Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31-12-2024 01:03
General
-
Target
2024-12-31_c2679a8f7c782c9a3c86ce0f054d359d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
c2679a8f7c782c9a3c86ce0f054d359d
-
SHA1
f35ffcceb73a651a43aa21fade171b2274eeee5f
-
SHA256
a547099d06df89e4ff16a9a7427d2d7217306eec385087534d9e5e68c719d341
-
SHA512
86efe86b182c653cdf26d6da752d98c4d2c75ab7c36fbfee46df83b5affde0ac2cc2fed5d42ba28dfbc41e0e782ce7aa7e26df10059217ead63715cef08318a9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_c2679a8f7c782c9a3c86ce0f054d359d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_c2679a8f7c782c9a3c86ce0f054d359d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IziypJw.exeC:\Windows\System\IziypJw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aevSfjr.exeC:\Windows\System\aevSfjr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\doTvyfn.exeC:\Windows\System\doTvyfn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\esiJKpN.exeC:\Windows\System\esiJKpN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\czhadZs.exeC:\Windows\System\czhadZs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWPNCNX.exeC:\Windows\System\qWPNCNX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sZGaOyn.exeC:\Windows\System\sZGaOyn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lVMoyyf.exeC:\Windows\System\lVMoyyf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wTwCRnA.exeC:\Windows\System\wTwCRnA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\beESqyC.exeC:\Windows\System\beESqyC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ItjwhSl.exeC:\Windows\System\ItjwhSl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lGHUYjI.exeC:\Windows\System\lGHUYjI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QnNOuwK.exeC:\Windows\System\QnNOuwK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XUkAZmu.exeC:\Windows\System\XUkAZmu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IuIJuyJ.exeC:\Windows\System\IuIJuyJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fFTYnMk.exeC:\Windows\System\fFTYnMk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DPpJjWz.exeC:\Windows\System\DPpJjWz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lehmLil.exeC:\Windows\System\lehmLil.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VQgnqVL.exeC:\Windows\System\VQgnqVL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EaHSzMb.exeC:\Windows\System\EaHSzMb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\buZiCnw.exeC:\Windows\System\buZiCnw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c4438209ef5e42e0c6e75aaa6181ebcc
SHA12742adbba9417b03a512bb9485de704eb02e434e
SHA256895f94fdf76dc50c135369d8c00d179ac73e13dbac4034771db051b226b4b9b5
SHA5122e5519ae91c459d87d7f3bb7bcd56fc6ef5917e11d502dbe69d16aea8fa881e0cd670411782970229f32c8b33a809010cd2fdcd7191abcfc36fa8032c5983da9
-
Filesize
5.2MB
MD577fafd94a8daeb9a29f8e54070f1e9ef
SHA19644408276c0989c81c2dbaf14daf82e4c136e2b
SHA25649eecd83338852bcde3044ee0415624066f84ce82902f4b76734465090f2b312
SHA5121c8d934e36fbc357dcf5e7685e2ad09554cc73f827828aa9448539457bce8ed6d5cdabd3230abb0e8d3a0fde41394f36d30c40f4e14614b66681a450fc3fa494
-
Filesize
5.2MB
MD5dabb386b6a4c4aef68c4556a40dd748a
SHA12d2b39adf25bfbd0050624cd3f8281eee9c50864
SHA256688fcb75ae0c88ca88ef2baf39fb2703103cbe800d569353237d226fb5b525c3
SHA512e59da7259593377c23ade624930b688ad01181dc52945065e781152e2d6c593826721b7b742724d67b9e130d6e81ea78aca68917a08efd2f5dda151835257679
-
Filesize
5.2MB
MD5955c1eba8f415be182d0e98ab3cd340e
SHA1cb0189e740196af76bf93dcc12ca1c51ccfe6301
SHA25686c7723d513de7162ffd1ceb08e6678c873ad93fc0cebc958204f2869483eaff
SHA51220abcc346d2d8e15a1e5d58ea5adc3d3fd46095f4aa0d6a7885b13c851affcb07faa1f7cb3b3dbf11eb869c01b548508a2ee084b7687440195216c18011e92a6
-
Filesize
5.2MB
MD5a0149238a59ebc673d497c6b435aaff3
SHA1671eb390df9a7e4ce4c715ea22fa778a894c3eed
SHA256b3108d46d788b670f8b3cd3f5b3dbf1a168727cfe84a31abb8b07f66a6271c3c
SHA512f213e3082e8d57d493bec5f4868684cb2e1a3a6bf521b92f1f2e0a06cb08e6f6dc3baec6736e0673b761c12daef884f9ffc1d94f7c53ef69b4993de18f323275
-
Filesize
5.2MB
MD524d2cd9a482d24f4076e5def8caf0aac
SHA175c9f6005649ef12862b754515b9a2a647ec26dc
SHA256eac017d7fc947a552bab7bb09bd5d15c2f483c99c87619e09c5e3c27c3c4ad6a
SHA512a76b90ffc27298d8e6d08290d1f49458cd81d28d1111ab4e178c697aed3fe225b1e9a9c60ae874468bcb6e1d5d7ba14e0d32df756adb6b8d98087370ed4d659b
-
Filesize
5.2MB
MD5f1a7af80d1a37260f20c90b3208c0b38
SHA1e276a06b577ae9fa868f6c044e8a9c79d2a57b8b
SHA256ad7cccbb261de34ee62e9e75a9dcf3be17fb9657cdfa9d94041a3a7f93e3beb7
SHA512590006549858f735c255520801d4eb4f46d0adacbf7213fdd29844f6be433d1ca80ed1e5901def09a6fe1307d3014885ddca02415b2f5e48386416f6b4c66a9a
-
Filesize
5.2MB
MD596e23a53c6d989ba9fb3675033b8db99
SHA145f5de719845e1d3f4efa9542ab761fa6ac9bbca
SHA25675618f606777602b0110b6b576e8da61beaa6018362331635ece96f61ccc47b6
SHA51293b376c6e6232ffddd80d9afec352d8bfa4da72463191c076208d39ad9649d5337ac77912a9b9ba6ad2bbdb6c51d9351b223e1cf47d0f42724c1f7f7c15ea0a7
-
Filesize
5.2MB
MD5d3e230e61062b91c4c63c492c7ec5938
SHA13bc8d4741d90cb8c6be4c14270f8aff539bc0435
SHA256585551fad109f6f292c1b77c533efbc4c1bb72772c53d742acd1e05ca6374e63
SHA512ee2c5ea45d7d9c83e7d55c793900412803ff457ffdf76d40de9bfae9aa2d12e03e85d32e78634fd33bf072d3051f97dc0d21ea655db1a04badb80ce78dd4eb70
-
Filesize
5.2MB
MD5372dc98a60211ead575128e58eafa3a8
SHA1c88925b6634d576774bb18b21bebf664e264a6cf
SHA256483d7efd1592b15bb5698e53271d785e747b73a43bf6a699b0929424664dc3a8
SHA51213a1f6e0f751b308c22f21fb7dbf193266ba81ebbd7cf4f96d71582d05fdaf3386e937bdd270d0e7db9e920620411ee7fb9cf6df11cb38da9314f39e5a259c74
-
Filesize
5.2MB
MD55839f9453b14060531ba9724ac27b39e
SHA1d155f24e5d8f9c5d0567002986377a3e40510345
SHA256a74b64f78b9529df35f220583a9c080c623a2ecbf55a9ea1fb1c96a8e769a34f
SHA512ded97e390a71509c0c74a6aacc37abc0d4e17e53620ec91292d373c08348b415f08ba9f277dfa5b37eba413181bc35e92ee3d390390a152417f27c5fa99f9f03
-
Filesize
5.2MB
MD5866d7b63c5fe180f791ed2d792d43ce8
SHA1c68f3f0b345c3c66c86c3fe7d35101b52afa2838
SHA2561b55efad11eb965d77f4ef8557077748aef16e45310f7618c10a3245334b1474
SHA512a1e447b21f7fb068be611e9d0fe76fceba99e803b2dc98a3ab855d2189163b5f65b04ff8f28ca3b39f041f45e1b19cc6fdee7b6bf2c4fe96a6a1127c90cab678
-
Filesize
5.2MB
MD5ee805150465dacbf5c732201ac23365e
SHA1cb12a8c978c5f72e50355aeab3deff2e7266edfb
SHA25621fdb2add466462028699938fdd5ae25da80b3ef88c6483ee386667d99753eee
SHA512dceb4afd4417c98ef7143b662ba8f8bf739964d8a11646197e65f5f835e6ec2f30c657a745d2953e10ddff2381d633347b38ed9d8efbfd12ea6f1f8e99dc5b70
-
Filesize
5.2MB
MD58499dced09b3247dd8067b95feaec577
SHA1565c246e3976a77f446585f7ec5dbe48f7bbd35b
SHA2569b2c9dd7d9b9fb3b7012791f032c10a6eec98505c86b052a08d633b61e45e9bc
SHA51250e42b40d409baaf3bf39c1fa3a5e561fb4ae748e6697bf0dca5a676b07763b9b3b099371598a5bb1f6653e599374058f189d346ad2d7d8f423bf77c2ed9f16a
-
Filesize
5.2MB
MD554fe8259fb15a7d9473d06e6f16af17e
SHA16fe6a2037e9093f49c36781f002341425ee05e43
SHA2563e2356648e70cd3176418ecf6f605d87001746d283f6249e8afe001dfa5b53cd
SHA5123c9baf9235fcb587f43ac8f95018e3084565ae50ca778c7987ac386d76b225b7fbadb54c6da3dea21daa02f06efcd7c7ef5f58b7f816a73853e68abaefd9a58f
-
Filesize
5.2MB
MD56c46132839c790ef78d30bce488fd14f
SHA1a59eabe179e7b55ddcff984d6dea5cb38e25dea5
SHA25648c6a8bc95d9debe5a6232e81be32f90eaa5f2c3cc486ddc6d2d77dc561939e9
SHA5122558742cc0b02e712f4e1be1e87213d3ad568562b6bcbfb62266cb0087e4603e314f200e4ca500042201e2502d26f60d28824dda7b9fcb6c733017eb24f31ea1
-
Filesize
5.2MB
MD5e7c195b2bdbfa682a04eaf972c70f470
SHA13775bfc2191a90aa5721c3dc8a26b4e583bd6409
SHA256412ff0abcb7a7d5a15572642e8b893c224fa395164dd35351d47ceb282f6f544
SHA512d11727ea888b1efbfeef28989ea012a98d8417d501a2c26ff2e30bfbe6b811a76be94280cba0f74e4610d5fc4c39f0917ec424f460f9ade146614cc53ed41f4a
-
Filesize
5.2MB
MD56c9cf8b4e942da0831e8ec8266e1ba32
SHA1b1dbce295e46d514173ab324051336c516d3eb67
SHA256a9eab83c1b8462b0818cabcc1b3eff2e034bb7e9e47597e53e32396423ce9238
SHA5126f16abcf039ae638c8bc9b1dd528fac25999768122b5d30574020b472162a4f9ba39abead516c1ea1bf9bc800a5823d678be173f76c2d2c7fd32c35cf73c9a1b
-
Filesize
5.2MB
MD52b25d98977aedfd4a46b5cc3085e6f95
SHA112fd0a51e7a9a44808ca41922836cb9dcee95d6b
SHA2567e0c2a7301f55319ade3b8cfafc3a1271c242a6e365b511429c9f34a91848943
SHA512512cd9e019a76b4a8cbfca51db2ad8e2d43aeff7dcdcd95bdb39e384bc2a426adb265a82dff6b95515b7b1d55ae717dcdc9c75b21a9200b84d7c93b018b6b97e
-
Filesize
5.2MB
MD594fe7c6c16e6c3dca6def475282ecdbf
SHA1c0bd8f85548bb2fa064d1e502d477f1a6304234e
SHA256631a8ff997f5f84bea4c76ee4eddaa3938b6c8267084a7a8c2d86f0afbc6487b
SHA512e1bba973b2ee186bfcb6ea09be50de5bef4bc723b0988994f9e0bb83e2c170c25420460d1191800d781068f41b4a5ca48b22732ab0fa28a911b4a12e31c79490
-
Filesize
5.2MB
MD52ef6cc5a23fbb9e3a91955dc907c5a51
SHA1d3a186c4657b762f68d87672c1f4ac996817e976
SHA256f2ce09832647a493b6889d3bae1716b6a78de17d909c6d33c1d259de6656f952
SHA512f9c2c4d0eee07feacac3203ab0bdbc61c91b6d4f25cb649607e2f4dacc80c85327d080b92e536885dfe38ddb45849184bcaa0f19a242ea299c837ffe6067eb82
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB