Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-12-2024 19:30
General
-
Target
2024-12-25_b1f920f2bddebcf656884e7358417b07_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b1f920f2bddebcf656884e7358417b07
-
SHA1
334e0be30fe7a00eba4a7392455b957e6ad482ca
-
SHA256
d0fc83411481880a24bdfb5b25f15e2451f07a6f6353d4d30e1a3d93cd6cb364
-
SHA512
1e7bb53ffe87aaa4e6a3f62f28f0366a1bd870a1623a4ba6159064c403fef5607c0b0a1460fd4fcd44f0b11a368af248fc48b88c8d89d543569162d3465a7093
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBib+56utgpPFotBER/mQ32lUK
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25_b1f920f2bddebcf656884e7358417b07_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25_b1f920f2bddebcf656884e7358417b07_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tyHRzSa.exeC:\Windows\System\tyHRzSa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DnyVMQO.exeC:\Windows\System\DnyVMQO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BrDKHSk.exeC:\Windows\System\BrDKHSk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HGQqOUv.exeC:\Windows\System\HGQqOUv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FAEslLj.exeC:\Windows\System\FAEslLj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wwUnHmS.exeC:\Windows\System\wwUnHmS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WmbfUhq.exeC:\Windows\System\WmbfUhq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GqiSIjA.exeC:\Windows\System\GqiSIjA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CAhPdSJ.exeC:\Windows\System\CAhPdSJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hpXTuKA.exeC:\Windows\System\hpXTuKA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YfraqXj.exeC:\Windows\System\YfraqXj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kRBwtbr.exeC:\Windows\System\kRBwtbr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CIYccpC.exeC:\Windows\System\CIYccpC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vrChRXb.exeC:\Windows\System\vrChRXb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LtypAHa.exeC:\Windows\System\LtypAHa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wlKUgUg.exeC:\Windows\System\wlKUgUg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CsDVeIn.exeC:\Windows\System\CsDVeIn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XVJycZh.exeC:\Windows\System\XVJycZh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RiHGqbr.exeC:\Windows\System\RiHGqbr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NggvPkA.exeC:\Windows\System\NggvPkA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KwDnmgE.exeC:\Windows\System\KwDnmgE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f00cdea2acd8a31a4f491a1f8e325689
SHA1cb5d9f6d9e2f22060c426f181b4b2e98823b9e44
SHA256338b9cf9de25275e5d756408cec02f8bc01a817318f90912970bed0bd6c9eba5
SHA5129e782d65bd9c8670d6b62ab82adcd390c877c8fe4f49630491346cddfc2487e06992a1f8a67f8ff357b48ca605adcce708cd78ffb581046709b62c822008f213
-
Filesize
5.2MB
MD5eb92d921a9d25435ee2ee3035c8dd113
SHA1b46502e02d5bd1b9052867301c41438a314b2488
SHA25696f1c9d1b0d9a12cfbf24aaa50dd18233616ca869b06e0fae158fa4d9ad03311
SHA5120ed29498dea8318631c5bc979ba5a98de9486f48345c5290aa19b2f3872399843e449025d212608e2e343de36a5fa7ae4f1d44f7743fe93feb1416dcbe0f4db8
-
Filesize
5.2MB
MD5c72ae8e3338ac121355ee126f151b208
SHA17d1374e97f149a176610b8dae0c9ac6278201f1f
SHA2564301e66ea2b4761f58daa8a4f2ecc4c0f2b4d918049ac9cf363c07a89cb2d0d9
SHA512253bb406136b4d7bc8ff56cebf1a2e8409d7be4b9051e494fff2ce1ca375d516c90310d3fb50f05c10e468b926f55b79f538065aa94415e878cfbe9e89562ab9
-
Filesize
5.2MB
MD5f16a12e915968d1b7e62d2fc1a7953ca
SHA1001f0a325f546bc17b9cf71eb7d94ca988dbd95f
SHA256d3e6aa0672c757fffdf7c1582b08634fdc0b334c0491fed0099b22c922111ddd
SHA5124d07aa05d31d4891d986f4308c3ef85b383287b819dc86c5bbf2978ad5801ffcf03b4061e7261ebb3eb57ce04afb35dedcbde5225d7e4c640bdd1684a9d45c77
-
Filesize
5.2MB
MD56d1b631b066b659294f693ef0781bdfc
SHA1f7028631ef13fbccf45ede60260ac31c8b994809
SHA256e77a8e76523f084feb614bba9021e688f6cb77ce281984200fc34c2f4f8c2eec
SHA512e45539ab5db3e7d401a40052d6a950e2ddfe9257e06adbb14ef4c4ef14aee674d999f964f6c746f77c07ea88c2f9df4b692b514ee75d0d8f58d78cf6c128a1b5
-
Filesize
5.2MB
MD5e1d19f4047d29fdde57fc37acc6b4f88
SHA1960cbbacedaefe440e508ee562deedd7654bdb13
SHA25684fe710fa581275f1725e95e3ead5b6d020f3a254437c84dadbdd6f0a1e32e25
SHA512c0c4578838c82143db48e6a0deafa4b76d7681cc3b366060a9f840c754f98e636cd8e040de4f270f955b5c0e4a3dce325abebc3f298771689dfb518a127bc63e
-
Filesize
5.2MB
MD55b2fed4c4639075daf49a64ee87e576d
SHA116acc57ee01b57f6c8fa81ba16d76a28da50d976
SHA256da9415fbfcafe691f31f0dd22a596d9678c8cd9235d836b16c1aaa7a15e3bf5a
SHA512a24426d0c0102bf11c60bb2cc9291f68bd39877cf0691c94d061064fa00b5ba1d23ac531e9afba280e4479db1606e40035330f50921a2f45b5d0776e9d1bcea3
-
Filesize
5.2MB
MD5b5203a447fa2f5ad5eb911fbf9e0c2dd
SHA1e6f0d5e925a18dac360180a0efa08437452176f3
SHA2567e701b9ae1dacc3d5a9c314edaf6775c9ca56e34ba89593db750159245849ddf
SHA512d62bb8d0df102cb13e57cedaf472a3cd961a28bda05e3363258cf8cfa5d7472416f20a23da6c363a9b93d085d3bb684c4637c1f45b51807e3df94c4c85e0c26e
-
Filesize
5.2MB
MD523707cc6570fd0d87d95c12175de0c2a
SHA18af165d7ee2975fc40902466d8e4b9a22ee0995a
SHA25669e19d84d51398739c9f3f0443894bd5da750141633b694d39b090a95ad92b0e
SHA512214a978a81037135a74f1d130c3f0dd949aa377b8d421d23ead49dc592d0421a6095813f4a70454e49efa93a121a69ba8b62ea45a5ed284afde192ea2309f660
-
Filesize
5.2MB
MD5a4e8741177c255e56bb7aae190940430
SHA1708b4ca463d09e8aa865573dad990496eedd621d
SHA2565d2c38ef1a2d8f7e1899cf8a37cf0a57558ca0f5120dd475ec3c7ec586c0e663
SHA512f3cbaf2ff87452e47282ecdc7450419d869ff4a3b95f074b0809e972d5bc85be6eb004b1eb20d4672245d2cc98627b121b6fe59c623465befdb643d398ce35fc
-
Filesize
5.2MB
MD5a63f7ca1389e6ee095225c2cf24fe9b2
SHA14b1376139093380efd11dae183e66c3ad8fc031a
SHA256705b0a36e59db7523358bd174b9b9333ad0eed0b7c601a8a3fb725029d4ef7ed
SHA5121a51d30c94ea026e82139eb8aa8d70abdec6d10df2e95b90f2c80c40920d8f352604f8e1c4e07debae7d07623948b1d2b9633f18205372cbb209ed5a0cc0a2c8
-
Filesize
5.2MB
MD57e7da1ce37b497869d5c0ffc1fd9eef9
SHA18a1723d32f30360482dbc3296425af7d2bdc7acc
SHA256b07c6923eede99c0def2e940195129a677815f8842e02115376736390972ac5a
SHA512e950750069c90dcf888230d83ed6877920c57ba06ceeaef097920a7b1f7462529aba499c3adfeb04a83d13be5eab3450a1b4234cf7a93322c606d444eefc06d3
-
Filesize
5.2MB
MD5afe135cacf059cade27e69500abebc82
SHA1f63ca1591ae8395d0fd43e87f843f3df05956ede
SHA25675080d884483591621272f5deab3f573a0aaea3e2738f7c85cc8d4aeb6b71583
SHA512d924239bace4e2ee15577b3a7050ac1230481801f0850ae3ebaff0b6b51360a9ba6192a4172275ff72f5622f6cb6a04dc50d3bcf0e381458a7f27db2c19b6ba8
-
Filesize
5.2MB
MD5f241891a9d3e825119be57ceb36cd0d5
SHA12b79eebd3f0ae0f0a9c41c713fa7add8f8d582bd
SHA2563aea8168a42393e21fad5b418a7eb49f293488df7558b0e14d8f2d90da05d347
SHA51297bf36395048524064f1bceb9eb38bf917aa9fd4fe45f1282a66ef7c791ae6ebcd473aea815e6fdeb90611ce0351e44f0ace70da9e04d8db7e277743b7dead95
-
Filesize
5.2MB
MD59d444eecde920cbf954021c7c56cbc35
SHA1bc7e89e356aaf4b1da0e0f8cd189f9a588e175e0
SHA25613de42f2d9f57ea0f69d2eee6a988bdde7075b1798495e1c85d1498154af3734
SHA512fef8635577bcc9a3bf00f5ba779eacfe3cdb9c6e37d70867ca778e0afa9a3a3970f19eba4d231d37153ff84e317cf52f89acd7c7e657b968a7e21dc2a310f39c
-
Filesize
5.2MB
MD5f671598281b985117596257006176e9f
SHA1c5305c49486673a25ed4e8d3380c1aec370c531c
SHA256f82da78d6d6a06e8a5a4de57a59c13da774b0c33700206b78f79644a96de6557
SHA512d2ad70ccb50d5fd76bd7f25414bfef0ffba21da04145f707ee06492fdcb9c5189fd30222444b9ca90b84265e1572c35c48d87bad331d2f12641d9e99459c51ed
-
Filesize
5.2MB
MD590a8a6e24f36d1fb2a7f9974f0335a0b
SHA120b93f46640fed20b9d2618cbdc0d139b54e7a35
SHA25698427bf04ad8e14eb4701b7afae5450e8bf8eb90a35fc713cd3b5b51ae76205e
SHA51228cb2e0ea6be5a61b5b58b55a751906ab5d8f5a79b3e6417300171d86f9563530f826b8b5a718a7c959ceff4760fe56f70f900d1ba37ff86fec7a93032d3f903
-
Filesize
5.2MB
MD5fa5ae5eea32ea0ef0901f1924f2e24bf
SHA1a7d7cbb8a889b4cb7d230dc1641a38a8c45ade9b
SHA25668b870c1e0a574154affda1db67ae6b74cc2c6b78ddaed71782dd3f4242d77b7
SHA5120315210f0ffd8999d7049cd0ae44c5008f03990a2a9e1899dc3e6a89b15d27113a6348f57b2a1afbbfc847b3a192e20a6b4e7a2f011dc46732c831fb8ca36941
-
Filesize
5.2MB
MD5177e7c1651966ed5d1d893350144a76d
SHA1cace067ee229d77b6d7d94b1babea77dee013294
SHA2561e5df6af9283ace6ec0690f20276ebbde010acac24bfc9646699e736ff878725
SHA51217913871c5c3bc449cbefe4168f5b7bef07b1e886c262ae96a1d7d2d7bd231d43f94736227fee89a52485e303449ff519d9595b789443b5e158f62e7f23cd4b9
-
Filesize
5.2MB
MD5c37c8b7be3885337685efd268b4b0023
SHA13f15276d7d5b80405358f812d22946353b244022
SHA25641cd875418d15c5da570878685bd54e16bda8a1bef971489605c1d94182ccd9b
SHA5127856a56f15a93927544a712be8e31952e22b5df6300c04642efdbeab8859c0cb6860340b54f182b9ac46695f8b0d55d9ad484238a7fb8e235fc44b2e89a5eeb6
-
Filesize
5.2MB
MD5dce3165ccefc918675e010bb14ea828e
SHA17043a119ecfea174012eb1022f5aa757c6cf4806
SHA256cf84f1ee4c915792b4b401c21d0cd6b69575241f980db45694a348df2836763c
SHA512f8e166e35611d078354b54cf7fd919a5607fa8485906a09da54ea21c2b3c281da32d1dad761d64914f194aa7626291d6f9dc8957a3ea6ff86e9aef7b19afe23f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB