b81f4b865367b9bfd2e38c9437618a4936d169b4fe259b1fd1f497e34f56dd631e6255af156383c23d3cd3e5065cd322a9d1
-
Filesize
5.2MB
MD570a69e6e714f60cbfc9fd2a0a7d198cc
SHA198bcfb54e7a43e739c89ab2e6ecec612a5476455
SHA256513c4d17dd7fb37477c9138dc4c4dcbc678182b8c15c852a6673a9b1b7995c96
SHA512072c730b7a78082b857010e91ca5fc6dbc975cc3ce52d58f8b1a372e46f95690bf66ff6a2e1cc718b871338c8c910c432504e0ffaa9324b78112bae2457177a5
-
Filesize
5.2MB
MD524f8c8d0b1ce8777a6dd86451bbe4c5e
SHA11927139204ecbac51480818a7164b1b9b8941cd3
SHA256d3bf595467ad890c93714203814342ba33f2628e8fd7be7c2dea9523578ae0bd
SHA5129b9060329dc6b5b55e9cc08c4175edd20d06964d8ae182ccca4e205217281f992fa6bb9e561728358947afbe44452a06c3eebe8836a27bd51df737afba802414
-
Filesize
5.2MB
MD5fcc07394342eadca0cb54de6e0db5db1
SHA11cc6cd28de232253f5aa81f14b83467e28cce968
SHA25639ee3ab3614dd52a0e9cbf523bbea94adeaf49384e2eeb3ed31c925367e39bd5
SHA5120963b5331d4d7e2312fbf096e96ab7da02771805c28c61ac3f8fcf6131a611a7182f011ae9e9eede13b66bb6293860a5186db8b32abf652ec9c5068e9e52f0af
-
Filesize
5.2MB
MD592a7830931ae938e2263365c1881aeb2
SHA1ad7c6d4b1bbf00880a448e24117698a81942ad68
SHA256cdec84f39f6385e6d60824e768bbf95afdc549b9be9ad99d7e13e1aba7f690ef
SHA51268c82b8f5ebe99ac32ba176c20d45ab24245ed489d7888ff8da8b5a09a21d66b5e140914d46e9c5512eb7077700ac429b0fda887d004a81b162f7edf92539118
-
Filesize
5.2MB
MD56651b731a365f6822e25303cf70893dc
SHA1997557621550a203a66ae65942576c4d90c8b7f9
SHA2564537e072218794d9ec709553133f66ede55742e03c62ecca50b76e6dbd5d3c16
SHA51253b6dcf1d395ae0eaf8b7a954717d2399e2ef5b259df586407804d6dfda1dc7118a677395a145f0b99a7bc9101e455d4ecdadf3bb245561c23d3d03fda760e56
-
Filesize
5.2MB
MD5d52c8b01f6a87782a3c93370df201502
SHA130e272164600aa5926ee60aff73a30c30b423386
SHA256987b64959c96b7ca59bbfc8c4c42d2877c571f0cf57f8bb9021d0c8419084e94
SHA51259f4ddd87a9ee4c24b4ef9c28b86bf7c164ffe890a9286e27cb9415b5224412d91726849b3306336995fe1e0b87a63f44311f46a3370e40a91fe3cdd2b21327a
-
Filesize
5.2MB
MD5339351f073eb8ae4007dee70374409f6
SHA1746adfcd2591c260c8c9ce6f412bc27bf6ec816d
SHA2565918bfc8257c9d5dfdb1d704436f77008513faa14df6d7f5b5c17f74550a6237
SHA51203b84cadc432799632bca98d65633c3bce6a666c33c1065ed98b9ae66c3d25b0535f781cc58f7046ab5604bd0c4f9b576a4857199ccfb16211ca08866457a414
-
Filesize
5.2MB
MD5361adc22a53664a62c1ea67b203f85dd
SHA13698af937acaf0f9d520649c918d47f8da118ada
SHA256047415d1723058218dde7025ea403437e57cac2e1191a969390b3123bfb31c4e
SHA5129336c070c85266218473ef4fc0be15b9c6c8091d97eab51e7ac56fa6d783761bb1073e56b2392160cf82c8512359fe6a8a1dc247f9d5f2f216024b8838a4016a
-
Filesize
5.2MB
MD51415ecbf3f1f810b35999a4845a73f6a
SHA14e6c3dfcbe39d0b54c5363b7513fde40ef47639d
SHA256d5e8d8847e58f7711a56ee0e19ae4fa8a497ec45cf379218307423782f27b56d
SHA512f0c844cbeee792db453d1eafabf6267b059985136ba669b0cf11792842e1c773c9eb16343af981cce08695e931933bd7908939e101c46a787569fd85fccf0468
-
Filesize
5.2MB
MD5bd39ba5779316ff121132c7282656b4c
SHA16c0ae11d1673cf327c36e4ed7e7451f8989f2a2a
SHA256a517cec78430735601aaa10d0d1951defd0d57e22182080a160323d20a6cec0b
SHA5128ba931257fd6fb33db5e655a42196257e06660d35c582dfab087606247c399b412dd7582a68e07b51451148fb91f0e097375d1c39e98ac8851f623e818ec3fcc
-
Filesize
5.2MB
MD5ecd3c3f7058a43f9e3ca8b9789c16f58
SHA1bf131fd6ec10b5ddacd2ac1e4e4ffa9e6031c892
SHA256462c9469ea608cc5d69cd89547bd3a7a35af57d884d4961783573220539d87ad
SHA512b90c3ae61fafde66a978bfdba6bd43352f4160a8268fb5b972648c75b4507cb2562eda54627798db094d975740d6559ebaeba494066dd52623efc1d0307d1c3b
-
Filesize
5.2MB
MD53565ad4c8a17465b04a141a6fcbd4a61
SHA152813533f642b29f482de2c11f0befe111273259
SHA2569d34c1ebe4dd64b80dc362658309759f8261d107d5d3d315cb69e5dd15168afc
SHA512cce85a858c66feb6172332354c0891171b566a62bcd458d5d1652c07169fceeb2e735b1497bafc1f394046c7f2961ba13c9508635cb99d62fc80d534824ec53c
-
Filesize
5.2MB
MD51484d26e58d483e9887c2f5bbb03d781
SHA133e39f4d90b3e3775051659037eca2cfc3fe6b2a
SHA2562b4513c19013fbd31493fcd3e97557664110fdc998fefa956b868d55f5c2ab95
SHA512a00b00ccc16eff3a1dde4c4d5845a775ed9e9cabe605e9e4d2c44a9459058083bf7aef815454a8654b006cd2f405b858953ed49cfa4b6980bf976582ab8ca598
-
Filesize
5.2MB
MD5af488156ad4c5d44cf4e3b73fa07d7f5
SHA11c9177022fafe4026672eebfc71b646aa720ccec
SHA25600f9e8a30204a6cbb4e4be51fb294ba808bb0a469c799d2a159036bd4d81eb90
SHA512096751d3877bb240f9244e5c011f461de476219dd312503315d3786d649495466845e2ab51dbc964b55b747e77e6287278606683cf958355c6922458b6695198
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB