Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
31-12-2024 01:06
General
-
Target
2024-12-31_ddcd8d807ea3b6f4a89350c6997d5dbc_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ddcd8d807ea3b6f4a89350c6997d5dbc
-
SHA1
b75059d6c94abdf91384c2fbea8e09170e1be73e
-
SHA256
d16ef1dc73c3018956bbd64f61acd816b061879daecef89cd67bd724f9396bf3
-
SHA512
52f9856965fa60d08198877fc4b8e137a9c49f4975fe4694be647c868ca59a53df27101fd069ea5d834308b965f8790e76ddbf97c82d63b991a21695f83886fc
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibf56utgpPFotBER/mQ32lUs
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_ddcd8d807ea3b6f4a89350c6997d5dbc_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_ddcd8d807ea3b6f4a89350c6997d5dbc_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YpqULQw.exeC:\Windows\System\YpqULQw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\njhbNYt.exeC:\Windows\System\njhbNYt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BCEKMUi.exeC:\Windows\System\BCEKMUi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qCtFktN.exeC:\Windows\System\qCtFktN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XUmrzlC.exeC:\Windows\System\XUmrzlC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\frfSntU.exeC:\Windows\System\frfSntU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Vixbsij.exeC:\Windows\System\Vixbsij.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wZVxLft.exeC:\Windows\System\wZVxLft.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hnanROJ.exeC:\Windows\System\hnanROJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ROygiqf.exeC:\Windows\System\ROygiqf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CtrseSS.exeC:\Windows\System\CtrseSS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oMvnTBt.exeC:\Windows\System\oMvnTBt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aKAAvpa.exeC:\Windows\System\aKAAvpa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vnmmiJq.exeC:\Windows\System\vnmmiJq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXsZyXa.exeC:\Windows\System\sXsZyXa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RAEsnnc.exeC:\Windows\System\RAEsnnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jSGOPvA.exeC:\Windows\System\jSGOPvA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FViCRXf.exeC:\Windows\System\FViCRXf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfxEmCq.exeC:\Windows\System\qfxEmCq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oxsvPpW.exeC:\Windows\System\oxsvPpW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JKctzme.exeC:\Windows\System\JKctzme.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54a526df73049e565b6d84bda32eb0598
SHA1687b61825b84fd7043bd45c926c13f050cdd2584
SHA2566563c1c504161dd7646a7b665f2bd65caa9d06381c5836b6da9eb872b3baedf3
SHA5122a7814374724aa865a7094630c7ed225d3a3640d6f6a85aa7721d00f965e6dd72a7bf7284bf16e01c1220d125aa17a7c24a365dc4d65f261838f2a6b4c0d4c49
-
Filesize
5.2MB
MD5a6ae6aa567535a5b0d6260db096fa34f
SHA1d89cb946ae93c0974085eeac4e01f7dfca59e14d
SHA256704a0368aa0475a603cf1f9212f4c861527002b5734ba7db21387b45db3eb581
SHA512bb733151b1f6dce0f56cafa8d0247f46f12640dd8d1f56d11b05c2330c15f68536b8568be73989f4afef831d3ab7ced01e2c87e8f89c0489a168efa85a420def
-
Filesize
5.2MB
MD5394a8e9da85f17b53a28a6a0f9d9fac0
SHA1679ab609d608b73f2ea4a9539f03410ae2667716
SHA2560c5118ded6cdd047b73898da942d019b04f0ffa3e3b7f82345d20b2f7ca411f4
SHA512261f89b61f80420a9ffbef64e5ca10e22618b86d7947e56319c28abc961ffbb143a3c2c2300e05e2381d8f9221d88d57e1d0a7ac290130dd0d76f55645be8743
-
Filesize
5.2MB
MD5673b6bf45c8cbbc5e21cc9926d58f289
SHA107da16d226efa256f3af837c1e800451bf7f5253
SHA256036524af1bc70482ea9fa4320b93ee87c9f297dfdcbe670528fbe0a584a125f7
SHA512e3ef5bd64b36103fea989f3df9fc9f792a8d7cdc2e9d20e0770df1027fdcfaa1c804633e5953b72b383dfa347eddd1a6b786e5816c2cf9222ca8be9627c4882b
-
Filesize
5.2MB
MD59354aa5ea312d73deee33f0b9b497ece
SHA1ecc8baf73edacef01d8f57d0a194522bcab080f3
SHA25680b08401a5a3ddfe6c5416c60d3d556112c112c2bc2bdfdee300e4e6978463fd
SHA512786dab6c4f6f08b8b7edc142047869ef83013dbf624c9e68564d151a05dc994e08d27b2db4ad6da025b50ebe956cdad404aa56b971503c71ceebef4b64099124
-
Filesize
5.2MB
MD539daeba860b8a55c678a8165ffb2f51b
SHA1b31f6e1fd8644835c4bbaada2693212555d36075
SHA256ae37836fafc1c342d5079b13cbfeae01721185d9d93ab81d16dc580b09f271d7
SHA512022788d41b6198f804fe6eaa19967348960a9f583c7965f392f1c7f2ed251b9553843899fc8728237afff4e20f42a850f0ca604a3fe78fb16f1c89174931daa2
-
Filesize
5.2MB
MD5b4749cef1e04e4f3fb303a493d2f10fa
SHA1b272246def0759003ba5464ef3ee2b0ec27ba909
SHA256d8ce3f1fad038ecc9f073edac43c20109cac3ba09f737668f8a7de426dbc0791
SHA512117fcfa37c3b514c95d7052a915df38f1933f5b1539c57737c7ddc0c00f33797e9116758cbcac9a627dca87b8ffd6ffd5327a68df13391eecb68528a7e706100
-
Filesize
5.2MB
MD53e3c7a355b95c5bab0bd949a179697cd
SHA121595e5fe123bd46593177b3d387f31285288565
SHA25674aad2b15cd699a0ec0f4b17e6eb03fb92a56d51c3d50a02e98b6c81d9e7dc7f
SHA5125ec4b18b858dcca3e2ac7535d646df5329d4c7a922aa6c32a6088e61572e76758f99abe10c1e35501fe58b167b8f7998566a0a084911cd53a444a7c719cc3726
-
Filesize
5.2MB
MD5469c0a05e9014160690d276fab5e3a77
SHA1732bd9587c732ba50aee54fbf55457ad0e85db94
SHA256e0f81f0bc6f5553dee9cc9ca61972701450a5ca601f26931f0d925256c5bac05
SHA5127bf10553224b6902557e4941b50955b1133f306617e9b69e50400de5f6608bcf29e453cc87287a7eda20c2126efa73ae16988cb4facd09c70f6ba0d518189436
-
Filesize
5.2MB
MD5085af97e7be20930dee6387dd5e5cfe8
SHA199e498c5c29bed2fa6347b86bc91496e89c49eeb
SHA256b3764dfda5c00cc1c9f81db2a29948b698cac990785d3a68973c57e7c12d843d
SHA512f51db05768c8a97ba2700e42f388f74baebe3b33e1a672e1c8e401c48bd0b6a22148c2d0c432e7790ce4ef0b6fc2d953b3f411c5bc4ebe7c1d4e37beb7614b50
-
Filesize
5.2MB
MD54964da47cff3a54f1c3c6dc3b7a8b11f
SHA1964b4f258afc96039c0f9d81aeeb7c4e75ffeffb
SHA25689846d15c1115ea9cd5e5e5004784b7d20ddc0bcdffbd3fff290bd99e9608356
SHA5128cf48762d1b0ecf92a0aff5603b72291f9dacf25c5bbdcc455ae1fcbdc55abd20b986b927d9d6eb0002cf7227dd1a7283315ed853f0a3ef607c7b8e37b60e8e8
-
Filesize
5.2MB
MD5540b2d8cb79250639f2986c817c02e8e
SHA1c0f643bdab91efaa44923f119a6eb4294e09d259
SHA2561b145c54cd564ba30731d56e171d72f52056eb848a928fc27f7bf6dc3cfa0d3d
SHA5128c520f5ea0a620916db85f6bedd585ef1464bfa6d9eeb926a39e30a3a34dc2d66a889fbdaa063405c585e279cc408642a726ab17d65b652a4623038119e12d2a
-
Filesize
5.2MB
MD5f87224c0fa2ecd5b9ee76b0abe622875
SHA1c743e15b495978c26fd27d44598c16a030012b83
SHA2560e9bc79b9ea0099a33742919aa9cba9bc1cc838cbf5aff368f6198e60a0861b9
SHA512f907210cb75d3c1e66fe42e6cd3bc82136528239abcfe17e376f73a7162497c950c194f3d2fac4fc229fcf3ac2e98d3848bf0c4ce4ddc5bb30ab62ec3af82a56
-
Filesize
5.2MB
MD57db0f65e437f84a7cb9bc4747cf14326
SHA100b899c1becd9839d32db134fdbe2daec065d05a
SHA2567895bc9fe96dd5ae1608898206e92ccf42e2bfc162ed6cfb39db5ba98e70bfaa
SHA5120fa1a1aa98afdb55e875f9456bfa42889463d6ba9c6aea2538548a42a1683ba73dda536aa46576686a686ef088ed87eb34891d2dfd05c216738f69721e60a81b
-
Filesize
5.2MB
MD55fdaf83c6762a7e918bccaae0f54e1af
SHA1f62f28b411b652dbf39cca6539f6b1f467443219
SHA25667b2a766a15b6041798430b77206db4fce1f8d46f35ae3b68fbe9f17dde37908
SHA512b9665bb0f251ad58bf9be76bf794468c5c215c4e87dee408e950d7422184901e7f748b01636d20a5467d9026307ea4a9eb5fcf0d840d87a72a4b6607306f5286
-
Filesize
5.2MB
MD5b1a2f1389b3508ff224352c269c77b49
SHA15339c3794ff961298197d683febe24fed88a612a
SHA256354a0430332ae33ac6170c1ddc81be923c5afa7603c16ae23f9022ef0f871aa1
SHA5125ad5e8ed8d751ff2a6d79acf5608e85f6ea6b4dc9a99b6228ef8d201f328cda3fb7ab023a893b189af15436c4fe5bfca38ffc9866c627aa798a5daa109117ce2
-
Filesize
5.2MB
MD56fa4ef887a1fea783ac74467d88d790f
SHA1a20f0c29c39304220ffee17ed8e13cabe84a67c1
SHA256078705542e7d2ce90ab9f9b962f79f896d43db01cc9e30835e915515170dab4a
SHA51216b4103aa9dfcbcb703fb92d5c97e10dd2bf2b46e9e88924554243c7ebbecb35e8ad4d8e52c0fbb48cff5e3070c4e57c4e3e512ef2c06e9a230a8d0e8e46ae7f
-
Filesize
5.2MB
MD5e2c7688975721f82f7630ab3193979b6
SHA1337ecdbc266d47e5a3b431c57e24d8ca971f3c98
SHA256e24330d2466d753ce6d56d46c40a59eedfedf32795acb35e6f4d026c5708b307
SHA512de37a8d90149ca211b520d252ddfbb9764a9f347168f6d51c0c5cf59b8b1355626e979f67f3533895c30fad2e4d7b1a001b12319b584e96d9f5220a5106ccd09
-
Filesize
5.2MB
MD5144bbc9709ec3241837b8640a8449402
SHA1c109404f8f9d8672c195b13e9547bbb33bd6a68d
SHA25672a96e4478c50ed9e15c4e71be532934d7f84b9f0d3f618275a8487296294415
SHA5126223134a9565276e441d0331f1e3ea0831408c871bb97f928edc629dd999de0ebb7e0471deab2e36127d7e7fcc1ce97d3c5adb52e953e704a4a6c0cacb296ba8
-
Filesize
5.2MB
MD58ca92d1b3f5cdc5202d76b8392711f04
SHA1e278daca1534e3ff18be701aed4f69ce66d4a931
SHA2567d216727b90ee3885662864b5724209db45352d1051d7d3d18a34372d098e9de
SHA512d672025fed972d29bda75b4b95e33a49ee10f93ce5044be6975daaa132ae0cf6b2163e7e5a61721e2dc7f7c737fa07c173cfd642b2c95439574069cdc143d959
-
Filesize
5.2MB
MD5973ef6f04d0cb084a8050d0b541f896b
SHA16368d69e262e8e86fd5be0093c0f25f69701856b
SHA256415c3b38a31475a59902c8487d5f438740dec16319a625e703b0d02a81f1fbc7
SHA5123d9fd563dfc8c5c6af3cdd0fd05ef2cdee2b5f9b0fbb4e89fb3c0fa4a44407068d6099a22e4878f8f654cc28feb2a46e0adecd891d0c60dbd94b1fb0faf7d139
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB