Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-12-2024 20:11
General
-
Target
2024-12-27_e4cac74f43a9f73cc0728d38482d171e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e4cac74f43a9f73cc0728d38482d171e
-
SHA1
977112261fff435460b1880fdcdd8bb687fff836
-
SHA256
6636e15c0e73dec8a3c9b644f5103f1057058c31efac04eb35a18634e00bca9b
-
SHA512
c408aee2a4299e00b785ffedc86b654f326fc8cba05838dbbb4abdbb549ce8e47ca2d3ce3fc06f6a4d5e97741b97edf826c801edb9a647767b974329decbe91d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUp
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_e4cac74f43a9f73cc0728d38482d171e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_e4cac74f43a9f73cc0728d38482d171e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aYcchHw.exeC:\Windows\System\aYcchHw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oIusRZX.exeC:\Windows\System\oIusRZX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dqQPQcM.exeC:\Windows\System\dqQPQcM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ehbmjQp.exeC:\Windows\System\ehbmjQp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eNadUVe.exeC:\Windows\System\eNadUVe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FtXDxHW.exeC:\Windows\System\FtXDxHW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NaTfklL.exeC:\Windows\System\NaTfklL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\axCscoR.exeC:\Windows\System\axCscoR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vWOIgWt.exeC:\Windows\System\vWOIgWt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kAzKXqe.exeC:\Windows\System\kAzKXqe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HscvWuY.exeC:\Windows\System\HscvWuY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nRAwtuV.exeC:\Windows\System\nRAwtuV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YFbdLnl.exeC:\Windows\System\YFbdLnl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MPWbgvD.exeC:\Windows\System\MPWbgvD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ePkBPut.exeC:\Windows\System\ePkBPut.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YiyvUJw.exeC:\Windows\System\YiyvUJw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lSwpzpr.exeC:\Windows\System\lSwpzpr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZsNnJXS.exeC:\Windows\System\ZsNnJXS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mQWrsiw.exeC:\Windows\System\mQWrsiw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IVmHQEb.exeC:\Windows\System\IVmHQEb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qtfbTGG.exeC:\Windows\System\qtfbTGG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51e40939b6fb354408067199cf0bb2e71
SHA1a25e1176efb682d65b8e4f0c2eb5809d98833ec0
SHA256daeba571b207fae5396a504808f0bde4568c3aa204f4806f60359f8d611d084b
SHA512b70c865e79251e4a280a4d6bf7e38e37c1b2b07b7670eab63ed1495eb8892ee2bf7a06f5463006d711341a780bb22d431a7ccbe382189efa702686767bb8d588
-
Filesize
5.2MB
MD53051384578fad9f88542e1a697fecfa4
SHA1a0ab16b2c1557428403641464b6edd6fb22717d7
SHA2563d195c8ce085b78bf776d57debb4774c935000ac70acff606b297d5d3a07009b
SHA51232d50c48155582caace53d4b1c8f460a24564fbc31e0f507e66084b8f200b52911397d200f8d418349d9e4b71370f2ca4fdd169077c810a57faf3a94a725f49d
-
Filesize
5.2MB
MD5233121ca8f8fb2a481ca4d16a44c34cf
SHA1d8f968327ee15d1dbe8855583782dd4ff87f40fc
SHA2564f16b63cbdc7454b11d5a7d1b8dd9ab2786842776a26e5c6ba1c69edf6b0c9ce
SHA512ff9244a6f4f28d5b61c7760cd9d544ee753d2a807fd4543e68a2d06b70ff335ddb4fd12f28e38f6f39e65da70e24151eda7cb995c786be773a4549a015cc1ffb
-
Filesize
5.2MB
MD5af4f486369d0c09c22cd392d17257057
SHA12ae5a9d9d1b3c4d97869ad8fbe612fd7081e2de1
SHA256fa81d79354151810ecea4cca167484cd3744708180a90d4cf362bb62380e1895
SHA512769c6ae5a7eeca620d1eb6256e9d0483d7abeab4b4502a0498aab280e090b8266fdb0fab2677c395c2db9fa5e61f870043820b8d4a8b84881174d0d80a483464
-
Filesize
5.2MB
MD592f6f880dd4706ce40b81c57495aa0c5
SHA1c8ab98015451b3cd96e2a6e49c16b88b897ca8a8
SHA2560227891685e5a124676d42c695a3630b339dd59bb3c45af519d92c674adca516
SHA512acadf51c0d300678cdcf747a85f73ec35a3cc3afec6ab88d98d8a8f6f5b535629aa6f7553e4a0a13715abda0be190f3e448db85f71cd5e3e811946beb1844c37
-
Filesize
5.2MB
MD5f6a774e02bb4d180bc01e0fd209d579b
SHA1026664b628afc34fbdd43521fd5c5cbac558495f
SHA256ab111fd5c4b742aef5052c25cc9d2c4708fc90025d7caf2f0c82e4047b33cb40
SHA51211134ebaa573fd5d55134e9683bfb793f5b4a3d909fcbbbe0ca36d2c90eb58a13718e3d5f62d0648bc00094084b08591777652a56f08882159db7912eb8502c9
-
Filesize
5.2MB
MD509851c9cd51e3d17ea718d08d31e2881
SHA1df7f843e2fe3c88f6f9af32883f7cdadc749a8af
SHA256128a7109338be2c13d0663b2faa2c1bfab115cc1bbb46c463d74055f2fd749bd
SHA5126a6f78725cd322ce5185c14e6bb9cb5e285c7a4a120f213fefc519de0cdcfce1ee632054ab4adea5d29c0973bc1c2014b6134caec3986cc6052458c0ead55268
-
Filesize
5.2MB
MD52c2364c3b4c6a46ad4b7bb54f4eaac8c
SHA1b323b03c2dc4e5dffed050cab3608db17205adaf
SHA256520538bc64fff5a9871f546b99f274d056adf7ead21e50090b94bf302825ad43
SHA5126cbf393e625e8c78ed7672d3c30fe40bc18dd1d631267d56a831dba15c4c458b92c8afa1b89937e28a03e6cee24faaf55338047131de3c3598002a59a231b638
-
Filesize
5.2MB
MD5e95240e0eeb5ea57fc96b7f2207d094c
SHA1c280b5b5568f8510a5161de338523bf0f8799893
SHA256effd1dd111180b95fdf24e3fe0b12920d29bfe60074033b65da2ea5ce2ad4cca
SHA512a87ea38cdbf486c6f8517feb6273403dcd0f904483f0a8591fd6f54bd31bb5531137dee59d33144085f37cb5a3474f158ef5c30e1eca8036d3ad8b86aa5cd4c2
-
Filesize
5.2MB
MD5294316704f3da748b2646e1649e0c80d
SHA152f126ee16bcaa617d8bae2290735fe875341da6
SHA256649de7eafd990f116c34734071c4cde3e23595b8ae3a626770aaa9e57b658108
SHA512a930452fc154c511d8b1d0eed587dce080f2dac62749e74c09d1c7e724ed6370e7a498a534ea5bdb008c314ecff5b6ec0f54a09c75f6faee0c063f95894c788b
-
Filesize
5.2MB
MD5c437e4d46f80e62a0de619bb947814ad
SHA1f89ce0ff1ab32e3b5f9ebb7b80a1e775d41faf43
SHA256c0175663bea999547ec98961e1d67de96c122f94dc2c10d604d08963104ae16c
SHA51237be8df55b7a6c7a8a1c392c62ad2d74f84c02bf59c92ee1d19ba0d22ac626fda69912b7ef5c7a5708c83cd1906f81a62d2828683180edf8b19c7a0f97d0ab1d
-
Filesize
5.2MB
MD592f242c5f6677f991e632ca153656fbc
SHA1343315b97b344844aaf4f235d1d934f72068a61e
SHA256117d270545b04f91cce0b99dc3501a41b745058a7264ce6d32ca680d2e4b0eda
SHA5129201dcb86cd8747156e802d4d219ecf345ca637005d3af3caca77e75f63add59dc576b99ca76f29ccc60d5c5cf1f593d1c955709c7802fc47d92dbc6cc81596f
-
Filesize
5.2MB
MD5f51a8e88636bc0283fb1b8ac5c12af4d
SHA1abdd7c9dfd092e2c31171b6ff8984f2e0a12b294
SHA256dfbe72c8a4f9e87f3168dc949ad39c96e5471a5b692a84056136746462fb08b8
SHA5127233ed421d595f6d8de4fdbab7aaf1e3db1b0aaa25857dc50585af13a632564e842bc88314f62a2baee0b3172bb96fc78d2b10d446d47705184c75bfc70549ba
-
Filesize
5.2MB
MD5ce218958805ad23e799bb04f1ef6e38d
SHA1c2381bb5c2aab126bbda89b035c0c49ccaa3af3b
SHA256aac304be16617d4dabcfd1ef92040f59a0f7c51bda0ebcc6bacec275ac3ce0b8
SHA5122c0eb7894fb6eb2216e850a207b5fe776e973bff3f8e847ec078be563a092e9e27946520f5371502c70956bdcf9e0ab53de11cec17c60f27c9163e5a8ff4dfea
-
Filesize
5.2MB
MD58330f005d899bb0292de50ea0a400bab
SHA1face22dffe7535b7b288d0197449f815db2631c4
SHA2561203576fbe598c279586b5633095b3a0ef206d6911fb442f65dc348aa009d372
SHA5127af876c1f6153018e87e461b5a02ae551731d9d583d138c16041ac0a5604a8bb9744b85c2ea11820c2ccd60a915b6722630df8cce34d3982caec0c48616ef323
-
Filesize
5.2MB
MD504dd383ef959fee9c547ceb3dbe6134a
SHA1ce0a698b23ed1553854a88c0baab97326d7fbc1d
SHA2562efe55aa7193915f2d634b55d17ccdaa79e104585f791e73cb63ef2e9095e952
SHA512cf37d953bbdcf89e767524429043e55a201fcd1fb1585cf5b11d1751b26cde0fa79b8d89209215c997f9c699c2a115f9b79e4a2d9f7e3ca890333e499f7a7615
-
Filesize
5.2MB
MD5b8494bd6e6c6f979a1b11618b4efb281
SHA16f00f731b45bd3a3420d126848ebe09617216af6
SHA2561c44d1b5ec9524194feb9610e2b653a9a156bad6b82a201bae21dc22781cf4c0
SHA512b79c38e25c9919c50c1b91e29f073974f9beb29cc662b9e30a8938a8ae0dbd55a85283c026758dd0245b4167c3017d6038eb8a882f9b3d57ede23361ac565922
-
Filesize
5.2MB
MD597a5eb200e86b81020a025b0a1a5c664
SHA1c48f5522f2b46239038bf0179ce2c2965fca6601
SHA256b06972a3c9d265f2f2a4be85fc484ac0e5715329e3f02c11b6c57c7283cd8437
SHA512968ac2f5a1881ba370c28be310d6655cc5d58400f41823574a1b32d38e39f07ef1852baea1627256ed396be637995513367c1675a669a342ce2f69997c7d206f
-
Filesize
5.2MB
MD58bc234fcf424d96d57a9f2b2bbcda090
SHA1ed3360460b8b65c7903a45889a33f0aa3a64dffe
SHA256ef0b3565006aa6132103a0c1073a330226063b8f7915360b403d7e8b37af05f9
SHA512f1b7818bfb5f72de8006ef5287f8555ee8d9e0d52926118f4bc0badcabd379735ce25c233c4bd6c781129a4f8946f3177c684deb5ae6696f1d95630bc30cbd99
-
Filesize
5.2MB
MD501feec0ea150344792d6c8fb8232c776
SHA155ad329c7f069628bb6ed04b81b7d030359fa606
SHA2561c7fec3e4520b77ea39cf9191e92c108ac8164e3a0314a7f5a2664df34d01ac5
SHA512553faabdeee49fe55bc8111d25d8f3d2fcd84c3b7aa4bb77d55b786bca9421580d35bfc2da7e99f6a452c167e1a64b2c629653e0936e1566a451ef5c02be4205
-
Filesize
5.2MB
MD53ba983b143234261d2e129c74c3f48ce
SHA1c0d38d9c74ecf1067ac40b59b1fcfe8301664ac2
SHA256f94935f23063c71d7d546519936b917025980661bf0f1beaa532885a13372ad1
SHA51226bf0ca5f5d4ccdb16083ca2645be35f74d0bcca9706e19c3bbfc557f80e137fde9c6ebb08c2a985607aaf84b9a05dfbb6d950bf97445f9a890d45dbc48f79fc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB