Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-12-2024 03:25
General
-
Target
2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d38078b651c6e2485dadce11626e2481
-
SHA1
b6c6b34ecc52ff16a3cf013a365cdaf165fb3688
-
SHA256
5f488b05f9f67cd9240bec1207ea63315c58c927c51a20d3e701dea927009c70
-
SHA512
e6055514433314057634fa7c5cceb1a68fe871533812549accd7f89f11eeb435180dcc73eaa5f564254161b2f5ce4edb8567cb4496d9870643ce75dcfc307dd8
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibj56utgpPFotBER/mQ32lUC
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wKVfNGp.exeC:\Windows\System\wKVfNGp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PoMhcGZ.exeC:\Windows\System\PoMhcGZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\frqmHAs.exeC:\Windows\System\frqmHAs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DThEKOi.exeC:\Windows\System\DThEKOi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MlBeovg.exeC:\Windows\System\MlBeovg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JFXgnQs.exeC:\Windows\System\JFXgnQs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lDvejLk.exeC:\Windows\System\lDvejLk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ENzVpnc.exeC:\Windows\System\ENzVpnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cKkPviI.exeC:\Windows\System\cKkPviI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\onKUgbW.exeC:\Windows\System\onKUgbW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TOAsMtp.exeC:\Windows\System\TOAsMtp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XJBFOQZ.exeC:\Windows\System\XJBFOQZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PFrWhik.exeC:\Windows\System\PFrWhik.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXAjLig.exeC:\Windows\System\bXAjLig.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bgaEJWs.exeC:\Windows\System\bgaEJWs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VElglDi.exeC:\Windows\System\VElglDi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DSkxXYQ.exeC:\Windows\System\DSkxXYQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QYxlxNT.exeC:\Windows\System\QYxlxNT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ptUOSUb.exeC:\Windows\System\ptUOSUb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Amimjml.exeC:\Windows\System\Amimjml.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pdSNejw.exeC:\Windows\System\pdSNejw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5bc498c68b41bce69e9177a2016e4f58a
SHA188791a5aa9c091589139b286b2b57e055312f4f2
SHA256d0ac1e517d6f5a6efa70124d4210471b203761501f05a53418807befa7757aec
SHA512bcceefa220a7d459bc134d125ecbbde834841e645f9ee385ffb5f5cc2767c730b83b4b06b63dc1938067c7222d9c3b58320e760dbda8fb896933800bdb12f412
-
Filesize
5.2MB
MD57cf1bd7846e2a80289c92229b344a4cc
SHA1344d2c5ae499ca6f0e704692713b9421a04dc304
SHA256d98232ab0da22fa044f927a8ba887d374413edb364f0d2baaf6d44ca5c92cfd0
SHA51233352fca290a00bece62ab8740112169bed2e0bd4cd67e2c9b06832d8b375a5a1fbecaab0e9492f52b3fb4e98aff0da645b18f39b857b66369ce20b9a7445668
-
Filesize
5.2MB
MD550ad25808cfef0c8ceb2e2ceb5920603
SHA17e760dad9cf7b59023485440bd46e28dfa4ccbd9
SHA2562d1e1a31a3a0fd59a66b3f883f6e7ef7d6e7f42b250162e3461a08b01e7de6a6
SHA5126c5502635212dedd71b0d6665c774d05c992abd3f86246dc9c8e94cf3f368f381cee4c5f5eb179d763edbf9123c4e02eceb47f0b4818407cb662e312415e3394
-
Filesize
5.2MB
MD5e6b5a785ba70bb62a822024b6b1cc473
SHA14a590e6de20a8eb16032e62a6ae84de77f038c19
SHA2561c0a6bca77c7d37b60dfdb337a61260701142029b3ae754d33c86152efdbd3c2
SHA51264768adf5b7817c639908ed421b2baf7765bb46917f1681dde0b5bd753f2ec5b0198a4de976883b45a76731363c6445ac6cdbad235e75f3ed243e3263f994f1a
-
Filesize
5.2MB
MD5b21575609af59dcbdc0b03ca8b7d3d4d
SHA10bd665d4c55204fcd3aeb6dee0470d461e80d168
SHA256b97bcbd9cfd867b14812651ac443efd8800071e1406e72ea5336b4ab646e0c52
SHA512dbf0e11c9a268ac281a4b7677238d5f127dc47704b1e126dbfbbb9e6b3f3bb634e5137589e8100cd7f87bff9fe6885328257556260c59e4e22dee13e84545827
-
Filesize
5.2MB
MD574b5fd47984f4bf5f95b38858ab9c303
SHA1f122d97f215e343897665d8cf8aeed66603065b5
SHA2565c86496ffeac2c81b081d10a547aedeaa8e82fc6694b4d83ae9be83f5ce21417
SHA512087b8796e5021ecf29979ff9ee1d6ca746ff7e9d05270173eee16680bc1899b718fed97f1bdb6b95fbcf151b9330ad7d93d1b74b8315dcb7f94edeb3c48c5108
-
Filesize
5.2MB
MD5380ec39425b59cc58d952c5190380eba
SHA181d0549ff6c21ba9312311e2937ccd7f68fc766c
SHA256aa48e6b0ad738169a6b78161a46fd5fe1f0cebe98aa46d821740e85f3d331596
SHA5123e7f96fb38fbf3fad1986f6a8bc4daf47b944e75551c0ddc1afa87cb0c4590775954845deb5aae4b4d589d499681dc5d44d95ad8b2037280981cd6d397db4ca1
-
Filesize
5.2MB
MD56c279e3c1576fe0756edb6f76b7bb367
SHA13108bebbe81d55f2152543ce02ddd3e44000ece8
SHA256bea2f2b8668b0fd552feafcd126404435600536d05b3e95070d10d5d88cf6290
SHA512d4c6ccfa7a48c3f28eb077e1ee41de12e5e5691440703277cff39d624146d27573de84a5a1564cb6df84ba6fcab5735ebb0b7cda1acfc4e26104dd600b347c6e
-
Filesize
5.2MB
MD5d272cd2b943aeafe00db43fc3299ce39
SHA12ba07c63e7ae21ce821b3ec57627a892d09dad4d
SHA2561eb97040fd0eba713beebf6cec20fe7ed04b53a40589ee545e74733b4bbb8946
SHA512f9178cfb04f6ca16f460bb16042e1c730983098e5e5f86a722ace54bc4cc8d6fa6b2aea93cfab97d3bec64b5933ba8bd0b79f056cebbc3750c86ecd5548b2c1b
-
Filesize
5.2MB
MD55e52d77a4906460c7acec56520122d22
SHA10bee77999c97c7622e625e749ef8f2eb907a7055
SHA256506d77c142a22dc72f26a4557437f7ac91f76fc6dc51e0539bc03dd5686f9816
SHA512b92d59cf98b75aaad9484b0668a8f1c9f667e14703048ce31fac9e552348edf3e5e29b05686550f2b17f0d81e69030b69a16b5e6b57eebaa2e349183e2914b29
-
Filesize
5.2MB
MD58bb6afe4b8ad95348b8dcd7bd1b9d893
SHA1f387bf65dc2d9a46fd6274ef2b76813f4148b360
SHA2569195c9f18535918f71fcbac9e9ae5494c83460124748d309487f1f4c920d8b78
SHA5128f33af7b2e3967cd778c94709f946f3db522407292b5918e6060c6d9f037e229674b5d400a8adc999d6d7ec018f86d684b272c622c258d5803f62feff4b0bd96
-
Filesize
5.2MB
MD566e9fad47a24c4703247d8a25d8c9e28
SHA1ff4931ece498bddb89ea23543a0c5dc504161ae8
SHA256ff01824d2e62a874b9ec1255643ce3bfbaa84dd96a8bd34327b7276f3d20e044
SHA51203df4df5dbfbaf88578826a5835dbcbcba7355c46300afdd29378c7b683b67cc7cfd98ad9221903cb4360344db490660e3d0db36ce003123ef131b54d77cef36
-
Filesize
5.2MB
MD584bc4d0e2a75af1219ad1d2aeb000b11
SHA1696516102b24104c45fc8abe72df1f203b167e42
SHA256aefb2229593a5da746efc46e99059d37ba4f22e0a318e473de4918cb935556e5
SHA5127c684f647c63568321b97c93ed962b9c273f2a829fd3e5db60a9a4373ab8fdc3d95dc73ebb8bf25d7403387f2ebaaf8fb04f3f9a5e07202336ea60a0f75e9fe9
-
Filesize
5.2MB
MD597f7690b4bdfe041eb51d1c0d2f377fc
SHA16762ebebb2ab593dd48285e9e436df851163746a
SHA2565f5943ab15c28400127ccd6bb809126541d219dfc437cbb1b37096e89cfb5655
SHA512b3236b07ca1ba946947fff19b2535dd81e79b9f50f79f743736bf8fe86351c8c3090164121102489fe9613ba1f2be27a251265dca7f4641bf6b109acbc2ec249
-
Filesize
5.2MB
MD56eb77a7584d80d07ebdfcf2dd1a8b9a9
SHA11ce689e01788799d2c2f561dadd4537a9e066ee0
SHA25628dc5169f13a557f372a7ffa5aaac4c8845e551457b0eefeb82daaa99fde637d
SHA5120c076a946da8a1341f3c45ab4f87fe090d208bffdcc04f1ddeaef052d432b0cd49add061da2c91c4899eb153138738c2d8637a39c43954e55c5236848a1dfaaa
-
Filesize
5.2MB
MD5c4e1e805f41e199de3a3131b463d1721
SHA1e055da1d7323445edd54b26be34fdbc772a414df
SHA256b18ed745481d4a205173bc22979aa59408f5ed57336fb0b14bc812af07bd91f4
SHA512ab5320fce27667e38ca9fb2aceb52504fbbef43d4d14d90176679ef12220b3897657e5b16648a439dd686fe4ea448254052011d4889d736a48c2c20f8158009d
-
Filesize
5.2MB
MD567dfba7fda3605f99d9371d580263aa0
SHA1b92517d13e0cd98db5fe3557a41bb9b00ffde755
SHA2568366b6cb95606b36115c0bfc07b0ff235eac25c59c2e56ba09ac58d91ebf629f
SHA512167581699fc44295853967f0e7ee2a199b503565801ba575e6aae9bf88f95598baa55e1624944bcaffc9ddbe442e440cdb034492ca4e992e9fc779013b201de4
-
Filesize
5.2MB
MD5858cabe6beb85914d46b29218f5c5a43
SHA18933b122a0307f2ec29749efd3bd6293a6e87c70
SHA2566518c55ea61d9323c4bb7b61ed8268b9b2751c280d790a251d1c399a114f4ab9
SHA51207b00522f054d549167ead4a687c962ac9fdf8de7df2ea0bea3eb426f3ec87743b3b9f9e7e8d5ebc5dab12fd79e17c768cca68e43004a36c4d3b183e3349c86e
-
Filesize
5.2MB
MD58ee13bd7d9fade5b4543f45a7209b2b5
SHA16bff74faf33ba78ed96f01c111ee0addf788baca
SHA256b4f66df6bb819fff5df34d6b9fcca271c8ff29b9a4d5de3fc09d37f98e645068
SHA5125c878ad3271b608ad4947bb8a5854594ef1f464c8b7e9f4ecc52acde6f8fa5e276f94588b8bf253c1422bb7f906cb5be7cf2e11097c85309259b94e2ac7e1b6c
-
Filesize
5.2MB
MD5e6e7eb12cee26e21c394f4b06ce02f36
SHA1c1d29954b8e558354ca92ea1b73fcc8727d16453
SHA256f34fba6ba6f2f7e2ca8bc7a06c23b3015ba5b1d3b3cf49fbfe46827cbfde27d9
SHA5120d646a071f4cee6cfd21135e0e05a1879f92b6e1c493ecdd9a0b1f64ec996ea9c40de02881f5a46ba497f5d44a0a2d6c92726f8137f4131ffb3098bd88d122c1
-
Filesize
5.2MB
MD511470fe8d3be941cbe1defc4c7e83f8a
SHA1af598177ff5872496e3aa5935aecad174dd18717
SHA256b44f2dddd3c3cd8d40727e68d25e81f3d51f19f7604dfe8ab409b42f3e01b626
SHA5120da023b475c11d6cc355887fd1364494b8d47e55085e281dccfffbffd3f8e9db8a05c22a5a6b1024ea68cd9b67a5152c1a025ed0fcf22a2edb4f2ed5c30a4c9d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB