Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-12-2024 20:02
General
-
Target
2024-12-27_a4105353cb4e931dd44836ec40bee483_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a4105353cb4e931dd44836ec40bee483
-
SHA1
4aeb1979841731cb0063ffb88297e6bcab340161
-
SHA256
7669205c5a9d3853792ff640a7aa52045f6b3e387618ee24b1402c9236e3267b
-
SHA512
a504ab3ef408972d7e8fe69f43ef3c5bb68b0dcbaaefe9885f32c9240019fd502a3d2eb2edf777dbfbcaa150676e95ebb686091f6156dd87930641d06a64e0ed
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_a4105353cb4e931dd44836ec40bee483_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_a4105353cb4e931dd44836ec40bee483_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\iRoyFEB.exeC:\Windows\System\iRoyFEB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BlSKfUm.exeC:\Windows\System\BlSKfUm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FarjEqp.exeC:\Windows\System\FarjEqp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RYEJgfo.exeC:\Windows\System\RYEJgfo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UDrRlnG.exeC:\Windows\System\UDrRlnG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sIjaEBH.exeC:\Windows\System\sIjaEBH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hCxMqsz.exeC:\Windows\System\hCxMqsz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CXfPGoH.exeC:\Windows\System\CXfPGoH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kJLBNlS.exeC:\Windows\System\kJLBNlS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TfBGxWZ.exeC:\Windows\System\TfBGxWZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sUPaagj.exeC:\Windows\System\sUPaagj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kjVDuhg.exeC:\Windows\System\kjVDuhg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VkEdZaw.exeC:\Windows\System\VkEdZaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fuzQhFE.exeC:\Windows\System\fuzQhFE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nGgBXhD.exeC:\Windows\System\nGgBXhD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tgQxeOQ.exeC:\Windows\System\tgQxeOQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rLCJxiW.exeC:\Windows\System\rLCJxiW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KIwoQUX.exeC:\Windows\System\KIwoQUX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Zpkvueg.exeC:\Windows\System\Zpkvueg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EjDjAqz.exeC:\Windows\System\EjDjAqz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yPCtQXB.exeC:\Windows\System\yPCtQXB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5741f979197c9f6f8752b812324030342
SHA1788a1420d63dc632909e67444170e50f43ed4519
SHA256efe948c9a332e6d0f637b25cff7b6c0cde1331cdaf52b36d996ac03cf9605e0c
SHA51258b4de3ebcd3467eb2129ece84a757e8774598ddb34eeb43955547b3f18306f243212482f3fdd74fd381b9eae71c3389c938d187a32b8c529dc878ab920a112c
-
Filesize
5.2MB
MD52de8d4f7426df3d742157887e9d47e27
SHA1822de3d748c7d5f868d387c63ce77636290c60ae
SHA256805701acbef51e881f48494d6fecf725cd8e0b338f9324afb07f94338b2d27b8
SHA512b805a695b50bcb07976f7853dba3188cedfa222ce712268fecfac16bdaaa37e62b796e00be25656a1ab277f5bf4e57614ec2992674c7c3a340ea9efd564dc824
-
Filesize
5.2MB
MD5f9214d63c0c14595b2dd30b616432d03
SHA1f6fd1508e8164c847216aae8898782c77f31af02
SHA25627f097a6f1033c25e7bd78bafdcb0ff8303c2d0c9100f713c40d65bd1d2da2ef
SHA51200881fa7062119b7528580b78f0828018407c914f03b55f3a17aae6bc1690cba2a95c83047b0c466948a0736b846c9813b2b23bd9ae502b7ba231f9152a7cc17
-
Filesize
5.2MB
MD59bfdbe084169b900ae62d498cd99fa11
SHA14db0038140adf9db84d41443f9cd98858e3ed072
SHA2564d69f71db898a32e3240e1a1d8891e45490be53916e07e6916f2d777f9e9cf9a
SHA51297ad572c459797a6797bed4ff499c1e20e566ae427a2450b67138b5f3fbcf2e1ed632b1793cefe150dde1eb483a9a3e70f86f7ec077984c859d82522f5663fa7
-
Filesize
5.2MB
MD520cc23dda7ba6f0dec3bff620f5c5eb2
SHA14eeb2ae86e49bb4df187e6fc902f7fe442dcb678
SHA256b2e1f5596aee91751ba49e129921a49a7f4484488def5726a5f012732e4d8c61
SHA5121089e09028292c48f5490c26b864dac16e4a7c087e74a4beaa288a99551a1eac1d86941a96cee6d92fe2f3bee168a43345e4e25cd2d3d3962f77cf09339712e3
-
Filesize
5.2MB
MD55bf4d29c10ebc779262a4cb14f8f5526
SHA1dd0d9c07253b9c94f6e54e4fd87cc8a3f0d406c2
SHA25662dd55004151e8bfad1e0bf25c9257390cf43807b2900e1b9ca67866fa46c9cd
SHA512ca9cc8c501d5eb322b82626f89af3e6244a6b800f84289c4751fa0e595aa6449226d8567e2d7004ae75dbb0cfc9423586a55c4b6e5487049265719587b4cd50d
-
Filesize
5.2MB
MD534354c8ab9a85b234997cf923499cd23
SHA18d2a085bab48928561021ac4ce66c9fdadf81219
SHA25649aa5f174ccc82bb6b7f1c8e216a8becf9c40d96f908d91ae8b4bf0a1bffc383
SHA5128e3b74b7d413c6e0fb68a29ce6384082c9c89a3dfdbdcccc1e5047c02b20148b79c95cbee21decec8c63dbc4830f013a647b3c7303182eca64f8d0b1e85ad2fa
-
Filesize
5.2MB
MD564a57d9d178d446b2298cb18cea8393b
SHA10215cfd81f095ab42e20f00efa2446702760ff33
SHA2565541808be14bc2b09b890432f3ffa673bb9a901cb75995151c96e2f4e1abeed7
SHA512ff5d5038f59131d7bf9b2b34972468d4f97a0ab5a3acee2e7e3ddaf221b67715196c37a252c47540a3b87c497facaac308ea6f6b9aa891523538588a9aa3d659
-
Filesize
5.2MB
MD52eb159780051a681629835671230a59a
SHA137a2d9a88b78bbd8945c8ad97b61ce8d55a22c92
SHA25687ec9a90bfb522e2375228f721bbab0bf10fae8c21b08249e0be4504de9d0a46
SHA5126dfa6f0cc134cf529cdfe0c05aaeca7304eb01cc157345330717633bf74dfe3a2deb524bb1730c4c6c5be1920e48a7e9122eac2e80336f9f96c0afaf85fa4e29
-
Filesize
5.2MB
MD52ed052f0c9171dd48550454ec5f9665d
SHA1905533b829eebba501467980afd4cb19c1ad7b59
SHA2566b28fce4d79729156b657dd14e97533438c8264f910dd9ff713daa6e33869b07
SHA512ffb0f6775734818d3fb5468856adf1519a38c1fc8653b00e4ad2fd76dda0ac27601caf43e989d8f21b8ea4bc13a9bf5422b95c282b606c1d040cf6fa7ddf2d0c
-
Filesize
5.2MB
MD5e2d5a8783dcf76d7cbe9340d1d4faa1c
SHA119e4d61b0d5f47a7b0a977774a07ba933f93ca23
SHA256fb9230ac63a4875f782ab11b23592446c5b94a6ac2ca2d6bae75bce92872f494
SHA5126ee44e8a78342358253cb4a910e7e932351d8a9d6ca6bf01a677a02ceb1d59126fc7d0b5da2e1ab3e7c1fcef6b4fe7e501c1b07b688d235678b72d2a7c9f1549
-
Filesize
5.2MB
MD5b25ce2ea7d7904f6aed57ef8251e2ebe
SHA1a8bbbdd2bac9adce860fd492d9c05505f64455ef
SHA2567067c9c6acf43e630d5f1b9fdd12e0785440ab4f3ca2a54eccf9a687962ae0b7
SHA512ce2d7d8d664dad40fd72264808ad1cf2c47ae2f0b606e1c3d670110ec2b53d99d1d6a10ec5293144b57afaf2f6e009945231f1fd88387bab4a73ab944167d0e3
-
Filesize
5.2MB
MD5f07e5c12b86756d9f47bc297de643ac6
SHA1e92aa97360d161fe01df33cc2707897c2e8df199
SHA256bee6b7eb8ce8f34a2d3840161ba35144bcccf757130fd8af14b21236ddefdb2e
SHA5121fc6bb1c7e61088e4d0b68db93389deab65f9e3dd697eab8fc1c057396dbb772801b9166932d03a3e82378eb4103748a01b8c572fcaea498597bccb2ca6bcea2
-
Filesize
5.2MB
MD53fba1fd0e21990760bb0d882e1914ba6
SHA159f018f95526775b633814a8a5f70434e61cb76d
SHA25648298a84bce47ee3a0d0e3cf38ab818c57d26a43fc4f83fb5edc6c7b1b2f161f
SHA512c00412a8b8a4e2449f2da80546ee7a2d36659d75d4b2989d9e9132f8b2f250a19a39266b1295ec388fa4607881841781650ad3f9379aa758e6534aa1f79d56e5
-
Filesize
5.2MB
MD53af3a58ece131ad128d9fcd1f600c1f8
SHA13367735da46e54c3f692693e003eb78970948729
SHA256f13eb05b17f20ddf87be0301412eaa619f6b5c880f354bc1059fcb4802821299
SHA512363a15a4a530d0367b07a47e27db1edf6852f2841e485a32c057db8619711e89efbf6c3c1fa0f0f231ed4643f79be77a5c1a4a99e33624c7c7c791728f0e07c2
-
Filesize
5.2MB
MD56667848def5e87f6e65cb85f604ddd99
SHA1faf3b8b3eabaa97ddde46ac9b01b2c0658e999e6
SHA256ce5899ed37159af709276d2a8b8ac385cd2f19f2b21ef8dbed6e49f933a398b1
SHA512422d5401778c1a9b9eb00ca195ffc5fcb21b2b4c05da5be8759cef3bcc4f49fa35e88db8454978fc20540a43b2c7c26a7a3ca82761fed95fdba58591d906baae
-
Filesize
5.2MB
MD54888187ce5fee3a33561ca33c211f10c
SHA16c054ca83474f73b7d11ea1affd232d52ce0ed53
SHA256152f966c454faba680698d32d0f74d7251b36e7549508b87816eed5f90656363
SHA512dd1bc62b092612df5b9b34d64446832dad94060ba9f72ae55e1bfb2772d9df5c739a7aa489970c093e4853253af20a3e74c01a76f4da0c75d7d3bc10fe211d2d
-
Filesize
5.2MB
MD508c6ba24d67330a9fd3cfd2cefdec24d
SHA1758a15e3f7221ec68b09196db695cf25caa880a0
SHA2564c0713b7a78f97b1a1fd43db706f546b19e5cdaae0e2c811dc9c34e02e6d5e05
SHA512634558475179ce7efe1543751d7bbdba41e38801309d882ead8173d6c85648ad2113af8b33a47381c4abf3af21ba2b082ddd9aaf1a1eed4eadbc9bc7659622e7
-
Filesize
5.2MB
MD57475f2be78d48eae1de195ddd5be428e
SHA17c17349257b64778b6d2414d5a6121a0f8fca8d9
SHA2568b11c2ff68b3d0f8f20adcae16b9dfe53b97dfe22fb87a710ceec8e37f84fb43
SHA512c2ca7fd92bea1305daebf1764d6e29f1c26c50f628de7d3c05f3eb82758a9bd0c0730f3774e7ae61c272cd7115fd6ccc553f6314825a6a881dd315bd0b26d131
-
Filesize
5.2MB
MD568ad1fe822db80b7001674303acfeb7c
SHA1e9a5fa043823ff49b4fe687bb6ad5eb988735ea1
SHA25609e6415a4184130d9680a5eb98c41784f365d4aec155fabae8530560b3f02bc4
SHA5121b502f6850779cdf64349b152c98e49a4c74e44c4dd6d3368fac0d9297b063bf8b5cacfb08dda83212786091036812e418f5c0681958783fc99d068a45cd8f12
-
Filesize
5.2MB
MD52485221332a9d5136f26d43ea623d320
SHA17f668109be1e8a63e424f62e13f58311a47800e4
SHA256529cc57e1554cf6938e726187477935abb364c0154b158a005e83f29921fbef1
SHA512e062b475f5e7e8f504f5106af4e20b941ccd14a614096831bcdd4a383388bfcae47804424d847315060b285f23bcade1df7a4d4a9820e1b0173a1dc405b277e4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB