Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19-12-2024 04:16
General
-
Target
2024-12-19_bcf1415bacf01105d7ddad34bc6b69d1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
bcf1415bacf01105d7ddad34bc6b69d1
-
SHA1
0084f4c8996a69b7eea02abb74f49c4d9b41863c
-
SHA256
b5d3be6cba78aee7ba3df63bfb8b2c6a84024c2718969866e9061ce58e54616a
-
SHA512
0540bbd2a39debffc8aa5da0a1e6a1af383f7912f2e5306750dc0e6ebab2070ea32c58b44c29e11625107a660f8a0ee526b869527294db75bf42329a70c93c49
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibd56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_bcf1415bacf01105d7ddad34bc6b69d1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_bcf1415bacf01105d7ddad34bc6b69d1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bEcfXeR.exeC:\Windows\System\bEcfXeR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HYHmKHb.exeC:\Windows\System\HYHmKHb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CCNcfEA.exeC:\Windows\System\CCNcfEA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SEhdVco.exeC:\Windows\System\SEhdVco.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FGqIPkj.exeC:\Windows\System\FGqIPkj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wKfJqkA.exeC:\Windows\System\wKfJqkA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zIMbDgp.exeC:\Windows\System\zIMbDgp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UUdwsdh.exeC:\Windows\System\UUdwsdh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tHJzUSO.exeC:\Windows\System\tHJzUSO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHlYABo.exeC:\Windows\System\BHlYABo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PdEHQPf.exeC:\Windows\System\PdEHQPf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tVsRmUj.exeC:\Windows\System\tVsRmUj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KYyqeKj.exeC:\Windows\System\KYyqeKj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZmESdcM.exeC:\Windows\System\ZmESdcM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yHmVkcF.exeC:\Windows\System\yHmVkcF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QNVWsnb.exeC:\Windows\System\QNVWsnb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RwggbvE.exeC:\Windows\System\RwggbvE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BBLteiz.exeC:\Windows\System\BBLteiz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sOxfcvR.exeC:\Windows\System\sOxfcvR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bCAyVEF.exeC:\Windows\System\bCAyVEF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UUrKlEt.exeC:\Windows\System\UUrKlEt.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD510364e5956e3e34b5a80eb2c24db8a61
SHA1a89240fec332065de033cc597750404ca7bd8f47
SHA256929497239d206f0c3a3ade40baf751877354f910743d6f3075dc1bb2354c14c5
SHA512aa2a07feea7e4cc7ca2afde60b1f26af1f3d9c5d72f8bf80e4ba7b4d3575261a7d1be185c5e9e4a2158de56ab0ef4f56e9a0667c41bb35cc9be77e18812bc620
-
Filesize
5.2MB
MD56f8c4a13270fb6b43dc8ac70e631d356
SHA150538582c74b7ea6f7fb926d9fea074a2d1c3367
SHA25604c6e8f93c91db25eb1b15811820138ad56efd33289f85d95a316053af90223e
SHA5122c88f5d181775b8a4c6d1c2afb6c6babe0a9dff1e024bba18cb3c1a56ac6fdc150cc59e84ba35766465c745ff5c9fa785cbca1311e5a0c61e7c32b6cc8cae826
-
Filesize
5.2MB
MD518e257d85216103657f7f55d1e1cd56b
SHA1105bb563692ddf6e18b16da9628431d70aea407e
SHA25684d0611cfc7f19bb24e2580f0c898fd484bc1d47ef685d7be17b3ff0a8d8aff4
SHA512fe849636a6c94a358e6222dbd4a9003bf51f98ef87e7e190cc63592cdb3fba91ebe17763abde2e1265094b745bc4d5b0ef383297deb379a046aa5878f10908fc
-
Filesize
5.2MB
MD586c6e25bf40685491845016235aa9255
SHA1caee91b8c4d16c28e466c7f3018c32bdce7282ea
SHA256b7715b6d5eb03f75726f2ab167c3dc5f1cb062ff267f5270efc8fce74f7538dc
SHA5123fbfe61338d11bf11691dfeea6a4bc2461ecfd446b72b1163c77f15493bcb762413ded0cc5e19e49327d3cdf69064ea50f4c2899e496bc63f671186ba0c8bed7
-
Filesize
5.2MB
MD5fcd3692d1bac592bc11497f22cd3bfbd
SHA1e29408b09b908ceb020f17565f7bb41c5f12cd85
SHA2564335c157ae8c205bf626fb708068138acc2b7c7b9d6e8b6b8e4b5249ff7a0cc4
SHA5127ae880ad82a04221cb166213fb7164fe1e4cae0a8c88be5d6c6dedb994a4ce3786d874e939fc98327c6bcff0e3ce9a726aa50ff3920c5f21580ec1bf04e327be
-
Filesize
5.2MB
MD5e769853e74895e02a2d62eb2a8b28ed2
SHA1dc11cd39b6c9c2f13f3fc4670f9620e285248221
SHA256d368e32f93e7f2823df888def3419b72be14b49e4fc99d17054f3d7e291da78e
SHA512d406760e20636cfb2c1ad76107980f2bbd6bf6e02fe52f7df2ddf2d7c1f6aa7376cfb73087832cb8803121458ab48c7298672ac47539aa30e5b888fc8df3dd23
-
Filesize
5.2MB
MD5a6812f3008b7527dcf19799eb3536af8
SHA10d2f2d91ec4693413d7137dfeb59ab337137c41a
SHA256add2f1bef5fd987545911ae558e1825dc2a4dd14614c44217087338a745129c0
SHA51211e8fc0414eb9272cb5fbe6eb7dd0c567bb7911faa2bd74090c417c4bb8226df5394357629d9880c2edd8602e93ef807bde3af0cd9a9edafa005814193f41405
-
Filesize
5.2MB
MD5c9f39f6ac768c75c1289ed73e53a3c9c
SHA1600fd8ec32e9e01e911fe5d65399a51f36c166df
SHA256d4e182963fb3020cc3bc0cddf9d6fa9617810ef47eb03d596e1ab2f9020a66fe
SHA512208e66764653b6bd6f8bcdea30f21a7978dbd17631bc29720037b152d183e702e860f6c3a63089e8ab6739eae33b6b099faa8128746a3163002aea8443c0f0ab
-
Filesize
5.2MB
MD5bc1090f7f76e18ee1b26a6a50dfd8346
SHA1701346f2c2953b53767f419e735e63efccb3747a
SHA2568fc041370d99d4f6e0cfdbc9703910c8833e5fab2e32f9a2a6cae8cf3666f4f7
SHA5124a9426077da14a6b6ec20706b042ab7583f157f93335fc4321c3b6711a3a016f5d1af90d621146e1d692844e760b55cf44abe34ac08d77706be63f91c2c185f9
-
Filesize
5.2MB
MD587960f2e9e00410e82cbc01f72d59e5e
SHA149a01c8b13cff206afc0a3fd75fce065e9a9b898
SHA256b9cd64102decea1a78269144a14d26fa001c1c9e2709e75d45baa1832318cedd
SHA51201c28b59de2a083e93806681302cdc3ddf2ae84bbfb566b073a515c27bec0916bf3fe4126005855a8c1e406294c84fcffe0ce101e1161a7a289ea041aa57d12e
-
Filesize
5.2MB
MD53ec2e622a6b9e8fcc9a90a0842895578
SHA1bbbad49c9ac628542c5c061b937f586c464e1890
SHA25677a608d299062838ff7c7ffb5bf81417dddba35cf352254b030cd1e3e31f4cd3
SHA5122b47e7bc01d71e78a86c12b9a13d27e03ce837cc5fa35e4db6ab16dc75665c408947a3d5a014e96328e500644ce4c6cfe549ee69ff40311ce2fde3cfbe290047
-
Filesize
5.2MB
MD5e7b55ce38009ae741cf7c9ac4f55adf1
SHA11f870b754154cdb51b9607692617bba907e90f67
SHA256c1ccb486a2e8e52030fccb48cd4ffb6dfc7456c400481f564ad81b6b24c43e7b
SHA512c4b4c94643c51d3c2803d1a0d9b28d8f5c90a63febdd4fccff6acd4945713991424001bd604d768ff4209573163f39e34053d7bfcb1510dee34cf6f2eac867fa
-
Filesize
5.2MB
MD56e5fedbe80f31e3d04ad02c4ebcf5575
SHA170de5fc9fb0cf175efb7d5d4ddfe2fd392079545
SHA2562f6837935a91845ffb30777291976427c038ac658902547623732d2f07f5abfd
SHA5124a99d0b18e5eb17e0736861da80a46b111a48a0c2937bf5430306e1eb16cf400aba478fb089012b52059c65dc7c1080867b0d02759bd34659cf27a7f0fdb514b
-
Filesize
5.2MB
MD50c9dc1c44808fd3e8e812b89a2f1556d
SHA1739e4ecf4dafaad5aeaeb43551ba1142951d97d0
SHA2560f7b5f894856a83289525526bf009b57bbc1680f5bac9a6334fee15ec4d5642d
SHA512603ca538f696d5a6489c2e7c0e9cc2290e2703d31a1ce9b46d064d53d2cc47cf25165f835569ac229132b88b4b7a5d986f75dde30e7303711b59d9741672168a
-
Filesize
5.2MB
MD548c4620920934875515ef3cfc58bb16f
SHA1e24623934385c9f6d2384c6144d9b50fbf53913a
SHA2564b9922d06a20b481a1599e24a53ff526a6451ebc40d121b52ed4ed2e9ab565b6
SHA51201c76f3f3a47d32bf2753511d24303c126046d6b7f5940611c3e950ce6443bdb45d066f8e7e7f4d109997422761625ae4de913dff5c033ab78d930711467e8fc
-
Filesize
5.2MB
MD59e8b4b95721ccddbae86c64eca67b6e1
SHA1b309edab66ba9e9c1ea987a0a3364ead2d532265
SHA2567f81c11875f6a1f5baf87af394d6cf5ce1742838d95a746562b4229c4a477b1b
SHA512b99140bd5aed27e529de858442a817321e390ff57067c865bc8a1d1fa9a2fd2872d6c1d5b5a5e983a0d31c5b647bf938f064793cfe2d5d577c01a566645a4b48
-
Filesize
5.2MB
MD58a1f27c06a03426028827a24751b8b85
SHA133ac669f14a37514bdcc1c490a88c23ebfd4044c
SHA256ad472e71abfcd6e598872575124ac1b5c1a7ebc65fc86b0a2a804721017f74f9
SHA512be4e0f89b8781e663d7ab78faeeb8ba0d0c89d5c582344d38aebb6288497086e5655c06e7d0dbc06d5acc4fc6b13ea74507e1556f7d3da70ee61229fc14f8628
-
Filesize
5.2MB
MD54249a1ceda5b676d6780bd45ad702925
SHA1046650fb0a1c5ef6f40026ba8ad5985a56ae07ba
SHA256bf5ff85eb9ac62ce36781dff30de78670d461477b82272e9af12fb46d79271e9
SHA512689d4bd1f9dba88ffd0a9867c739a2da6f0b91a66813d1f5b73f15d776de9fdb239fb0ee0432bbb2c26301eb42786d0520c13837634c3423a70a063022a739df
-
Filesize
5.2MB
MD5316413e3de31771902bb52ac187ae8a4
SHA1b32fc4636e09e116ccd6398b67d0153e5f619060
SHA2568a25ced2b2e153ffc6bede6688f3833d86539c3b0feefd22055da259d17c7d82
SHA512fe3caa504d58f4796518090727381c8b7b58d3e894cd308a40e6cd7b7ca30ce8d1056421b4f4bd3267de3319a52b4bb1e56c7c532a965d6a617d733a222f81e6
-
Filesize
5.2MB
MD5c7ec9f2a0b3bc7d77ac93b29e94267e2
SHA1da04d442a2c42363bd24f16ef4bda392f2af86a1
SHA2568b6302204cd07032a4d95074f1e04c5ac87c519dd7a99e6f7f95e483b45e1b14
SHA5122ad79de45b9642054fe5208cdb637ff498e51904799b49bac89cb0fe9f0f95f32092fe242f731326504af9ec8cd54e234cafc8fb7ecd9fc904700a638a482a8a
-
Filesize
5.2MB
MD5db59bb85f5a9b35f3c8f2b9b043e97fd
SHA1e06d30828b2f6f815e20469342b4a62f519c1dd6
SHA256d9440c683d464355b537dcfa74e47d3cb6abf31fbfc5c361f8a7561ec09991f7
SHA51286136a08b4958aa0649aef600315b9b006c37d1db529115ff8da1b10811d023679b9ebed7f73770a89e7f2c9eaa7a15535c83ba7a3e6ebe6cbd02c509da5bde1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB