Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-12-2024 19:31
General
-
Target
2024-12-25_bfb5e6e2de5e6b0c4dea88ac5de97e43_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
bfb5e6e2de5e6b0c4dea88ac5de97e43
-
SHA1
6a5b1590ddb323018e89cec1e29b4c88a5f8ce29
-
SHA256
0dd9b62ece79eb25fd02d73d49b8e657fa37ca7fa834bf41d9b15eb284eef06a
-
SHA512
c304ccbad984fc658b3577c1585596da8664402db4c6836595867bc8681a6ec33b106be769fdd4e5ee90d27c812cb5e567d7fa1f7f98299f5ef125284bb9d257
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBib+56utgpPFotBER/mQ32lUq
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25_bfb5e6e2de5e6b0c4dea88ac5de97e43_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25_bfb5e6e2de5e6b0c4dea88ac5de97e43_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ELYxeUn.exeC:\Windows\System\ELYxeUn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uwsNswG.exeC:\Windows\System\uwsNswG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XepjTje.exeC:\Windows\System\XepjTje.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sSnYtGg.exeC:\Windows\System\sSnYtGg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MJnOHOn.exeC:\Windows\System\MJnOHOn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OVOsinj.exeC:\Windows\System\OVOsinj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BtYcuSA.exeC:\Windows\System\BtYcuSA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GAaJUBx.exeC:\Windows\System\GAaJUBx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sGQudmM.exeC:\Windows\System\sGQudmM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZipcMZM.exeC:\Windows\System\ZipcMZM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jgeaMIn.exeC:\Windows\System\jgeaMIn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yJVgPQp.exeC:\Windows\System\yJVgPQp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wVTQGQg.exeC:\Windows\System\wVTQGQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dVUpgOA.exeC:\Windows\System\dVUpgOA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XWiaMet.exeC:\Windows\System\XWiaMet.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zfWtOGh.exeC:\Windows\System\zfWtOGh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jDePlQu.exeC:\Windows\System\jDePlQu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SMovKoE.exeC:\Windows\System\SMovKoE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lRaZEFw.exeC:\Windows\System\lRaZEFw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mLSNhpc.exeC:\Windows\System\mLSNhpc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dXNiYXv.exeC:\Windows\System\dXNiYXv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5070a68db70570a366b7b3c3c8913ed1b
SHA1a792fafb1d9e92876fd6c396dc7c62c523adb857
SHA25688f3ba735c8a217642d1986b2eb83f822ba309832416e8ba3effd1fd533de5e7
SHA51297b1eecd5c36d904fbe558240bc19ea0aacc42345fb242a061d731d51970768981ef823cd5d020b4ecd7e0498967fdd545624f346dd1d2024efc36e43d550c1b
-
Filesize
5.2MB
MD533c156ba76004d96c41654766e24e862
SHA18bf8fd70aef0cf3ed1cbba5ac9b611c07677023c
SHA2562e4d786b5c4d7d59c28a3a75ec4dd44853aca7194f5b2c19980ed7faf7d9924e
SHA512d1b27b3f3c159415122b36d80d55f57a796aa5902c879cf139f82a5eb4799ed0e297a6f9df2074440ec390a6ff781fad1c8faed8d24165b3390c60c93d9fe190
-
Filesize
5.2MB
MD55479ec9c7d45a7240bfbbbdcd0b94f87
SHA1ce67a64eccbf42d9860b5f35a42636d509b1e4d5
SHA2561dc9afd395fdd651a63e75fe7bfd6f9595d5585eef66d1ed2c9a5b53d2d05b80
SHA512342013f2b8f0592e79e8743543280ccb816065be67a8e87b140a0795dd3b6bc338541603a5b68faf336e4cce6d1a3ba09a1c34912b257e6eec40d78044a7d91d
-
Filesize
5.2MB
MD589cc8e2a476c15431431db428c242ec1
SHA10d45d9211050c6df20e5403dba2f2d2fd209889e
SHA256e7a8956106f54029d7efb3545ad84b50061933e958c9008345bac1ba9fd8d60d
SHA5121ef5fee1d9ea700e79fc0bf63a7bdbec35f7a7980abcbb48d5769f1e3cd254d13ea9f26cff69f28e601bc96bf6b2fcf611f80d8bf8f490a247f35f908d0ff4c3
-
Filesize
5.2MB
MD5c73a4566192f121bc8115b6bc56476b5
SHA1aee2594318de42b7d5a481742588c9b92f44a17b
SHA2561eaaf3c5b8fb187b0bd95c41fbc1a6f0e8747ef93f1cf26c97748e0b06d39cac
SHA512f1a1ef05134ea8f5c5aa17f475ca61842f91dddd9ec77e384d59ef050e8518a0a3fc1e0b1ded0c6ee2c66a6aad246efd4aaae0bdca2cdff80261882497b5aaac
-
Filesize
5.2MB
MD5790b4a5e99ac356b0499bf30fa07e116
SHA187b93e90ec63e6d7b27ca5195937ab96f3b850d8
SHA25669e98d0c2c3b62af6e5ef7ffc91ee93b39b94549d0e96e802d8374e02fb946f8
SHA512e7ac09b29954fcf66812a6dedfbae989f2c47ef06fd8e471dcf09732d71abfe3194f15dfea729cc14a1e2c496f8e94449cb70460ae7c8432b9bd517013c9b389
-
Filesize
5.2MB
MD53b60462e74dae114971236a1b1ad2ef1
SHA14569be0d4df91d610358bd65c882b56fa6db88be
SHA256d7905e3685d613bacba2a72bad5f3047d6d718b64155f55b08af34eaa1230552
SHA512541d21041cb0047b9cfb5945cee43d858f43fe16c49abd510015d51d4c17c85cb29c2bb9e0f757fb0bbe4b63b77fd3535eac43b6af72a4642b593d8ca424a526
-
Filesize
5.2MB
MD5390bd4c498a81043a9c5eb113ea07d0d
SHA1c122e46d347e729911b412055065b3bc17de08f3
SHA256a1109718fc4535f4e9c81fd049fe640c476536d60001ca73c4ec5a5e4c834982
SHA512c0ec623e87751c026cac3e81d2e987e230b00c97661c2b0f74c71581a954e4a883ae9597d9df6bb910015ab45650fb061d21315c33668a93b2b0bb89d7d77a3d
-
Filesize
5.2MB
MD5e524ee138b6eaf093ae4913e8fc27fe6
SHA18a066a852bed6ab155c9f488735761b1dc0cf01f
SHA256dedd0347bf649324c4eaf8f85e2ce52df19a9cac3d1858c304a1774b246cc1f8
SHA5123cd39eb1fa94f2960938f42c0e509a59237d337a327cc8e659138852269a697d1cd96526b3d28fdebbf72de358dd9bbae6d1b6711e65cb3c7c9516ff28932e57
-
Filesize
5.2MB
MD58e40544954f607c23cd4682f4182eebc
SHA1fd55fef93ec281e6a7e37154e5bbfb1e4f3a9445
SHA256bf42c57b4414a4da5502980ce6e758941a59942fe671fb3464a88fd6e478a72e
SHA5129193b62bb068f0486df6334aa63512798956cc4fb1a591a109c545c76f3bcbb5a58c0afa9bebb4592bc1bffa5789e1c7313f9b76761bd5b9edf7fb39a0b42807
-
Filesize
5.2MB
MD57c6c21f5ce18dae27fe4374b0a27530a
SHA107961e5d21c8b30cb8711ea10b78acb31ef29211
SHA25655aa74b45cea88348b17812854197d111e9130ba699ca47f26d73084f48a9b0b
SHA5129c0da963dcb43f858f84481e7a3109b3a9d64fcd7a9632f15447d7197e84c5974eb25714e2cf36b885c9c4701d6c53efe4dfee6262a335ee4f107dd6ac9fed48
-
Filesize
5.2MB
MD5efc06f701615ebfa082c91b616a23c50
SHA17fc3f45ddc0620e2ed7aaf0f4972ea7df7c37328
SHA2567b9d0a437528f791dfaed8af1bd4cf215d608ce918a28d694b9a4d1755a5d6b9
SHA51289a1194e71e421f096ff24030d3f6b80c14d891c0560243716ab6627296514a7e007f60fc40902f37d5971cdef88ebf01615c36e8acb5169a04c97b511d3d0fc
-
Filesize
5.2MB
MD5d202b1da11ecab5830a5805bb42e3625
SHA1eb73f8fe4b18e36df42566ad688e2320bd970e64
SHA2569ba3847ddd3fd1117830732bbf60f5d6d81fe3bacf2d98cb38fd96aaa0a3fad3
SHA51264a53995cd0dc011a54ada518a9f2b14ae0493def3adf5272a595f947624fb94e4b338eb4bbca6005d8000a42e9a9d3ab0301473a8c1510216e4500f3ca97c62
-
Filesize
5.2MB
MD59f6c312fcc207ce6df0734420adeb903
SHA151033cb24d8bf36c30f9a265606f5f0000109cbd
SHA256500f61da584d6b99d31a80f1063eca35b0ee795ebdfd786ba7db33c884030482
SHA5121e5983a2d11dbc8ff3afbd538e0b8914b0babf867bf2ad83761753dd5b463f61dc6bcdbb19111196878d0bc4e841277c563d174482a58fbede0a5aec5739314e
-
Filesize
5.2MB
MD5b8e5da3c0d73e5f3d9206ade72fc2f7c
SHA1e8dfc97ebb0bd1b8fed5b7335cd5b863f37067f9
SHA2563a0f5952e0c138ffc72adbd470a01ad2729794c84136edff17ea200871b2ce1a
SHA512f6670907ab22c95b58de1385520828f37ac668ad925ba3fd6cfba7d3a92d7394a79ea51227640bc9b6b18f6c02bed274bab4a40f25d1f7f0e3d822461f939889
-
Filesize
5.2MB
MD54a69acb4574cc3c678e8ecb7cec90b07
SHA18319603bed538f57da6e88152f7f5fd896ea6df4
SHA2565aeba0811f9074714a1d4b9b6924275c5185635b9db342c144185025895aabad
SHA512c976382541a23844da8148c422ea1e9aabf800b8f80ba49f65543ec9694c1fab565e72634765ebfed465bea91cbc5b1e9bd6fd351395621f70ed50c97406711e
-
Filesize
5.2MB
MD5b2ad1b89d7e9535ea7a2bec8081578a4
SHA1f7ba76d0fa67464a028b3b3af756c6e548d2fce1
SHA2568c89d5ed4ad0b02e474ff14fb35fe60be0087ed5dc4cd01dcaac07618498bd69
SHA51229d40a6a18b16fe373f7fe944f2fc355b0934baff4dc1f9c275070333b4774917dd705be1792be2e59ef0e0728b6cbae93be3dd000543c51c275ee1e8b812932
-
Filesize
5.2MB
MD5ff8fe3ecdb173801956a567e43c6dfeb
SHA1e49b129e8f87c3ca0741057ab9248c0e761f090e
SHA2565fa296dcd3ecd04372eb6fa90be1f2e809b76947e52c61218809edc610fb763e
SHA5121c114f6f0d7ee40b861476dda4676ec22c10d469906bfabd7e89744aba9a1e75a464b6a9634f8e643bade1ac857d9bdc30bca533ff5f6379cdc0b7920d45cf70
-
Filesize
5.2MB
MD5c373544a27eed0dce1bb21755daf2457
SHA14e5920d6c591a67ca4ec644d7f7a5889bb7d1e1d
SHA2566930603259e87c6b77ae20b5dfd03ccc35bea515580ef001f5267f998357b6ff
SHA5126e71876f6889bfe3218ce767fcb96d8993747d50cbf1cadd08e03473286f3694c63d3990d8376d538ed1d4e0ff0c75dc93e5c3f288b5da4d2e1ad6cb6942f881
-
Filesize
5.2MB
MD5513750403fbbba93bdf260420878d9f6
SHA1854fef2c4b157eba70ec5783a28d46cf992303b4
SHA256a9304c9442c4449966792350cd308a91eaad7e739fff9269f9a658324ca0f825
SHA5120d804f08d064344f7d3d60ee8f75be44978ce3d69c1e089a2354c7682696e34d1e58eec90848dd618989d4c823df529df8197380faaa6b3c7b89deb3e9f099ac
-
Filesize
5.2MB
MD555c9d0860de6924161a51ddd64554470
SHA19012c757331322affa6e279ad2d8353f402a6414
SHA256e09ebc3571d1699ecd80f5e89de23da21b99ff89a7cdcb27d291d93c4b89a774
SHA5125a988829b36b88a75d05eb56d02071eae9facc2c7a2926ceb36b3ea6c012feb2ecffb35eefbadc672db82eaef8d81a05eb2ba277909d20b7a49da301cffe2293
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB