Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
19-12-2024 04:15
General
-
Target
2024-12-19_b400d0004ef0cdd62a59e7807f96e930_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b400d0004ef0cdd62a59e7807f96e930
-
SHA1
69183c44032bebb8d70fe6a11397d7a7b8d38e3d
-
SHA256
41e43fa5fabeb1553dac99f0f43f5ea21c2098844b6f4d4a098fe027f7695cb1
-
SHA512
a54e5a3dcb04471c84719e50467015d6267279b3a099d0e7fd80e62960a2cdcfec39a4d1182237e14c78436a12a4594a3cb9b50ee6a37e20a6c2161770330867
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibd56utgpPFotBER/mQ32lUE
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_b400d0004ef0cdd62a59e7807f96e930_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_b400d0004ef0cdd62a59e7807f96e930_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zwNvIuZ.exeC:\Windows\System\zwNvIuZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BzChLiS.exeC:\Windows\System\BzChLiS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VUCgkHx.exeC:\Windows\System\VUCgkHx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wPqeEyg.exeC:\Windows\System\wPqeEyg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jdJaNxM.exeC:\Windows\System\jdJaNxM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TZBZehV.exeC:\Windows\System\TZBZehV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZDcplGx.exeC:\Windows\System\ZDcplGx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YRnlYYA.exeC:\Windows\System\YRnlYYA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JFJDbUB.exeC:\Windows\System\JFJDbUB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gKdWOZZ.exeC:\Windows\System\gKdWOZZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FjNfYnY.exeC:\Windows\System\FjNfYnY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OoVzsMZ.exeC:\Windows\System\OoVzsMZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SsxilHe.exeC:\Windows\System\SsxilHe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iDLblIe.exeC:\Windows\System\iDLblIe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CgblUed.exeC:\Windows\System\CgblUed.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YJGGTBh.exeC:\Windows\System\YJGGTBh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KSxwZds.exeC:\Windows\System\KSxwZds.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rejaqIK.exeC:\Windows\System\rejaqIK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oFQnBeR.exeC:\Windows\System\oFQnBeR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xvXxsTP.exeC:\Windows\System\xvXxsTP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PjGUzOL.exeC:\Windows\System\PjGUzOL.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52c324a6fd2e8588ccbcbfc688bc67188
SHA168a5c83f3b79b9976a67102f027a1749747fdf29
SHA256531b9bcdbad4f0eab523eb3cc4f1f5a5f2b61485bbe311816d90aa1af541693d
SHA5120a2a0a358688b1ae9ec6de2713980062643d9415ce109931e31c7d42940c173b9f403b192c456343eee0cf4df232d98fbf3727e12b95a078c6301deb3eb42857
-
Filesize
5.2MB
MD5c765a1e811c989be619ec88970a4c8c3
SHA18bb31a8a0a3a7f3161df844a93e862435f922cef
SHA256221281e08eec11101613bd51275a6793c75b67bbc8e977a7ed6a7674f377b929
SHA5122d7c5c2ffd822d07ccf155aa438d4b5da7c7f3867260d13363d5cc0853f37d4a43ff50572dfd160dba28da3a853b755ff83793196a43bf8e02298260444b1664
-
Filesize
5.2MB
MD52306b7c743c9c345825ef2b080ac9135
SHA14ae0adf2a1f1f2795915380073f697523ba6a228
SHA256a806b2c1c42f65b4e88e6b7b8b16dd47106588bfa1e7d84eb21d6743ff501b8e
SHA512b2d72fbcf812c48180f5619d807985969c7aa78c0e174602b578f6c2027fe148daae90814ed56746e806378711e12c9c6dee5fd186b5c1c51de1b0dece72532e
-
Filesize
5.2MB
MD52c191cc56e3861cd9cb2701839480ed3
SHA11de21677be846e205ccb5ba7b2b34fcb74c496db
SHA256637537aac5206e49a569b336944a6142525a46eb1f3348ac3ea0993305ec8d7f
SHA51274dd7863c521d2b57b92596e131c7567fd059b69061fc8d63c2ac95f2be41589245ec2bfe82b9761e080999a6b2283dadc7bf8d774b0c1a34954a28ab7e210d1
-
Filesize
5.2MB
MD56b9e0c5d2837d0f54a32b32cf17c063c
SHA1689c94f30ea82de967b19f3d7a58835754cd4356
SHA256fc6a0d63ac2fd7dbd817809c8388103de6f08887826751d188611ed7a9d0ade4
SHA512d1f88b17c9690723d763c920fcb9984afabd44ebdad8ac077a1421716449acef79b92c9c892bfe14c2c304902b239b297c921ffb4919f9e7d3cf031b2f6c3c6f
-
Filesize
5.2MB
MD5de68de14cbb0dea7ede4ccd10b037412
SHA14d1c3b0f8b1727f2605b5c5330241439fb1a26dc
SHA256e7fcbdabf1aa822dfbf49fe1eec5a7e61884a08117108964d4c823eb28f8b23a
SHA5124004545c57275c79ffd57b27bb7db0581c09141332bdceb132aa917227169bfb6b49c6003fe013f5813d739ec4c8c77bc60358eba4fd0751f2341e5cfcd38db0
-
Filesize
5.2MB
MD58bce684f67c72e7960689cee7e55374e
SHA10d5f59a31150201c45368ec0e57cdbb6d30e08fc
SHA256c999567a84d54845c90c7995877f102a12664c0183ea89ef93b4f2711d59077a
SHA512f69b629824123c0279db0f93221c6b1fac28fe94c1863ce8ac0bf12c06e11d692fc64a022992264a045d8583a43b2ae1ad2fe0f1f84c6859e83605ffaaf656d4
-
Filesize
5.2MB
MD5b9f4efedb90417f5932a6755ee3344ee
SHA1d93280d7b9da17caa7b7975907e4f52eb9fcc841
SHA256357322d6a8e2dbad03db6d6b6010be3a97e2b57f58a52706bcc340676c180b2a
SHA51217c5873bf78e98f9651ec32f278206747a0e63cbc86cb8e982bb53abdee2763d9a6c4db2c68d3cc6a6f3526b854e58a2429051ab9b36eb03217548c7ae58c3f6
-
Filesize
5.2MB
MD59d639866ffce782a0bf2f59d68d1f1be
SHA1d55644092127747261183972466fe5c07c8cf01f
SHA25676263dcec7e8bca0d8220c8b1c241a45e16c5092c12ff5c1c9007407d0f7f07f
SHA512955bdb754b8f7960a1793a600b6897502c3b6cd0f99dbc4a85c1897b3e69bb9c8f11420b3caaf2eed89ca5d81d7cfbe1815472429ede22ff6207d57667298a8a
-
Filesize
5.2MB
MD5d19ac62c2f8024751079b646a5423623
SHA15e14c3dd43e10846d262832028304a7ec503468a
SHA2569ac788c5a50e99016fba6bd56e98ea501e62d652987c1d6110d5a1e6f6244166
SHA512f16e12225701b7f96a9f93cee0deb40745bf28b3460c4b1e7a97f9f975403122e5da4c73239350ed18fd0c15f8abe2b224e163c7dac17df4f5444856ee6b6ccc
-
Filesize
5.2MB
MD5ff6edb4b4e23f12138120aef15177caa
SHA1b8771f5961066befb2727cd5e0c327b5bcd3e807
SHA2568ee6ececf17607293d9cf26099d79f219ee51d81a9fe631ce8baf3a4649927a9
SHA5122b6e58ba68cf63065a6bc94be92318015c83e9115cb473f17e4340929c1f553d584936822934b54ec9aae2c25bc1b24f8ba5b683278421bbbe5a32f214c46c63
-
Filesize
5.2MB
MD539de61c57e5f28ab09065c4a77f27699
SHA179aea4ba49b12893fe2ed1f5e3b12dfd7b350358
SHA2564a69ebe4689bafa7ad5c9f1b801a2cf78192a385874405f0736cadc3c2151ce4
SHA5125147e6a56897c46b3e683dfde7a727709fb48ef4b6568f443367fe132b6148284df2de521ded74e5e7265df152705e923a13f5c71c51174313004f493d3f067a
-
Filesize
5.2MB
MD57fdb8d4718c4fa2164526eec00890fb3
SHA1495d14357d0c079a374917f46556290cc284f9e5
SHA256d7515319a06de5ab756720f8d47d9d7098f7dcf28e5b685bce3540af007c85e2
SHA512d22841ebdfa6471252cbb92d6f36ccb1911b525dd88b84af42521a9862264fd2fc03b8aa10d1e010b308c263af95ac92791b648c88d4f36785d5e92d82d318bf
-
Filesize
5.2MB
MD55f98ea8942bab0a5c02fc3fcab946bab
SHA1966e607c1802f90831abb45688e4c0ad46ecef46
SHA256eaddb65103e470a31340930739ce11712f519e3311925d4a4e581f2b7a4d517f
SHA5125d4ab7cf9a3c630c9374ee5df57c0b4f1bf37732cbf0d6713d088e5200b7fc4651ab99294f8defc599ea19be9d556428f8daba49b358f35988449343ea56030f
-
Filesize
5.2MB
MD5e6bcb715ed3fc21de6252440edc3b910
SHA1175d69b31fb2b50dd9f8595d1c464518aa07f1a8
SHA256a428066e542b7d59e7ab3d9df99319e31a60cac8b0c1a14ea1807b7acf72465f
SHA512c7545bb37265b3b3719b1930524ea32a20073a0467cac53f9b86c8e8d14ab185ae360c7fbfd2b1057393adf9792783f2d5f445a13528e4c49b02208ecfd83ab4
-
Filesize
5.2MB
MD5b54a2b82476c708fb472d5d4e88f5a2a
SHA1c9e5d39d9baf607df26e0b1ce5eaa6033f7f28d6
SHA2560330a93bcd5e54da3a55f24facc3c3f4beaa770f0f88d3f1625983647ccf328e
SHA512731c63d24be1bcd090ddb8a7b0eaf3642dcbcab4c2e79079caf8cd40a0294bc493acad6c230a514489035141e2edf3f1bb3cf8ba6cf26d1fc23ecc2a7fb73a9b
-
Filesize
5.2MB
MD53238ec3a679283209a1712f1bc68fbb1
SHA15e47158f60c6ca08dcc6c03b43276d7db6259d5e
SHA256629b5c621db891db46e0236dc8815e412f4e6fecd3a53c44dde95246941fb343
SHA512b4c28aae13a640df50f68b8c434ce8ce480d6b0c2ab1cf6f47732ad8dc5b1f3f75b01a26a755f59c72478f3482da617b1a6e17382e309d69fc18195a9487ff15
-
Filesize
5.2MB
MD50a166e24d123bd6962f925ab697e2a2b
SHA1a4e9de2966534bfa6b4744ac9e688198140387a3
SHA256f43bde31ade015e11fa305b4134ae291d546800db84df3e747bcbb1c5f016842
SHA512920a4a93069953500b5720dd3e0ec85aa6547fb02f8dbc881ec327c58e7418f09465c7cf0b4ec778426721807fbe1260f7e9536e54993ae6c911c20fe7557fd9
-
Filesize
5.2MB
MD5dbabce23587b50147b91741ab59cf430
SHA14cff98c2b0864ebae14139963c7675dfc7a7a3ca
SHA256eb73de9f56cc906c47e42ea0e2e15a850824b0a4d522eaed8dd6221c40a25d5e
SHA512d86032e86a7afd4938d5d36ee2a247349f14adf185963a6d023fd9df303d50f5aba569af434ba0d296b8f758a32d5718ef4a9ddf4d921a2fc3e75485cde56e01
-
Filesize
5.2MB
MD59b6ed14af0c2778d393269501605a029
SHA16fb907359bbf0e69234c95dd603f1b9a0d9852f3
SHA2563b902c20f32efb69ec9af8fce4e3cd0d7479da4a1a2cc2091404d6da18a5d82c
SHA512dff5d17dcb739b01bd7555ee643082b0ee0cc80ae07217288995c2cb36183f540947bae8b1493125c64d768e788f0d93dbd332ec6209fa383d0f1040586c13d0
-
Filesize
5.2MB
MD59d18a45874f205fa91275a7657372baa
SHA1f3032f37432742985538aaea6938e706f583947a
SHA2569a91f8dc78ade1f6b01f9d39299a97c587cc38ca8cc527387b2da871c93d94d0
SHA512c5b96402160ff01eaa6fdbc3b710278b29403c68d5ba91986c7e58e1809d9721c478fa8e758add5ac1529a8213d2eb8baa56a5a60a8848a11f680859b2205c19
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB