Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-12-2024 18:08
General
-
Target
2024-12-05_8eaddb3daf30a3c0aba8b19d798cf8ea_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8eaddb3daf30a3c0aba8b19d798cf8ea
-
SHA1
edfba34fc8228455d412846c809b8e26a88629d2
-
SHA256
9525f2e61ae4121173c0a320994316d941a95ba3687a19945f300a5e47934778
-
SHA512
20a7daf4a03c44e06660c1ea9439b0ce1520827ebe8c4d56d7d9248a2cc2f66dfe3f054a2dd5c35909cc46cbafb5fe6ae04999151f954302b2daff2c6dce84ab
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-05_8eaddb3daf30a3c0aba8b19d798cf8ea_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-05_8eaddb3daf30a3c0aba8b19d798cf8ea_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zYhfjqy.exeC:\Windows\System\zYhfjqy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BgPicjl.exeC:\Windows\System\BgPicjl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qdpzLfn.exeC:\Windows\System\qdpzLfn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xVoVUJv.exeC:\Windows\System\xVoVUJv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ykiJzeO.exeC:\Windows\System\ykiJzeO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DEAbHyh.exeC:\Windows\System\DEAbHyh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aHKLvIJ.exeC:\Windows\System\aHKLvIJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YbhHNGO.exeC:\Windows\System\YbhHNGO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LnCXHIr.exeC:\Windows\System\LnCXHIr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\shDTMuo.exeC:\Windows\System\shDTMuo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CxeaemO.exeC:\Windows\System\CxeaemO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PyeccGl.exeC:\Windows\System\PyeccGl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OQgXWiR.exeC:\Windows\System\OQgXWiR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WYyNXjL.exeC:\Windows\System\WYyNXjL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rxozYRv.exeC:\Windows\System\rxozYRv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yksRsfn.exeC:\Windows\System\yksRsfn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zCOlXey.exeC:\Windows\System\zCOlXey.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nwIIHYi.exeC:\Windows\System\nwIIHYi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DxewWBx.exeC:\Windows\System\DxewWBx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mplrnpm.exeC:\Windows\System\mplrnpm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IesqmZY.exeC:\Windows\System\IesqmZY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f322c7e6cf7734616d40900511406239
SHA142d9e0b56c1df009c501685f092132985208889c
SHA25629b41c4a56b8757414051e9ebe3c64c13ae014b6f8b21f17b5fba8aed5cbfa1b
SHA5120cfbb49618a30757ff911da325a5ebde60053074f96d7e645d9b271855c6d0aa2e54111dc1189ad7c9065f6274122096e93b5f31a6d4c5a8d23e31e18fddcbe3
-
Filesize
5.2MB
MD55aac3af6eebcc09cac5a84cd65bde59c
SHA1eb1b134b0b1d10256870d95d4545c0135cce3e93
SHA256affa4b754830198e638cf1328da925a664d4ec357ebfa5405d1a981ae8800e42
SHA5127f28e941e483ed51af2f5a1c11a4c85120142be1ad58a034827868730a5ab19afe5fa70e8da67a9027c05c6632ef6ca6859cf1892b6a5e274faf69c68fa83f3f
-
Filesize
5.2MB
MD5b69987409425774ba0a83d863fac2bf4
SHA1f7d2bacccec4e33d27b6f3df151bf7688bc62f80
SHA2568b0fd9cef1d19bfedeefa7c24b54b113680d3fc14386e380aad220bb18b6b3a4
SHA5121014300ce3bb028dc25c239c943712bb16be4f6f3d61f4121193bdf59bcd7be88ad79acbce6e0369fe5c148ec96d4536f625087bdc1dea71f513b3b01b8af9b5
-
Filesize
5.2MB
MD5cf68dd3bb6be6b2cfe55f0975bf7e9a7
SHA1edcb52c761a872c8f86d9edef735101114d3652e
SHA256e54a2a99fb787a4be29bc6c36df68b690b3798047ab52a1b415c8934af29f829
SHA512dd3fae29662c7f38434b7853243e8066dc72a7c6c0a8adad9275841d9208ee26d67fa68f513e819d7dfa29ced2303391a02b56e005e43fd5346d2003c486c1ce
-
Filesize
5.2MB
MD5ef729391f9ecf34f415287bbce48f249
SHA1774a79282c8dbba55f15d0331ef11b8a0bd7cb50
SHA256daa2cfb272f9931ce4166cfa0b54a0c59303d42e2e7ba7b85de1e329fc80164b
SHA512ef5c39911cfca14aaa2f90f47767bf4f79eb2a758a2930d0021b41e74ff92098186881a00c919f0519f46f531b4dd312b4f5e4471671550fe462decb168b75b8
-
Filesize
5.2MB
MD53a769b6cc65170f6c005ca2f1e40dd32
SHA16503258f8c97df2489c06ff1352408dfb6d5b765
SHA25647b6af6d9e8848d536e5580401d8cac507e83c34dcf5eb7f28fc0acecdcd817b
SHA5121e86b67a0232c3903212f106e30b7a5e662cf4b49644b6e9c607bc47117855ee1894ef53a311601a312da2d0d9324c76554e2d468ab2752fcbd173a6cba97d52
-
Filesize
5.2MB
MD5db30398e0c0b0bd0275a495056f3d366
SHA1c691e1615d3ad954ae23f5effe7852046d7a8651
SHA256427a071d909f256f13c840bb3ff95c068644b8d5d1d8fcf4fc29d883fcca8d5c
SHA512a64b9d96a08bcde95005d55aa033c79cd3506031cbbcf035cfc84b527645ffbe4c21c6f9cd49feafb52230bdf68863c250b23b7877afbaf959935f768016dd3c
-
Filesize
5.2MB
MD5fbb68659f87732d5e16860daff367eec
SHA138a1131552abf4d40e28dbb12fa10eb142d2af88
SHA25645104dcaf0d7a20ed0e40a7c7f5afc96f76194e70ee7f4353db054bb2d47fceb
SHA51204a090a3407ef7bf1259beb7c6fe2dcc0034b062398b9b46231f685ce34f5ac1986e5cc8bbf3c8654e637e917bca59925d1ccd36623a58e03d7fdd27c6a2a354
-
Filesize
5.2MB
MD5e3ed7011c84513bbc4575adb8553fd5e
SHA1bed08260b1b404c4ff4f524298c7583920e2f25f
SHA2563abe79d2a97a68df3c75b0ebc4f25c78354cd1b2585cfd9415ce9f2761e6de33
SHA51296d972fe6ee87186a1fb4084f3b3c64c49532d95bab91b9890213da17d50bc7125c8ebf27a7448577c9a34f18d652b2754d1c02269693d4927d324cf4895dc4a
-
Filesize
5.2MB
MD5ab26199166d2844d4849b7e208915886
SHA1f0b7eb2a75c7caf1ebe72616be5207e257790d7c
SHA2566e27bc9435487287d56b032f4b248fd9c263b6e5999bfced47aa89babb5a04af
SHA51269053bd5dd124c95b152f6b3da39a4661e54eb0e0b8ec47c65da7ddc66c3b1ba904eb2b228174d5c6389f3f0ed154ee26f1b2544418ca6d337b761be666cb2ed
-
Filesize
5.2MB
MD5c0f7954a7aadd1e9d6a4fde9fedc1b0c
SHA154e991b77d6faa66102386afbd7668e9a9f89bad
SHA256c3a071b83805f49754f39dd6bbcbe2b49b5474a68b515410c7515645bf616dfa
SHA512447fbc931af330556f00b33abc9409979d810c5f0f13c32cb765e1151ab3eb40c3e8425b0c9c75af28dc2b6b782e9f1e74a289a77ce580770d354097a70f2d98
-
Filesize
5.2MB
MD50133e04a023df2399f3133b209bb22a3
SHA1cbfa8ed07b903a866ee87b2d2315cf9cc63d14c5
SHA256e3ce796ded11c28ebbb5f97c31e40963edf3742271b5ef6ce3d7314d8156b281
SHA5125f9c3e5fd73c63498952473302dc66aee39514fa3de272825206c9a8053a26ead7be845e83752f32f8c46218bf69b70b85f7ad51b316547751f1956298b4759b
-
Filesize
5.2MB
MD5ce428621a634073306ae7e54331645ac
SHA1db9dbf1b022303141db58681f0fe06f8cfb91eb3
SHA2560988c15ac5c3b0cc6045680b1b8f1abfa065a381b27b0bb7d67b49b776d57f3e
SHA5121b34ed54f5a21e8a62d5f32485166fe943ee0261ab8da44ef1e2d9836fcc6f18e67f60d95b36dc19535ca332bd73dffe9c20e386d48fe3f008555d92020c9e20
-
Filesize
5.2MB
MD5ec7ff1ddd18a0be25d4d712bc61407c7
SHA1110e01a444cba14dd7424e96466fb8596d901f47
SHA25691cda61afe9ad05e21a83cc10b3fd248b3d26b647c3b1132eec20555abdb537f
SHA5126617f065ff6fee0bfaa3443dc1ccb3bb82859ae2a9ac1424f40f438cf1538609b19399519b1239d12940292773143be4f6ef41258f265f1e92f910d25e5f390f
-
Filesize
5.2MB
MD5a0114fa3f9548db3b435dea1dbd58ca2
SHA14b959f5a2133516794e8e35ccb7bba36bc086d5d
SHA25622eae10d47db14e93533ecf17e355324ff59b224ff1bcc29c177592c1cfe238a
SHA5127186e45ba2afa1bfe34a4e649b776f6429972c8c3f1202d5a104b4a9b7d607a77af185b953a283e1730754fcde01a3087cfc44082bc92b218255725305f9f0f4
-
Filesize
5.2MB
MD5e8f5d715b10c8b4db31a6600aecc3654
SHA198cc9bb0659b981e463923e567f45b493f4566f7
SHA256ed2328bcec4c84e00a860b244db4a3693de08c8d2451c72c95c89b7a9257e976
SHA5127cf7d94d9c7bad689899ffa2460852867af542a4881b77cd3a6c753cdd91b041b6962a3cd7a591f9fe4f9702b41740b05b4342b3e7dbc92431e1dff200532b10
-
Filesize
5.2MB
MD52f04f4c8b6e25be32b860371dfa977e4
SHA101ef6ae417d0acf0ad5f284921a54a9d3fdb6ef3
SHA256869646fe5e06ed614dd6bb2a00f80ff02135cc9a57766ead2a4ecdcd606a7d65
SHA5120502079de2c08acf0063ad87453d88b660fbdbe6fad27dca5c5614f997d8cc84071b4517dd5ab194c40f70d38a584f911a4e30bd4b26e77231e2efa39ae12028
-
Filesize
5.2MB
MD53b53707c326887d4f139a2ad50fee2cd
SHA113d15b261cccd287cdba4c2a37357e0a937297f3
SHA256c5b567d0583dcceacdc1f06f913e255eac417e1309ffcb48a0b2f71a79f5ec92
SHA51257d17b91d2b10334194687ae440533a572aa260eea24f6774b03d37214cb73642765d1fbb5ce0f795a6440e2665f6ad276b1ed494e4c7d1106bdf5e3d835524d
-
Filesize
5.2MB
MD5ea29372c814908992e3c6818ed6c265b
SHA158738995c12eeb96f015fc9deb9058004db585ae
SHA256b2204deed5e0af192cbf47aa8617c57b17256210565b807e3e8ac55221147abe
SHA512fe92712bdb66ecd5d0d3d907b8abcff198255a0a9a4d2df5c8fbd622365880b5cd6cb745fd6ca9749c4984faf026bcf618727c4ea201665e723dc0512eb95472
-
Filesize
5.2MB
MD55ead74bebdc2a409b6039e33da8f3f00
SHA1983519ec7e8c64ad0afaf17067bb7d8ac31118c8
SHA2565b7c23b5931a2fa74f3a0d647948144af1808405509523c9be021358b0290f9e
SHA512ce355109d230906d37e11d9374e490ec9c06936bddc964cf0f848f9fab5e2e8bfe97e114c8e384bc9bedcde3dba8b1ee2139f303b37231552887681ef6b57852
-
Filesize
5.2MB
MD5cdeccbfa2dd151f62bc5a27f5a1abba7
SHA1311c3eff626c2817748a209943ae651b49889377
SHA256aa7946a02a484f8017a0e55994d658c8748c25332ec3f51218a654d9f9eb6dea
SHA512e3914264e38070aa60381cc92241b37065ff72953c9b5d71ccb92606510bc68f29adf236e34155e34d930a27e5f3c56113a110afb21d07cfb5b013e4f55d2286
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB