Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
31-12-2024 01:02
General
-
Target
2024-12-31_be2c85d6efdfc4353a65b89ce48854f9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
be2c85d6efdfc4353a65b89ce48854f9
-
SHA1
97817c3cea696eceee04c58ac1be83f2e4827369
-
SHA256
19209576ba88a47dab03667291e7de50a9b9b498b45979685731b198f1e8b9ff
-
SHA512
39966ad0abae066586163b8982b4606341a86896ea7230e279e444a63de6bd2c5bfa1b2ac1a3ee8473af58924aaf08cc6fa49b5f956532b3b7ceadff41d75e19
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUD
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_be2c85d6efdfc4353a65b89ce48854f9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_be2c85d6efdfc4353a65b89ce48854f9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VZaoERw.exeC:\Windows\System\VZaoERw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XwKUgtr.exeC:\Windows\System\XwKUgtr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JbNbagI.exeC:\Windows\System\JbNbagI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\myNNxWR.exeC:\Windows\System\myNNxWR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rLMNFJK.exeC:\Windows\System\rLMNFJK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gEeVami.exeC:\Windows\System\gEeVami.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FXOkgHO.exeC:\Windows\System\FXOkgHO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RtRaoVk.exeC:\Windows\System\RtRaoVk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fxsbzwu.exeC:\Windows\System\fxsbzwu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NKANuOv.exeC:\Windows\System\NKANuOv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DSNmoZH.exeC:\Windows\System\DSNmoZH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sLvhxjD.exeC:\Windows\System\sLvhxjD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rXfktRi.exeC:\Windows\System\rXfktRi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gdNBdYg.exeC:\Windows\System\gdNBdYg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gDdnmZD.exeC:\Windows\System\gDdnmZD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHIvAtj.exeC:\Windows\System\BHIvAtj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VAXvIRP.exeC:\Windows\System\VAXvIRP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jsPCNRn.exeC:\Windows\System\jsPCNRn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XqmRDjl.exeC:\Windows\System\XqmRDjl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SOTNoqg.exeC:\Windows\System\SOTNoqg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Zthqjsb.exeC:\Windows\System\Zthqjsb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55901d5a99fde92d9254e1a1ff212564f
SHA14ba0559a28d238088798d1e1269d58e5deaf635c
SHA256bb78683a291def7e4e9b2321b2aec6928ec8db6e53a545e91a869c79003b214b
SHA5120d334dd436715d4cc86cd56f3d36920579421e395d743ad72e450c9dd0f1d7e9526ccca593da7e04bd8d06c2e3fcbbfec22afbf460ffce174ac0c3d85e3f4225
-
Filesize
5.2MB
MD5194d9d35393cc58527e95982aad7f403
SHA17bbc75634acc498e6436d0db267f2d82371e6edf
SHA2560fb2b01eb240219cb9a255d3c50b2e76a19cd3dccd312f16beee995bee1dbda3
SHA51209c5f6991eceada7010446fdd0584589f5e99c591cba662f87ea9d87aae9c68773ca04b1e8512146f70708a7569d5f7134d35f81bf46a92b4bbd99679e596c31
-
Filesize
5.2MB
MD5bb15a6c541e9b936db26ccc78e8d8d8f
SHA155502920b040a58fb5075f8d55961c02e3005f71
SHA25653c938892f6abe7799df4f9acb4b9394259b3482232fce8f219cad6a1d4805f8
SHA512c25b84095ace6c7fab12e3915fbae7b280bfe0da624b08988d0ae11599c8bae74ceb93fc42eda62144eea48ecec2f6f22615b355ccc40d5baf0c689815ba2291
-
Filesize
5.2MB
MD511d6cc113201c9396e71386072d14779
SHA133d8d7ce736e0f71ec602fe70ebf34bff8729571
SHA2563b970a5827ea8598f30bd8bf39f0c47d51523258dcbb6cafb2939115f2b9ffc1
SHA512f8ad89fc2f69c7ebf17d50bb033a0c589291a5c44d4200f66afc980c14b9c7e9db933208463e571de6313075959e90242bf782f077301934c9893c519f20a02e
-
Filesize
5.2MB
MD50a75d373ea300ab997e812a4f7af49ad
SHA10dbba1b83a9b484c8877e08aad3e415ad398a2f9
SHA2560e2ea200b6862ebc98d11039d11bcab8736e539bce96b2d084b64dffe58034e5
SHA51215af8d9448a12d7c46d56e9852017d7b8b4fe32542be005aad478404440ef7c98feeb884f1600beaa148b1177e5b24e31ecc63b32af5c64ebc58dac30def7746
-
Filesize
5.2MB
MD5101d28dec968d5190af6ac88949d9ca1
SHA194fe236c11d0f3cb3bc89e0d639fe3c8c10e187a
SHA256da00f474dd50b2b9d2fb4feac5bac567d511b49117c8c532b03c7e297b13444c
SHA512b6d90268c3d0b76d51c82810968da9f719c9a244fb52fdb75a0348d10dbe60548fad73fb7cacf1cf228f041cfb94d89debaa7509b78d7aa156d205e8370bf843
-
Filesize
5.2MB
MD55cedd4a60625873ac3574464f86ab00f
SHA11bdf5642891b31d00cadb55e18031139da96f706
SHA25619edd32c46bd157bfc7b6e7b293d8dead345bc2cc2645d052f5c6f41e7a12b71
SHA5123180e14a03ef3974febcfcded663af8f136a2f9a3344f621918fd46b7446fa11d8a7e37a55e5ae72b9621e1397e89361db862fe32c2e63d82557ca49a0fd16e7
-
Filesize
5.2MB
MD5038adb488374da16b89900e184c9007d
SHA1e8a98f0cd7fe4462c2371c3e311519d0d1dc54eb
SHA256bc81c171da3b5a98cb9427695fd0167ca904d63e0e694f6c3cb753ee629e72f2
SHA512965844ad3d37c765a72737faa222b8a6368f94d586dfa8d25d65188522b76fc6caf09caf2dc59735dd21b7e49837253a0353bc48a411c5b0ec0d9619fb463de9
-
Filesize
5.2MB
MD58a13630d7ec949c0ab6c6573413121f3
SHA1b2e3141817648a1b47608465b72b3facfb49b75d
SHA25690b97ce9a9baaa9c43c5b9bac031a7d716cc5d4f724c022a580f73a124759485
SHA512224b9c5a12cca0e294f77c0430cbb84a0324c4edccc23528613e2b135b42dc769f140762d0928803e2255010b60095ccdc5ca6b83b0f4abc404b3db5e569d118
-
Filesize
5.2MB
MD5f35c73b349df9e11fe5b3a246422bdac
SHA1de2d4698a8a3eb42e281f7c5c6a66db6fc91f1d5
SHA2565c3957917e30f185949c0c76c85dbce5c8576f68c56f4d2d71026680be41be71
SHA512798ecf879d94e629ef7e97b5afd6f7420925f852e1c0e9c3e3f2483837dccdb1a54538edc6c49821b82a6174b13452b904b6e7b56b8faf80c49caf77ce04a3f9
-
Filesize
5.2MB
MD5381d348e95c9a80c5c774fc68be35943
SHA1593b437788b53e8596f3b189a2182d1c6c51c850
SHA2566c2160858e680bfc2bf6bf9e26c29bd957ddb22f69b65efaf98f9c31e1660d21
SHA5127754e7f2f06a3df202b65f62daecd31acc887e8e6d9b6f2f20a85249e2e2cc49b43cd6dbea0c556a0453144158141ba2db16c21325c625b5ad04ab7acc96d91d
-
Filesize
5.2MB
MD5ced4fc5302170f37fb4d646bd0dfa19d
SHA19f7297ce8bc414cc6381bed69cad917c8206582f
SHA256ce4d0239e80557cffd84fff999772213b812e9fb5be56a0f121cceaa0408583e
SHA512fbdb16c921ba29fb90993be128879cfa49817722394c7fc9746e18bf2024e8170fa378f4ca409e853251befbd2be08ee637f4ed121de0818947942c1b3ceb8d1
-
Filesize
5.2MB
MD568a042b389acfd3d3d475dea5846a31b
SHA1dbf18a731c4a3e694fa16846a1a561a4332a661b
SHA256d709aa4b410aa5e1ebb1b95276d2163b321b9081c0195ae5edd49dd1145b1f92
SHA512ca303f06c3c64c359fc85219cb4ce437c8eddf850b6b9347858c5c5fb8c3cb48ff76107256459166a19b31e514c5bb50c596d2663184e1aba43ea228fb31f5a0
-
Filesize
5.2MB
MD54d80656cc87027fa3ba3f50b69c36df0
SHA1c8e198000085ef8b3a0607e64093397f6cdd354d
SHA25623bd3d3c700aeddb4900f1d302a81808c5a1a63f34c016acf766489c861d0c60
SHA5129d22e8aae6bc610ecc6154bf509b3d072faaa445cc1a2c92b23070e008a4557753485987066e52654c5755556112aa75ca98ebc47850be13b6e45628b825c8b0
-
Filesize
5.2MB
MD5f0abe6b78bb645b702ef7d106a4bd581
SHA16d92786b9221ea0274386bef6cd7a1de24f73e0b
SHA256dc51ba805cbe9572fd171c16285161e3dd19f78ce2c74044ad3fa9349d0f199b
SHA51273bf93e74d7d253814995818f7f4f20cdfa9f92b1604523f9267e589d79a6702a96aacc5f4dda70e1531d34a493adf12897cd2a865daa19f7d981615577fbf19
-
Filesize
5.2MB
MD50d9be89ae8a204c1044f43d80876963d
SHA165fd981c88acee0bd67d7ba1696b7781e5fcfd27
SHA256e785aa467d835443b3eaa0c2e72b5414289f8fdc2ba5f42c5af53c80c6a84f78
SHA5128492dd7bd6272e5d1fe0dbb4c910d78bbe53c3070f598402650165e0401ff55b920662866784e1cfa79074fd36e7acd86bd9d17f100752be7ee481f7e024851a
-
Filesize
5.2MB
MD53a43d2528fc3d3a0410054c7561a28d9
SHA15ee63815a13d4f879c04a72105906e9d8eb6c07a
SHA256346cf31a4e9633081ac61d481fb3753e652e9b4621d519a41ad7a7578580b7a1
SHA512f4c357367e12e6fe4bb3642028c1653a3416b3b3356d0f94cc3e3cdcc8a2d4d8d0f61e33c68cf270367503c86d9435703a7129e46bf4e6101378a4b57041d4bb
-
Filesize
5.2MB
MD52a8107e3ffafdb430afa408569bb5018
SHA151a23d59bc301bbf9323c19046dc8da39fd910f7
SHA2565df8732ae4949ab0004b198565462fe2058048530111302398dde5bf0c2b7aee
SHA51224baaea54191af293f28082c676f61fb0441f079b1d0167987f2ebdc131540eaf2e663d23cda46d8da5879d156d24b9986173e359e680977d41eacc50bb5a32b
-
Filesize
5.2MB
MD5a527fb67840dc86c16897d9a99189ccc
SHA1b8109f3a9cb741fdb6df9599136ccd841d60801a
SHA256b1b5f9e8cc6b76bf9ff9d08853fbb82d628c35df8e025322d8d9677d99665efa
SHA5127eba8762615eeaf181f7c234e3a71ca24e17869f753a7e41d53969c8cb46f50a5be0d96b69c2e59e955d0f4d9effe6e50c95a0b9837fba4a14824d65dabaf4f6
-
Filesize
5.2MB
MD58c8ca020b8c9341f6c639d909d2f72d4
SHA1295d902d8ea03dc40d0c232b4e2ed2ded0ef4298
SHA256ac6bd3548de3c35e9ebe036e74a8a6f2b09de7e848b57a3d047342a09e604422
SHA512f2a573519991aa803506f9f92dd37c836616d23f286041a2168919dc17c5155291704c13b268b70034adfaac4c80cc8b6eacd27524ca65b1589d6a129f9b0792
-
Filesize
5.2MB
MD59cd42292492cc541b148f11b25691eae
SHA17aee24d85f67c6e5cbc4ee84c6e3a74207e75e33
SHA2568206abd9d0666d8b904417af72840b52e723606e38e34bc92d1a2b2c3ade2c2c
SHA5127ee74cf441fe84c73ad4e2557be96f985a50ba01abd4c5b097adc8eb329dc3a96efb55d3ea3084ec337f2c2c5cda340295c7316c9c88cc7f3c057f60c4f49f05
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB