Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-12-2024 20:15
General
-
Target
2024-12-27_4485d19fa4c6770a92c3f6d2be903bb4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4485d19fa4c6770a92c3f6d2be903bb4
-
SHA1
2071cb795d55d26a16de981dff59eb8cde55170e
-
SHA256
9c6e72b2e0c5767da5c7fdde052394a7eca3c0793ed2d9d15aa2963ddeb10bf3
-
SHA512
3ed4d32852bb4c262e62401ee9b067803daaa7ced94fb8a0412ce14cb989051f9d6dc083299def679145bf0b46ddd6abe1fca3ccbf231bbfff7e37ac7fc701e9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lUQ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_4485d19fa4c6770a92c3f6d2be903bb4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_4485d19fa4c6770a92c3f6d2be903bb4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rOkqCOE.exeC:\Windows\System\rOkqCOE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CMoBzOZ.exeC:\Windows\System\CMoBzOZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IwBeeYQ.exeC:\Windows\System\IwBeeYQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pqmiKUo.exeC:\Windows\System\pqmiKUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Zaguqhp.exeC:\Windows\System\Zaguqhp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWnIbnb.exeC:\Windows\System\tWnIbnb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qbKYOWO.exeC:\Windows\System\qbKYOWO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lBTtqWn.exeC:\Windows\System\lBTtqWn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YpttgwJ.exeC:\Windows\System\YpttgwJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZtsYOiH.exeC:\Windows\System\ZtsYOiH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BsksTDN.exeC:\Windows\System\BsksTDN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pfnPoEF.exeC:\Windows\System\pfnPoEF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hcOXMfB.exeC:\Windows\System\hcOXMfB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kigVpaz.exeC:\Windows\System\kigVpaz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OkcSTTJ.exeC:\Windows\System\OkcSTTJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KkrPdlo.exeC:\Windows\System\KkrPdlo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KUNunPA.exeC:\Windows\System\KUNunPA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BbNDPNU.exeC:\Windows\System\BbNDPNU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IfmIoHT.exeC:\Windows\System\IfmIoHT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tsekghf.exeC:\Windows\System\tsekghf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YRivQNw.exeC:\Windows\System\YRivQNw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5da14c960e5b8a8bcbbcf0d2fdcd0cf57
SHA127d7ee89b26fe9a56970dea6e2ea05550e7bcfe6
SHA25669fad9ed735edc72b628000dc640606a2e950aaaf007dbaf3a2cf373bad81bb7
SHA512406e1cc87df0b9dc69753868fa665425a6c10ee0805ce6436f86e0dfe88f23c91e9424ea62761c8e0dffdef81e37b71b69f42314d920de2120bd8d2cb145bacb
-
Filesize
5.2MB
MD59fee2aca3ccdb0a082c37acfa90453ef
SHA1be8de1005c619e16566855f0b020c3abeada57f1
SHA256270d9a4d6ead717c49e89171cc19b7452317607710636fa26b0d55803b6c66ce
SHA512a3c5e5d54dad8554d84584e6a15047fbf7e121cd72b6cda59d825e3b99887a1c1d49841aed6a72c316aab65e7889279aa9dccf906733047c05ed8cefe5de0bff
-
Filesize
5.2MB
MD52b54c6fe0af49e331aa30d40aace6383
SHA1037b0114b87b950cd7fa7776c10d51fced03eaf7
SHA256fddc1e0da9dea69e083505b49582954c6801bcadd1a49055dbc47d42fe70094c
SHA512708894b9aad3f15f436d7d7e8d577dde15d7dc625f36404f9eb4ff8949c74724b4b868261893e02f3590b1ddb076d8d2cd03e15f8ded5bf44b8db52a2b70801a
-
Filesize
5.2MB
MD591d7c3028a90eb37f061d9a0a03c24bf
SHA12fb26177e597f02065898958e1cd1b41729850af
SHA256d58eb4d5c14524f5ac796bb864ca7511fcbd97992b2ff166d7acc62be88f32d7
SHA512a5e7a487d46ae8caee172c16260990869fe5e377f10beaa23900396d7980d92dd4d08b97e1a0e09509ad47b0e0cb3b8e8405caf5740bf1efe5b2d83b16bf5e6c
-
Filesize
5.2MB
MD5b564ef1faac3286505bc5ccf5915282d
SHA1e826716dc84ee6a0169e4e5989ba2cb4673e13cf
SHA25615a2e11d357c575ad8238b2a77a18b43bba84c7fe58e0ce85b4bb24faad4c642
SHA5125f4af5b20e4c2c7cda7a9f86b259d6cd261a1109b27fb08e15c960dd2361de15b32211dd96dc5c697a98dcbe0b1fb6ebc9d48fe69207c0b2ca4bfde83f177bd3
-
Filesize
5.2MB
MD5e32c2643058ac89425468fefbf3e1bde
SHA15cf0360a0688206864185de6e9a91a5f6498cb8b
SHA256203354a83ec06a04c71562c389d660f56b8fc9b95520220af3bffe572e2f9b72
SHA5122f363f804ed8e2b0d836da29ce8ecb6b39282b57b600468ca0e38883e2d49006947dce8b82dc12b7faf99daeede662197147ab2428acfd6f99c56252f049b228
-
Filesize
5.2MB
MD5fcddfed6c884c4f1c69aaeb8d571ad98
SHA1ebb767dea9be5704ac863d439d3f6808ce4254c0
SHA256026f4e7cf63d38d072c9e1c70d128f59984b14c31adc39077acee755042cf7ff
SHA512deac2c5f1064fd010085440862a23fedce5f0d21f0f9f02718383653cc105623ab6f80ef61edeeeba1e3d63aeb484214358e011e0da4285870073917ae6eda5b
-
Filesize
5.2MB
MD5a217c1ff7ac20481aa2bee8a1dfdd78d
SHA1d44cb9b8c015005fc91feed04a8db406d8a4b66f
SHA256c677478646ab2b7015f5d7e5e072c49ac1dd54969eb4e992a2608904f3ad3d9c
SHA5121936bc00e5b4955ea1ee0dde1c9235a8ad29f48bc9758d2cf466dbf17769dc8d0a85cd35c53493da39662fee42fec3a6c14375bc331c6d9a8287e40c4c70c16b
-
Filesize
5.2MB
MD5f7664e37563d1f8eb89ba25cac5b766b
SHA1c3794cf210c261a68a416e10b3f07cfdf2e0df9e
SHA256d2fb298e7071ccc5f1bf0aef8480491149b12ab22a5a71833f2b7feea1c5dfe1
SHA512e540003517d3eb46cbb37a19faf01e57c133ce6ccaf5391c784758436e74702147dfbd80d42446fffedd33521f51e31b9acb61c0bd07e0815aaf6f3b46421311
-
Filesize
5.2MB
MD552b9ef27f8b5328dac4f12a328c063f6
SHA10f02f66cc3ab36543d9a067020fdc83dba9773b9
SHA256125b59a67df436220def1acb94ba92cda6485f2dfc3be09c7a3259ab6af6d0a0
SHA5121cc5e972f03822db4b082d0c062d1c23064b292098e362499b98b2692848bcb8ab35540534ea3cbbb76e2d086246502deb6fa6b63677d708e7ca73b5bd5deb95
-
Filesize
5.2MB
MD5b2ee3f3da873859df476b4210842e423
SHA1a066f0572d20434bb7945d4dbd5cdc0bda6d61e0
SHA2567ed7a52af83d67f07b6c5c1e7f468c832783aa93237169e06b393e599639e608
SHA512e400c7315d7da05ff59ef3a80da79d04096e777e992aa2019e045be930dc1c4697c4ec5028ed6763deb4c588cefd07ae63b93e8c735851a0128273e65eed1c89
-
Filesize
5.2MB
MD5a17adfa92f91dc56f05af307dfa6c75a
SHA12a47d0f2e4c8838c41189d02ef57ab28484ba97b
SHA256042cfc78bb60fdca1bb72296ef855d3467a6180c767fa652fbbb3ddd5a6c4a71
SHA512bd83afa3496565056acbb6b2c1f49b78f0251ce123352de9fb86bce6b46c19f303590f43f640a207abe2b5002e23ed5ff88d1b897727f74457b9ec02c7d74e40
-
Filesize
5.2MB
MD5b906455b8e31d7b32ae9c54b4810bc01
SHA18aba0c85250ae30250b10469caa9cdd3c2c5f28e
SHA25670d20a654eb787b8882c8f82b27a88feba0f7a26af89cbdf0b2e35addf990fe6
SHA51232a7a86750c038f25749ec2089bd1c9b9e41f34f7283c521118e91f4acb57ec97108f10c131b282abdafb2559a6ae88c1a758e3a006cd512976f3faf2f349c02
-
Filesize
5.2MB
MD5f440df392f0ec84fde6122cc84738d64
SHA1972346983bc761eb21e439f96230907675e838e9
SHA25665b8869bf0770a2a20f3577902a1a397658ea63b3752466f2997d786549fa08a
SHA51276f46376ea44b09a9aa82d90f66980290435e6e66309175bd61b18521d45a29d330cab6f25f702148d00e0d2a08bf42c7d8a5491d30c5385095dfd155a7ddb27
-
Filesize
5.2MB
MD5acb9a5fa481499494c8380a53bf50847
SHA15e41b7cb682f4b7dbb41dc17e32eafb43c06c8b1
SHA256d23793dfbd6cf6baa8e00f51751e21e4295d9d8877530edf679c34c41016cf7a
SHA512faf00be823b76c4cc993c1a8246dfae1fdd15fba1f5e965e0af2245ca5fa40105f06532f25850d91b35b72d43a14097db05aa8d0bd2d68530d11b6760b212517
-
Filesize
5.2MB
MD545b55e619dce2fa3d43e148d734f86b8
SHA11bdaf8077c827af2ad7895f79591388673bf8935
SHA256937f72331e30b044b8005e02f350b83626e4a9c83bd0f460931727fd745b0cd9
SHA512b6f53484b1ad4c3305de38b170dca73d06c95b27b744d6fc6d1d120f1c99dab6d068c982b13829a2ce7a10175c107d0a9c91635ebc35df978f704d290ca52194
-
Filesize
5.2MB
MD55779adca54fe2ebdea66d585af0ee696
SHA13eecf5f91900d8bc10019f191e0376a8e710eb7e
SHA256150e44bd1ef090b38f86921b74e831eea8d4111b38da2622a119c634b16815d3
SHA51208b419b9e20a0ffe573568be17a31d278c14fa9d1b1ee05060fa26f6ec37502730d6c82017d7cab475bbe6f1f05a62578a27584807c49da9a9699adebd1520b3
-
Filesize
5.2MB
MD5e9b5f90bd8032e5e7d8f08d0880fcfe4
SHA1425731ce980d367bb53adffd061bce35dd4642ef
SHA25603046f5c41d472d5fd1bc43f7044ff98e8fb3ad45c91f0b3e783a187ec046bd2
SHA5127be2129986299fc01e12bbce7b6ada9dda67c9081087d801efa5c31ecc87fa68aaf4a1fd298c2c85d5a413712b313f6714f033265189292e01d821ddff580600
-
Filesize
5.2MB
MD5515712d4257fc19a469bbf60d45bb2e7
SHA1f544f964411f160ebcfd0355f602d6ea84679413
SHA256d450523aa0c2699da7f9d82c2794444c41cc747d60f2536679b57581b37faae2
SHA512d6ff5851c9f07f8c156fcfc615e14c56ba1605d308da8412fb2bb7b8a8defc6c937f5ab1bde1eaf162ebd9538a71d28c50bfce8abe36355e987a36cb5141a393
-
Filesize
5.2MB
MD51c914b9b635fefb94284939ca2e83f39
SHA1f3a8568ba7abb7ab4ce5bbf55ff22111c935846c
SHA256e7ff3903ddb6a1ae07f533aacd2f678897e4142728d3117b921d1d5828033df0
SHA51211e31276dc46a15d2aa241f458e21ceda835ed907c5d67fd6e9d13cb54b9198f356a51cab7d8dc5851bd82ee50b7ec14edd7ce44182cc5b064fdb955a129f759
-
Filesize
5.2MB
MD5b3cf4932ba6dd8b6abd1faba66dd21ee
SHA1bbd7fafdc57fdfebbe7ddde31318ed8b1f11aae3
SHA256b43b461787d62dd8b1b6df54b1dcf39302489efa81cd818aa7bec4a1ae2bad7b
SHA51265c2b0f5a11b66e2eb3ed653fe16285af6c9379e6b327a66d95f75cc54472fe92f06b87cb07579707124235ac96907f774f4c6002278ccce46324e04623654c7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB