Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 01:46
General
-
Target
2024-12-21_cff67ea97a622a094267144b17f6b952_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
cff67ea97a622a094267144b17f6b952
-
SHA1
f3c5d105648f07f4e0b96d2fbe44cd202108b6cc
-
SHA256
1274694cc728f34bd424fdc2fb47ea545621aa0b22bc13fbf892a3837c2a9895
-
SHA512
d378edc27640d69212ce2aadfa5f38d21095bea54129ae7062fdc684f49ab72a083209d037d80fd0ac602f75fc62f8fe18b4f0b44593f472c7ea847b56080dbd
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUR:E+b56utgpPF8u/7R
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 60 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_cff67ea97a622a094267144b17f6b952_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_cff67ea97a622a094267144b17f6b952_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kvmonSP.exeC:\Windows\System\kvmonSP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xAhosxC.exeC:\Windows\System\xAhosxC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\egyYjan.exeC:\Windows\System\egyYjan.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wDhFZec.exeC:\Windows\System\wDhFZec.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lnrhDeA.exeC:\Windows\System\lnrhDeA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfpUONa.exeC:\Windows\System\kfpUONa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sDBwTar.exeC:\Windows\System\sDBwTar.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\unVZMGm.exeC:\Windows\System\unVZMGm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OIgRfUi.exeC:\Windows\System\OIgRfUi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZcmuLuH.exeC:\Windows\System\ZcmuLuH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oKlZCvH.exeC:\Windows\System\oKlZCvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IkzEoCU.exeC:\Windows\System\IkzEoCU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gEdZTdl.exeC:\Windows\System\gEdZTdl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NKsVGKR.exeC:\Windows\System\NKsVGKR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rpxcvkt.exeC:\Windows\System\rpxcvkt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EcwnuXk.exeC:\Windows\System\EcwnuXk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bDnciPZ.exeC:\Windows\System\bDnciPZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Vitpjqz.exeC:\Windows\System\Vitpjqz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iYehUfT.exeC:\Windows\System\iYehUfT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aLdJhqb.exeC:\Windows\System\aLdJhqb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\viasBiR.exeC:\Windows\System\viasBiR.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5bfdeaff6d25b4f800d56499e15770b5d
SHA1d2747349f8cbdfb92798f035b9a2bec5e3516075
SHA25645e00c5b77344c636b62111288e6de6d327cd8c3b7ae1d33ae37b053cb2ba753
SHA5122c9cdb96aeeb1411abd5e49d3fc07065684b92e4a2c8151e2b97ea5a4aa2183bb09a7408e07e03f7f5f97081e948e77044037ec6a01bc9a73026b6c062d4eb73
-
Filesize
5.9MB
MD5f3cddec382c1a0e39debfa65aae10971
SHA115f0755d10deb9ac863f6590a03f35eeb89f7845
SHA256ba5e3b7fa8d79043fd114e5caddda3dd2e045fab4e990c92d2275856394abebe
SHA512a30d0e5b0fcc9a6c76b1f855b7c576d3d5600dc8d3fa4ae67b740ea439a1d5abcb188035371cde73a6919035bea95238e7c352d6f8d8bf67399a2eab4b88de0e
-
Filesize
5.9MB
MD55c118dba5d5b095999d0d6c2b994fbc2
SHA153292a89b3e09ecfe3cf3cd68976deaa6c43b061
SHA2561bb21576863553ddd794ac21bad64f0448c1660f66bdc28e835e540e1b45edf2
SHA512e120413cd52470adb962b04d012270d80ba164a1c5672f2373add48af27a562fde1029c450136462a25b35df9622b25db2fc442713c60d5157ba47083d26d51f
-
Filesize
5.9MB
MD5b2a109791456ebcf6e955c66c394e679
SHA17a11f42224995e5b335f205231bbf0a82337c707
SHA2563db65196d7773532a9aab052bcbfb55503286fcb319fd99301aa5b302abb0154
SHA512872af9bf352b0cabe6b506222f591c1d2900cbaf66f2be5fce6f3c9b575c2de857e59b04e46b47950c46af13c716aba3325c744fdcf509455d7e146cac4fd756
-
Filesize
5.9MB
MD51b1cd473f207ac30c7807e7dd7555ca7
SHA1ae7aeba90172c1fea4c4e49033c441177f176acd
SHA256e3769bb0a74d6fccb8f13e8d3931cf8b9b3c495622c3b4270e687d50b67de654
SHA5129053159894b3745343d7dd8363bd373c7ee852f5bdd89a984a073a583df5fad57be26f38e6d186ca2e37879bd419dc7b77b9cdba4beffff4c8c861bc7cf1ae8f
-
Filesize
5.9MB
MD51b160ae1eb95ce839aca2154a8819597
SHA193a9ccbf85f2db8f5466f670de4cfc033cf0f6ce
SHA256c6edb098b01b40e181931ede072713549dca991315002b8aa228221a33053303
SHA512d60fdcb85e032b1c5cfc8a1499dcec0888e35cf515de880af166f37d7580e3783ee2d7e78587a9cb6ce0e605bb038ee7dd90f9afa9742cd070a0fa5a4a584e54
-
Filesize
5.9MB
MD5a22e2d69dc89194b44cb3b6bd5efa52a
SHA1bee7d141821e2495189e887731201cc63241955b
SHA256117c3bc00c85ace63bf5594bc1de71f7aa843145615cc3ee1dcba02d72159666
SHA512898a78dc3af1bc44965ab98b4d305ac7744f2c8244410d35b5dc6b520e095ebbdcbc314671e9a7b1a9d5b8ae485f39ea24a7487f31380020243879af013838e9
-
Filesize
5.9MB
MD535075dbcaef85e13ce26f72f249b343d
SHA107473000f22fe44b25d1279cbf1756de4cd7f410
SHA256c406aa074947ee35334598962f544dc408305ec0cf834de4c1bc87abc40578a1
SHA512897843a25eca9cf4429e6a038092fe58dfe1301aff22bdead0e0f09e4db30be58f4e8f97b1487a4380fa8534f9e1d8fc63ae726bf94f590954553b5e950f48e6
-
Filesize
5.9MB
MD5c3611c0a5b4dbd32e70d3228281dc0c1
SHA190d0884765004c86babcf45a0efb452180cc624a
SHA2563be375557af7d51b0777a47651fa2d3042b8d1fd08264c7eb4e6e1bd82999e5b
SHA512bec63b87ee43cfdc43ce245635f657c07e3d1e87ae90952df6553fb4b352bd5dd1cd955c4bfa7f13983738e4845f4dd90e46229a8d4cc913b2b486493234b3d8
-
Filesize
5.9MB
MD5872a3b3139b882fc0d51a409161157ac
SHA15caa00d99ae91029b47dba0eba2d598846279b48
SHA2560d9e14ec882eb15951c07eeb3246d160c27572dbefcc06980a684814a3bff42d
SHA512fa02743f9c75f8a1a32025a5df4ecad5e9936a2345d5314502aad16cf52add82821197f6ed150897b44a5f3941b40b6c352091d63547b3628f45d2f7e1d0b6f5
-
Filesize
5.9MB
MD54b9b7f5d0d2b5452e193d99330ce8a5c
SHA18fa570018fa74524ac7b21258495a02fa4121d30
SHA256f476453e1397007db328c8cdacda3d8f895dae412a2b29dbb8fa1d3cdd17eeab
SHA5123cc9256d5815e22c7943b6ece3170cbf90986e519feac2ced8d3fdbf0afcfad8168394a4e24787e80cf276838dbc78ed570e11af5a05419c8764c46c28a099ba
-
Filesize
5.9MB
MD5138f482b85d835bcdd6d0e0ff64b5bfb
SHA1b7b7b9d215ead91ac652def030b094ef5d713130
SHA2569d36812a51ad911109098f2f04a325733c72e05b92dfa4b6f394c8d462bf5035
SHA512f26167effdc7a231ca8e566c27ef1c4bf6872365833328e51e115aedaadf709333753755596334cde12e7b5f4ed8708aec38b26deb7641a24e2235ea9f16104e
-
Filesize
5.9MB
MD582778c50ebd8e998660b1e94059c016a
SHA1978c8a09443abcc52b26889305d14335ae8f1d64
SHA25638aa100b683b76f6325fb39f088e45e78dcbdf94d05c2e356b4499e8fc5a9dc2
SHA512aa2dfecea5d657fac95472717f2957bdc3478c3f0811d88369a3a201036c326889c21e00a4a9f5867375fb015b3f6f4ad9af2be8378693631a13fbca38b161bd
-
Filesize
5.9MB
MD5ebf2a76136ae7b5b5d15a4dc88e77f14
SHA13a651d3294002d2bf3f131f4749d973fde5a7212
SHA256807e1db97b7021469be15abf395f920d20f27f0c3c7bf5f121cf0f85a591fdaa
SHA5125d2dde8a40312bfe28711b73cc32069d8be8996eedd4979683518c28abb71fe5d66b0b2089c7e1a938efa0c09e550c741bb45c0c7a983eb13dbfb12e64bcc8b3
-
Filesize
5.9MB
MD5ccf237348aee0c813673b21a517139ab
SHA1cf5078f3b0497a996465b81260b3e30f7bfece9d
SHA2564fe8eedd1b8f09db49478c3938ea3741a54af1eabf0fea8f84252e93892b25b0
SHA51243deb153b5b7b78ae40af66bf8f4eb52a3baa3fc968b55d459f4363bcb58666890c0a755402e0abdefc66015a84edea7e0b2e206f4c0aa6d979e5174105eec5a
-
Filesize
5.9MB
MD5c90fc96fa84132ec69255b1b4a217407
SHA165ae399f7f28e0b6e001dbfcda93e0dccd55df62
SHA256970a19163fda396ad2c0e43ef1bf15321b545f5a84ae4b7dd585c490bf8dca8e
SHA5122fc91767a726614bac941927ca4116fad65318ecbc1702ba84728b53c37743e8539bdb8faab764749a8515f8b420752e3957a0842219821803e3f5b2fe4fb256
-
Filesize
5.9MB
MD5e398d846fe616b3ca362b8c07887034e
SHA1422183f397c29336bfa05be9d4746c69475e1739
SHA256fa405a91b5a466567207cef45cac4d2a8f5578c76d8e40d8e1f83adaf686f002
SHA512bc2d510bdadd44e8a8977a51da45010fb4c780c885722e0786f0801aa8c3c8e4bcc2efcd510eedd1659749ead964d17f33f55b57661c6bc5e3e3e27d7d6a0164
-
Filesize
5.9MB
MD5bfb2f647747ca3f182b1e5745e507431
SHA1012db5fd4a5252c5a426fb04f851b9a5e94535d3
SHA2565df77e50daa3d27116c15b41a39a50a871e3b940f3ebafa0afc1e980235c271c
SHA512f4e901115428a4ceb6a7ef2db0ec92b8ed20d832b82955922c22c6edfea97a37960b1213e565c68dac75f0a4ec9b42fa92c0add254d0db8abb7464e1c39577d1
-
Filesize
5.9MB
MD5ac3923b8577630d7fa7342e73787e257
SHA16bfa2d2c2543adc8fd1e319e287c32c3d4defe41
SHA256faaba7bd28fbae360c10125e923f4524defcff2d08b9e167e88d27e51d0cb5fd
SHA512e17dff4c86ebf5af44f297f99e927c01851fe7d7a22df62244bed70c80b4a8ed92d488d26177a2beeda32326ec52a1d4a3bf69cdceb64f13c8a4aa767cf0f208
-
Filesize
5.9MB
MD55fe24e9260543e9ce4b298e05052cd9c
SHA132ae13349b1ac2e1ee975716952bed8a30002ec5
SHA25618b3037ac112a77b69be984b06d3f50aa67b763abf7e5fdc982811bcd2e0d487
SHA5126c95908b63f6d29e740472e2c9530a1462077025fc194f4711c1045b1da49cc92f7e3fb4ed3b325f3bea82023a1089d9384bd1a059ea2f20ead9f0faf0e28d86
-
Filesize
5.9MB
MD5d64f1ecd76f7c17e0cbe94e25f77fefd
SHA134da9eb8388a63f8c83c704eb6bfde9ed28bd994
SHA25636e84d7e9a36f367e6e1db54444b39f6b669c4b769c837bcd044983db38295b9
SHA51258b576aabb18d14ccf276a0404371aa043a0ee1ac702704776b6931ccd15fd1155c348a19420542297d344f2601b1c9d68be6bc73ec69ea3dbaad1660833a7dd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB