Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
31-12-2024 00:53
General
-
Target
2024-12-31_5e1c387bff046709fbc6907fe26b04b3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5e1c387bff046709fbc6907fe26b04b3
-
SHA1
ee3ac707e507e367ae6d5cf582d129f837e83803
-
SHA256
23b9fb6d90834e3d039b5830dff0b878084c32313588be38a24940ed8a009d4c
-
SHA512
f7bc0dae4299dc16d1b74b4e67155fcef0793a6372f23dae05ae0ae22dd3ecae137645b89b69b8f8f140c5996e87bc8222e4fe3eaca2b30dfe269705f60f90cf
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lUv
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_5e1c387bff046709fbc6907fe26b04b3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_5e1c387bff046709fbc6907fe26b04b3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WrbRCDL.exeC:\Windows\System\WrbRCDL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AWFFPkw.exeC:\Windows\System\AWFFPkw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RAhxmeI.exeC:\Windows\System\RAhxmeI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cFmIqPb.exeC:\Windows\System\cFmIqPb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfDhXuC.exeC:\Windows\System\kfDhXuC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hFQzxVe.exeC:\Windows\System\hFQzxVe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tInIjZi.exeC:\Windows\System\tInIjZi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DLQssPl.exeC:\Windows\System\DLQssPl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hGSLzPO.exeC:\Windows\System\hGSLzPO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FUFZJXQ.exeC:\Windows\System\FUFZJXQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UXhgfKP.exeC:\Windows\System\UXhgfKP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AlklFyX.exeC:\Windows\System\AlklFyX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNsoHuO.exeC:\Windows\System\sNsoHuO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SgQTlkF.exeC:\Windows\System\SgQTlkF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FHhPOVq.exeC:\Windows\System\FHhPOVq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NoXMDOG.exeC:\Windows\System\NoXMDOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zTfLHMs.exeC:\Windows\System\zTfLHMs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dlaKsab.exeC:\Windows\System\dlaKsab.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\krQdZHj.exeC:\Windows\System\krQdZHj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MLTrMoy.exeC:\Windows\System\MLTrMoy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntGekWb.exeC:\Windows\System\ntGekWb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58e8b5b49ed29e3a611a1afaa30e9d18c
SHA1aed7ee3b0a51a39266ee7a7d844d820194d23877
SHA2560d1a7f75075d243e95d11235f27720e3ad8c520c0300974cf6bfff944380fbba
SHA512348ff9e678d04b2348ebcc0495cfdc78f706110b30dac90923a318f1af3df659d8b84bf0518cbc4ed39fea37cf4eb11ac4bce96703ceddb209cc6fd10aed847e
-
Filesize
5.2MB
MD5ba9dcb22ce907585bf17c832b5070a84
SHA1a2a78649dddaeb2041c7cb58750a79f4cc6b86fe
SHA2562f5bba0385a99cb973cc8b4ce0286f7bd76497e28d6848bed18596120fb307c1
SHA51271bcea65c578d6bee37d96c6bcfa592a6e967f445286e7a0f413a3f818778ca70755836c61ac592feec4e6a4bb6a29d30b16bdca77553d8df2c3a26645fd95b3
-
Filesize
5.2MB
MD529186b4c6ef9114a3cf2fca2ebc35728
SHA14dfc6e85c2acb96805b431c62a831da3f8d10613
SHA25612b1356b36662cda8653e88ff865eb01f6fb0d132a06ee833edb69947bd49dab
SHA5120eafa0456f748b23402145bbfc59e6a36e51af765f7832710fe2de4f62e28a102aecabe3e83566e63171e617e7b72f97e7e0ef3367cbc0b597583846d77e9045
-
Filesize
5.2MB
MD5b6a767c45baf7f66d5c71b2866a65625
SHA118bb918e0287d3ceadd46a3436a19851a33e2b66
SHA2563332d3794a761c85e2d87ee0dcc7590c92a56963ab3e00aee548ea90fb5c361e
SHA512ceaadf64be358dc80f5276b24f9ea377cbab2106315e207c05f523ffb668ac3c58b64557014a564ac63dbeb723e7fc346994c9711be2d1c5c674aaf9b6e70bb4
-
Filesize
5.2MB
MD596cd7946a3a7b5be6746931fc7159186
SHA13e830ee303f66a823c26e2199412964c612c71f1
SHA256b58b0dd4c56fef94d5efc2e9e1544ae06e95e8de9456eca64b31957ee2b777d7
SHA512bc81b605b653af8e69a8119c4f104803ce78c298634d26952bf31246b94c328d314e13e40b2faa39be4ceac7ea9c490d8669f0dbf1cdd5ab298eda2c7fcfd675
-
Filesize
5.2MB
MD5e8b982c6e74a2251bed9aaae4189a8c7
SHA1cdf2f55755e897ac4574891c1f4209d2066c4204
SHA25677f821c10fc156dbf4a8affbf3f83140fd2ac1f74fcf78c64d59d89fda80db7f
SHA51248f8ddf890f7c5ad7a30afb118579c864b1ce51670b9a5afa58ca1ea036cb7f084bdead11ebd97521b61917befa3428a1d1f1febf8239620cc200ac2afb87936
-
Filesize
5.2MB
MD533058e71a22693324b0638655e499773
SHA157f93d47b876f1a893d2bd3b9e0f09d6dc6a5622
SHA25640999e67e92a7f3d7a97f2fd14e717194fe597f8b9257340b9df26f573c375f9
SHA5127506ddaf6e599a315713277b2a3b133f18198cf9325641c08d4c41f4345418a28f0e6df9a6365a306c0f3c1a453c3813d765783ba80318e34c6e5c354345583d
-
Filesize
5.2MB
MD56050ab84a5958b3153419b385bf8f0ff
SHA1b228a87132fb716dc2a298ecdaa006f962a14105
SHA256ce0295186c10d4f7c9ec6a1bbcda29bcbc3a8c34b4a2bde363c0e384fab12696
SHA51236367d7d042f78e2648775b4d4c5a4d54e353ba9839f44bec7030720da06e73bbb9a64f5329e0ca586c5d59e15733ea05306dfd6a62af09158594d4b503355b1
-
Filesize
5.2MB
MD59fed5c560cdde8cdddc0a36291938e59
SHA10188fee846e0f72494a5202c7904e7abe9293709
SHA2563faac26fc696be1d1c2f71e068c09c95e6d8359766099159cac13aeaa790d611
SHA5120768ca9015578578ed212153668ce37cdaf7873041ee647efdd0c5d1f32c8dee66a42f054c6f5f5e5460bce2c7ae094a868fe92a130009b26afba52c0836491e
-
Filesize
5.2MB
MD57eff10e177dc5a27edfc45abf2023bca
SHA148a0666085589b8d0c2a38d513f0b71a96e58a7a
SHA25660a4c0386daf9408934e4a5f8d7cc36ceb937e32222b4626475a7cf532e3e800
SHA512fc7dc06b4d2bb06a9133e0b69d6b41832ea8c1d5e18b9e6bf2270eb2863fa11e856744b8a377aaf13faa22d892dd654448a0070efaab8141fd31d8c7cbd32a4d
-
Filesize
5.2MB
MD5a0df96db68e70fa4d8cb83f7fe5fa7b6
SHA12114122adefe6c6f0b664f2c81c89610348c8cf1
SHA256963910f5542598560cc6ba608bb61d6c81c10159132db6201ae62f9ee9b6da6a
SHA512596022fd18bbfdd7965a0126452687326b82a4ed8d0beff08b07f5f3d4e2644e3fe7528a8e67ace10e94e169629f5fd8fd771dd49dd1ccbf0b3951418c1af915
-
Filesize
5.2MB
MD5ba15596c3346b49b3811d4ec5df8f265
SHA16786ddf50561b0c9917c5833db98ada4008dd4e9
SHA256d137630bdc455c23bd2bc10f5ae67c5c3008e8c15684c53bf7ee85d5b964b82c
SHA512df01fef680e5fcae2efcb0ff564d4f99b2e34754b84bd76a2967c8431127884d3e0db91c499e6731ab81332f441bf03c91e445489dcf4b3aa29f28ca7fad887d
-
Filesize
5.2MB
MD5e045c31d9ee2cceb30e49ae68999f84a
SHA10de93761cea75c239fcf5362cab3343c15a01f68
SHA256a4ebb4f682110398ef40f685470ddf2732bd13f06220b01646dc27f67f185255
SHA51278c9bea3f648546c10daf9a22c904ed60eb43baae0a7a0d5db1c8bbd200ad1f9711036d2ae1e0bfe815a6a9f6174663f5a1e552517b8995fcbf0f6a5d7071496
-
Filesize
5.2MB
MD510b33d1246856871523bfb8d472f31b4
SHA177a34752f74cf74a7adb5b211c753c27d17360e5
SHA256234b67d5712a97f922b573e6a61a4e15cb674bb56b61dbeb73380fa1762180f8
SHA512d9d995fec2925954268bfc3ca9aa02356543af1fef569a253c7e0537f964cda37c040854934461b5a5d50f138c86d2e2998386ff96ee3d00d418ca49745a4133
-
Filesize
5.2MB
MD5e840860be4b1c2510d62c6195632343c
SHA16100798c5ddaca068dbe0816761a108076de03eb
SHA2560ae49c4601b956f74da921f64bcc3bed17a640fd659867e17532d65e9f2071e0
SHA5128b787f81da81a16d36d505514797ff79f29ff720e60d3fd60f0b334aefd483d646cb7458173f0516fb106958500bdb5a8ea030645e67fcbaa7f85f6415d757b1
-
Filesize
5.2MB
MD529ab8e10b959172f975892f57bde4bbb
SHA13ff32da84a2b5202f4054ae8d66ae145c96bbce8
SHA2563475b0bc0e78c717fa830d75d3d2234f56073aa9827ccc9b8344650f44e3d453
SHA51257b5c84af08d3cfa40d01c5b4a8f2ccf6322dc5cc8e761a3140786bc39670fb8c440e28a82e00f8973cf5de707996045948c57e3a89c4ec0d03f664215462e6a
-
Filesize
5.2MB
MD5250ac3e2e7def14f2d87d77d2bf34fea
SHA1362f0d6146bb5b3e1deca677ba6ff39eae37207c
SHA256a4c40c8068366134ee449cff3bf550dd9f6d24d58454aedc95a660943926f03f
SHA51240ed2f7028d6a9aaa659451e35fadf157fc98334b71a686a80276fd60db38758c93714e2a18b7b083e95c3fdd73bcda37657816f0557a60c75b3d97ff4c0ea8c
-
Filesize
5.2MB
MD5faf49e7ca20a7d711760e657fbfec60e
SHA15facdb9e44da4ef2b414475bf04f103f0baa10ff
SHA2568437b4a00ff88a8f869dc64bf3146e3f82a424fe9d2b92cb5be58e95d8259469
SHA512561621575e5e41a9d7dbe031641513c81c9316b312b4fa1841398f1c3696ed6d8278d9367cd97a8f264c4d7813bc58306d3f6affa160c39b510dd1881166a7b5
-
Filesize
5.2MB
MD5fd0aa9cb10522356d812d8ec4f8d2f3d
SHA108cc3ce1d4433eae8e37e26f7f5768ed74cb382b
SHA256da918cb76618660a2da6a513ccdef20c9fbe4a9231774d8160a7b5f8847d2b1c
SHA51236ccb927ce40861f26ad133f8a47a52100406d40bf1f6c47cb578a1fdf90f2db9db22226ff40a90ba2bd00458ade9ac7a7e19c40e1813bdb59fbc08c5b186210
-
Filesize
5.2MB
MD57818743888bf9dde26b0b50005abfbdb
SHA13be76c1c723866894f6c28afcc4e108848a4bb43
SHA256f6828bebaaf6d90f4e82d6d299a3947b872eca97768fbf3dc5d693d5bc84b413
SHA51250a66f66030b3d1aa3d0e711d7fc18bd1b0e36670c8842225b4820ef4d879a5c3034f225a715c4e8e713c470471b5387dde9d3ef0193148e255c89d8a83379bf
-
Filesize
5.2MB
MD56652ed11feca85832b5b6417fc805af4
SHA100f308e70e5afae9e3ef0c9665d191f7768ade9d
SHA2563bb81b1db16fb01b2731879901219babbec7c3b61985149555592f2b8a8aaba6
SHA51209fac07898b3362b5825863a8a0e758c0e522f8b22f87d12252ed5f799552ee5215b5d586097899e157f15e6502a4683a8fbc9d127e899763976e9ee900a64d2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB