Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-12-2024 18:16
General
-
Target
2024-12-05_e36ea141005366e1f95af91d89136d63_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e36ea141005366e1f95af91d89136d63
-
SHA1
31c151e452fe12b16a5778932501559ceef6de1a
-
SHA256
31152e5ee43a38e24745b0aab6a6876a1c579dd1cc5ee6c6fd778185c8ab308f
-
SHA512
5ea1032775c2244b1b2a5a4f4664beecf1cb1047d41a6e6de84acf9fffe131b9f1bbc5bd62020da76e1699bf5133e96fe788ecc60fd0e5e676f4eec4e654c529
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibf56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-05_e36ea141005366e1f95af91d89136d63_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-05_e36ea141005366e1f95af91d89136d63_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XWRAOBT.exeC:\Windows\System\XWRAOBT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QgUNKqw.exeC:\Windows\System\QgUNKqw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lqLZHeU.exeC:\Windows\System\lqLZHeU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\okBWnlq.exeC:\Windows\System\okBWnlq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uxDsxev.exeC:\Windows\System\uxDsxev.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cHzEIRe.exeC:\Windows\System\cHzEIRe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MaGBYom.exeC:\Windows\System\MaGBYom.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\emkgBSA.exeC:\Windows\System\emkgBSA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KkddVCW.exeC:\Windows\System\KkddVCW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XrZvSaq.exeC:\Windows\System\XrZvSaq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QHGqMhS.exeC:\Windows\System\QHGqMhS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yJIcoyq.exeC:\Windows\System\yJIcoyq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\whPRlFr.exeC:\Windows\System\whPRlFr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mbnYTwd.exeC:\Windows\System\mbnYTwd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tKCopRD.exeC:\Windows\System\tKCopRD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WJXoTYO.exeC:\Windows\System\WJXoTYO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yxZOOFb.exeC:\Windows\System\yxZOOFb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\njTPFxM.exeC:\Windows\System\njTPFxM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kYtaAeE.exeC:\Windows\System\kYtaAeE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BoEsPVz.exeC:\Windows\System\BoEsPVz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZfVyfPa.exeC:\Windows\System\ZfVyfPa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f73340e362da1efee06132acc92c843b
SHA1a93a64f4072d71d506279a568968f7036a3df758
SHA2560d7ec79bbd07d42a44d99e5e87bda163a5d8b0f5d0926bb5c07b95523daab0c1
SHA5122cfef834cf68e601f14681365483c6e50128d30ae587f509a3d872d1ffbbf21cc35697ee64ac898f7407cf14ab377620cff2614afe98e7890ad5cc73b351c0d9
-
Filesize
5.2MB
MD585219a4317c2de78837ab4cb43d77eb7
SHA16305b233167d5cfe595520de01ca57d78c9f73db
SHA256a4d490303c8d65c754fb749073a1fe49bb53871df98ae857d931dcaeaa034a40
SHA5129c7eef1881767f60b52155f0472fa4ac0170509573b6ebfee9f063ddeceed8a2327dd23cb637418c1d4ad70807ac2efdffb93e57fd560aaebf97799af8ae1994
-
Filesize
5.2MB
MD53d98077fa6047ee9c9380b5522f43070
SHA14a98835d52d482bfd0137812578e45370f7f57ad
SHA2568ffa09c44e01f363f9f6b79c066a31e71f469b79bbb8bd6b577cb974ff6dba37
SHA512e3bcb1af5c10114f08a02b9af34f1dd10020d7352756fe976066360357d0a21f9b443c96d7c94f35799c0821ad9736691a317d3d9744bc299d3c770afef14dc8
-
Filesize
5.2MB
MD551256a14e22acb8a61da04385ff2d59c
SHA13cfb100827a126b8c8e8a1564093e328adf0fe3d
SHA2565e42d43fb2ecfd7c9db339ebaa31c0eb6eacb65210f0e7c28000126966f0b83b
SHA512e31ef41133eb60fa1e857e5cd909f10af53bcd11de690c1b3592debd5db8e665ae2bb5dad32b4588def88e91ed04c484d34a664d749f7d08fa3da447d4ebff4e
-
Filesize
5.2MB
MD56faa3280360687df47b880f7273d4516
SHA10fa0cfa4ee1219a4369866ea201290115df7dd9e
SHA2569217d6bba4e43ae2900f78060454c9e90d2e418fffc8a7c18833752d08235cf1
SHA512583518789aa6138ff6954d2bf5a9ebbae390083eb43f0adc2504a41b3b9643c5c32de6e463cefe969094d98c0f36d2fd53298a3015d738644e50915145803c67
-
Filesize
5.2MB
MD558d26f370bda042a3220272dedaaf3d4
SHA135b1bad67b0ee11db8afdd6440027f18a7048438
SHA2563d85af6509402e7eb51c6cc14dab8b58a696f9d2b7bce138254d034070b2679f
SHA512289b67caf1ecc8c9e5bc31e6dc013e6c9abf762d5e6a98acd382bb10e9bb00de7bd4412de06ea35994e4f5219c76e3f3dab19fa948924c7a581cd823f40ba030
-
Filesize
5.2MB
MD5f3a51f8fed10ef74845d85c3b9d0a19b
SHA1bf2893cedede5d2d9e45ea9edde81dcee920c79f
SHA2569162cfb97a396ef33c9dd06cf14a3365e4d6c48e37214b1e618881b397ff9740
SHA5125863b64042d17e81587e3291a8759272031a8fd373d974b673d1cbad9fa617080622c4df033a87a15f92113328813d7a6669b08dd69fb5831c7b7329b7f09c6a
-
Filesize
5.2MB
MD5a8b6ac3f074fee1258e3c829bd51a159
SHA14896f661c85f751f8d5700a8e815f7fe4362c138
SHA256254ab0fdb3555da2a8e6a6113ea960053dc13e385502bbef802e19f1748e2cda
SHA512d727cde943c2b89b60ffe1f9e6fd54d4950417247730822083f44614a4e607af04361dcee486e52b5f70b089e20a800f4a23d7210ed4eb3c07e3fd317b37a4f5
-
Filesize
5.2MB
MD5a942c8871beb9b1c18d53cee8c8c8032
SHA1936648a46574845bae03574fb0bd5f3c6fd158f3
SHA2562b340f25b3180bc3dd1b655d0e25bb510319be5e898e1c45bc2f0da530810adb
SHA512392b1b0815cc0bc6dbdbd0ad994c1ff38930c92784d3dcb552542e02f59cafecc4419d256b9f0337860542c361e9d2e002be8d2ef64b49adaf866e5b9cacbb8b
-
Filesize
5.2MB
MD5a86a6b90099cf00838ea45c72f56609d
SHA1ccdbcd72e8f2d0e2d13ee408906e15b4c7c921ed
SHA2561f86fb88e35ef58e89cebecd1a00d9c7b6deeee19bc697f069ea381c919df941
SHA51215cc26d79d14b46b14e65dcd098a1caadf340484409b4163c8f2c233833d6b90ed616ba733ec174be69dd7053559ca3a8377b271889a5ca3ce3781be9a418525
-
Filesize
5.2MB
MD58bf7da53b118418a2d7db70562e41b38
SHA1c998f81ecfc965c2def59a408ef98645756e380c
SHA256d62f4b9b10713ef592029280034a95697f25fe97953c3f2a996a2ec93b465b07
SHA5123422cb17b289373249e723ca48741bd03ca2d71f4ec17395129aa9192e2566f1d43f25fdaf7de8dcdcd1018d1999e5670fa0db91ffc3ba95c960519691375572
-
Filesize
5.2MB
MD5695be135f7fc16f3d8df6713f7905944
SHA178adf3229495a6105a29ea7ad110a7313e49f84c
SHA25642dbb79b80888b8666d4cb1a55b591627f3960ebe1b9ecfd7bd16fb01fd98709
SHA512c445f9f74ec48a35c00637828035ebe2a7a0cf3ff56945c05634ed92c2fe94dee8c85251e051a54ca69f46f5ff671b1238dc8e1b2fe1de8c186f71991aa66bc2
-
Filesize
5.2MB
MD5fb16555f2dede8000f1f75deb37004fa
SHA180671b6cd0984bed791b6b060a71693a660a1c10
SHA256f5c7eb5f3037f7dd5f5d1f91e98a7ee3dd76be8bddf9c27c7d5dde8d9bc32377
SHA512a00bdba3bfdd0818dcb260ca0378790c44f19eb17d634622a66fa33b6d058d92aea1e353f1d7231d501f2c35aecbb8de12a17cfc75c45d869a77f9db550d4238
-
Filesize
5.2MB
MD59d53f948d50142e2b3a54b292a0b544e
SHA1f3bc49e61bda723568174c472b05f547d8bf2b77
SHA2569f39dec96d77df142dc9c4bee352f36c8e9d2a8fe9fb155e63f71101d18ab751
SHA512eca1104fd27d726160a7ad39b366f38f58a0d6708cc7371f6635b03383bc5d6a8671d4fa4ec145195c110e0fcd56e07dc84771253484ab2737703fb6437bb7c1
-
Filesize
5.2MB
MD5b8fa7ef1015924742692f6307a94e101
SHA12945707aed8b18fb6c55a86cba282b18dcf389c6
SHA2563592b8f525c83f97522feb54b1a7e1449f5427046d5cd67bc661dd1a14b63a81
SHA5121c5035b51efc3004eccbc49eca8961b0e04972ed9c580dd04560d50ccd353db53070c768a965026ded27803789e2f66cc6a027de0ee81e1fc3efd2de94b0e78d
-
Filesize
5.2MB
MD5d219ac6a6453a13e1e505f35cc68f069
SHA11675c48c094e47601e06c53f7a55172e195402d2
SHA256ecc65ebae0cec3d1565365b974e6e788c89123f0a9e235f915c7cfeca9a5c8d8
SHA512cd581352dcbb48918c2bd1453c8cb338962eafea31e24ce9a4550727cca4e94fcf156c43702140128ba9e59f6c5a9566b4c0765ce417cc5078607c74d04a77f0
-
Filesize
5.2MB
MD5aff366b56ca8d210a0b45d0e80355bcd
SHA174fd963fa53c3f43a3fbd591b47fbe120031b298
SHA2560e6a11d9244bd737978c616ba655bb3a4017c852d1e7f0807d96556800547766
SHA5126e052113fe2a3fb07a108ec6da8358e8726ddd9bdaa0146c00eef6d668eb9ec2ba153d496716b7b7cec697d46f76c5ed2f9f662a23f2fbdeea49526323a6497b
-
Filesize
5.2MB
MD57ac6dac7ca5a81b7a5a98319f2e62de1
SHA1290d9853c791374a778e8a3d4aea4bba55b01218
SHA2560a9d90ea8622bc3e93b22feda4b315b5c585d21d0bc4b1a381ef8bcae582cafe
SHA5124d45f474cab8d31462dedf4110a3d7051d56df01768fe868b52ef0bea205782d0d319ab561cf603b42615d61a97dade4936f8551c0f41f2dc220adbf77766569
-
Filesize
5.2MB
MD52c921cce4419dd3b8e415bea2f205311
SHA103ba690343a6092a7623580da2372983e35e5f1c
SHA256c1d37fc8777318bde66f25671214c2011698e1e67a590fb88ee4208218e20384
SHA512abfed1a39e45ba999d3893d1d6167cdad0b8ae3af0d258b3a90d0afcb582634203e09afc6345eeb52c67b6798e7dc6de908f9fbcf22f9fe56c48d518f0cb608f
-
Filesize
5.2MB
MD578581a7eb679301b6c76e29a4ae0ba64
SHA1e63cbd4f08a09d3457f43d061813ebf0adf96686
SHA2562957c92225017175e28ca2d3a0b4c0e75d056025c85d7a5cdc0fb3923b099a6c
SHA5122c6f4f18296465f41c8971ada5050db55692ad69539fd4e0c2c18477322e1a16dd3bc44c0c70263eefdd7caa663ede978340448356886f216be2744da9d06691
-
Filesize
5.2MB
MD5f3851eb4e55754fae6c5c6aec705afad
SHA1a91c1db71b267b29147df4c54f89307aaa961123
SHA256c42a6b91fc2ecd39bb53e5196497392b7610144d5bc8b8ae68dc7804169986b2
SHA512d57cd3b90c1d0d53056f5c739326e5c62419c8cbb24521afff082dbc2c0d7173f4887d2021b1fce06e48ae64457c63198ef2a7b6dfd50988a5283ddea7e9aa6c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB