Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-12-2024 03:24
General
-
Target
2024-12-27_8c065b9be5951b9f5bc1227131a3bc48_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8c065b9be5951b9f5bc1227131a3bc48
-
SHA1
4523c1911e7e558227b14ccbd13162a0c4e237bf
-
SHA256
497d3c955bf27f60465a952aec2bb44f8e70069a4eb820b1d95df1fa32f8f139
-
SHA512
e2bf6bd9ba2de236a868f3dc18864d14525ce6946a0854a75f29caf603b37fcab3b0cb98800827965ac13095e791c590971094e80fe2646c0d3c4696057c5080
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibj56utgpPFotBER/mQ32lUW
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_8c065b9be5951b9f5bc1227131a3bc48_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_8c065b9be5951b9f5bc1227131a3bc48_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yIbCqyt.exeC:\Windows\System\yIbCqyt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qttfeTJ.exeC:\Windows\System\qttfeTJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bnUtLmo.exeC:\Windows\System\bnUtLmo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\efuUoZw.exeC:\Windows\System\efuUoZw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KkSRjfs.exeC:\Windows\System\KkSRjfs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\avdMIyW.exeC:\Windows\System\avdMIyW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aucQLTv.exeC:\Windows\System\aucQLTv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eBtAvtm.exeC:\Windows\System\eBtAvtm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wVDfItE.exeC:\Windows\System\wVDfItE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\okWcqPu.exeC:\Windows\System\okWcqPu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bRljTMD.exeC:\Windows\System\bRljTMD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DSSoAdz.exeC:\Windows\System\DSSoAdz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wChVblL.exeC:\Windows\System\wChVblL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWMhogl.exeC:\Windows\System\qWMhogl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IdDQUck.exeC:\Windows\System\IdDQUck.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LDhwMdk.exeC:\Windows\System\LDhwMdk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hJJhIzm.exeC:\Windows\System\hJJhIzm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kvOJcgc.exeC:\Windows\System\kvOJcgc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aICLrTy.exeC:\Windows\System\aICLrTy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LYSvbYa.exeC:\Windows\System\LYSvbYa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tmFFQTf.exeC:\Windows\System\tmFFQTf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD542ae85a26abaa10d2887f9cb3d8af719
SHA15c30fe979ef643a2cf606c05faaebf38d17a7709
SHA2563f495b97126fbd16e967e69c22c4f252b4e3e8d984f62fa7b42c0af62bbbf9c1
SHA512e4d01affff836f1b0256c17c6e49649ae4bf3310cc7846f84e498d26f9f8d288c0cc9786b1f3bbf1a3c027dd0a714a20b470088dc4092bea68efbb081cdad013
-
Filesize
5.2MB
MD5ad31662562eb97c5b9f2e49564449e54
SHA1e2a56e0130883dcbd0e535880b57974384617c37
SHA256873e52bdad0a5050e0f7aee257f25b0f5a01d1a96cb9169958c47508198549df
SHA51298c04b67105bd77dd3c442dba10e72281bcca997801192b2d651773c06c8b70fb3be24aab98d6114c031853c5a4d581f339844e03f54d3e63eaa4d9026ef814e
-
Filesize
5.2MB
MD5a8c3714ffc98654900f09c2bb4ce75bc
SHA120cf42600fe1635f9b9844d50f395f5ec0ea79b6
SHA256dd0f652141b167f37f1d27d630d4d76a1285678f43961185494a2cd45ab5117d
SHA51219c2f72cd59bbe46a2a9092e9b1d84b398bd832a70c5a9d42de453a6e297dfef1a9e3cc975c6628831a57bf2a4a2ba59232d55399cc3cced5c727c4162a129de
-
Filesize
5.2MB
MD56e4bc2671d4bea773e0bd5717e7725cd
SHA10937562b82991b57b865141796cbd7f9f853eec2
SHA2564539b450330f77c063dc5b79847c75b91127d3381dbbdb1d81c5faf2dd1eebcb
SHA5128a21b9a374b419d973a0f3721bf2f0547ab81a82451674a3e05511cab14cbc90b3637ecad52d74ee55262bc0b0bca593876ced24fbb14714d53238c35afa6760
-
Filesize
5.2MB
MD5a4d5882593378909c8e45fd38f0c306a
SHA11f10b136bc86b4c39f7f9aedde2e8e28d622b319
SHA256f6e61e0bb97dd90568eeb0a7e7f09b1d45d1be1bece47dfbe03dec001f77e919
SHA512df9c18ba992096f190c19cf2276b1eb1c61326bb94638d67a0675ada4949f9b7423ef9d7e568c47bed22e155f436c5a35003e91853cd6307bc10b501cb83c0f9
-
Filesize
5.2MB
MD5d4472f760c63ae09eaab570b4a4b6ac5
SHA123a15e195f6cc3540a9ad3115fa968a1e4170aa7
SHA2563ed34a7ee8d20272d0387d86b6229874699560147752ef7608ab0701f281e161
SHA512212f4b1baf34b515e5b4aaa06e03e09a149ee5815beaa124b732d69563049ba1a27e6558c429863ae02d30363c90437f2bca9af2b7375e0c03738b8a1a842b8d
-
Filesize
5.2MB
MD5c92733d46d925dcf61846383bfcbd0f7
SHA1b01a481ea6cde4869d96f706dfdba00b5ea1c10c
SHA256b7dbdf02393d386a904048da15d4820a95bb1cf3df3ef286fb3bc651ba514e85
SHA5124b10ebd6ad0b7a4bb85faebbeaa36d5217ab956d8ce85ec0853e818307f9e7e070044bcad452131c5d01cdd61235ebba30737856458f01fb1f4ce79b1188edf8
-
Filesize
5.2MB
MD5fd833d4fee8d3844e8c2ab53e6bd9f71
SHA115eef07ebba216828259eca67e5d78b6eb5524aa
SHA256d0519b55e52214832b87498711572beaee92b2616526586760e8e468c38d2e5e
SHA5128573e7f2ae39c70de39d33d2de4c4b53fe212edfc7ad6097a77b49258f67900c5a1d9351611a840ea85cdf92db0eb4994b3eaa564c371c9922878e2468e80a12
-
Filesize
5.2MB
MD5b22f4cbae69fe4e1bf197f7e1c8a4a26
SHA10b2d5c11b3e630eb294d21b7ba0ae314af8f6d09
SHA256bd71323854f1cfcf54c1eaebca699c1963b86ce83999fee896a56fa7a323638e
SHA5129d3e43b9930b03b60450dc42c4a926cb6e200ecd6d4a8d721fce6b178f8ca5fb3097035dbdcee7eba2a6d7476d00a2756973b9710ed175dadde6ef82db008bec
-
Filesize
5.2MB
MD502fbae5aaa8d8882ad6f12ddff6624a2
SHA1ed2e109e3a12e9353ebf3c8202ef0000ec9b180c
SHA256d55b81eaa349e582967e7340278acb23ffeb12d7af4074256d94f2dd79d17011
SHA512c562a482778734bff01a237e82ece91c1d07fd211bb0638064a147b83764fa3fce413452efab376810e75b968da754c8b1a819c7999c83fb6ed653dbd024bdff
-
Filesize
5.2MB
MD53857351f7c16dedd3685306ed4bfaa9e
SHA16ede3084da4f52658f859f419adf765ce8c9a516
SHA256ffc288d6b4f7a774e176c541272c00c62290854f4a3c2de23d1215de3e10e05a
SHA512468a36e017a8c0348b207717bc560ef6515d9e1fc5a790f1c97d9665ee06b822e9de7615b775ab21d1af6fe2e0ca067d1c53a39b6ec3f0a27acdfd8aa38f74d5
-
Filesize
5.2MB
MD530f25239759cd09a7459640ad747f0fe
SHA1dea6513906692cb93794537053b912ed36412426
SHA256d3d80f893cc8e0f7cf60fa272421e77d9b8a3e47a932bfb344b76b84806322d5
SHA512c10c761742a565c353257b0ed8ada0a4429bdf6153f7ba05eaeb900315e0e4ee95868d38b55016fc8990fd8c2e9426b76a1a8d547fc5c5a21e550a26693e1f6b
-
Filesize
5.2MB
MD5693fc363e1b13ffbb2f278804c86ecba
SHA1c49c5a0e286247826c60459ae4c6f871bf5ec31e
SHA25652fe5eb6fccc6147f643b3f2227e93a2ee4b8ec5d94b5769d931c1ef08b38b5a
SHA512a4fe51287c6377dc113f1aa7839b59e2db4ab9278b04a68ba9e610bc396734509606760950ee000ef287986698316a7a9222fcd51b92a61181cb782be0513cae
-
Filesize
5.2MB
MD5901e659243acd8d1facb1869ff866283
SHA16ce5f13f7c4b24257a347906e6ff2fe4755d8469
SHA256fde6ca7d6afea42906cc3c2beee46c34bca4052b0a176f7c2d8c294f2247734f
SHA512b291d9b33564f78b5b5a06d93e7a52faf59e85ffb87cf5d2967d9035413778d9ee6e009147d7fd772f3effc71cb4d05743833fddffe82ef680dee617215ffcf8
-
Filesize
5.2MB
MD599b52ed9dfa05fcb02795f6a88407b3e
SHA18d0ef227838bcf6dd3b98028fe192ac343335013
SHA256556a042c765244de0d02f809c8feebd878ff6ae8926989187b8ecf76ddd271c2
SHA51228fe351f3825036771185a74970cc9956d91685bf0de153802307b77356622983027c97113c63dc7e47631d70598cfe7a85d05b00ca31e699b30438b6e230a98
-
Filesize
5.2MB
MD57aa257f8e88c824c3a546ea769c5462a
SHA17d46ae4f82a0c274b8d74cf6eff1648774b50941
SHA2566f3d0fcfcec464578c564e870d325c3d5a4d66b5ffcdaa5aae615653eee7cd7a
SHA5128de195a3a7f19ffc58006a2b746df9bb6fac1a8770432f3bbd065b68154d4a6cf161e3a4a9f73aa2f31d874bf0d8c3db8a39dc2a3f6efaf86e7d263d0b0d1f5e
-
Filesize
5.2MB
MD52d0e7e9b9ad58cea3dae424042dcf423
SHA173f016e8e1982e2176f56137f866d25824a17db5
SHA256435da7759c34fa80867d7136727ebf7a38d8855487926e758ae2e1db951466c2
SHA5122f463e7276b0e3aced8b8a1ccdb2ceff80226a38a34333a3b19e09c3357a6815ada8f587470ba580ecd178c741e88301553be0a4af3cc686e0abdbb659d70241
-
Filesize
5.2MB
MD5efdc560357f75b40a312e90a79e25c44
SHA1f59116785b593ae94b29758e3c97095cb8182c17
SHA25626c72e977d112ef9c38b2e2eb73a4156e6960987d99794aec60d38c6c37ec14e
SHA51204bc2a4024e49e1f054a11f5ea7cad8f65cf07022a7f13c822f0a4c972111fa628586ac448609a7f078b6933509422690067e25c9bf747f6056af1f4cf178607
-
Filesize
5.2MB
MD549069ad790b3f92b70228cd1f9cb0199
SHA150a21129f96b3de443621abad6cf76b895e36e9e
SHA256ef3a7382741dea8f0af5973dc8a0b9ab8730524df21ef8fb3dd5df98e3146f38
SHA512ba456a8b471c7b96f42a342b27927a02545d20f9675ad147f5399a71886cb1981abdfb74a497bf6515b8c99aac974c8b6936f54bdabf9d5e186b291143b2b5fc
-
Filesize
5.2MB
MD54ce9c131eee9c6f7c40ba02c14fcc56b
SHA184e6dd30499f96c9d9bfacc91302b48889b44420
SHA2564c1132ae31bf84f7afef91b05da7da4ea2754052a4d018388386b779ad4a65f3
SHA5125bfeb5c9beafe904558356b9c3190907355284c7d752489d4b446147fe356e0b88b4367deb2887a47cce1aeae035ad09e46cbc608a666b023e0a6a53e1ce6455
-
Filesize
5.2MB
MD57551e30a82fc8cca3936e204839f17fa
SHA18dd95ca3a520745cee0ea12bef7368f26f15a74f
SHA256d9dfc828667ccd7f2ac280d52f5a21e878e217567c802cff0935e0aad97b24ce
SHA512e85be556cda6248a9dc25f13fe95fc7892bd180be03711c418efbc2939ee6fef3e8619535df67fdb70732e78b1aaa8d47ce48d00321f683d8d956685da434e14
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB