Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-12-2024 18:55
General
-
Target
2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
313868a1a130554e4f091f298496ea56
-
SHA1
879979388ab9415176380b98e1e0370b10e39556
-
SHA256
d2650632c3364598ca0cb43c7ddf2cfbeff3c8efc8dffe09eaf211c55fb56d39
-
SHA512
a8859e5457397d536ed2e3493f89f48ce09fb281fe02e99f4dbb2f2be7b7acca9b457ce1a59061765579339f95707448404904847a516929c9e385a6487bfaa0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lUS
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 35 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\MhmloYw.exeC:\Windows\System\MhmloYw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wIdOxAs.exeC:\Windows\System\wIdOxAs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FSBbwJV.exeC:\Windows\System\FSBbwJV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EiIiIjt.exeC:\Windows\System\EiIiIjt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jCIZXVl.exeC:\Windows\System\jCIZXVl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HpduKtk.exeC:\Windows\System\HpduKtk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qToPRSM.exeC:\Windows\System\qToPRSM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\spTIJkL.exeC:\Windows\System\spTIJkL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AHlNUym.exeC:\Windows\System\AHlNUym.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XSMnqKK.exeC:\Windows\System\XSMnqKK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AYWHMbr.exeC:\Windows\System\AYWHMbr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XXwmySd.exeC:\Windows\System\XXwmySd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iUrHWVI.exeC:\Windows\System\iUrHWVI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YdNLDTA.exeC:\Windows\System\YdNLDTA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fRzaAST.exeC:\Windows\System\fRzaAST.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FHurzSR.exeC:\Windows\System\FHurzSR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bQXgsry.exeC:\Windows\System\bQXgsry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DNiJjXn.exeC:\Windows\System\DNiJjXn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZGeXfbQ.exeC:\Windows\System\ZGeXfbQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DNczDAh.exeC:\Windows\System\DNczDAh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VEQFwIk.exeC:\Windows\System\VEQFwIk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54b15699126fff7c8874804fd11512acb
SHA1ebdc31dbc41b4f0732b0dc7783a469dc727b7685
SHA25655a1579a263332abf96a0f5eed500f6676c8090cf8cfeb3f97677cd6420c60a3
SHA5121523285f4823edec25a4feb952a92039d7af970896c6aa6e8db72d36f5ca4514a425e2a47d9ec09e8dd0a83c92c3eae1344e04957b21b6366dd616aa7d20bd54
-
Filesize
5.2MB
MD5cdb90d6588065c274af21cf4eb1c0dcc
SHA1e72c90d75476266970da1db919eef6760185c5f0
SHA256189886ccbe1d9e790f7ec62fd4081be5dffd5216cdcb450c87b06289986c26a8
SHA512e874aec516887a652a0cb7d062b5d196fde1b80f63fb1520fec8b354fac877b0e974d58e5799d752485d72861284f6dd92fa8ca0c5219b515574edc5286e49ab
-
Filesize
5.2MB
MD51770a75717f2844e97af6ff794d01165
SHA1258ea5e298af90c23cb635034c8963a05926d18e
SHA256a5b0769e84ce583b960e8d6eddb3892705c58096c18c8b64778cbc27c41849d7
SHA51262fa57e4c6f33e0536febda4f12ebbbbfca941bef50ebad88877ff13a8ad6306fe10c45710219d6fe562ad98a2ceefb282c81b1c8c44e82829d3f7d37e51f593
-
Filesize
5.2MB
MD5bf82080361fa29256982ad0df79eb2c4
SHA122002230000f652d7cda5c9807dde67ca711df47
SHA2568e69901c6b6d178b5d2a000d57b805efb716a766012a32fd5fd6e3aade23756c
SHA512ce9975995bfc4523b55dda53007b69e867b36cd0c82d8a364549622fe12cc33d931a517cfe3c38867a03452e94d09eb65fb92567659194344ad11bbd9a72854b
-
Filesize
5.2MB
MD5963520b4a10e5a41d161e4fbea6cc286
SHA1baa86f283800b9a76124f0f248d99af9d01780ed
SHA256c8e601b547471b80461452aa36db296b1e21030baec1d8185bb0fbaaa8f46e7e
SHA51217ce880ccd923bff50a85e7e76ff40cfeebd4f95ff478abadf6dce84a8915b1badfda61d5b49a1252e6c1455952b9356af70d51294cad8d8908a3018c3fb9c2b
-
Filesize
5.2MB
MD53072571f94a74b8c7ece74ef978928aa
SHA1df35bc477899f3cf55da772787affe3ef14721ef
SHA25671f999b82b273f74a91f9a965b5b07afa57cb6cb2b15b4fa2aadae920d6d34b5
SHA512cb9548d105c08617cca3ac1653bb2328dd7f22926737b748116eb50c130af5e2e3e6a61c3c9d2cdb267271ab2289c2d186942b3b5bdd5cab1580b760c97b3d25
-
Filesize
5.2MB
MD53877ced715efefd8f51c9f960dfa228f
SHA1318d36d786ca6a2a6880e9151596dec79513fc82
SHA25620cfb866f4b66087cd9a270454769a5cdc44b700ade605cabdf248ddb4d4de85
SHA5127f1a015df0c5550afa07f6c69366f6e485275b080baf4e6616b9aa88b2daaae8ad2276739f4939210822fffd01f13c8d82a272782122bb69bbc72d1e120b087f
-
Filesize
5.2MB
MD5747920cd261f8784fd6a4e60d920d43f
SHA1784913f36dca162ab2d93ff6d101f39f01d2795c
SHA256a0d4f5bdb9f1ac317c93a6137d517463602f1f6901f2c04825bb632703b4e28d
SHA5125f204144078111391b6ff0061faf2f879ac417c5227f7267721a57d2f6cce5299ac2c516182735eeae47402dfb01179349f4312271940ba9bb5e5fe302a55a1c
-
Filesize
5.2MB
MD5fd77e48a9bb46e39fcc4b758a0ff66ac
SHA13894794ebf304048e6ac61c0c7c00da488445a9f
SHA256b312fe878244bb14b9ef4b4ed9add1b7c880480bc38a745433e0eead7d424548
SHA51228143a7b79d4d0a6062be685157e3de73a47adde4a5d7b8b991bae0f27e9e56534d0ba8ea6ffd3ccc6197e9f3781a75ea7c82584d3e432fb09a9e30de7f5bdf8
-
Filesize
5.2MB
MD5c89b24ea51643d523498b943447dde3b
SHA1024d3fdca07ab191162e61e3178fd079fcdd1cff
SHA2569ca2ece5260a9c3c081bd7b95aaa49c67060f8ff937f3150c85901fa0e4a0ff8
SHA512d59b15badf1dad63d1a3ccc11222e4805b8f857c31cfe6c0fee0bcc5011f20bfb20f2b326bf4d0ea3706eb5ec97237678a5378877a61f18b1ca7de1d9eb30cce
-
Filesize
5.2MB
MD5c76d75786193703443115bdae96cf828
SHA13b254d46cffa66d1f9c2569a23b0987d44ef07fc
SHA256b1452e1babb1cc3d55513520f1ed39fccdfa983b950055af8888acf98365d408
SHA5121d92ec6c7db16b0f910ed4839a82d692b7e17721aada5a622afd1218fdf40bbc5eea6daa8b8854149abdce54634e7ba2040d15184ce58da6c01705a97324345d
-
Filesize
5.2MB
MD555f5068fd1b06777c55245010fe43e8d
SHA17c300c834b358a9fad835f1bcbae376cf792b6df
SHA256bf546321e2e7d469384baf94060f7bde62dc68dd2571d9b0539e533173387edb
SHA512ba71517b9c1201316309621e5ab39cfb7430b6b0231d0a0872acc2a25b43b7386ee7e5f2caa7ce89113fd370e48f48134b4aa97b1569419f98f312acc976eb22
-
Filesize
5.2MB
MD597e8edc512e387559afd27d2d36e984f
SHA13f18fd240fdfe9afc1585a4295ead8869dba75a3
SHA25622829939089590e7ec7cb9169e14bf01e03a2d0fa42a953032232fd9920bfbcf
SHA51204183098e11fd4434a17505b46d6cce41f49d1edc49b874634099b5ba7b611e2a32cc1611b99df8381425bc8fa17bd6433ba5fd8cfb708461b41a6e240c9b76d
-
Filesize
5.2MB
MD5ae1989d25567a351ad5f2382722990f4
SHA19112f062380a278dcaaa2c7e57ccca3058a23e3d
SHA25620ded110321a78b15687da8f019b8173b0c9514a7bc8f6c3df187a2167ec3a8a
SHA512713764787eac5b1180cd8e6727ee0c376c640364153b028c1a1d605194ff5cd77e47782e45f8a4dfd4c3b7cf0feaaa31e44a1999f7eacfdf9239802d28c61d8b
-
Filesize
5.2MB
MD5806bcff7af45f4ab1e834080a536092b
SHA1bc08e8cda1850557ccd758b9f6f2c4e82869ff2f
SHA256311a7f4ed6fd178f1111584b922f96b1a3b278f43e101e01048e6e211ed591d2
SHA512ae8d0f21bc2e40d55f4aec4e234fad63eb8625b426770c1975581900856006346d2955e1928133013401fc4af90b2cbd306518817b8da4c3758a209ac50374ad
-
Filesize
5.2MB
MD5d3a2840a28f04445dc36bd9bf80f3ed2
SHA1eb087a3597532c95040e64d386cb736ed7af0730
SHA25626945acb3e7a65691e680dcbc7614e818c059412f71de46b7d55600de2468f10
SHA5129a74d7ac00e801a1b5261e236cdc53b3d3fc4db4eef1ff6bf9bf0d378c847b402b431baae33890e94362224e5761f6099200b701a4dd2d14d5436ea25e51a08a
-
Filesize
5.2MB
MD58032e79c45359c56db3782ab02a0a609
SHA122dceb8362c29889027ff8edd0b212cc76a25ef6
SHA2568efc83a52aa54c4341768d0a29cabd4c7dabf3a641bf344f275c32440a478f63
SHA51246e2dc0ccf7b86f6aa2d4bf0b29f79bda81bb6f82baef2a022ffac61050378380483a18d8d7fb707bfdc08314e88e31828528fc418b71b93445934efe296449c
-
Filesize
5.2MB
MD50112b16f92f362a8b275bf0dcb150a0c
SHA11b2f1efd4f0baac02999e2ef651b94f4aa275259
SHA256764ab91725fd2b3cd3942a8730dccc16096084d9d11e7028b28e7bd09b86fd13
SHA512fe7ecf53682952ec15bedee6e62f0e701fda529c241819ab8578900a275bceeff6a55385d0155ea84737e9ecf6811a8da3c7e2374c33902b75e5952bdd9163a0
-
Filesize
5.2MB
MD5931fbda902d03f9cb8ea0bd050e8297d
SHA1c07d7d16ebd9d3b1fe6a74f068fadeb4d0c3a300
SHA256e1dbf429c4f2d8b9acf85ec565e186e2a79e1790eef1d23d435d697f96e18a74
SHA512880c68d13087e69b231aeb62ef3811cef68b97b0fd314ed59d7a3424f34f132fc0909ff5739e4b490296d5b98b5f647dbc23b329e528e24ae617596e9e21f043
-
Filesize
5.2MB
MD554c401c9d8a0eb5070d04e828db41a7a
SHA1bbdc5c3771b7dbf50eaeb095ed23d59c31204908
SHA256ee72ccbaabdb2a205a1e6cfa862caae0918587054c71fbda4b6b4dd51064f78e
SHA512c4a195e78ef2a3a22c1506e9eb9857a45bacb5a95a37d3a58cd9a82116d03da7c4736e4c7b7781f7962958cab17ba8bebf2bf4057738a8f62c68e157bdd96f64
-
Filesize
5.2MB
MD56df79a93b66d0516a12a14ffe817beaf
SHA189a607952bc583e2d236c42d0c1f99737041052b
SHA2566c7435d33623c16bb0c311b3b8a3de8844f156216a4b6a5061fd79ae5158f480
SHA512121dad7d6e4adb81172ef6f2f1cb86866e8587d5847d0abc9b6e2a30ab21d35faa625081598d7c20b06e1694c1da7048c86f95d0d72de8df1804b7c1a0a3658d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB