Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
31-12-2024 00:52
General
-
Target
2024-12-31_4a15e1781481dc27c90ed37d8df4b393_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4a15e1781481dc27c90ed37d8df4b393
-
SHA1
a5345306f572153395e1b4072ff1b0912658c130
-
SHA256
1676ced20f9fa3e3a9a35af56d26055344cf81d5ce586a38eca931972562e1eb
-
SHA512
4fe2dc57a8f74e6742511455718d1496b062f150e1fd939b6546401ec46c22e6ee421e513af190f4729ee7e2cbceabb92fbc7848adb7f6edc8b7cfc89e2e3237
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibf56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_4a15e1781481dc27c90ed37d8df4b393_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_4a15e1781481dc27c90ed37d8df4b393_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lewsszq.exeC:\Windows\System\lewsszq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\txMkBSU.exeC:\Windows\System\txMkBSU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rrlMsBw.exeC:\Windows\System\rrlMsBw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QJKWOHD.exeC:\Windows\System\QJKWOHD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KSoWITn.exeC:\Windows\System\KSoWITn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qjyAmVP.exeC:\Windows\System\qjyAmVP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hMLYyuf.exeC:\Windows\System\hMLYyuf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EeSdZwk.exeC:\Windows\System\EeSdZwk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zIrOFHL.exeC:\Windows\System\zIrOFHL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lwFpEqL.exeC:\Windows\System\lwFpEqL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vlyyaMW.exeC:\Windows\System\vlyyaMW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\emiELzN.exeC:\Windows\System\emiELzN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qHnyySr.exeC:\Windows\System\qHnyySr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CZFpciP.exeC:\Windows\System\CZFpciP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VvXuvnS.exeC:\Windows\System\VvXuvnS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mAzcAjL.exeC:\Windows\System\mAzcAjL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nmWSjai.exeC:\Windows\System\nmWSjai.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bZRjXeV.exeC:\Windows\System\bZRjXeV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QuiyTXb.exeC:\Windows\System\QuiyTXb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oikEBGt.exeC:\Windows\System\oikEBGt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IbynjHn.exeC:\Windows\System\IbynjHn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f98e1e6b926f3ae3137be2301f5fb075
SHA11a23137cd4fe537a4e516e2d874358711fbeeed4
SHA25601ae5cb4bd3d489c1298df5143d1c54f8486b4c761765f4470c125d86e23de8e
SHA5125b42199511f5b7537874f21325c1b72e6f3e004552d7fa7d28d4b3025852dfb8522c5aead7e060579614eb14259046d3886ff804b6253cfe4dcfaf8b202176c2
-
Filesize
5.2MB
MD5a9f2bcc125a456ed51c3d0e039ebacd7
SHA1416b3db8557054870abe0892f44d270ac4e8893f
SHA256fba72ef8911f4248455202e1399196e83564410e57ab66b5a4cc453db4bf2b6f
SHA5123da07dce2e7472191fa03b26e441f30bc3cdfd69ae9d41942e95e37341851f43810115390e81ba3dc8dc87a6112e6a0cc140766f26db76c76eb4793cc5b09761
-
Filesize
5.2MB
MD5f8cc5e081628390093f19fbe2e4de8cb
SHA1e58588a530ab337d3b26b052e0617c2abd4c8ef6
SHA256dac4543d519c7845e7a674aec46ae19a10a5a6541770978661e880c99a4d42a8
SHA512064739f42b9a9bd9cf57051114ad410619ec4cf8e63200c46e32f42b5beca77e7fa674c7faca12d3f3d0028134b66fa4e8e4b8cc6b88e27ee9100b780ce3e9f7
-
Filesize
5.2MB
MD53c6d87a52412ee2ed09a1aadb451e8ba
SHA1fa663ffba095fc9fc50a5eb96d919d3dcdd0bb8c
SHA2561e8e72a5c258dc371cf7adbd6068605e5e20bd6f5bb48322d442a2e39459ccae
SHA512c906cc9c52794d46b92e6a23590d4164cf766f2eaed72d0999e9a182c4cbcf9d92ea8f52666c78ace8fde644a12267b71b8f7f3e93bdd58c0d1c15ef8a794411
-
Filesize
5.2MB
MD54a99eb71defec7e2af0694638dc281ca
SHA16494ea99700fc04e652cfd14d707e1e9c7a3e1f8
SHA256d1aea3cbee52cb5e2f4b26b159adbd403103572d25f3adc02250b5d9090c0624
SHA51246f492b13ea7a2de7bd1ccfa60cc0bf5f434122f290f682ff75f45270d5b45265025e8fe6391d2b46f2e1b39e7a69f4901ae9640db87f09dd58301e0ff3add49
-
Filesize
5.2MB
MD536075cc007c3e03090c23015ad0bc1cc
SHA18b51356b0459437ffab63a5d7a2388bad665cbfa
SHA256a38aade0d5f73901e1cf2621294478b42d905ed0b8da03b65281f2494fd8537d
SHA512ecb2d63688ac92f7a5024701b080e99fe76e27420b1ec14d8eefe864674722432f06b2993b12033e33277a5486fe6457b2489d4047fb1fd5525d62c7994063a2
-
Filesize
5.2MB
MD5e9e98441ae662a83170e201c15f5b51c
SHA125304cc966a3f2f45a34d8a1a522500088f9bb4f
SHA25678e87119eb4622653d472640c70084c14de02c943dd11f5044393bf19e0ea2cb
SHA5127640d7e8164c65de196d52cec1144a68c8821003959ba0abf23f6511fbf309b50e2df4e7553dac56350a6d3ff1d11df399c1fca002f77f2a1451fe5af7e6d99d
-
Filesize
5.2MB
MD5a114572eb042acb4942cb8d8c982c822
SHA17658ffefeefdf690d8c53fb373bce4a746e819fd
SHA2560cf71972e5b00ed78af2ab3e19662a7e1200ce1de617d89ed190655b2c04bd00
SHA512d287751c52d6c0e2de94b82255a098ea0b6d4f4e958fc3876889342c382a95bbec446a7c522b90191418b14bfc194883158d3574881863d4abd42bb918717148
-
Filesize
5.2MB
MD5e232ae80e7ba107311d43c0733edd205
SHA1f3df45c8654c3a78fdb88a02f345ff42c448f895
SHA2567796d185d4f4c754f6ebe20124b14f9337c8978ed14ed7e8d9f09feeb14b331a
SHA512c059a688e282c7077d9cc5f9860c0972c67892931069036bdeab4f17ca4927301be43ebdbf9f635254c445a688411d99224b0eea5c5411e85b9d4549299581d5
-
Filesize
5.2MB
MD5550ea695be1fb5f11c7768f896acc73d
SHA13fa0bb93c9b123fd60e32bbc476928928d7c795a
SHA2566c2d086cd31f14307c415ac185abb53fb105606548b33ce6ce9c0527a5857d96
SHA512f6094b1a4840d0bab8597aeace37916245d45f82909823c3e516ae6d1f8dccfef7f23dcea4cf085f5b53cf80eed22c76a5ae456bf8c444443cfd7e06503417e1
-
Filesize
5.2MB
MD5d1cc820558bfceb85541b4b63f8362f2
SHA1cfd9676dde67ddddcbf9322bdcec5e05032b5228
SHA256375fd5a979aa606ef3b1fcfe0f009d08615f17c085970c9dc8a9812e1e7ea0d6
SHA512c3bb0f67db6d6b0f4e32013d3ba7ee53c16003abb002d115911438fac98f06d7acadd0be200b1576f9995a592517ae117a02591089fae487a677a351d7a89c49
-
Filesize
5.2MB
MD558cb91170a3b510ea9a45ceb0d83c622
SHA1075fa627b61ae84a7e911a0bcfb152dcb8cacd71
SHA256e7c31ae778cbdd00d36e8e9d5157faecc5c94c9d43ddb9bb1582ed180e80cde2
SHA512aff2a4a662923f8af7e002a2f0a9b57aeeac17c78a0253d1aa6f4f06fbac2b449dbc14e56679d73dc61f4d2be7ce741f97976dc87cf629a6bd4f89a1babb4df9
-
Filesize
5.2MB
MD5ea8db494c327b225770074af33a4ab52
SHA14f3e52a8219a48e05c4490026fe04e55bbf69104
SHA2568f2e29f1fe3c955e603507c93bcb7267bd9428d995cb4ee8f62f2538d44f6aeb
SHA51257f76e618a2dfdbc4a6ae9fbd4350e984cb394969745ccde15952a361f0610aa5623d884b1744197d93691dfe6ce0729b679d042294325112afd604ccb3fd9c0
-
Filesize
5.2MB
MD5c3cc78975857ae542d88a809f11e298a
SHA10fa321716eaed2b219228e756dd5d7e1fdac8c08
SHA25634cfba3445f70e1044d9c1648ff5120f2cdbd63c018a5c7562e08dcaf37bbdac
SHA51239aff3b29a0b5200d20897ff09ac81960979e339da867433bbb67eb744b5b6d57efbe7165541199460411117147c8895ece3f00e5ad97df2e331ad7dac6b32c8
-
Filesize
5.2MB
MD519d385a58452b47f2c3780b248f5d100
SHA1114b1baac1cca3061903ff3cf5687a3d5ad0bc47
SHA256305d8515b21dc21a6a35cde1bcce7990e24040d2b16d2ddde90d5fc1b072998f
SHA5122f3b73b7c891ec88cf2d0cccf549a56a89c6cbd15d48ffe8ea3c66f46a7803d2ecf0f72d64b66358eecba23cbcd5af4f3eeb172262f83fc8f1ecac6c1a7187a4
-
Filesize
5.2MB
MD5d1aee5ab611b0fb0eabbe1a7ec5e070c
SHA1d56143cc6ca72ace4f24fe2e4818683be555658d
SHA2569d9e7b6fa7caea44a48f20f18b4617a10f4492404bdb8581676a48b11d050eca
SHA5126259f1532ae315952106d453e7cee41d5f413333ad90a9b1b731ac520325c85d578a85327ff4432179fe1500c531037e60594ec799c28a1b46ceae5b02da2582
-
Filesize
5.2MB
MD572ab6a4aa57ec5b6a526e0f1f15b1ae8
SHA11bbe7358fe5c8ccc2023d8a51356a26480e06fb3
SHA2562b4ffec587c4a7cbd1eb7a30154bb4b5363f98d7b33fb84c985f73903aafd6bd
SHA5127b3b83bd9d7d630132f81c8d77ab2430973c3470f90311aff0ab8f49859e47ec278eff6235da8fce8a983feb30ab6bbbaa6ed52f060f3df64d9fa60260a18db8
-
Filesize
5.2MB
MD50d7e061331c1e09edca54f317ae91501
SHA1fc22515a6d8144cd7c99edc8f457d5d88c924c92
SHA2565169112d2e6e2b290308b697399f24b4e0b97c77c0b4bed2e9856ff6129a8e29
SHA512a1001d6ae12a940fc479be417fc2c410eded20c9fa6f06cb678e11bcca7fc055749d6b02cc748c511b921d7813b356b32f5588d3c011e8295ffc542fb4f6cda8
-
Filesize
5.2MB
MD5c2736416661e9506179d3282320ef5ee
SHA14fb4215c2b3e60d9722b5de3a417a74f87865d59
SHA2565f9d3e34772413cc96288e2170e0e420be3bccb421172aac93b6f7112df3e6a9
SHA5123e68f1040c83d765964d26e7c28f72eef733ef92d41d11afd07ca7f62ac9a75a955aade875608a45271c548d46dea511fe22e5bb75b2835d2194d7da8a8354a5
-
Filesize
5.2MB
MD588c2c34dada68781ac32704d1edf8209
SHA1489540875a9d3560858b14dd408cb01a15c5abc8
SHA256b40fa85ede92b25818a650342df970d47bd215c126afe643feb20c7a53a250e4
SHA512df6b9d1cd5dc4225a4c6eda49685f95af60df6c812da210acad61489421a219b78b5fa8b6685f6bbf29c48ead0baf89b9c119a36b5a3ba58ddaa2544e277c8cd
-
Filesize
5.2MB
MD5ece9e3144b10be20a26a18d1c83618bd
SHA1edd1c69fc254c04ebfd8d2b3dac59f8c69d15504
SHA256a968b2580471e6229c560a4cd0975746526f687b07d3a23d6c1396fee75a98f0
SHA5125535d3ab995abb407236a7c4835ea37e37c27498be33987005f19e9bcba789cb054b1cd730cbbf4f5a9f0b26160c76fd3369e624db28ef40aaa04f76f0904a98
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB