Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-12-2024 03:23
General
-
Target
2024-12-27_60ae59c2ff9203224752c549e133ce97_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
60ae59c2ff9203224752c549e133ce97
-
SHA1
65ce97a5a24b1b210c1bed4d5747f8e59eb4a571
-
SHA256
285537e506b3cfd1e3eee158c3359a3c36dd106ae6a41a4d1cfead4d8ef0affe
-
SHA512
a0a8ff4d66c364693e803e708e05618c43346bd87f857e6865c9df1c12fd202c6e7a045990db7f2c067572b729d69f4f95e1d41a15fe7708aa369554c3d07254
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibj56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_60ae59c2ff9203224752c549e133ce97_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_60ae59c2ff9203224752c549e133ce97_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xBaPzDf.exeC:\Windows\System\xBaPzDf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aLrRWIB.exeC:\Windows\System\aLrRWIB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fHBFfxw.exeC:\Windows\System\fHBFfxw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ddBTEAq.exeC:\Windows\System\ddBTEAq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EcZZftP.exeC:\Windows\System\EcZZftP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zbSRUsk.exeC:\Windows\System\zbSRUsk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HQwuIiA.exeC:\Windows\System\HQwuIiA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fpFDprC.exeC:\Windows\System\fpFDprC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eRYnITx.exeC:\Windows\System\eRYnITx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OGJoZOb.exeC:\Windows\System\OGJoZOb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dnrmKEu.exeC:\Windows\System\dnrmKEu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aoYDtDE.exeC:\Windows\System\aoYDtDE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EEmwqce.exeC:\Windows\System\EEmwqce.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qBLXUFu.exeC:\Windows\System\qBLXUFu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tdoMPEz.exeC:\Windows\System\tdoMPEz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wygtoho.exeC:\Windows\System\wygtoho.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ljMTpFi.exeC:\Windows\System\ljMTpFi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mQlSxcH.exeC:\Windows\System\mQlSxcH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TUPqiKs.exeC:\Windows\System\TUPqiKs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SPyjePT.exeC:\Windows\System\SPyjePT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FTiijpn.exeC:\Windows\System\FTiijpn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5beed412446d584eb668161af81e63e98
SHA1836f7d1012c626d119377af3908baa1d0094a05c
SHA25657756412e7cbe801e232d7b6871940a0ba6f6c042a77b22d7f313ea5bb3c9eb4
SHA512894374779367e514b7be5c11a7708de6f70710de61ae693b329c7575ce05266a5b3c4a840c4eaadebcba47dffd87283e19905cca4ad303ef198241a76269c0b8
-
Filesize
5.2MB
MD5e8c2350936e39c9c8db83989bff111a9
SHA13b1cfab4c2d91a90e2242c3bdaa3121f954d19e4
SHA256d932828ba5a846dbc412a9ab1446c50b6d705b560475f22dc091e5aa5ee6a91d
SHA5122debb7747b3f7ca9ab2aaa7bd670129f5d39fad3ed3b26df1b9a2d473aad5fd800fd6376db94b8518144d25324eb7ae5575c0f4607dde089bc7e85faa65d9ca2
-
Filesize
5.2MB
MD59f88afd3c7f7d9bb42325a3d56ca0442
SHA10d97a6df6edea55f6654b3ba0e2647281883a614
SHA256cb32f11624788ed2deeb55c49636436dd001037d7fe1c8027938fa2209020cb4
SHA512eafea41d231115646077a33a87d6e43e27e053d7ddfeed7610057b7d98ce0e59b77b047adbb897843223629814cd6e10fae59f0b9a13436af9e898369a8b1b28
-
Filesize
5.2MB
MD5d01932b48f15b95c40aea52659cc82e6
SHA1aa9ef67ef1bf78db7b6761fc2fb59bdb07ade5a5
SHA256f2b836fb6463146c26373dd8be2c1c88380d40393375b2698633ec9b538511f5
SHA512b6497959f5a1b603163ad257a18ddbb7508b4adf3469bada6404053e54cc1cca1a14b174ad3945e474fc378441ebd7cec435006edb3206d2d0457610b23f67e2
-
Filesize
5.2MB
MD5bcebc189c08799727c7e63278c5bf8a6
SHA148f74691b1d2a73bd4f46e7d5fa2ef47c705e0a4
SHA2567204984d9406b639a550e6a9f9ea3c5a59d0a956eb4f1e148b5175f1341b5bd5
SHA512ddedaae6f146112ace7dcecc4ef8343c02651c4b31326179d97fd78d31a04733150fd93869282b4587c7f6c6570c1fbdcb170319cb0a0497bb871cf9af091591
-
Filesize
5.2MB
MD5c78ef8a15eae89aecb29382de4c8e9b2
SHA14cdee3f44463e1ad1ca19cbb065e2f379e9d017b
SHA25622c220c381fca79233f799389f278bd850a0202d477bb57a03383e73d07bf964
SHA5120d28803eaa0d86e579b24c464db19aef26b10a484b59c863e6ab238f5f2bcf0aeac0c0682fa8d4a54800a42a00ca439e4d36f45f2a3d0637a32d2713976396a1
-
Filesize
5.2MB
MD5bc6c11b49eb360c6ee107ffe45feeedc
SHA1ec7235f9c84892b1479113cb6b9b3b782dd82191
SHA256ef106a4c85774db8ed651e22efa843412c5fb05565c1e31ffd146aeb81765efd
SHA51224436204e7cc96a8105f6a38c936474feeb88a967059bc08cf1708f0ca0c2d4b31574a618b40fa24e56b99c9b663041fffdcdae0bdb52afba52b60709f2d23c2
-
Filesize
5.2MB
MD52eed769245510fa49b9f58152fb1d105
SHA1483dd15d81916caab0148902c93963d9c42c3b3b
SHA256c20b43b15799e89741fef26e5c65077ca236ac541de000fb7b36aee21211f706
SHA5125490281f0f81fddd46eed7d656d07802a303cff36bc8d2b598c2ac6756243aeae6cc896c2ec1ae51a3820ea13b4fd528fb0860d57378a5fc855fa44ec212915e
-
Filesize
5.2MB
MD505b7349db9d1613225ae320078daff40
SHA1b2fa1d0942f21792c37bd4478f1ae83acd8efd06
SHA256cda70d98a265cb52bbaa37d11eacb41559b3d5e8b6a189f9674de75d1edeae67
SHA5129d3f165226366999fae723df881468756c4f52acc101dcf671716997b983c2973d173181da29c9194de1a7639042b6a7aa1970ddc7760c323ab6247ab365e527
-
Filesize
5.2MB
MD5bbb3ca20fc225aba53d2f2db8a31ffcf
SHA147a09a4fb54ad1839532c31eb0f333f508e4e312
SHA2565cb66b65652d95061ee61d715b17f4906ae5e1d0250b60bf332ed447e69b490f
SHA512cafb3b6e9929cd98a4c5798731456fe7291921039d14e425c53d2696a0fd98d40e7c58ef7c587a6adbbf4d29c05cf05d4498b68567fe17f17021439b9596bbcf
-
Filesize
5.2MB
MD56641b6cabb53341d21d3f78110a95c10
SHA157045c5403248899554c8742415420a1dce0fb87
SHA256cac3781b2e45669dc8e66d567ddee69e285f9be1e70e1194d76b382c28cbb060
SHA512bd9e76aabbfbb6284bcca1c7806f7566b29677492dc16c133dbec80d77d388029effe338dbc9b0ec2703c71f9917d508e840903683ad262f82ae36be1404b64e
-
Filesize
5.2MB
MD568bb57e1d2b7178e7e24ddb08ac8463d
SHA1cb3462cd9db299695a6322313f388caedcfbe19b
SHA256d7475c4b9a32140c91aa2082f2ff5e05f906d1d6be18ac99d7cc62aa93048156
SHA512bc94699c724267927550d0b1360dfdd629cb7c8e868d8dc456b389d0a2cbd837caaec8001e361043c87c5ee50e68c5d6b84492637e0904c79614c53926c8da25
-
Filesize
5.2MB
MD5d6bf5cd8bc280d6070a0a2389b559018
SHA12b049969164c7317ab2108bce1a0c79a5456bdb7
SHA25601e9524b163b7221b0f493b38fedb9ba26358fac3b516df6d1ee252c12332037
SHA512e0e05086b68399698ac9145ccccda22ceb136734137de65dbfec6b991f879427525667d027b0523f5af6412c52e750ae61c9985bcfee23d949b1c30346bf3dd9
-
Filesize
5.2MB
MD58e0643e0c0cf9f0f9ab625549874867a
SHA11ec2ee09feefccaa01a53ffff81417b119359305
SHA25665d7683d79bdd396cfbc9d5713db184f42b66cdcc4feaeaa63cf089c71479975
SHA5128658b221ecdcc79afc3cf020298971e775356f6fd1f37f9f52d7d1f8f214e7a69590bae7825e8c659df053d617541fcd5caad0043cb86aa971acefe0a058e8ce
-
Filesize
5.2MB
MD5dfe05140b5b0af754b829efb1c6d902a
SHA1cb11f6c4bbbff2f6353256e9f0da663a891b2585
SHA2561f1ebd0ea1a4a0f575ee1405d4300b581e64d4d5f487ec12288fb59e275e76cb
SHA5128763374ee469774810d8355b498a710e7e50df391126af4309f89ee15735781d160a223bb924d811b6eb6e1b0b94c24a899761773ff6a6c3d7a867cc89048fad
-
Filesize
5.2MB
MD5deef7424b85c1704fde9eaa6fc622024
SHA1a1e77d2cccbd5037e1efc11e0aaa7381d328d78d
SHA2562613d503cbd8b0a15f40c025a569f7f28c259adf7a91a4824e7e6150bd5f0bba
SHA5127897ac0e8c70b12590ca0f43f389a7ecbb0baf118d54426063815d3313604a99af1b44b2ed4986b097fdebb426b8da010487249a001302295c230665d3797546
-
Filesize
5.2MB
MD581c19360f407bed718b1cd8e5a24d4e5
SHA14a2fe178708930ba13e077853af66eee1c5472f9
SHA256ee1f8b17056787703b4358547074a61868ea5286f6b32d02d0f88344bffc48cd
SHA5129dd11927b2b4e75a6df27c3bc08194bf76654c36ad949ef119354ba90560368d899c83755491ffa889281aab6d5c15783dd282251d9a1940cbd9d98203bf777e
-
Filesize
5.2MB
MD5cfc8fded0631717fc188ad6be7178910
SHA1dda78a58468c2679fbd44d6d89e8782c8328f3d1
SHA256290427c5ac5f154d580e049cf4daa648142b37e8684b74af37328c408df645b1
SHA512ecf10b732c4c57575e894f0e5f0708ee3f5659c484a53d982cdaaccb952dc97d7709f9990bb25e926f3d5bb9f1b6e0ec5f09225e7964379aa6996687f8e07eb5
-
Filesize
5.2MB
MD50b22d26789ab24f3f928450abbc873bf
SHA185c55aab9cef83feade5b2bf149c544b8fea705d
SHA256f1d4f97107b5e4e35368466c825f6660488b94dbd7f2eb0c1614a42d8fce95d2
SHA512c5d0b2cb88498d5e32ca69448eeee1d3684c6ba78a638de4a41299ceb12f00f878089263f6e63a6fe624e23a40f76602dc480ddc286c00436320e20ce12a2e64
-
Filesize
5.2MB
MD59870ff1e0d1612cc551fe77d55679221
SHA161f8af8a0ced662a5379a93c200386dd04f6bcf3
SHA256d27d618ba5a299dee914d260cac2c982338569546204cca01c1d91d3cdd60aac
SHA51229e3df4acce7cf8c5a1831a758cdf69ed8dd1e48a0da940ff74852befa4ece3ab5f20c62410d06e47ca2b986fe207662eb80d2821c56fe879b69cba866c79a48
-
Filesize
5.2MB
MD58e2ddee1e43812b04b392c0a33993f7a
SHA1e7ff7461f2b265b365a7b0613059aa87e81344cc
SHA25652510547a9f32e03debb61bd1e70b058a02a7b603d309da2988d87c2d42b6f8c
SHA5127af91cac921de1b4bb05c7151da23ae09469027be2d62a1f97fd11167f00a8bb849667486096ef70f02787dc0c18382e52ce4e5bd335556e42cdb5f14d5f5f16
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB