Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-12-2024 20:19
General
-
Target
2024-12-27_5054368619cbd5c917be75a46dab33d5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5054368619cbd5c917be75a46dab33d5
-
SHA1
6814d2a4d14998747ff22f24d32dc2655f5b9759
-
SHA256
9b760cb95a5b9f632b856e419b02f7ecf7d5d1bb599cb10730d2134357280b04
-
SHA512
01415d643ccaac875b7cb995daf97c4da6b51c9894199d47b52eb0b7a499e104ce2bb2a9e80fc1eb91c9d289c51ead9724efc00a58f1006f2a05613ca975c449
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibf56utgpPFotBER/mQ32lUW
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_5054368619cbd5c917be75a46dab33d5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_5054368619cbd5c917be75a46dab33d5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RJCyLcC.exeC:\Windows\System\RJCyLcC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\psSYEID.exeC:\Windows\System\psSYEID.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VJqXPxU.exeC:\Windows\System\VJqXPxU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sBaUflL.exeC:\Windows\System\sBaUflL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WndpdMT.exeC:\Windows\System\WndpdMT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YEmXyFD.exeC:\Windows\System\YEmXyFD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YMRsOFY.exeC:\Windows\System\YMRsOFY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yvovIbP.exeC:\Windows\System\yvovIbP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gJdXXIW.exeC:\Windows\System\gJdXXIW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gsrGGne.exeC:\Windows\System\gsrGGne.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IHmrlop.exeC:\Windows\System\IHmrlop.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\drJiymt.exeC:\Windows\System\drJiymt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BWJZWqX.exeC:\Windows\System\BWJZWqX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ptINtNl.exeC:\Windows\System\ptINtNl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CphPWry.exeC:\Windows\System\CphPWry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lTvynCc.exeC:\Windows\System\lTvynCc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dHIWPDD.exeC:\Windows\System\dHIWPDD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TmPJhVQ.exeC:\Windows\System\TmPJhVQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zYqYYKE.exeC:\Windows\System\zYqYYKE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QtfTbHv.exeC:\Windows\System\QtfTbHv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\boYnJXd.exeC:\Windows\System\boYnJXd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b27ced397efd92f4c650270ac270e6e1
SHA1dd84acd8f30407f78944018e45d6abd9c762b156
SHA256769c0b72942c4338940e963b62927891e97375670583aba14be6f180f887ba22
SHA512956267bc3e79d45dd99d6d944e903567b70531113df8e7c7973cd8e1b81c6ef247834bf59ba414331a6a3bfaed16ef031fcb5292f8ad12f18af20ba04fd0b4f8
-
Filesize
5.2MB
MD5d3abfd3d53be1e48e0891b4a90f57e62
SHA1b7d7144b630c12b05eff038d2505052cceb5ff43
SHA2565d9e712cfcd3527aeaedfd27869c373251241125eae36f97b6ca7c599ea82c86
SHA5126c105fd14b4a51d051b18cd23f7d9d336deb8ff7ed087d4e79b42697ad8db0ae6dd4353aa4fb23205dc240e5974d9795b5832dbc0ed26cfceb606e46b1c3ffc5
-
Filesize
5.2MB
MD554a5afbe3f39afec6f5a1c195b7573d1
SHA1256aa7e2d61b84cb152da8f260a0b29041cc72ec
SHA2567311896de9577ce4624e7470047c49fe83b185df899a3c2a3d43d7e4eaa04323
SHA5124a3ac63059d30d9ff432d051a0bb15214bbbced591233266377c4528463cf80880993d18ace2a2acee805243a5ee65cb810c5d2b79305b5c0dbdeb88ffe929b0
-
Filesize
5.2MB
MD519b1e4f637a099564331d8e5fda38b8b
SHA1f8d23bff1322a96ef0e5dc89ff186c3895a9ee7c
SHA2568a8ef98313ad5dac54f04ed760f22819ccc4e258cb4b24184f257e2de2c18cab
SHA512e0ac1c6c5112aeccb7135bcc8c10359c53bd6deb90372ed368fcdec1977d7bdf9747c068ba5bf38997b911409addcfbe14d53e1f3237750f5d65b04999f4599e
-
Filesize
5.2MB
MD5bb9723d11ee02d9effe30fae04567a84
SHA1ac41ec2672fc8ff55ce11ad955a063e021ed040d
SHA25647ff886ef3c7420ef776c270a92353edc70446367115db5296615e8ff4067229
SHA512e88c5b2d53199be3f93c137caf04057421dc51d97c579548b641deb295f29a17f91fdeff1626f3ec2b4b73310f454b7a65b902334b6a7c552477cf610399f29f
-
Filesize
5.2MB
MD5a0246efb4145c068f895b11050116014
SHA136c49a8ed4aaa7bc14e8c5486f3eeb0fc2bc564a
SHA2567b12f46078625b18cbcf2d61c3de71ee8de6d8299dd828a80e479d04bbbbd631
SHA51269811eefbf5397eac5657e730be4fed91daeb4994a61f97a34629ec7de915778cbc0ad3217eb8784032e5dd59a393ecea914aa7fb2b761a697ee3b04df4cd0da
-
Filesize
5.2MB
MD5af86a17f21f9c7428598121e89714832
SHA1700e923be9c4f7a3f70b26599389850388441f9a
SHA256f9d48bd1420414dead232a71a0a9bc37bb29d0e7d799d6ee1caefde372cfdc85
SHA512cceb7d32ab873bcadfdeb9b1a964c9325166adfb1912bf5d23d486a70c6fdd4e0a7550a88ef89d556ae7a4784e3b1228757ee8f85b3771e2abc332a8cbc5a355
-
Filesize
5.2MB
MD5bf3ccb4b0f662b2d89dab4d179664837
SHA177bcbf7bc0646b8e87629c917815caf41d1b9ea2
SHA2569f7f9ca56ce99144917c3a6a7b993ec770eff7481ee7110ddff4b4b80180b237
SHA5126df63ae4c6b60e4d0776d92270623c28cf906e5ba5d6a58bc7cf792ddfe653c87e5c0590de36f9fab1112efc9a8dbfee777464699eb102491704610ecb73b40d
-
Filesize
5.2MB
MD59120164fccb96e1d96625a092276c16f
SHA167e444ff9b17aa7ca4b3591703df9e9e9a3a5f31
SHA256a8c1df5c728748f824b9afc382512a61c63a6bdae596b9d5082e3422b8f13872
SHA51268f7b4705229dae09b764ac60924c5b3852dfca78a85127a60b861c822bc24c11528c123e634dc2876987b656ef8512fcb4b070fe12ebcdc9534864a4d37315b
-
Filesize
5.2MB
MD59656b302f166dfa62fed16567c2b0b7e
SHA1adf44a94c0a14ef61e666e048e7f6f72faa324a0
SHA256d3d1f892ba6de84c2432d2d2ebbc4c6b29a9b267fba183a8170f13c70c2b2f27
SHA5126e0dc53f8fa514f42bf422ea834e3603d7f7c28959f125a680b9ce49157b64326adb0bd9db48bebc7d58cf34de0b2624914f3b1471dfff748a44a9b85edf4add
-
Filesize
5.2MB
MD597ac9c77621dbe3e3259512de10442ba
SHA13fc2a54226d495a67ba49bb8408e71639020795b
SHA25668c92cd85f16da3887ff26815b2c6f4b9206b1165ec7476951d21c21cd666273
SHA5127e886b8b2a9dd6ec098c99553f2ecc0525d9c78bc11ec13563329607a9c4bb2f83340d086bcc9732400b8bccda2fbb437e683e3ac1cd8d8448543725db2cb95d
-
Filesize
5.2MB
MD582fa6bac9bd9ec38b5cdc3f0f3568c64
SHA1fd043348fbde0d899374559e3453065933eb966d
SHA256a2612841e4b68307b221d10ac135f3127c8a631df98ed7a3ea05e241158035b2
SHA512a6453741194004bf37a6bc684a8b535b8731e302103616d9e3553a976ea80d61ea747263c21b89b08b50acbe22dc25a5e06c622ff9f09da336b8fed9c9552037
-
Filesize
5.2MB
MD511dac5cfee990dc48a6853a566adad9d
SHA15b11f10e75d410ee46fcc3c1fabd4c61c2118a3f
SHA2564a7572126a866edf21b75c82ec4e0c59d63a257040d4f9c283ebd4119e3dc385
SHA5129288f7270efb12a2fd9db13016a02c94c1c36b86462c082d9c0c8f5f7d81d2db684dce2f92d49862b249b48da17d07d631c9601c3d299e7f124d35830a75f69e
-
Filesize
5.2MB
MD5fe545c48f493d4257788e9f94c7a66c8
SHA1d8161996cf85eef716d5f2a4118968056ee6d6f2
SHA256e99a05304bbac251dd3f94abf0e9dd46b25ed3e2bdc2d00bc817b6ffbe705d16
SHA512111bc1b288c31ae9735f14ee316b4fd9876d74c803e225c9d9a38fa7aef51baa0c349cf41e401f0468d22a7f205f44871fbf1feaad56303a67e26ff087a58e88
-
Filesize
5.2MB
MD59c0feca6ff4dbbdf7e038faec2df9421
SHA124ce35ba37b135e3a9e838666a24311edd5bc8c0
SHA256f910a087a3474f7a2b63fb5dca65a972897a5a6bd71f3682c30ba79fc2f0d108
SHA512a9d2bea6bf7e6539350631ab1dd6e7cef035ad136fd085b496689fa1408bf01fa0cb94ecb2fb8122be5d9e8ad2bccb7dc9add189cd8d39fad8b2aa8dc2d7452e
-
Filesize
5.2MB
MD5fda5ef64bb07572487def94ecdba0e65
SHA1e6ebaca1a629b863faa4f6723d63ecb0c6048391
SHA2560a099ae37d3ace46eb2d28310cfa5f1b6cc12a8d4ffaae465e9325772ba8b2e0
SHA512268a820d68511b117371156dcf74637da5865ea9de44e5985d9f2673be8138fbf91f6d87b4e936d05518fc336cab21fdcc0fefc5205fcbaf1e9dc99e98f0e816
-
Filesize
5.2MB
MD5e05b5bcbda8fa5374f53f1827a309c68
SHA184ccb0733f61459d3037c1f49d2a8007f5dc298e
SHA256228715bf1c6eec46f058fa67babdda4f32555f2423485a6aeb04aa58316c5c75
SHA51217c0439cdb2bdaa49d9778040eeaf6575cc6b5cf159d251e57d3c6b882fdc2547256ef72343ff6caec9f29f2266671ba0a13237e84ff8db379999fb052d193a9
-
Filesize
5.2MB
MD594cdfcadbadf8416b327c7723496ee80
SHA12be5c8fb863b19dd4b83c670e859ea686f2531ba
SHA2562ea3c1ec9d503678d52a11081286ffa19ea5f78865b871cfc2f2c3a576718db1
SHA5122fdd8d7cfa00f8281a552f66a45310b18d08dbb6be4a04b214b021fd259435665e29ee4dbd4ee9529d35d6bd856791262155637e5644a63baddb7c99f8e9bcdd
-
Filesize
5.2MB
MD5ac65d5d7035b8d15dea4e108af36b16d
SHA1d8e1e318ef26dc6c2213d52c58efbe3b2f87ae3b
SHA256ce2bad0d86a7e8e5be16e4908c354bdc3164f98b47aa3819749d694c9e782382
SHA51265cb0059e71869e3456201b89c711d0a4ee90acd0dbf528195a3c25aca21abe80164a28181dab49529a8504986f9a44789a13f1794126dbbf0b348eccb05c714
-
Filesize
5.2MB
MD5604e72e21ed5aaff92355b905c7e785a
SHA172fab9c49163599719aaa096c77a89a36bf20cb7
SHA256c2bd32f6f9cbaae3f4412d44c04d34d827db35843de10552d115cc6146638396
SHA5128cc8246c364fd8f5eaea2c556f7383654f204da012919b36c672541e5b41a7da7d6d6d0528b787b3484654a869b9875dfe3ebd3d50b6000a30adc8dec2d965ff
-
Filesize
5.2MB
MD542783ac44190e2f7e643a39d39fe28f1
SHA165501d51bf81cb4a1859ca9fd6cc2f496a8700aa
SHA2568e4253b9dcc779fefad628c640a8d38ec81fbf45ceb6d03910de47bf97e829af
SHA51278672f8ceae0936ec6d98ba88ddcab5f0f9d0be671e9f4fd99af7f02b25c2f2c7586b9b31a15cf4c481ba7cdcb9319d952c9503876e51909d2d4c80c9f538dff
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB