Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
31-12-2024 01:05
General
-
Target
2024-12-31_cfaa22902717bc2e7a0d155cf64d9a32_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
cfaa22902717bc2e7a0d155cf64d9a32
-
SHA1
9878ac058f9f2e958954910d8629163f558bf530
-
SHA256
f287fd50e5adc896f4800db853b98e412c7039717c540cba3b5341484f200c99
-
SHA512
126e3f3ab47969cacd54fcf339790b0f92a0ebb9bc2804fe6881628522b1cee778fb7414347575f25afdf27b26c25e407ab69dcb5239beb088cd053b844010ce
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_cfaa22902717bc2e7a0d155cf64d9a32_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_cfaa22902717bc2e7a0d155cf64d9a32_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kXxVogJ.exeC:\Windows\System\kXxVogJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wdDuoaR.exeC:\Windows\System\wdDuoaR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zJEeiRi.exeC:\Windows\System\zJEeiRi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BjLJCsb.exeC:\Windows\System\BjLJCsb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DsGAkxz.exeC:\Windows\System\DsGAkxz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uTEALOo.exeC:\Windows\System\uTEALOo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tJPjbBS.exeC:\Windows\System\tJPjbBS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fkiFgEx.exeC:\Windows\System\fkiFgEx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yZKiKME.exeC:\Windows\System\yZKiKME.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WGaAtTs.exeC:\Windows\System\WGaAtTs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QScORuC.exeC:\Windows\System\QScORuC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tRYXYQF.exeC:\Windows\System\tRYXYQF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rKJmPIw.exeC:\Windows\System\rKJmPIw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PoWAciU.exeC:\Windows\System\PoWAciU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LOipQTY.exeC:\Windows\System\LOipQTY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lPjykmb.exeC:\Windows\System\lPjykmb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FUdPwpP.exeC:\Windows\System\FUdPwpP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lPfFmMv.exeC:\Windows\System\lPfFmMv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oWtIqCL.exeC:\Windows\System\oWtIqCL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bqEfYNX.exeC:\Windows\System\bqEfYNX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dHZnWIW.exeC:\Windows\System\dHZnWIW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55db3d1bc5885af8498f4493ecf2cfca9
SHA16751c699adfec1705ee6eeaacf31b8ef30c65c09
SHA2560a181980c8b4c693731fa26f4bcb350f88e472f623a402c989e5b61be41e8530
SHA512f10a1b35654b73fa76d27dcfedd189c3308651fcdc7523cda6ce824a6c09a8e380e99a461738a48164ab0b53a61f9b5881a5e06867233a9f380e1b090b2c322b
-
Filesize
5.2MB
MD5460e0196de42c5a57a08f668ea130539
SHA163e3d36cf4c51247d1ee6405de76588da7661d49
SHA2568acbe92386a74ecbdde6ff40220547d4ae97b12bcbdf6043675f342b94dd7e20
SHA512f4ff729ecda98acf257687a58946d12e3cfc2cf71785caf7a801b708928297d7c84574bb1c64b36338cfeb16b5ce69e86e00d4fecaea4e892fa99a8b2101d8c8
-
Filesize
5.2MB
MD59d1171ac8309163d55d12a56cf61b369
SHA1c14ea060f4bf15d86810f88ebea1e3b88bbd0f9e
SHA25674f3d9cf03f46b6b0fce61b87d4b61ecc4c2a55df20bd390fce302d2483557c3
SHA512cd4b384c19b773d57d5f474e4e00328431c7db0e876134d050f78372e6221ae59d7e88bc8936c1875b5645af7e4870eb872da49d2243c520ef61ff2e81fbff12
-
Filesize
5.2MB
MD5370dbe68a51ac4f8ce576529e4b00b4f
SHA15f6d545a09653a200d7893e8cef2fe6724ebcec3
SHA25606288284363a7c5e5d4ef9aca194a654049a317c320a229b939c539fa1ba85aa
SHA5127d7efe849014176f39e024449dab36b0357553e033808ec748188d28cd00ae44a34c569a00ea45bf589293cdb45647957a0ad1c80631f5b350c5b4fe362692a5
-
Filesize
5.2MB
MD5e65da6f8c98c32dca1972b5f711fdcb7
SHA11a39e322d335f19ce48565b192e2298fd37099f0
SHA256da3f8587568ae91ee2c8e24bc55921407d4ecf042dc1ef9f2153ed05605c007d
SHA5122e3569d8ab4e84ddbbdda2068e64b2b28516c23aa2048af40ef27c376015a4a6f5bcd63932854fb30ae6de623c98068c6435be95ba685d4f2d28b80a78b515ab
-
Filesize
5.2MB
MD56b96597da5b7ffcbabcfffcce9d27b38
SHA1899fcd83d74ba495c2c2b41b287b4ec1d942d27e
SHA256ad6446b278da7fd319c0f54275b7b374e4c86ddcfc9ec66d1a1e1b383087276c
SHA5121952d76768f4ff69b9edb81c309179694a0b486d9a01c570ac84debd105a096f0a7bed0f481a44e533f73898920bed142307aef9a96a1cbc63975fe4d638c7d8
-
Filesize
5.2MB
MD576b56c255d401b5ec60306bc1dce26e5
SHA1a2eac4f060eae2cfada5f2deaf982691d9caf604
SHA2566ed66d2630b1eebd6a777eb3cc79a9f1a0428b4e16d3a262e3c95affb2ad43c0
SHA512af9b196e81a85f4334f0df502fc6a5efacadce1278faafb2da39f483702a9d4142f3e6b2497d37e8ace724ec438be666134f6a8c3d99a9f871eeaf81153a2c3b
-
Filesize
5.2MB
MD5106af5a4bd2fbf1b40ee309a486424df
SHA1904079466f5d6c8f26e36dba42e867a4b5205787
SHA2561bc016fe30199442857bab9c6b018e69ebd0436013a2f3b9f6654bbe694fd150
SHA51200a8f9e7f8b84f5a71a004ad93d0381321a23c2aa556d1d6873b47259de8af8d6628942e9be0b5b0f03d21a38b2188835b946e56b4b673d5390fe413b9c6db16
-
Filesize
5.2MB
MD508a27d4a590d57f67ff68512a3ac9ccf
SHA1c9e0afaffe53e7489a9a6d9a41baaccb5a905acd
SHA256cec05050164bbfbdebe75fe797d33b931a9174f16253b4e5ad416db2b2af67cd
SHA51256954a65019c1ef4e04bbf8daf80e23c6bd43b66df2e123ad5341271416d71393b9078f516b1853c4c4de80e0a0a0874c78112d912e0c554d8c0dfe6795e7a26
-
Filesize
5.2MB
MD59b66a2f48e8e2181645ea0bb82ede46d
SHA1f0b950525b12d14595f668d1edc9cff4e0208db5
SHA25665fab667deb89c96d161f49f34eeeabff89f376ba11311a2128d317fa0dc4cec
SHA512d26f371acfd75705a9a453060b1be0710f51d555d036bb552e29e51a6fe8e8afe0c04b78ecdf1d92634618827136cff83d669f1400012158c088b8e244dfbf6b
-
Filesize
5.2MB
MD5c079f61e5595d4a21822c9fdff60df36
SHA1f0974c400d545d4663c6161040d49eca4f805b1f
SHA25687e80935430a41298105aeec53ab60632f487d9fea7fdd4189dbcc226bc2ed52
SHA5121a63bfb7d4e912609841b509f5b50cb587d13cbf9be43e00c72e7b9f21000ba2e2dbbcc882affcaa0307eb654fcb09ee04f9831e69a3ba5513c441b3570343f2
-
Filesize
5.2MB
MD503342fe5f860699c63a6bde36bb8fb3d
SHA1009dca29a9fb998dc895e350654b8f726de395a9
SHA2567233d54006a2f7122a1108260f3866b8e8dcf53fa7d179540f9669fdad9b2835
SHA5120122b9bc49b4dd05d10d703ee44cf4985713b99fdb852f129f96be3660fa9d9bb083671f0d1278a9330357a36426d85e53af6659faaf4a5e87d82ce522424757
-
Filesize
5.2MB
MD5c4b35d1c4b7ba83fc421f870549f5b18
SHA13eb04ee30850bf75bbb0809b2a242f4d7ef6a0a4
SHA256633a3d36b65f5dbfc194342d88d5319b79ab4bb60058d3e24d478a0f4f86e300
SHA512149d1698e5588255cdc4e91ab84470a92567431e551eea0e6a3d17bc0263a8d74f2611e657c5f73b636d78210add46bb301691d0c56cb932d2cb7d4dc443926c
-
Filesize
5.2MB
MD55f0abab9e6e815e2d65785b746a074aa
SHA108f3f496e6741c76911fc64e01c8a81887367513
SHA25690968dc9b82d107c717dbeed9a19e26a4c07eee574a43920081ed8b7702e34b0
SHA5128dea71e53a43b2d48876502e892b0636e579966dec8dd299db442900e96bba862ee8b1118a0f6646088fa20cba6351f1955fd937dfa098b463db97845bf7bbc5
-
Filesize
5.2MB
MD5367ea6e34b098bff3e0c77079f274d7e
SHA1c7e6de9f59698792de5bb54a0a1734c60f285735
SHA256fe20e81378ba5785ef6a5471538300ee872332586eae092a837dec6fdcb1caa8
SHA5126fd2ab7bb34f30c6122e568914a8539711cb0a551e4e0907425b3a20ae9c871023b40af2d51d683596185dfd7cea84082cf3309a9ebf06e165dd7a410f41d3d9
-
Filesize
5.2MB
MD5ae532d27b960274fc9624ea4511767e4
SHA1a8818a05dcdb84dd15827f625e48bf73586eae8e
SHA2562756b7715921d973c9cfc2fa4ae167d9bb326882a2db9f2bf544ad0bc5624caf
SHA512abb18cd10eb496e18efcc2662eeda83cb94f33d3acae5413be9f92bc18ee4174b6e16c16360dcd3648b27d20ea4ff726f4eb64d61a000ef1ae8ff6c3c58dc750
-
Filesize
5.2MB
MD5cdc200d85357f14b4d08a4dbbe289739
SHA109295fa215c5fc0764cf499397e5d34b07b98cb0
SHA256097678679a80a21633b980f18313ba7f4d6741da6986babaa1e9435d12d1f06a
SHA512df9e276fddf226faedc80907b060e24a10b2ca57b53907f3f957b0e628771deaeaf4693d620f6a57f86feeb3733854f748d39ebd5126ca5b8e6a2958def3069a
-
Filesize
5.2MB
MD58b2b77fcad93da6224c61d00af615f3b
SHA1f7d9ad427b3767aaf31d67449553abd44a40774c
SHA25693d240aa513435ff70c01917ea589b8169dc6258546cb3230a665d445e36ab61
SHA512fb687fcc24f1c68b9fa67fa5654370fb3b5a6f8aaffe804c9fde9253b3fc4482a3f08d6c6f94d406e8ce882dfb3004d00a55100c665ae818f4ee19b5f5e156fe
-
Filesize
5.2MB
MD59b6def58ea6386eebb4cce9353216d35
SHA1cb083a91e78cff55b949bc572e9538ac2454bb6d
SHA2563509caa49d7a7cdae8413d4c0c02525399796de4bc53dae91bd5a7281ee48834
SHA512a9d58a7504f099bc085d8c1f7ff676554e656ef9dc86e7e2e5b50c92998d7d77ba1b3a4662e88978a8284c4629c9f8e5a969ff832e4147956488c40192d02f04
-
Filesize
5.2MB
MD5b83c41e93632fb4d2a7472b3cfdb9a6e
SHA147525c57d7a37db42638dd37bf5430a88dca4487
SHA2566efa6a05b41065124c0588fbf7546ee101698ccd2296ac5e2f4f8da5ac418665
SHA512c7eb81c4690d4c5e08b57fec6f994af104298e3aea0d90bcea258576c6bf5bea68acdc3b19164db22b87c23724e7463230ab23b5cdf8bc8eef7819933593cc30
-
Filesize
5.2MB
MD5ec5eb26a3c613bdf492f0ba74ab03489
SHA16567b6ae83f25f89274d6e32149d158121ff7265
SHA25677835790e0b6f2d52e3e84916a7b32c9fe328713cb62208549cb7623d0761ebc
SHA5127845de589290825eba073d9dc189c05b27ed34c9d74f42f7eb6c4139b6cdda074fa0883b2017833d04cb36028704973aa190e6a67d148c2a86afc1d6bc92f5f7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB