Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 02:06
General
-
Target
2024-12-21_bfb082b462e06503ee0246cfe65fbf5b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
bfb082b462e06503ee0246cfe65fbf5b
-
SHA1
939137e0941df31825836a529b99f0df5becdef2
-
SHA256
b7ba2da90e454bce4ebbd87e01d124b3df2046684a5dfad9235fb985c10e9c25
-
SHA512
990779ad00a56520499f2ac5aa290c7904d04c27d9c00c3766fa7a89bd83e33b46988ccb145e0ef973574fc9387cb67555183036942d22b088646ecc47dd6d35
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUh:E+b56utgpPF8u/7h
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 63 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_bfb082b462e06503ee0246cfe65fbf5b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_bfb082b462e06503ee0246cfe65fbf5b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZfGfZdB.exeC:\Windows\System\ZfGfZdB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AokkSRi.exeC:\Windows\System\AokkSRi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\seCaTma.exeC:\Windows\System\seCaTma.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTXZTbs.exeC:\Windows\System\oTXZTbs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uTfHWCS.exeC:\Windows\System\uTfHWCS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PHeZEFz.exeC:\Windows\System\PHeZEFz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tsfeKdK.exeC:\Windows\System\tsfeKdK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tYnoHOe.exeC:\Windows\System\tYnoHOe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WEhCIEy.exeC:\Windows\System\WEhCIEy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DBKAkFb.exeC:\Windows\System\DBKAkFb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CwfMUCW.exeC:\Windows\System\CwfMUCW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BedSUyk.exeC:\Windows\System\BedSUyk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tFHoNLI.exeC:\Windows\System\tFHoNLI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iFudynn.exeC:\Windows\System\iFudynn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wHFGewV.exeC:\Windows\System\wHFGewV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FxtYJKn.exeC:\Windows\System\FxtYJKn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zQSISoJ.exeC:\Windows\System\zQSISoJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntwxtYc.exeC:\Windows\System\ntwxtYc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KGrPxaR.exeC:\Windows\System\KGrPxaR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CjuaChI.exeC:\Windows\System\CjuaChI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ugZZRai.exeC:\Windows\System\ugZZRai.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e57db6ee19688e0c1b94caba9fdea293
SHA1b12f9eb8c2283b1572073a1e81c48799118aea2e
SHA25666bb27f9211b22272cf79de0657c357744c44041d2ebde1115037bb3b68c2a40
SHA512b48050c3e60d4b42cc7d3b72bc74b97f915cc07a77445619b4479b810e1e43327247671cc482f90dcf730d17571912ec3f84cb5e7aec22b66c4565fbfb39b02a
-
Filesize
5.9MB
MD51329a22f91fcdd482fff1843ad7ad3b4
SHA10cdf48ccdd9411451e99baa90173aed4361a2fe3
SHA256c64c1dd02d4d4cf434652d18292f2ed1dd0bb90b927e8815eff41cce7433b671
SHA51215362c4932cb9db4778cf586a817ab73be886b2a6283f69ee46a8be09be28ab9c7e4302269fdd8a37a2f0c9cfd9598b240c207b7c7815f761bacb691da20bba9
-
Filesize
5.9MB
MD564446fae98455222bdf8e7c4258a28c9
SHA1fb4eca0190338781badb9ffbbc535892fcd5751e
SHA25659b5ae9f003eebac35ef459bb091deef5fc7c07b7184934abc7cd31c3d039789
SHA5123a8fe23af2644474d0fd34ab3b027713451ee24322841936aa8133a4950dc893e13390acbff6e249a895661237e12bc630685d93b666f43af12bf4819e72ce60
-
Filesize
5.9MB
MD5e00f3c7fba6b4f8c00600b02bfa5acf9
SHA10659e5bb21a0f4c7f5954b772d99ccf9200b7648
SHA2568bc15755b3d80582ef89dd9ee5077368d3152a7c75cc9b1dd614ff5e605f45f8
SHA5122137b42282295cbb75acbe8de367f02a819e5cb6655ffccc10cb49b452e93167cd4d2f861bd79d0e63cd734be41b167b338d529393a38d62aaba2fad08c97628
-
Filesize
5.9MB
MD55b0cebce0e46194fb1fb6c158bcbe0e5
SHA10465f1a6f7424b3bef8d2cdb3ed75811b715a487
SHA256bef4a0f68b42b65c5390c6e7554e98020ebdb53defc4b693aaf2a174e10484d2
SHA51270aa59ba135a21c14ee49ec5239b9433abe90682763c006bfca39a452f58a05c19de52f19dbea0ef5f4439481aaecce7bbbac78ce245a76c3c1d6727fa15f128
-
Filesize
5.9MB
MD5587f001e158a1184152a2665268f7726
SHA13acc3ec4d5f8f6d487d51b07d4b0e6c8add41ed0
SHA256d32c038f38c3ff6bdcf9189f613e5f57cc92353548f1f717539d2668b8a7c49e
SHA5122d99661a3a183bbfb36eb083d3a6bdc8c768d0b9903232bd05ecd9b571eb037c06bc9ca24e02fd584a1ec38cc0970125df2a565cec15a3240efc017257daaaf0
-
Filesize
5.9MB
MD5a4be833fecea5d46773f264a7b46a6e5
SHA160ca58bbdaac4d7668b2783571f1a03af395faaa
SHA256f1fb4b77d1a45b81328aae79730f070c3edb34f12b7b519c6cd7c4955671aba8
SHA512f50860aff9330d8512095081994ef0afbfd9f64c7938c97f3805fa667a8ae2809fda5c700ab90c03fdbbab9a5f2ad5368475e4d8d75fcd45c44ebfcf989d9f29
-
Filesize
5.9MB
MD5130ba988582ca6b319e66414054852ec
SHA153b64f4f215dc7bcb48af9df3f54f95aa94a3cc9
SHA256a7e4dae5a6a37020928beacf185b433554c4748f4d4acf11abbdf34a7bf36184
SHA5129d5bb76d9408c1d1b54cddb159133858a51271cceb998e942fdd2a443f1b52c391f32966d3fde37e71face4c033e11eb88b53f707fe47712f21165260228b299
-
Filesize
5.9MB
MD5333604559d03c81dc463414dea45b6e5
SHA198b27b17c3744f3a828bc19e1d6e45afca78fa0d
SHA2565a0236e0e2b78b5c446aeada12e3d94d3588ea34061a809b5e0514fba37b73f8
SHA512f1a8c304b1c5d93d785e293a6c808bf8f72f2b2d172be9ae0a53f02556ee6283b9b818c24e3e72899dc9fdc648c1b48ed53ad173fcf1b015f7c4fe4078b0a3cb
-
Filesize
5.9MB
MD5dc1b1ab1307b5b9b2c25805d8834284e
SHA1a668760343d8c81e22527e96536339fdcc564b1c
SHA25680778f32c48485fe1a271b603a3855dff2b1b6107697c89e71c4122a74a03f5f
SHA512e566be8d69cc8a67488ce168e345a0bf22c05f33babf3a3f541f6677c03b0c02205f410bbc3e2ed56227c8bd708f0e8d1a5cf55be91cddb3f613b71db7aeb60a
-
Filesize
5.9MB
MD5116a918ebe28eb32c652320f884d33c1
SHA127c6df552dd2550dc356a53d0219872b4f401a53
SHA25615f721eb9e761ea94e0d36a6ef9120859ceb4367ea15f5930bc10ffaf864ed87
SHA5126b8722c18530721e33fc1698b5b42c31ef56eaacb8397d3e8771663b27ce6b9e4affd115f9b8f03392ed865bb047d445c300033f90aba0c4c44f0034f8dc631c
-
Filesize
5.9MB
MD58c3595d25e4be998ae4ffea6febc3432
SHA1b353296310a2b6de40197f45bc5c752ad5404d60
SHA2568c5baf2b2200a06fcbfc94ddef4522b643ae28547e5fefc5c5423c3ecb51c262
SHA51248589f910f80eebd86ae5537b372d33372e796236d3d79161631d823338feb16ca773c0dae98a0cb4c22166462bf1db7817e432ccaf255aeb9ff4f5db20f371b
-
Filesize
5.9MB
MD574634e61f90ef163eeb9a9cb5ef9fecc
SHA162b8ab8f19dca151856c4d1ac703da79dc515105
SHA25608c42815ce5d06dcb8c4db2c9214de3d6b17ac165981d4efef6b4f880afca519
SHA5129747f30aff3446d20cbd1fe562779bcb97157cfb591b6c9275ca7fc3503e65bd0fa0c15e736d5780346d45d955c46bafb1068a63141e55c68fadd774909aae89
-
Filesize
5.9MB
MD51255f21a9ddfe3981355d3f152426919
SHA1ad8ea1f494b8e5a46b22430e1ae1aa1e2032b6f9
SHA25653e43e756ec9653656037f3f8942cf67d09499613ee6ecd9e25958f7aefa483d
SHA512e61664f56a7e0079c2a5cd75336bd9b2954b74017d32fe2d664a59ecdbf44633ff8d804cf149b7aff181c00782c6aaf981668c90374707cdc3d3012098bec0c0
-
Filesize
5.9MB
MD5890edaaf3aed2aa71bbd67948f2f13bc
SHA147013d38525862fb5aff3765a36405e3dc23b114
SHA2563b22621d8bfbde375a63d7fd36a0ab68165c1912e39a2ba3eb52a63a2108a078
SHA512967b9ddb9081ca37ce11f8d95e5f9841ed2ad61b09dc777530a050098f99bac1a702007fc85b4711f819e5953eb49d271ef10309dc33acd7d192bb0433d41400
-
Filesize
5.9MB
MD55a73167de25ae2b378cf592bc01df3ed
SHA1b5de1c22b5d95713202fafe61d2de64f18f2d101
SHA25622a8648c0de594579699f1f424210d796ac4d9024cea949e147efbd52d046e19
SHA512c585d64143140a8619630abab28ffec6c1f907e8911dd855281a983c6372ac74a978d6a08c682bf14ee5b952dc82618c75988c3917755c954bcba4467b7e409a
-
Filesize
5.9MB
MD5ce1645fc7b3e6fd8dbacb2b5f6609dc4
SHA148033f6010059ae24a77cc245583c71b55ded01a
SHA2564fdd1b8f09df9e7c5d4a9bca50042562ad19c84d62ac72b6569db52c1fd8eefb
SHA5124280d8ad5fa2323d5195cfd6464bf69885a9658b825e9101224de6dd4863fe3cb1972e339adfa101ce6e575682248b3382ab2a6ea8b7d2a9e4781ef3d92b8005
-
Filesize
5.9MB
MD53147ccdb0a5774794e1b0072efeaeeb4
SHA16fa79e7ccebafa8e6af099eafbadbcc3edbdefb1
SHA25676f16d14ab1ba1694de98d2775db4aaedbb8278ef8d9294e56baed3c8c251359
SHA512aa22da7faa788f6f46eadfdd4a882e22253cebfc4fa8c1aec7f735a57beb0ab705dd1b07a6ee6569da973dc3309ca55481e78e1c65c67955e8dde951f2b66a5e
-
Filesize
5.9MB
MD548f5f4c27ff6c0420de2bc31f2e427a0
SHA118a44675c2e7161fdddeefe75d7257be8ae7e87c
SHA256faede9fdfe0cb29fe364e5414b981e90ec16686e4a2f81722804cc031fcace77
SHA5126b93855340a3a9655ab57bb81afdf8faaf2ba47fbb2e774e4388c10b16a63ca351abd7755e78926096928749e4913142f5b77430ff93f629747917ab28809141
-
Filesize
5.9MB
MD57440b5da9ae211d3e96d50c6a59fd15e
SHA1f31d7b191dc53315f8be1fbc2ec98f2e4f4a4a96
SHA256ee8068c67bf619092f79e754ebf44f39228e3e94fa7497781a92cfc24eab2ede
SHA512e4fd5d6249151d9ac40985e8339609c5d531f32eb26b9f447ad45d4625e636507ea274e6cb4d2bc0f28a51b3bcc29e004edc049d343c860dafa97b64f86248fb
-
Filesize
5.9MB
MD56fbfea6da959fd562391b2198ddceffc
SHA1ef710feba154aef6e7bd206e129d51aae5d9e33d
SHA25687573b46434b765e7752c3ccb941565ad2f1c696e0a2e96f33fd426ec2e94d7f
SHA5124cd82eeef47bff170f0b0e028095b810e10203375480e2f1b68dce7803c1b7e1f81f21592a404975a246914e118a0353af2780fecb4f044eb76fcf4b3c9c4e30
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB