Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
27-12-2024 19:52
General
-
Target
2024-12-27_3d43340b8eb46e2ee3fad8d2a5b66577_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3d43340b8eb46e2ee3fad8d2a5b66577
-
SHA1
407ce18eb349d46133d7e464881d749553399c5f
-
SHA256
6c292f37713ce6b64a92e207176e9087dbe222d1c837eb4b373240664b7d2d5b
-
SHA512
80e08209c755e839ec56d28a9494d55ed0a203039edee61a71fe7f73cb4d3154c5e848835649297fad1962f49fed916025639fbef120ea8de7df5c0acde2c79b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibf56utgpPFotBER/mQ32lUY
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_3d43340b8eb46e2ee3fad8d2a5b66577_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_3d43340b8eb46e2ee3fad8d2a5b66577_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SnEXprz.exeC:\Windows\System\SnEXprz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eZfOvRi.exeC:\Windows\System\eZfOvRi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bNjuFJb.exeC:\Windows\System\bNjuFJb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JaTzprZ.exeC:\Windows\System\JaTzprZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ErgLVBy.exeC:\Windows\System\ErgLVBy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OCpBUZS.exeC:\Windows\System\OCpBUZS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lKvyXHw.exeC:\Windows\System\lKvyXHw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IKEXMCm.exeC:\Windows\System\IKEXMCm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXIGiUg.exeC:\Windows\System\sXIGiUg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uxUXCla.exeC:\Windows\System\uxUXCla.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pWrthdi.exeC:\Windows\System\pWrthdi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EvOagtX.exeC:\Windows\System\EvOagtX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qqFYPHo.exeC:\Windows\System\qqFYPHo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SfglOIk.exeC:\Windows\System\SfglOIk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AuBPClV.exeC:\Windows\System\AuBPClV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\exBvOJt.exeC:\Windows\System\exBvOJt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HbnUYlc.exeC:\Windows\System\HbnUYlc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aPaerHt.exeC:\Windows\System\aPaerHt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\soRTFco.exeC:\Windows\System\soRTFco.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\laYeEgd.exeC:\Windows\System\laYeEgd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MsEscAX.exeC:\Windows\System\MsEscAX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52162d01cb5aa7b934fdba674d603947d
SHA16e3e66892a3ea216024e114704e674280952baad
SHA25634dfc58c12dc7e30b901e8eb8c3079fccbd014e3dc397e04786e727bd2ae9c9e
SHA512cb6b071dabef3f2c2502705ab5d4a63a983f5b5d3bd7e4bae588616b071a099873a5c9ea11747691e55ec50e2816ac13e9e13c0f5c8382297fa4ff6ccb320828
-
Filesize
5.2MB
MD58fae06dd0ebf1b89ac437799a42017f5
SHA137badf9e20449b88c5f3527a555f90dee1009303
SHA2564e1347bc8383cc80508772dec647979cbf28894b15444d8fe423d8b47d5ad292
SHA5122fddbf8c545c83d4ee78b88099a2c7af2a39dadbf800ef61bfdd74e8608d750de854737a31c4ed772c2a55781f733565009969f883f167055d76f09c93203c32
-
Filesize
5.2MB
MD5c62bf4308c4a050f5c9f235dd43ab487
SHA17135d479764de515d35000c2581ddcda46edc9e5
SHA256cc7e70719230d02730f71feb39e6174835f4d394140d4ddaf8888a7563f2e8fa
SHA5125fde4545756c04be8af7d57d018cbaf2ae6fdd75f861e73831aac15e17ef8559b86df7259939a0fb7e3eab9e2637c988439e31d354e7d495715f76d9dde3d31f
-
Filesize
5.2MB
MD57959032a8145e487f36d7ef1e1a14c41
SHA17ee6bfeb80bb4126464e01b9f777f58603a19fdf
SHA256a64d7f17fc3f9c71b37fd3d1f0acbeaeb5992591b4d7b7b91b943cdbb5a56527
SHA5125bbb5eafbbcec116c22a3697159d696df307ca5c7b2d23e399ebdc2212ef0eec32290217b9103ab518793839f1115b51bac680d98edda594d8b7c458f64d5160
-
Filesize
5.2MB
MD5a128c5cf1785b19b9980287279bf73fa
SHA149dfffb0bb628c2e317ac0ae206fa6cc0ea33086
SHA256ea597c641906a5057a620c8edeca1de685a437fce9f4fd6b5c35f68125e6b3ec
SHA512932e3dce7c40eb52660a40c4b8b2a0b938544a74c34d9c1eedc797c0e9a6d871701fe12f73ed20f3bc2013e551a349729c2656bde6b2e64452c454c22d0bf189
-
Filesize
5.2MB
MD5a7fa0004173eff2afd41514937a7dd41
SHA14a484d6700e321f9e0e4f0d0e09841fd9158fed4
SHA2565aed452933512231ee0278c52ef8d8b6328f0432aebfa28ba9354a0a41a1cb2b
SHA5120b6d0dbd951c8fe75ffcc766e179e7c7b9cc1423deff4da1d6dd23038b871b7ec97142c33d564152c1910dae3fe4afab74c2b08e212afb15a38c18acf6282ac4
-
Filesize
5.2MB
MD50f85eedabcdb38a843e7d600e88ec50c
SHA17a8ab267a2efe4acf65a1fe303a5599fd0a410f5
SHA2563edac4bc56e3cfd9a512d54db9f2b73cbb54ad0e0d76921e119cca11e5d25ed2
SHA512c526f4f9bbc4240cfb3e252c6ca3f2375db48d0eaeae189d15d01edc049e61ea5a3b4491a913c92fb9e6c8d76699cd047472da13bc09f2e1387ef2c8a39efa25
-
Filesize
5.2MB
MD5a53dbf3ff7f49695e6656a98d5972603
SHA1ef0ebdd96206201f478a72830da5fd24a791d9cd
SHA2561f9c3dbcf7e8eb574e3f27b2108e168475c740325c037342a04633c2c1e07e60
SHA512cc2141634177b2c3eb23b2741ab7a306fa2f3e7560a34f662b2b6db61271610a74585bc99ebffc027aaa20113c183fbc0a636510f507dbdb646219369296cce0
-
Filesize
5.2MB
MD59686cf4e67175284de96158c9a6fa218
SHA1fd85357ba97cf6ea557e8422da20829ba8d4072e
SHA256e0f55533f42328584be49e9083a355aadf44c7a7a137d5ae3d4dfba8125299ad
SHA512ae5ea0d0316e3275fe3e93d4b18f3f16edd022ea574d3798a2523d57f894a62f2a511101d1588136ad7a71f9349e70a02903845a699ca2e69290761f07f1e897
-
Filesize
5.2MB
MD56afb90159f05b541f0d060e15858e0e6
SHA1bf871153f57af4eba5a18eb828c9938000261736
SHA256fc21d0e8c2fef3d9509a91cfb9b876020f101d01e1b43d03ea3a590f1b81efdf
SHA51262d5a7693d6fff133bda9ca1b1383b70027c71cbc956e25c47e1da184058fecb8860b31e3d021f7af172d48915a098f154a04aac103dd140cb50efb80359e339
-
Filesize
5.2MB
MD5db2a70f920262fceec85105fda3b61ed
SHA13c0fb275c3ec5547c08fe338143b7c0be7852fb1
SHA25696fcbe70f5e4b3c98f47bc5aab16081eec8d75781c32acbbaaab7e75578f8095
SHA512c63b1fdb069ffb35369583ccb1ec18678a30b16e681617ea22d532a79915d33658fa886962bc27777aa012eb9b6d25135fe922baa0316e6bd217bdd2a681b896
-
Filesize
5.2MB
MD52932c56ac1ed1b23a2cf4576005ab24f
SHA1c302f73f8c4cedc788c8c3eb1c62a4964aacb55a
SHA256d1e7a5e55a2a8345178aa4f491accd9b5067bc4ca1b54f99ae8bc53c901ab406
SHA512d6c406f2c628ea47580685bd8ab89b012795a29387bd5844df5fecd1b6f20469914f4614bc286aa2a3613de0eab6b24cafd18ba84a93f4e196fc0ae3bff76c06
-
Filesize
5.2MB
MD575d89e8cb380f313e2bd917e942567c6
SHA1410e637d91a838f5a24f96b6f4bba28e5f22ab00
SHA2564f4b0db745cf963f9436d1aa86985a4906eb198d37cee72cd5f11ed07b00d95e
SHA512684a384c861cf1c35a85bf8171a93ac8c5e41bce036887587629211d84a0713090b67137a1ca1fa8a4bef29e4b063fac35da50ac22df46c3ea07f8dfd255c499
-
Filesize
5.2MB
MD529296d0d0445eebbd95386380ed47f04
SHA19ea1cda0c8d8c267ae32368422a0f35715d688b5
SHA25652e981e5f9a36f7339d46b6ca7e8be9059d0cd3339786e5fa1726814d85c2498
SHA512d2fe3f0f56eacd7142ce0b203c7945a9c62a3823d475687dab6eb6164b788537a717bf2f1e7728e1c03b3c72c0508a993f12dee48cfc13d981a38ef1b93c6ad7
-
Filesize
5.2MB
MD5d7d775fdc37b29ee443e5d8ca4d67552
SHA15a56cc34d1efa5f7d0f17b02c48284fb2f7a76c7
SHA2562da0898da89edef9ca04523c426c4673681ed2941a4565776439d4d374c9adbc
SHA512f09153498e31ffd80a5aac2a5c97206078344f5c37447926c924e9325984d415e81f9544a6736aafd4884d8cf374b7d2f516944a1816c2fa156c7478c61ee95c
-
Filesize
5.2MB
MD50aea454f3e732658a5b97c01b64c0c6a
SHA1e6fec3155d0567c66f510f50b830ef8900d74343
SHA2563591048e20546bf01ca767a858cc68649820f3fcde1c410a8be50cc7e4ea9bf0
SHA512e8373031cbcd9fc4dd96be5b4b114f56e441c26fa3984d5e581261809070e2b175c0683f97dc3a74879a08cda0fd6f8bc8ae70251310b27fe347c2b820a9e554
-
Filesize
5.2MB
MD542037de50368ece5e42e4ee973b070d5
SHA1754c3df3bfe1afee437380562e749b7eef6aaeb7
SHA256ab35193d90ac5d97ba0db174044dd6264a7f3391be2eac8db36dbc75997fc521
SHA512eeb0898a9a0d9102e2d810149257c6d7e9c4ab7e650f507349c48f3753ead630d5856586f5bc8ab70528194983e02553c8bbe4436002964625535e1a30a0aa61
-
Filesize
5.2MB
MD586f8b7f72fe8b454143474643a94c119
SHA1d01ea57541f9cb4b2f705f5aefae786093af48fb
SHA256fb2c54f528b33fdf2bcdc07b3e1f67db4b0cb3d41b7590993700e71359babc9c
SHA512f85793f34bf0ff7f5458ae4d3e713be7875475f398e040ab549c52d44ed3fdd622d594fbff8a44145570016366e9a2889529d4bdadff7cb6f358877aaad9a0a8
-
Filesize
5.2MB
MD587da7173474376333b6be9ff190dd54b
SHA132bc4005c6b3cd817d8814adc0a5b5e46c9b487a
SHA25640159f280b2cf6f9c27f87ac137134855b022bad6803942ea84a0b9b2d8e66c4
SHA5125344c9d00efbaefa1629bf733c5cbf7fcb2dd6630443fca4efd085bb350ad71d93144f073bbccac912f6ef8398a2870f2a544f9a7866dddf2e13f231db2cdda7
-
Filesize
5.2MB
MD5d0d0aa492530fe3acaa94ce7e2f5edeb
SHA1b8f51090a97a25113eba0655dfa52c3e43d7004e
SHA25615d47de04d96eb7a9986973902093082c62dbfcb39e3166bca1930a0afbb6922
SHA5127603cabfee11dc65fb171d07fde2acc27c1a7d71ef935f05be8fdd4900b0d1f8d42b47a689c637a03fee0e2fbbf9aff2f92b48beac306ee6d08b214c7568f318
-
Filesize
5.2MB
MD54614f05caf1d9df533e89fc9996e1373
SHA135a0e3295957543a89be9a073a5c83f708828eb6
SHA25614fa41d509d694b22a74ced37d0fefef73d78dac64b544cf4b64e8ce66ee6050
SHA5126b9fadcf369f7fc20ced338edb8368b4be4c71700cd5da0cd7c3af43bf29e8ce8e61cf879c7e3961d346ebe8689583bbef1243c0d37a7cf89e069bc72c7ef234
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB