Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
27-12-2024 03:43
General
-
Target
2024-12-27_fc556d85bf81a5338bd0205038420ff7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
fc556d85bf81a5338bd0205038420ff7
-
SHA1
609314a3d1a900797e96e4d9d7b8d76ad24a90c4
-
SHA256
b045160f144dec819a41d71bcaeac2dac9c502967d5be1715ccd6ced420340e9
-
SHA512
f6ddde02ba859e753be788b7b5b502a13a047ad50594790d5d47a700b72d5af79992b3e585d5039a85d961a3a8ef85eac0d3efdeddcf408882dee1000dda8967
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibj56utgpPFotBER/mQ32lU3
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_fc556d85bf81a5338bd0205038420ff7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_fc556d85bf81a5338bd0205038420ff7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CvHbaFJ.exeC:\Windows\System\CvHbaFJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vzLzyVN.exeC:\Windows\System\vzLzyVN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HcbKAVH.exeC:\Windows\System\HcbKAVH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SyAuGyw.exeC:\Windows\System\SyAuGyw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tvqhnbn.exeC:\Windows\System\tvqhnbn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WuARnqY.exeC:\Windows\System\WuARnqY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fnfPJjK.exeC:\Windows\System\fnfPJjK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dNNAXZd.exeC:\Windows\System\dNNAXZd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XKdTHeR.exeC:\Windows\System\XKdTHeR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ysuGLsI.exeC:\Windows\System\ysuGLsI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JSwfgOa.exeC:\Windows\System\JSwfgOa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aOmMmaG.exeC:\Windows\System\aOmMmaG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FwHtUtL.exeC:\Windows\System\FwHtUtL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nCwKXGQ.exeC:\Windows\System\nCwKXGQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VjCblGw.exeC:\Windows\System\VjCblGw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lsGEYkt.exeC:\Windows\System\lsGEYkt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AafMUnN.exeC:\Windows\System\AafMUnN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BnAyQSz.exeC:\Windows\System\BnAyQSz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\atqPWmh.exeC:\Windows\System\atqPWmh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YMJZloK.exeC:\Windows\System\YMJZloK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FLwvnwA.exeC:\Windows\System\FLwvnwA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5702024f85a30cd0258116c378db73c83
SHA16942e225c87fb1f3fe0afe266b67e70b395847ae
SHA256bc24a731fa85c5340c833bb878eb3f3ab01851356dd2e33a8f20ba59bf098704
SHA512f1c3a4c38a0d3f3d6befdbfbab13fc23a37dcd087058e8a69327bd31616b5f95727b0000efcba31f6cf9895144202b01a9fd32754d99f450784db307eda37700
-
Filesize
5.2MB
MD530c1890881bdbe56c8f73532e53883c9
SHA12ab66efa6a7a0e12b137416f94233d623d034a5d
SHA256e8299bd1fb3c0d1967bc63a646ad9f9a7444ceec33bf8ec7e1b1810a528b4b3b
SHA512be32722c0acddbac5b26b9216329216a657cc371fa4972e5ad23a3e1ad85dedeb9d91e7477c234699a55b8cbd8785ff4824ac6df7df25d95668a2a0d421be3f0
-
Filesize
5.2MB
MD591f68a830b0717caf88253e484e53bb1
SHA1670b9b20cd624c92f7b724229e518bf868a74939
SHA25664db848c1f4a6a74172917e7f96c84da3f26df5f527549ecec46cd89a4caec63
SHA51228576104e029e56cfa6065e7250044b5b732684daaa4aaa948cbec007e08288bd3f36fc2d0bfa482538b5036fcae5c240e12906605a269e98c5175c0e22fe5f0
-
Filesize
5.2MB
MD5675886fb2418bee0972cc4296af1e69a
SHA1adb61d2ce4fd8631e71bda2e81e40b10167c7a9a
SHA2565615ed1b71985669cfe12a8964d2e302bc00e09dad36372fd960a8733418e260
SHA512a511c484d96d2ea55beee91708318e1d49b88cfa38a086b32aad3e2c9855bcf98895d965cd06549654ff1328391c55b34412d81da4f0be9b7d55d6d8e137dfdd
-
Filesize
5.2MB
MD5d4ebbce8c0df565c78b9d107dc8e53a0
SHA14ad68d42fb287a9528fee0618dbb7084f08e1bd8
SHA256f7a2177eea209a9609578fa5e68068b7e82fa76776aa675eb1a16ca554c59d52
SHA512ab8bc5830a9eb4c76951bb9b05031ca101cf0105404575e5d6819f99be07781fd7617359353da5feb9c3c009d5a32fa57a1b584bf19bd66920a148704ed43f75
-
Filesize
5.2MB
MD5a8693a61a35750c2a37efa50b494cf17
SHA1a0308989e28a05fa6b793b4cc1222901c1ee9786
SHA256f09157025ffa2be7109127258f0dc3ef190490838bd9a310c97a283443ca04e3
SHA512a28df4ad5bcaa2e49eca6f424b1b7bdeb3334a992ef587628b559256d8ea13a3ded967c1539456d8db2bfc7db15a549da3adb3a07a7c005d252cefceb45ad4d1
-
Filesize
5.2MB
MD5295b931bafd396cb32ca1be6f3bf1542
SHA11b70f178dbad8002b8bd4323b462afb67e8787cd
SHA256667b95e0afce2d991f41e596907253927d5affb8845b19296ea358ebd2c77ff0
SHA5125ba7bf4b45255d29ae7b3c24cb86687e07e19a5ae544478031961d38a36a6fd58c12319af8083181d88cf8ec279b255b9c10a069cd972eca63130ce490115af8
-
Filesize
5.2MB
MD5f3ed65952ca9b279f961e51226799236
SHA1a6bfbf9f28410d9fa78c715ede1ed87629ea6267
SHA256fd781df63c417441fb15cd6bf4c053823de13ab4d0265ed123d70a17d21041bb
SHA5129fbca6b6614fcf5f6a71fbd20505726dd286b355d92d6b67f956708af598568f49d22cdc8ec2bec9160b805c79e39d99e8ce1952ee424a0cca49113818805cfc
-
Filesize
5.2MB
MD5c706c2ce0faeecf8de507726e9e6c2dd
SHA190561c75a6913b48339738b9aeeda8fc0d93dab2
SHA2566ea7380b42ba06eb476420451c1b92e38d8a90cd7d4b81ee647a3338ab40ab14
SHA5125f25373b79cf46bd0a72db7560e2c0aaaba6fdb267b9c97264ea8b0a603f79a8efbe1aa8739461e5320cedbd26d4aaff42beab86a7baca9ae846fc379fef96b9
-
Filesize
5.2MB
MD591ed2ff318beaf0b3c82816fb3ddc1c7
SHA1951d66304790d0a4a3231b8fb9ee6783f90ce735
SHA256c656d5485987130f0d8ac3fe4d69653dbab456564277ae5187d01a169b76dad4
SHA512ef0e04c14d41959c7e20db722b0c1d4a21c4b53a1b6d00ef059e1c1143074fa1559659f59ba2f14e9a99c159c1768162d3ebfed13ae5ea898060f5a0702cf597
-
Filesize
5.2MB
MD5d0493c2a11c76cde47c4bfc18c0bfb37
SHA17c75140297e0e880496367771d081b69b4735ca8
SHA25698639af60537cf47e8a4baa68751da6253155e726fe78f7345e7b00265eba6f7
SHA5126e117c57c18deb081d08d101918b5c59b97851e84cbff844617b3df22c72c676d3a6b13671e1ec9e5dbf0ed4c1b9b401692733ba211f69c7c5eba884ddac4172
-
Filesize
5.2MB
MD50d1e858c94cb5f22e3bb917918f618d0
SHA1ee5b40aec0b4fdac6171322f24a45912dcec98d3
SHA256b98da16648af192a04b0fe4907264e768880979a554c52e2dd5844eca88f24bb
SHA512bf6adf12af2ecdaf14a93829d6b07ef917175bb37e66afdd5c1945e95c68dbc09ea9db589d02b0972f0196fc151f6515662ae944fd8b08809d7fe6f2a5c49733
-
Filesize
5.2MB
MD5a9d891c55c7184de1eba1fd7870ffcb7
SHA129f4a6c22f3ae3c474a90116994a797d055f80f8
SHA256e30876f87b075e51fa02a0cfb77a95cf3015a4b531ac95ae2fc9531ad0b3e7da
SHA512e8e407effd04fe3fed41f1685258d65f272be4c57f7148d9d1397397d3ae9e3fb89488a4991c0a7958ca1e2572fc077832e6f4aca113efa61ae301f737020ee3
-
Filesize
5.2MB
MD5d39084d535467115f082277ca5978143
SHA1be09bdea60d57250b92b98972e9e77ec7a63e102
SHA2562aba0b816d99096298802bd2eb6efd04e45fc79761a7f8c10cbccdbf7237c300
SHA5121214b56a1e52171d5e840e1d657602918165bd6e698256a176477d678ac6d292ec2cd768358ffccf7613f70884d63b16a39e932124b00091ee7cf8b7b0f28ca1
-
Filesize
5.2MB
MD5279cb99f9f78119289bbde03afa26e9e
SHA1f4b7ab195650a0d355e6a0660316e6f0c6c6aa61
SHA256c68896fce705a667eb1617efb4ae4039f63266c7b0e5856af973403e0bcd87d0
SHA512162b68a0e328be840daf1a0ca43d4f632ec485ffb7fe1606b3c865b467a30d5022191b51cb7dc6723aefc4e2a96f0bc65718cd493eebda6df1e26d07539f2765
-
Filesize
5.2MB
MD50ddb1ccdcffaf62e333d09a8b8de0a30
SHA197a44deccdcd0d8ed146e29c961c1ff813650ca9
SHA25617b0d2a594f81997f7113831c128b977d0ccf55ca287471c3b899f02bfbcecee
SHA5128eb468bb53d0a2ccb42f5cb91fdb09cf41378863fb7f81c3ac0c3e1e72e13124cf664cfe87062eede2bbe85bb87bbebf11e29d6e99c4225404f1cd249b4e1494
-
Filesize
5.2MB
MD5cfaad0cd360301c7fff1ac46f028fe92
SHA1edde89a59986895e7032ab1d7ca08097c3cf87c9
SHA256e53d9b96315e2576c274bfa0480b9c9e829e1b80dd0684eafa006b2c761f9d37
SHA512dc68105a232ba9ceb850f4cf4a9b12bf677d8c3d329b14d80fcdc57e1a65a2d14e99854c7e0a30f305334c09e8d6282ce2c43bb807199b15c124407dcb89b46a
-
Filesize
5.2MB
MD51066bfce27192a1a95421ee28b1cfff5
SHA16b188583257d561e876cd229d8820b30ddffff5b
SHA256cfadb32a0303c3f0c2d35f18c8eaf41d0150219fcac6b3fc1c58d0b5681d4802
SHA512572b33109bbcf6be18f22ee31a410a07588ea613f41ed9f53dda9e6e761860cbc657d83ccd078aa5a71f7530e850afcb5876968787ecb806e808a53db916c49c
-
Filesize
5.2MB
MD5eaba3fc74c97cc7f7346e1adf739318c
SHA103824cb5c165410b233238577f4f455ebbaa3dc4
SHA256afbd996fcb7d31f2184220c888bdf18cf2f96d45ee49bf48459cd5bcfb3c4080
SHA512f4a99975213cd0b5791f72c4f312dba9267fe4b225237eac94f1324daf15bb9fa6aad1a63a8c25f379f5e9ed33bcfa210ed725a7b89569947a179f54771d9604
-
Filesize
5.2MB
MD5b706509511e415ae6c235556e4b020c9
SHA1007d81ca509f5250e12c98bbb4ac18944d68ccc8
SHA256220f17035296b34d674ed5c1518d681ec5651299753a47974b869ef6f4f5c0a5
SHA51240ba1e10049286d40ea850499a1e8056467777a089f9a0051fa4e6c0d2cecdc872295b2d645777e7115319814290f494da4f45cfa62ba007cc85b9b07c1a0092
-
Filesize
5.2MB
MD594af1eb2103e1706b2b6bfa745fb9494
SHA19eea87486cef0b7af2ae58ded10b871256dad9c1
SHA256773a78b125772022f1c56b8aec976f8b55111ba265a6ba0a5a11e955883ae77d
SHA512aa47f6aad542151250a7c4fac8f7a37f4480715361af3108bf93ccda5f4125fad3fee146102c615d8b1d1060f69526e3ef6fde8352518e9604fc9128c02bcd29
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB