Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
27-12-2024 20:47
General
-
Target
2024-12-27_ee12c8a1ca0471fd6ee220af7a22e514_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ee12c8a1ca0471fd6ee220af7a22e514
-
SHA1
f56bf90eacb7677fe25d2dd72347dd4b53b328d3
-
SHA256
a5e4c1e155a70bd1b69a43dac678063fa72e93903652a67476747da77ec09600
-
SHA512
ba394b7c3634874818d0d72dd30a4b1a437773908743ef9a0f9c850e06abcc7a87218b6075db3cc265296380312a912f97eee6c6d2ea8db8ede009899279ba78
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUv
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_ee12c8a1ca0471fd6ee220af7a22e514_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_ee12c8a1ca0471fd6ee220af7a22e514_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aMiCEmf.exeC:\Windows\System\aMiCEmf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MpSkGPR.exeC:\Windows\System\MpSkGPR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QYZiZWA.exeC:\Windows\System\QYZiZWA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IWOzcEI.exeC:\Windows\System\IWOzcEI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mzqICXt.exeC:\Windows\System\mzqICXt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DXBFHzz.exeC:\Windows\System\DXBFHzz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mbIeXji.exeC:\Windows\System\mbIeXji.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gvzbinm.exeC:\Windows\System\gvzbinm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PiikulW.exeC:\Windows\System\PiikulW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ifhKNZJ.exeC:\Windows\System\ifhKNZJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AtuWYem.exeC:\Windows\System\AtuWYem.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MsRuPbK.exeC:\Windows\System\MsRuPbK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KysVXIb.exeC:\Windows\System\KysVXIb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BUMBLHF.exeC:\Windows\System\BUMBLHF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tJRkNDh.exeC:\Windows\System\tJRkNDh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xfDQMOO.exeC:\Windows\System\xfDQMOO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dyzAufj.exeC:\Windows\System\dyzAufj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lCfpKxH.exeC:\Windows\System\lCfpKxH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mafcUsT.exeC:\Windows\System\mafcUsT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VzdugTo.exeC:\Windows\System\VzdugTo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GOskldV.exeC:\Windows\System\GOskldV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD563a58ed53cf5c8c90e550d8bd7b5ae5e
SHA1e171bb0d34baaa3fa7a4bd0af204ac1c1a48eb1c
SHA25614da0028b59eecf844c84684722eb15f51318dc6e3e7adc8170f159ee7d3f0ad
SHA5120b34960150254d79c7ebafcc20fa01819243f61226a4e9437ad88f64c3cbc9c5b1ace50a3093df8e1b215e38673c85f24cfb183b0f743942f89fdde4f1a65a45
-
Filesize
5.2MB
MD58eb4504c84c95d2da2e81d1b05b3becc
SHA10dc5a889459dec397c1d4584c4063522c26a2222
SHA256a35e60894fff956c4a98f8cefcd1280d8d40223d89bbfeaed7bf0bccfed24637
SHA512ed5e3577a4a535fa39147cabf5bbeb0083edc9b796283a5f4e7da0de763f31afa7a35e8ec980a5c2b7a083c5e0dac06d1fbef31b223ef1e4234050c48b49f66c
-
Filesize
5.2MB
MD5f623394f997e8b64dabadaa92971ff13
SHA19d17c541e368364c6c541705528705696f914048
SHA2566d4f8752ef0a7c64e745e3250d5abd4871f93e5babd0181ed5bf6dd5088e9797
SHA512400391a03e31ac51b9ae6ad6a79c7d897e01ea5e534627d0d54aa013bcf114c88223f03b177d9b547dcba3b8423e2b52343cb5094713eb238307a81873427997
-
Filesize
5.2MB
MD516d517b362161c2d00a229764eb98c1d
SHA1bfba1657122b3967ae2d454484a8224fb75d8c98
SHA256378bd9a49d473793ae8a1a11088352226d500627ef8d36e445639a5ae96fe264
SHA512a29528df04570d8953aac7a2049952edc68e2cab4f7432d1172aec13d7a007df13719d963ee259fda07bcb15f2033ac7557ce806353e0cb2eaee6939e5c98173
-
Filesize
5.2MB
MD5ee6b3b1bfc4699507bdf7ac54fd0559e
SHA13b2cff1805cb5aa0130d4e3100ac5a18746c23a6
SHA256fdc301b43b215404b607b0c7dfaf60ff6598d5ae7abf3e6efcce10cd4e446d4c
SHA512ee119182cd942d72a58451460c2ca5cf310d02e705851a54fbe5ab77d38cc6c1af92ab6a83595c6915dcb9b799b0ad168ba65e05e4c0939f63a740affb20b4f3
-
Filesize
5.2MB
MD5353ec6f75dd34761c0043ef95bd33692
SHA15217af9049f6ef2c539a26978580924bb247fee5
SHA25622e09bbafb63df6fe3cca25ba15e6f98b96c4252899a99be5dfecbc682a33be4
SHA51253f8d0b0cf55533781ac35d1e21d35e25abbecc20510e3e6b778d84a931b4e7b184fbddbe163e5eac15034024abe48726893b2bc9b829564cd39c19e181f4536
-
Filesize
5.2MB
MD52bd899f7b8efef881e8f4dc34e2681d3
SHA160b0da2dfeb559aaef9656101f588ba02c3aa32d
SHA2562d1599a551f4e2555961aa79e253a4927ccb005578bf2f59373df4e86efb5fc3
SHA512b162076ecf91225fda0cf9779fbf0244174a6739046c5bdb36b7fcb5d1166309a5c9675d031aa7ac09052b5b19064d7b68ea14c7a774656d697aa4424114af78
-
Filesize
5.2MB
MD55212e4a4987ee3a3db6a0341d20511f9
SHA112699124868c5caf249c8cee63a123d416813a68
SHA256d25a811b71754cce20fda55c19256e4c46a4526b6f180a9c812c4b7cfad6f9e1
SHA512d0a10b1da793acda8978e560521cf1bbb9bd82dd8edbd43f6f5c368f4be4a64f83584075cdd73344fb25c6ada70255ee4c229c2640cedcafa310c3ac52f3c97b
-
Filesize
5.2MB
MD546a56756a6ad2491eb7f936bc1fe4d27
SHA1d0de319a1f9c5bf488388da6beda84fa6d6cc424
SHA25679ab9d7afb7c5d31fc9556f577bcfa62e155bb5037b773f16c12151ec6589e80
SHA51253d5be5ec4776748727f813091fa87754c3f4123e8e87ef6cddea2d4857383dfa20e52afecf930743dc1581fdf748db6f7e539f177518b3c22088c4e55643fa7
-
Filesize
5.2MB
MD5c475af14c9c977e29e41f5df4f0d784b
SHA131ef9c1f8f64a174bc68f9ecd046aeb6d6d4cddb
SHA256850edbd0458c33057accf9878efcf00740591c5aadc0474ad381f1b77ceea28e
SHA512e4a0c70cfd886cf898abda05e43f57a27a05a27fb8a1f166f9c4823d380e0d01623b57a8a781791b047bd0d9a9168bcd94c00fc296416c0ea3128e7df840b964
-
Filesize
5.2MB
MD5c936bce9852d0335a716c8d7d6abb2da
SHA12d45b4b2c0753dcecd73fc14d714d23d69ee4fb9
SHA2562569f6b0a4f6691eda89435504f9fa8c0eaf82f0c8fbf0670ae7f5d91015b66f
SHA5125f6cf55b01d53439e50afdcd9f4df0ee6349d46b65e16a59a9f8692282387720a0b18e4db795420818cad039eed2226f819fa2925a52188954206b1df03e2069
-
Filesize
5.2MB
MD56796c6a115c7b48023c7c6a92874d949
SHA190f31e43c3322d140f8fe0ab17631a75db15d985
SHA256ba19b6468d5eff34efaf0028d9ee3a74362109f1df0360d1a40e2c03d8016bed
SHA512ef52622ae788421989503767db6235b571fbdecaeebd7b62fe5e79cb93573f0f58ac764674c54f7d4c056b3fe97f7516584f4300a0de92ead77d227ef2395cb3
-
Filesize
5.2MB
MD5a97c9330a74e383ebba461d22bcbbe58
SHA151f46e08c80ea84ba3d03e1c41fc7e6b7e96e2e8
SHA2567311430348634ab4afaaa3c556464915ce313c3e3d0bde127959e43e281b5e65
SHA512a69e662381f507762c02d4c0369741439dffd0c7440f1a139658a4a59980aec2bb018865669ac353c0b342ac255c273c83706382c04d97719fe59453cc646ede
-
Filesize
5.2MB
MD52d2332ca5993849f75508ef3fab42c69
SHA1ee05b4e45aefa64a2cf55eb6a6791d6f8bb65db1
SHA25613fcc7179680d9e60faa1ec8f7c5ab603d0c644ebae77d0d08daf2f93af74c92
SHA51222a644e3c3d03d022396d5cd5b87626173650e727539aca9df3bc4e5a51685828dc465567cb6989b3b2f62da4ab8ae21e617fa512487f10e731e8242f1b2980b
-
Filesize
5.2MB
MD5058d85812c2b535a660a991e20fb4eee
SHA1109f2906cd7eea610bc997b3431ceccbc73b9dc9
SHA2567afe93a3c3b9302db7675930b01f7b38f8727d8805e03f00b0583754787e0712
SHA51294231cf7b35d27942efd6f5b89d1e0464f74e2835caa1dbea4744c63f18439142504d8a25828406602d2dd653ef48c4e324092d03ce85fd8476e3043f69d9a7b
-
Filesize
5.2MB
MD57c8e400efc75ef7b964ddcb982b6cd88
SHA1d5ec2e2b2ad2f4ea6de467ad5bc44c4deaea72ea
SHA25617a15ce88b239d0cf8285286108f34bb59c8536fa838bb50bd19bc6cde94cf6e
SHA512f58c577b12104b828a1e5375354fa1e0bce69fb8368c770043bfb5f894f0dc2c74cdb6c42c3960d8515d6c39b8f95eb8dc21ab99b30f25b22d651c1227c1add1
-
Filesize
5.2MB
MD55cdebd61d591dd2bcf177f1f36773c42
SHA10a96fc21272e6f71626ec523b053a84df0c71304
SHA25667056371b90dcd73e2ed05a87fb56115834e43a79b6e860c9bb074dd708b2742
SHA512e98f53624fa04e6d7d00d81e761e23e6c1f7de245a221447121f167f360f20aacd44294c4649235cc9c7fbb08264614b0e94cadf2ae8896c0507ccb39206c410
-
Filesize
5.2MB
MD5df3b41ebc54b71d7b4e06f23b881eb8c
SHA1c7ed2fe8536cda3485e86c9b507a1e0e70d01201
SHA256d50338347d1e7df03a5fb80d1e1bfaa654aa887cc18075b15c3959f39145f101
SHA5125da32b5e88763e0a35e5547c12bc67e7de154743b94ea5cda40a83cc5b3e3b871659667dd2f97879419ecae922645d2a19d7259b33302c2f31b9fe6c89394fa7
-
Filesize
5.2MB
MD5c55fde84f247e662f7f5a288bc8edd7d
SHA19820ec40c35f14e1d9a55fc4109669a1cba8b4ab
SHA256dc11ccbcdd46c82d9f9f581590f8f5763f8aff19d3d1078cb36d9e2e4c4e8e34
SHA5126e22ba2f2c3f1ab328a04bdfa17904ae95dbc78053e5dda9a1f8aa1741d780890ab3fd3975ff668df1d847d7de291165032596265afa0681436b1a2e59d17a65
-
Filesize
5.2MB
MD553c45f5639407f2a00ae2b911dcb9aa8
SHA17fbc3664ff17d582a7f79e31660f0a4fcc8f2ccd
SHA25622d3ee18b3fea27308a852fdb0aae7cb1e0bfddeed51e9315687141069900801
SHA5126657ac32c15213bf95e2231b1254783bb189bdad708c6c8e7dadbeef0a908db2c18bc6fc410bc762270607ca3d0c60d6da32e464c7f73baa4a2f9c09dbad6135
-
Filesize
5.2MB
MD59c1b8c31bcc5a732bc9d26902c07388f
SHA18e66d9ad6e1dd8a178f889356a539ea8912f5333
SHA256125f3a036a7177691540c37b8ab46b4d3450bd73c258da99dcd5183de2ba1e5e
SHA5125bd8eb0641d44cfa1bbfdbb33202dc91930a6abed3d84a75d97cc414d5394b18074fd6b6ef9ad8b446a00955993673f7820b67a34763837139aada7affa8607f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB