Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
31-12-2024 00:58
General
-
Target
2024-12-31_838059f573426998f018c1c975c038c8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
838059f573426998f018c1c975c038c8
-
SHA1
8efc7dd89d4e11cd075f594505b50da210ba2508
-
SHA256
1c80c646e4bdb46e8d67a13fb00bc350469ea46e725c2cd421098a5a03598976
-
SHA512
05bfe1dda3be01ce2eadeb5d552bb234e15a36109c06cb929f142fcfeb73d728605e635e4fbd32e71e434f0789323662a198f27ae8ca5cadb0743b76ecf07528
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lUP
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_838059f573426998f018c1c975c038c8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_838059f573426998f018c1c975c038c8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uBYuszR.exeC:\Windows\System\uBYuszR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LTqcKDt.exeC:\Windows\System\LTqcKDt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vVvKOkS.exeC:\Windows\System\vVvKOkS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pRxcqEM.exeC:\Windows\System\pRxcqEM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QSDhorm.exeC:\Windows\System\QSDhorm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KdsbyOC.exeC:\Windows\System\KdsbyOC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JJxsAbz.exeC:\Windows\System\JJxsAbz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yysrGTr.exeC:\Windows\System\yysrGTr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nqSTLJh.exeC:\Windows\System\nqSTLJh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\stmrjYK.exeC:\Windows\System\stmrjYK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NiEPKIv.exeC:\Windows\System\NiEPKIv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oeJVayc.exeC:\Windows\System\oeJVayc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GyXXpHq.exeC:\Windows\System\GyXXpHq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vmmgjrV.exeC:\Windows\System\vmmgjrV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CgJXWmE.exeC:\Windows\System\CgJXWmE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\frnqyxz.exeC:\Windows\System\frnqyxz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BFMEGeQ.exeC:\Windows\System\BFMEGeQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xrFZuKR.exeC:\Windows\System\xrFZuKR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iLMoTjD.exeC:\Windows\System\iLMoTjD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NTnoKSR.exeC:\Windows\System\NTnoKSR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ofoyVdr.exeC:\Windows\System\ofoyVdr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5051ac978ffaa5fa46175d6d925411323
SHA11f8834a4eb7adef1509282c34836814626da67d3
SHA2563de29c1b9fde46e3791ec082752b16144eadcff1d7fc54568b4753315f48f8c3
SHA512e79691954cbc246f50da3fcf6ca9a8778cb2bfb13a9f40b682f4ac6c3e11b2f2302192926f2551f4dc00123fbc974bd8dc8db5efa571b46335ba07d49e8a95af
-
Filesize
5.2MB
MD56ac96a3848d6a6cf7128c0da36ab4f59
SHA162afecaf35fe7ba3c874d82fd50300b88fb43b6a
SHA256e62946e49aea1bee2f3b61b51e2ac70a18249b46d8de105ca3635273a1b51e29
SHA51265566d8cee6306e58e0ef6bf773c712be655163a1cba91f1f4c800c6a882fdcfe63b2d0a2b6a8e8ae00b31bee8cef0b78efcf7b930330e8e6c7881e048cb7b48
-
Filesize
5.2MB
MD525d7f76720374b381ccdfa66b6793039
SHA1036ba133b05ebd82110fae9592e34d00b9f4c5dc
SHA256e8d803fe05b8114887a516e977ee4be6f715d3723e8c7d6542e10d8df69e5dfb
SHA512ed882d0060d9d46e3471ff74799cd6692b3d7a954fae1b78b46982dcd2c1cdc9c3062f92ea49d689f1c4c8c2afd3d80ec63a483a311e1c31aef3372a97e33844
-
Filesize
5.2MB
MD54e8af55ffc077bce2d858b65cd268f8c
SHA1c39dddf7828b53c6762c050ed5b3b6ffae083527
SHA25654c1b1cc4c3ddb56a46e784e042f4a4873c0d80cb3caee8bb256da778343cb86
SHA5126f1887c0664bba3d0b180dd651af63d134e2657f4de31de0901ee1d3cd576f720ed1a6a9dcbb999e7e149bf013839708de0e9ef857320ec2c871ccb7c0ecf466
-
Filesize
5.2MB
MD50ae00295d8bf8f60a6e86d455fbfabf8
SHA14544fb806c5e7e904e31213e837e0a3918084c8e
SHA25699bf4032cba7b74f6679ef4c7af6318d8d6de41909cc1ae14b464bac8a159c00
SHA5126432f4303b50d70dc9bab5fd5234711b47aded52d5af21e2508ca1c7bf723aa1d2b19bab365d256d65c24e200cbab8226e7e584c7be5e826a1c5f091bab48480
-
Filesize
5.2MB
MD51f5a0758d030e308aa16660d160b6956
SHA1a886212826fcc1f47a83b6b710e11097cf6a14ad
SHA256a950dbdb7e9f31ff10d2ee9ba29ba8932f16e1476017bee13df86899a8673c81
SHA512d79c757f81d2ae6963e0359b2f2dc2160a6461034dc0851c891e468d80417c8cbf57ef8c9f82eaf4877f04a3842face082a63192caa115eef2baa335e481a1ab
-
Filesize
5.2MB
MD5bfeac61b11669565c2d0c5734ae8987b
SHA1b15003a3920706e6ee3471cd8bb847e7cdc67d99
SHA25654279b1bd735efef31077c257de21107de55961930996d5b82b1020434482d0d
SHA512bb01837513ca420e884a5d65a36df85153651db3a11466300fa45e85b4ee47bf2c539ac16a22cbf73af33766937fed0afd8e179be6a163d645f893929e554277
-
Filesize
5.2MB
MD56db2bfb0996acfee89a777aa68421218
SHA15d8ca6ef4e45aa6e3495d2dc947ef152f772cc2c
SHA256c6b8d93cedd4c905398520d1a5653d50457d6c87e726e36395cc6b1c90be1904
SHA51233ae84355eea903703c0453f6316be975c2c5089933b8fb62c53e9a479c47511f3b16f1b0752e719df10c656f94ac1b819d0673c31fccea2d5ee2132b01819e4
-
Filesize
5.2MB
MD58b72c86bff9155a7f93f615883415820
SHA13b6fc1b2f99ff52776155af26968a88ffc0cdae4
SHA256cfbcf987c893580f3b676012de177993e4566c2969688d83686bc052dd29ff7a
SHA5125d26c6322add9e55786a9d96072bbcf6c7afdcb8a2f1d8f2310dba48f03be16450452555a90c0dfb1e7486db52def48421ca01e9e83e7f108db37fc175de96fe
-
Filesize
5.2MB
MD53ebc58cd69356176fd9aba0f0004b430
SHA1c63913ca5a59c9d1810fafa5aa5e6b09b6e2533a
SHA256b945ef64925aeea5118c4b9db4e5f98134842fa4f333bcbc03b596b689573369
SHA51292341bfa7dfc0a1f8eb3b7b5ecfecb8264ae5c01c960950844f190434efff9e40d4e1675457e84e5783c5e22296a5b59c4d665894cbeed95f7e0d98ec9fa3a74
-
Filesize
5.2MB
MD5c37f762937b2ce5935fe6ea91d980ab7
SHA1db2c1b5e6df84afcf805fce7431c6a2dac3049b7
SHA256bd2326fee6a8a311179407370b425a8733d2250d8c2a8fb5dba37a1305234201
SHA512f5629f38c2aaa600fff9d9fd6cda332aad35b85646e605a295344ab1f7e020ac775a4cc208926c3b6a01f4794e88d8df0dd3890d9496fd8b4643366e1f9025ec
-
Filesize
5.2MB
MD55154e4992c350192b9222791da2d6aaf
SHA11bd31d7d25845e1943fa8102b6e9c65f8fecb32f
SHA256ad623e30ec182ea228d747ce917eea9588d8ec97c3c559c422af191ef81b1485
SHA5120fe98512b7c7ad4bd23891969f6a111d137a10052ac64d8c8692a722590913098a726224e870a760c1b73748d7dbadb92c27f1e4c70a13013f4b9bf5cbba83fa
-
Filesize
5.2MB
MD58ff918ec56e9b92d84e91f870c6d956a
SHA12d8955e75002770bafb48d61879224eeea74c962
SHA2568a18d2568885ff48696128745cf0d8a96e7614816d42bb5b6617a852df92a75b
SHA512bc5f5f45ef5ae7029403c81d3c39203732fad3e21f72b4faa48087afe15a3a813e83c567eb1f878b1222d62d49c60e90d979baecabc771478a55ac349f1fac6c
-
Filesize
5.2MB
MD55dd33600b67cc9cfef5e65144747f190
SHA1fd41cd41317e5450192dac82faec98751ce6160f
SHA25682d5dbfa7dbbc230700960dd08dffdc1227e731c21798bdb253759d80e7b869d
SHA512d3119e6acff16cccce89372ca389e04e7f478c2a04ea12c3a001b410328d431ea12a4828d4948ce0c0ade90401afbc7dbca2ef99b6af667f2ca36c4a98008fc9
-
Filesize
5.2MB
MD5f002bdf2fdf822efa51c118e431287d9
SHA123d0afafbe4f89c60c8a2f29d5d5acd6c3cb4880
SHA256cb508d53e8d4a33803d8603c826a5932793bb079ad9a8b55992124f66104fe7f
SHA51242de96b7538b0556ea8d761b181e442e288d986928434d6316b0db01d0e6c038d8349edc5f297d381b96200e68d7de0663168a3882c7d1f4c0cd5745290f8c37
-
Filesize
5.2MB
MD5c97dc36758571a91907a55cbf1b60482
SHA12cbb75890e45230e405f590e3f6af31f9a6bd7a4
SHA2564802dd996a6e9d2ca5a090ec19801dc8930fce0c973cc7b8f4f10162e9b82704
SHA5122bfac19a8c64539594d95ab2d4a0b08d058166a257d2286c2e76ed2f0b8c9fe23fb875fc1682f84be29a4375d8cd284b3c7955f7123e03a603d24813947ec768
-
Filesize
5.2MB
MD5c7992eeb9ea7258d58f9382dfdfb7a21
SHA139cab6ce1fcb1f1ee7bac35284152bf18769ef65
SHA256e0078a4a2079f85fbedacdc32cfaeb76decdb68376e51712cba0ef8092018194
SHA5125e555b9767f375322283a64bf673698fa73901e49409e405b87dca4b82996747ebe52e0c7c7f9f6e0c961555f5f10e02d63fb84b5ec4760232a93bd2c89487b9
-
Filesize
5.2MB
MD56651212e1c0e063a48187d2f48f2c026
SHA1e056741ee1c4d05d48ddb239ae6ddb4ad78e56d8
SHA256f000a3b9f1ba77ddaf3400b6478780b94619aa0672015b2b5bbfbc76a98bed7b
SHA51273e500a7453397647f9c5bd1e1b9fff0038ce78dc0958cbc487a6ab19c052ec1ef22e2defbd7d5a96d9a388ec6b1317bb68e1b589ef3b55582731b2598d82fa5
-
Filesize
5.2MB
MD53a3d407b604ddf8e0cb708d77c529113
SHA19014f1fcc2f243eb42587dd04549e4b2466ef1c2
SHA256455e536616cd01160251c4b8b758a61817e239d6be82b3fffcff1138b2385bf0
SHA512975acbcf5c5fe59e892cec5fef5eec769e700828720007ec6fdf2a0c4b0323d1b02792a5a65e9b6b7b02f98f57941a4068f02a81c5cb4f6759d1608d2a3f7be0
-
Filesize
5.2MB
MD518e98b7fd5b2855a7cd4b8ef62a73928
SHA1a2448ad499ebce72b9dc4e95d87f693a94a36dee
SHA256bba463c5639e093f63fe7404ac2c81fd9bdd1b0b34ac85165704cdd1a7ae9598
SHA512360460f75ebcc1f476c305887294a1fb208af7c6452db47b132082bc171e33354832bfffcd4c726a61569dc979a79504af01120cc06d01e22ba965265380925d
-
Filesize
5.2MB
MD5c2b88fca2e7484afc3e8b0f08943c83a
SHA1794b0ec263a7e71c40e462e137b7cb606070c862
SHA256de7ee4103a494acc16a26570772a762a7ce902a25c91cec7a385b7371b83d84f
SHA5123750f77fb224c020e3014c6dbeaf3b81dde44541835924b6a2ab1b8b060e6030c6876926bd5c6652f6f1461a7a5ff9d781264b701e4445297aa840e3e58db61e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB