Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
27-12-2024 19:26
General
-
Target
2024-12-27_99a5e4738bdb888968c2703abe3dbce5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
99a5e4738bdb888968c2703abe3dbce5
-
SHA1
c73256936ebbeb491fc635e9f9a0dc2a4c605e18
-
SHA256
c08a09c4360b33cc61a78e18fda9abf52b1d1d91944c4256fd64eb50ccf35146
-
SHA512
042f67e405e036a080a485359f9150c9737da7da6ec1b5a17f2d6ee35535832b491c60995509749dda93fc9d463c9b4107ac7b23d795a2bffa841c270f3612f7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUZ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_99a5e4738bdb888968c2703abe3dbce5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_99a5e4738bdb888968c2703abe3dbce5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kMrAhxU.exeC:\Windows\System\kMrAhxU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LuadOVP.exeC:\Windows\System\LuadOVP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TEocNzE.exeC:\Windows\System\TEocNzE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YEXqjmV.exeC:\Windows\System\YEXqjmV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mimHuNc.exeC:\Windows\System\mimHuNc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zPYipvb.exeC:\Windows\System\zPYipvb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rlIhLMs.exeC:\Windows\System\rlIhLMs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yEuBWJg.exeC:\Windows\System\yEuBWJg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GZJLQIn.exeC:\Windows\System\GZJLQIn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aCabIcq.exeC:\Windows\System\aCabIcq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xpodNys.exeC:\Windows\System\xpodNys.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bFPxcDd.exeC:\Windows\System\bFPxcDd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MCGggUu.exeC:\Windows\System\MCGggUu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CihPLUU.exeC:\Windows\System\CihPLUU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LONVfXE.exeC:\Windows\System\LONVfXE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qzeDJqD.exeC:\Windows\System\qzeDJqD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zyweFTX.exeC:\Windows\System\zyweFTX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LdSRGHg.exeC:\Windows\System\LdSRGHg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mGxBpVG.exeC:\Windows\System\mGxBpVG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SMwYJOz.exeC:\Windows\System\SMwYJOz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xaHtbdv.exeC:\Windows\System\xaHtbdv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f6a7a3dad027089d13cbfccdf4e6c3f3
SHA1d3b5a876af34bebcd754d26ee2f11477463322c0
SHA25677d35fabf9d99021fd5961d67d422acbc92f439229118a892dd21c56026bdbb4
SHA5128e0ac353878e9bd54341dc7ed19148b4ef97155b9ba4217c9f0740a697f9fca8607e31ee446971e1c692da21c6f152ec8bee71278d55670767f67301c2922665
-
Filesize
5.2MB
MD5d9220a066fa60cb7a00d5f341e14ae08
SHA13740fd73688ae6d1c2ea87c51947ac7397fbce0f
SHA256123c4cb7f1eeab8173687bda4bbecff7a160b7ae21374c3f64b8b6310bd2d4f7
SHA512eff27d00581e906c54a5033160f9d837d48852ccfc484d96f81ce53fdc5a92fc08dd992465dc55285a567015925f2147fca44ad58d196ed06024ba478a04461a
-
Filesize
5.2MB
MD5d092b3b3ab49e33fd3e6941ef1f1f631
SHA1e8c032a0cfaa073818d23e7eab7819ecb2af3cf2
SHA25697dcf8ff5155434be46faa81cc15e139ecd609da8ab101760d8e81f164756944
SHA5128085b73eafe0e0ce858c2d7b41ffa1b0e007e59dca1eee885e3642c0afe9f2e9a3a5b2fd8c45c4983ce8836931ef10781842b041d06dec7cc66ba5e230dcdd64
-
Filesize
5.2MB
MD57d9b00a7a4a41922c0fe0d4ec4d7fac0
SHA1d6dc66001cab446f100e99126876ee1cbcff0127
SHA2569d69ac5e6e4d541509b8eb8cd5fd5dcf0b2ad72dda3acfe46a395c7853ab0bbc
SHA512f651dd0ee7d1df642a61e4b8b32969fa30ef9c24567de63b1cf161cf20130ddc61d9f63ef0b77b726dfccc7fe99340d161decc0cc0a2fd36ca6b60427d910914
-
Filesize
5.2MB
MD54011d8b8d0fb246d3922f9cc603be895
SHA16c5ede7ecd77254238c713133f5bc6f2d0933c16
SHA256a3ce707977db56c9c09bf9bf08157b559d13976eef8711532e5ea0a301786076
SHA51206dfa2063afc89d80ecc3555d11a745c89df6a45f2716e987918ef56bcba840dd449ef633ff3a872da1368e3b786b632c1ec65a34ce10b11c9a26d621f4f5d3d
-
Filesize
5.2MB
MD5de56ba8dc4216a55adc1656a6e8c766b
SHA121b217572a89ce53376261d6305fbe293b311a8e
SHA25665315184e59cf75facb15d1324d88b5e23049c5c2cda09631c12a791dd680640
SHA5121f28fc3fef4dbf101ceec84d7d0cbe14220bcc66323ef684a005ca68c10d7855e15fdf9ad43575b1049f958db34da94622f9779af3a4063c9c52d42af78f2746
-
Filesize
5.2MB
MD5be1238738a3cf9a70ec7058be143ff69
SHA13d0b47a22ad7f16d8c47cf2d76d8e5dfd8d7e984
SHA256c00a9f11097a274907f35bcbc73345fdde743008cc35cab3e3e43a1c3ca13777
SHA512223fd966cb230567563d2f9f91ae96cd50476ede68d3df056af59515a7dcd9dafb774cb1e279cc3f725518e9f584e90b2510ffdd19e07f7b4ee35af9d473aac2
-
Filesize
5.2MB
MD59e575729a9284e9774c3def3e01e734e
SHA1528d2d36001a3aa9188fcc6a0f47b80ddc17a244
SHA256cbebf16980d3e82db228d80716eed26772c7ac961510014179d1014abf76c484
SHA51268b7aaf5213ec27bbb3c318f2a2bed1b0c0bf42fd85df47c5f5bff20a687dc92e58e258f9180f47750b3b8440656ee08551cc8ef4375b5b580489cc8d013c137
-
Filesize
5.2MB
MD51816341ff50fc5b95c3115cfa90980f4
SHA1832b6d73755f2e84654122e95e362a55fa1f8821
SHA256f3f0796ba51ab257ff132be77ab70fee104cc96af5565b483d8d72c4b299a271
SHA512f7b6631274810593fba56db72bb42ea34695ab60b731d1dc04b27ec4554eeeca0532404880aac2935de14a359037f33c545c42408eed7ef862260fae821ceb58
-
Filesize
5.2MB
MD5b4ad9735c8460b60d4c783963b5e60f0
SHA15b7c73aea3d2379dbf3a3f8cd0bddc4f319b6aa8
SHA2564bb74f256ca5601106f16cb980b0704bf37774e888dddf07ff8ea82d8022230b
SHA512ab12e1ec5ad15262e50f7de1de34363680aa24b248470a8d0a2496ee4879b56993b72ac668f1889c6654845ff7daec0714ea0723d42cc420ee39fa11fdcaad81
-
Filesize
5.2MB
MD52d395399b1193d5b2066af9b844e52d3
SHA1d364cd1331cfb9d2d25af736a03f3923b65c38b2
SHA256bfb10b2ab99d5850979d114c55bfe148c643fc0c3bcf4b4076a2199912290575
SHA512fbd6942946b2f311312c1559da7d97736e80acadec694aa8162f075cc53615a3d8cbaba805fdac0820509dd79e21cf8bc2fe40d12db8db08733f16e313cdaeb0
-
Filesize
5.2MB
MD58467acf5a0e02f8db1d7150eccc5cf0a
SHA1c6eb87012b7fef14fd78adf37eb9461969329f6a
SHA25681c5d3ad4ab668bde22aa38802ae92859600f653bbc8e2d565bfb47d6a9154a2
SHA512270ffa3412a2ad957ee03d37698253793b054addb8228627cec4d3eaf4955f64df232dae9b8b359155ae087d890dedb76b441443a1a5f7c7fbab8933ff16a5ed
-
Filesize
5.2MB
MD51078bca728d8819b7917efb10ccac024
SHA1f06140f754fa037f4559fbca6385012c375b7f89
SHA2565f9996e4f1e2f4ede854498d03a0d81edfb437ea2ebd601fb998bc2d781c8feb
SHA51291608524264f9779fd4c3da67901fe4cccc50fba52f2a03f027d39004325e3becdd15e4117bc64ae69916b055b08f2c3827884be87b43a6938d92b2ca291890f
-
Filesize
5.2MB
MD5a78bc996829acec9ffa7f42155b7e847
SHA1959a9a206149733cf68dca953921d669be913882
SHA256b9c7a0e833ff5ec02085b30d4e5367f83baaf1586370b0a3f7c2e62ef06f1cee
SHA512e8a366665c14a7ca5a19717c813a95561595407a7044b71a2788edfebd3907183abf01de36d0e2c14796b049aa962da0a336349f81a741269623c1b615e79365
-
Filesize
5.2MB
MD5d05c779d2cceb54be8fcc79c98da9f5e
SHA134328dfff74d36e23aee705cb8ac2e56322b4b55
SHA256a8f54b50613ea18a74976cd74496b832ba2cd50f6f393a88c13d0f5f3f2d4ecb
SHA5128e5bfcd840bf621a4c13fdc38f11a59b413f36b2eba95e5bb413e57fbb5ee2dc39f017a7819e3165f90de93985f0f2a524c412891de5cdf0cb5bd9e3e66c55ab
-
Filesize
5.2MB
MD55639ba5996a93987cbc285e7f212737d
SHA178b8ac7dd300ce8a499ba700a643a65c424f1d45
SHA256156a2d29ba299fb3a73054bd6e44b974f2535e916efb0049f204c4dccb0f442c
SHA512f9f9ea9f84bed0741a220b81ee774446e206c8d66cd07dba171984cfe6840fc3f2cf003f6f7455e1ab6c5f33cc7d35fb65a05e49db607ed0b6f996dca48e595c
-
Filesize
5.2MB
MD5fa0f141e8587b39204c7e4bd332742dd
SHA158467dfd14ef8a63b73d1cbc958a384e61c0305d
SHA25664cf090178d3c55d433d0d9f177dd5b8f7881e74480127dc3d9743b4df40cd5c
SHA5129d6bb2b10e52261cf1e3ff33f5568fbdf8cf94e25c19425e030f7ee32323adfc11798f8eb2d644b852f2c1bf1b68633f736e0539c0dc6e9ef3e8b3512a1d34f9
-
Filesize
5.2MB
MD524e5148d116a199e7f4093ef6159783e
SHA12099e83252cdc06f78345d62ddb645cf2909f969
SHA2568534aa43042c8d589026276bb67b34155ad2aecfb16225751d7fcc2891ef656d
SHA512c43720fda961b0f49d95f72e7febf4513cc95d76ae68dac679253d1429a35723d79eb25b16170a6c2e4a3d09754b21ed171efa43eebc462f9d71adb69e5f9118
-
Filesize
5.2MB
MD52a12aa462654d59485565edc8cf5699f
SHA110e727c25fc1fd3f4f84c7dc4bd2a0db25cb26c9
SHA256538c6ac865a796674fcc4e004d2d841d46f3f3d719fe10c701578f77ecf7d8c7
SHA512646ada02bd8e75b32bd0d0a937c605502c0ddc3fd9e5ca9ac3d83d4ab41d4e3b57228eba9fe5c2f187ab4f8b02427dae6cee8fb430a740b111c48302e35ba00a
-
Filesize
5.2MB
MD5231175db8f5ab386bd848e0914fb2f8a
SHA1bbd97dcf33d27c41f2166080bd0f0aa9aa1c3eba
SHA256c3c3667c9b29df19dce2c47ffe8d5536fe892d9c43ba8b3394420f074fdd1d53
SHA512a1b9c543cb97856961434b5a4b787b432d292b81c76a435685dbfcd0cc6a0662ed62daa0ada0d5f6110acf4d387dcc7c61d7e9ee097cd97f555bdf20afd721fa
-
Filesize
5.2MB
MD54ec90cb560b309726f190309eef6011d
SHA1885f9e62f938860ad4239f46b24eecb92b216eb6
SHA2560ec8cae733e826fb4a43716adf7d0b52554e93f8db10380a481d85d46e297dfe
SHA512357b0f71299772892d0f07c217ea2ca1981af9e2d3415463414bbc397d4b93d5e5774a7dca4b5de179319a00f360cc6c052097477fb4da7836259835a7ba7d1a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB