Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
31-12-2024 01:08
General
-
Target
2024-12-31_f58e63a004039d7d24bd664375d5c550_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f58e63a004039d7d24bd664375d5c550
-
SHA1
bd5925072c043eda2373ad32bd583a6a2e8e5ff7
-
SHA256
39d2e8d5e6d6b2024ab3f978a8d8e7f76a195a38085558cebba63d5f93bb1a9c
-
SHA512
b89147b7fad0fa4edb1411c3b2a9230da6c9511b30b6a5302c4c11ed16f6864bf04e619019c29161581a4385f16a2d1e6321e3ae4fca59b7d2e75aa422beca34
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_f58e63a004039d7d24bd664375d5c550_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_f58e63a004039d7d24bd664375d5c550_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HDfpplb.exeC:\Windows\System\HDfpplb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WwjPrWJ.exeC:\Windows\System\WwjPrWJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qrUUwyd.exeC:\Windows\System\qrUUwyd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XPEaMQh.exeC:\Windows\System\XPEaMQh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IuZkjEs.exeC:\Windows\System\IuZkjEs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mRALcHW.exeC:\Windows\System\mRALcHW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EQJdTWk.exeC:\Windows\System\EQJdTWk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hEanCDk.exeC:\Windows\System\hEanCDk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\drWrKzR.exeC:\Windows\System\drWrKzR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FBKZVEg.exeC:\Windows\System\FBKZVEg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lMwXIQC.exeC:\Windows\System\lMwXIQC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UtUIIDC.exeC:\Windows\System\UtUIIDC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nkGPXLN.exeC:\Windows\System\nkGPXLN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XorYwJS.exeC:\Windows\System\XorYwJS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rMDLgUC.exeC:\Windows\System\rMDLgUC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kuOozLU.exeC:\Windows\System\kuOozLU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VoVCJFe.exeC:\Windows\System\VoVCJFe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cxxjLyh.exeC:\Windows\System\cxxjLyh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dffDKSd.exeC:\Windows\System\dffDKSd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZsjOKYa.exeC:\Windows\System\ZsjOKYa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OInlChw.exeC:\Windows\System\OInlChw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56f1ac214f691a626373d1f2a989bbaa4
SHA1320e420b032cde5575b9bb480a86e06f69e878a1
SHA2561e54c790bd0c9760b33561b6c6b627028caa90fb40d50b7588204855ef178283
SHA5125d4a7044c4f630ea32518bc45e9dbfd8671a556a9a43f7e3c7b028d4bdd7210dec5b4f031ef630d2221ac7f830e7d3562a2a2cdcfa4c78c04e832a4d96037f1d
-
Filesize
5.2MB
MD5d2e51d5f815c76ce671b84ab5a220098
SHA15c67b186e117da0afd1ddf73dda65fd8a41ddedf
SHA25679f80c5fb21daf20f3b1620d7b76e46d792443bb7b263064ebbcefdfb57a89bc
SHA512169e85dd9db9b6af83b62eaa8059a6a9e4eefd9f3a6add749933fe3c26d1ae2e47aede8f4c49199d26242bc043e52a597f9729b721de19d26c0b8e613cf03052
-
Filesize
5.2MB
MD539bf49f485c031d90a222e1e63fdc55f
SHA12afaf146ca72be7e727f03530b3842590bdecc93
SHA256e4692a0905e20df8a6483ef5a0578c2cde8395319a339af67d444a9c7369ac2d
SHA512392a30b9e923c224bed6632c834c30007a2bf35f23dd29ef8b21a3c4d81b1c6c9eb3e10f30dc17561ddbf8359ab40dbcde60f8d5944f6dbd85a0cc9e31521b2c
-
Filesize
5.2MB
MD5ff08a4dc3ae3c99e9655d46b8de22f27
SHA1815d46a80fdfafa218fe891a7e1efefdfb59fd96
SHA2567c1767e481c31e67be08ce5cf2493f6194bc477e6ffbe8d69643484a35df1ca2
SHA51224b0c529f36dee5611880130f93c0f54a51e576594a44608d5b8cc23bd98e479d0ce3311000e8702de9cfcb9ce08aa0222f21de0c58e43e143d6115e3ced67fb
-
Filesize
5.2MB
MD56f635957ba7f3a4f4a7a28d268fba5f7
SHA151c4c03c4101954f2ae546f15854d0ed33074d2d
SHA256f5d8f0c222b93699310cf6df92d4a4425bd7914cfdddb7262e97d18995c08780
SHA512927412fafd635255cf226b77704da8698be4c55f779abd4d65c009f88b40e986aac0dd48eea7e78bf0376ae0915d09a1049e11621773bdaf66d825c9798294cf
-
Filesize
5.2MB
MD54c48b936fe277303a560e0fa63c21264
SHA1b1d8a8a47a10048145d429bf4357911597306b4a
SHA256249d0beaa3b3b14c879d728e5416d2f2f1795887f8e9d173176d04b9d8269277
SHA512725cf9516720c77d16fdbef8bc0cb7b6df5cfdc7c7b02cef6912b5f891a41ecc583f5a83e25058ab3cb4ee0ebd28414125760024caba010ad518ba4f5942bb5d
-
Filesize
5.2MB
MD592486d71d228c7358676c0ca55099692
SHA130cae690ec083d675c923717a7bb73255674a5d8
SHA256cc69cc36e52f41a31edba847d2e92a70944577b3821953f45bc6c6a6ae4ce4d1
SHA51233513479e936d9525a66c028061e686e09ca81a7bc3dc2e31327d44ec22a26e52522603f42f88881d3fcb7099b1fad9690772db9009aeeb01f6eb05df0029ecd
-
Filesize
5.2MB
MD5865fef866eab0ae5c5623319ff1b7ea0
SHA11ea3f7b65ad40ae37f7750fd55cda2d0633cc52f
SHA2562b860ea44b6734fb651e8e58ea3a47f54dbe152888a5a6e71e880113d6ff8b34
SHA51218da34dd4b46f9740f91a904a41586c680dc093dbb93139f2a5845b75118ec25f731b3599d311e37890e2c60c0e68aa0d0c7a2e772b4e1abf4eabcb4b3f29864
-
Filesize
5.2MB
MD50f36aaa8adb553c2e135f87ebdf7638f
SHA1bda941d0a20978b77820b0980975e60f6959f368
SHA25651fbf1f68a4d1a79920a793518cf2f80a98a099ce4010889d6313a7b6b895950
SHA5125f82b08eda4b775678b3961b69cf4cb4f6672ad678becc21acf878f0c0a9508c01de66430364a3ebbd470752397ea331b9f1c46ba1cace1d61bfbe8aff9f2320
-
Filesize
5.2MB
MD5823fcf56f3606b0521bfba0e8a9209c5
SHA170c3945229a396d1e2fbbe6586b65e90c0bca091
SHA256c28f090aa83d8589df6e7daaf257dac211c206f3334ce163be74791004ca0e3d
SHA512d4aa86a849cc8565fc1bc1339689e7557df71037f9621f5c912c75078b4e6448cf2c2ada17133f6fde851bf22e6d0bc2e9467a0556c5c6501f653b72cb84f262
-
Filesize
5.2MB
MD50af1d07fcdc5d745cca5a5c512dc8c5a
SHA16b1e6df37697759f69b2ff72128a0ac9faeeba86
SHA25696aa0652971520bcf3b3578a29a3d307491d42086a2d2a0815eda5a9851f6626
SHA512a2600e9421e63ad85643c5a501c0cb36f2dbe3eee84d7a5c36c2e2077a2145c30d273db5c3a3a2115ecda0d8693caa1f66c24bf78943fc174b82d4c4e7ea17eb
-
Filesize
5.2MB
MD5be15ad0fd987608df8b157de67cbda87
SHA12176832de2589be7ef8215d8877a4c8f4535321d
SHA256ebac927e4484e5eb021bda86c040e4e70b5e41315dd51c92758b6b3f2f3b6f75
SHA512f762fbad9be9776dc16e69a84a036027bb0aadbcd9ce96417f10f18d6ff0bb3e7fc596843857b93dd2e93dc5527bd873fcb0b8882dd336e0462fccd603de04f3
-
Filesize
5.2MB
MD5dab68cfe567aef5e40ce627bdadaf7f9
SHA18e8352ac3457220cc63a2bf68bfcb5c40866710b
SHA256dd4d78af6a5c9322055fe89c0fa69835657c064a8746efa26eb5cb9409c0fa32
SHA512607f6ed8f84654eb51e87fb0135f77ccc1baeccd4bb055831437dd281fa130ba17a3251a479e3a929a66d2ffa56afc50e6bd9cdb6694fdcf735f219d313a02a9
-
Filesize
5.2MB
MD5ac28479bc0343b956740485fa3696bc5
SHA1b0dfd3cdd1f8625727e622895f24c35189a4d643
SHA2564bb27f8940d285ce8de4354fcbf8f8fa286b428cb40817cac6eecb0fa75c9e78
SHA5125033aee095f604a5f8166d4a550699aae51f72cdb67af41bebbb172e5f8b11dc48d5589c822eb28cb6696d43c30f18fb9ff81ec409c06d899f7f736f71784f34
-
Filesize
5.2MB
MD54218fb54757f93ebb20a15e2bb4916f0
SHA1ae93aca8fd0dd306123867e329ce2a83e37c5eaa
SHA2563ee6081d1ab75f3d368b8daf5263ac25dd58691a5b2cd8f5b0b5a4c108f28b5d
SHA5127881fb4219abcc190edd3c13971b01ea858a5f35701e0bac5720eb97eb05164a34ce55b2544f89fad001f8f141bd15dbf3b60909bbf1616f80e72942e7963e8e
-
Filesize
5.2MB
MD512e093b89ee349bbf8fcc57062d03511
SHA1adb14a45b9b373770072c6c26dce5a098a4342f9
SHA25604a14f52739ae02b4dbaa163848e743f314b0b20711923ac2ed7a463b62364a9
SHA51200cb6fb9b1ad96d21b63ae51f32fdc4e6e86dc368488cf38e741828928afdebbeb7713f146d3339547578e773f73dd6bc92dd71fadbc5b1d2ae32eb979ed659c
-
Filesize
5.2MB
MD5c9bdbec64e8387d875f15d73c61eae04
SHA1587ab1fdad5c5b0bff978d8f03a6b19521c414b7
SHA256a25799cb08e6cd256dacfb06075977b3ed2374e1d112e8a25dfc45b58503e02d
SHA51207c0509fdd5bc050a28c384c55208d9d2de4f9e45f7f1d0c6a5893156e82a9dcd8a2d75ffaa25483c4b9159dfefba80a763935d486b35b16e27edb745aa24f4a
-
Filesize
5.2MB
MD5697437f2330dcac374e168c18ff637a3
SHA1069219adeda29c699a587ea42e42abda7e2ff4a2
SHA25675b0c30212b1ee0c5cc43b4f9a50f0e2dcb9d47ae27071311993d6d4ddc6c0e1
SHA51281aab426842070ed6c1711173c68995b4b25e74cf0c4fee835b85b85b3940c0566790e2cf854857b4bcc011880534e4709726b9767623f77f3a1322b3046d165
-
Filesize
5.2MB
MD50727973029645d6432637bfa0315d94d
SHA1d5f66ad7994847cf3a9faea76b4020d22538231e
SHA256055054d41c52ff3708575a16dd0827610881e92d2dc4368de744824dad850690
SHA512d456cfee98f1bf5418ba2a55e8e816925761ca322529262ec51d8f2c3d3d14e711e1c55ec68acb28b793702b6cd110297b88a38fc028f51770fe335c20859df3
-
Filesize
5.2MB
MD5d2e23bbb6d4246cc2314ebca78ff868f
SHA17fcece2deff0c8d4014282b4de4f6b99923a1ba0
SHA25614f15dbc0e05fb18bd140127340a6bfe921624283763e79faec3046521414f1f
SHA512f095f3bfb40ddad115a207aa24761bf97e95df064a4ed108a927d29be53d5dd0b6303f7fa04107366f9a38b8fe503211dfba620db141f1262f0086078b869910
-
Filesize
5.2MB
MD535c5bd9e72bc0edb8bb1400486b8f02c
SHA13fa336db13ba2f1bbf1cfaade66fb86cc65ffaf6
SHA2565ff2c6ca31c6d15610e66ab8fe6a6ee008e7ec786cf35398ce8ca49eeafc9e25
SHA512ebdaa0b6f5c7e8e4fba6e77ed295afef85f7893368b6cd42a26274fca6a21f5ffc999827dec237da16c17e02e2bcb1183430cd7f8bde5731ab3d8e1dcf08763e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB