Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 12:50
General
-
Target
2024-12-17_ea2aa2cec88fd2ca25dc41cc026ab413_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ea2aa2cec88fd2ca25dc41cc026ab413
-
SHA1
dc1e6c4d1b102df1d692f5cc095f04d73d2deba7
-
SHA256
4b607402f1d0e60ac61197c7c7f8d5f147abfe047ffcb2097d6c2a1931759f21
-
SHA512
19b127eff1e265d35a1264c198876d57446fd96e8ad06434f6160700ab27f6d83d403707c0a57ef8ba91836ecf8536d64014cd9ac541703da2b648d4e2beeb0e
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBib+56utgpPFotBER/mQ32lUF
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_ea2aa2cec88fd2ca25dc41cc026ab413_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_ea2aa2cec88fd2ca25dc41cc026ab413_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yGfrYfJ.exeC:\Windows\System\yGfrYfJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AUieVaV.exeC:\Windows\System\AUieVaV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GNSocCK.exeC:\Windows\System\GNSocCK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xTACFBL.exeC:\Windows\System\xTACFBL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MRPsKFD.exeC:\Windows\System\MRPsKFD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tctSyxV.exeC:\Windows\System\tctSyxV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FnnzTjp.exeC:\Windows\System\FnnzTjp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CfQaBfD.exeC:\Windows\System\CfQaBfD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CluFFfD.exeC:\Windows\System\CluFFfD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EOidjuS.exeC:\Windows\System\EOidjuS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\siqYPOA.exeC:\Windows\System\siqYPOA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RbyvLDK.exeC:\Windows\System\RbyvLDK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sUJKGfR.exeC:\Windows\System\sUJKGfR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yzKnAvc.exeC:\Windows\System\yzKnAvc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OGFrltp.exeC:\Windows\System\OGFrltp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\smumahY.exeC:\Windows\System\smumahY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eLcBLoB.exeC:\Windows\System\eLcBLoB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\akAozjU.exeC:\Windows\System\akAozjU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XphpkjT.exeC:\Windows\System\XphpkjT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QKrGdHH.exeC:\Windows\System\QKrGdHH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JdNqozk.exeC:\Windows\System\JdNqozk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b61df9e49ee82b544f129a010df3da01
SHA103192b402a5444d22fc8b1508adfd6df6af9ce36
SHA256b4814d63486545d587426df4c994bdf4daa840a955a17871fa8a2397d1b6ff4d
SHA512ca135a859878b48515118494feda6b91f3a85819b5d0d40005b17dc2eec3bc9939f64bae87492d4d0607801311e1181ff9c9f0bcfa5643fa6d0c7fe5442aca7f
-
Filesize
5.2MB
MD51922cfb0ac1b307c7f344871ab89546a
SHA125b1acd7a45557fa42842666f4a2396df3f50c92
SHA256763e574a6c28f05ae59d68793d62c8e2fe33a248a65b65f99cb1fa1630f53065
SHA5121785613e1b61600104d6691e9191c829a317d8ab785e0e61fb71b74513e396d910cc3a91af002f189bcd32ee75504dfbed51ccd6cda6ffcf0c67553d80a06b51
-
Filesize
5.2MB
MD56cb056199821579abcc523be1d6de82f
SHA14a3ae276b4bed7ac66129bc3d3d43e695eaeaf2b
SHA256af7a5b8ccf5a9b6931c138b754db2a009fe223c2b6f2ab1e447089846bb0e597
SHA51298b21b17b10d8c65a1081c63062d8fc3b230e04ad481243ef547a6cf70a209414c417cf0bf9f1c553a4e07b57ef0db245ff364fc18263fe82a102f8f882ed87f
-
Filesize
5.2MB
MD5de0e8d20ccd1457f273aebf62980c0b5
SHA1c7c0cb465872099efb13d77b14d5bfd77631366b
SHA256953451e96fd51ff456a3dcc63ae4dd41fa29f01a3c7758e0c8c20d16ac5c32a5
SHA5126d19d0ce724ad2e9f9fee56a3148d801147480eb3422699b4039754b931ba56b5c8ad772ed2440cb9906b3897fa57a6e8b37361d60cc39b530fba4565efa864d
-
Filesize
5.2MB
MD5db011e02a7f065cdbdc0390e14e3dc2a
SHA1eb6f40a772b4780636eb474d5981498ab7bd313c
SHA2569f8d73a7eff16a9496d6b2647b55ca5cae939601e3308f27d6cd116fe387e7e6
SHA512a0c7e4aba7fa90acb7e7cc3368bc59df7ad7c0e24e149ab3dfd379468b67ca8d95ba55d4ca63731e3719755b1b73713ef04f2b4e38a38f8b7ce4a47d992dab28
-
Filesize
5.2MB
MD59c8089c2c0af4b237269a25e668a6ac0
SHA14c0ce1fbefd69db24b5289e249c401b10938a47f
SHA256715a3a117c2cd00721ab06ed81b55d325f51bd99788c3ade52020d9881e77502
SHA5124b2acb16d120daecc59524d52c33eab0911236cef2ee374135cc0edaccf02b922f845b6164489f78a7b0e1c15c7bfb5fa3c699eae82f746b0ef6b076cffef9aa
-
Filesize
5.2MB
MD586514f6eba1e546f387dc180ba04cc1f
SHA1ea923fe3d48991ed79031f110f90571bd770d0af
SHA256c3cb0ae815b7297d3582115ec9b24b0ed0bc714ebde9fdc4b3e0442784bae57f
SHA512c05b3d3470665d2768eb7b9e2d455cf3370dd58ca21d7c97ee9b88878fc6d9f3772699bec2c1b8dde9a6bc664eeec022b565d7d3d5e7a9a1ae161b71eb767f5f
-
Filesize
5.2MB
MD5c2a2d20790329dfc85584c56db4954fb
SHA13e710699a261344ff478f2738dbfbb536a3d84ab
SHA256978872e96d91625f810dfa6e01ae232c96e5499ac1cbb51af9850f16bf649630
SHA512fda1182f050b8bea2447e43167cf39c903aeb39cca6bde8e35832b0ed32887157a2db178a0c887bbb31b849904761b468f229a59c8856e6455dd73d7195828e5
-
Filesize
5.2MB
MD5c0c69ddd408667ed99cf5c72f3222f69
SHA118cf4e27c8520a1833b9189a5da246dcf0755794
SHA25643d5b8a446c4251a41b58c7778a2c1e8b73e3637d4d355736fbccaaf1b7eefe2
SHA512088a9067ad1c9fb06b215c129b96c4c148d38dd4295eb17b1a52fe10e830d0b1eeb5e5810b21d16de310291082009557c2a25a2993a3897dc5320fa4fefdc981
-
Filesize
5.2MB
MD51b6ce88a173716e9c8bd916aed44cf7a
SHA1fce56cb545713a8c78eeef5937d11a8b7e443f68
SHA2564d3d5f8c007bbdcd4cb97306b3158f9412641020bede6ac13fc81549c3c5ae80
SHA512c07ba744e4a5a878ecb6545641d7898648423c247b6d65c693c09cadcb4225145a66c12212b66ab934ba76a255f2cfba2877a556540d0a2c6d0fa5916f705c3d
-
Filesize
5.2MB
MD5a0a5fb1f6849d0b1860dc0f47435331a
SHA19fce807b8206a2ce4f9644b5ad83eef1688d4e06
SHA2561981f921cb1dc39a6d730ee8f0dae2a5e126744312fd5fc8351744339f2513c4
SHA512362686d78f44eae1ffdedafa5f7d105e06491426eefb8345f7e43e74356f240b3e06318b3e3cc122e48a10cc327986575fcd03040d9cbde206eab202d6a76873
-
Filesize
5.2MB
MD526fbbb03a2482ef75f5401a4594962c9
SHA183852f5bd6748e25ed4b3ff9b3c0bbe331f3cf37
SHA256076e7e7e7141f34f6cdea9065e60d09614d8a7ad896fa3108f38af60a667c726
SHA512bf53432d08b6e492d5bb9068d49fa9ab051506d05d6841094f10d71b66cedffbe26a8a529d92b7d1ee47e082d4e5f86f218aa5b3241fae537de61e4973668b33
-
Filesize
5.2MB
MD5482ec67eeba921df622a7b406f5ece17
SHA16b868db53854cc4c3a3a4419f033a217acdd8d89
SHA256fa338dab7dfae1eaae4b649a552173fde3379d31411c74c32e2aff8bb978f740
SHA512076ddf910774d8fd83d9bdb10460ba1b961ec630546d107afa1148ab01de5f8530754048515688e994b58766a06cf317b48c3c45d5cd4399567a90589b39f3f8
-
Filesize
5.2MB
MD5b9c308844d0e659304b5ee5aed8e30bb
SHA1635062d2525d6d5210392e9ea2b9434406fecadb
SHA256dd7567e372fd3e1deacd7bb4f4a6a05698c8c11474160e13652eb5d10b3e96fe
SHA51289393affb54612d89dad6469d281fd1c31855291cd8ace20536403793ea64e078e9cf3f78326b9071d484121c331e99c4deaa420357222031cc7f6a6b1098e1b
-
Filesize
5.2MB
MD5d152fb74132c833148a12c0fadf00b08
SHA18d400bb3c76644a7ab590a99e471d32b99c96e90
SHA256f0fbec1082e9e19101f1163ab00e067c06a29faea56c44db804251e3623888f1
SHA512d65f160725986e4536ff245cbf64489053f9932d970b9e6f4bcb573fb763522f10c64309267e9aa9b399623302ab73a5bf507cd27654d11f023a3a1121449433
-
Filesize
5.2MB
MD5af9eee2ddcb1fece4bc12a5f7a4aec01
SHA139f977cc74727773d17e598a3717e8128656ffcd
SHA2569eb51b259c06c5907abd0130958179560a746c0dfd45c319c7cf20a039092e2d
SHA5129caf6d4d57076dffc639d40446d59a11c9043087864eba543acd8b1d8d149d441b26058b153d39779c71d572256767fbae3ae30b45f884f1391203eeb79f0645
-
Filesize
5.2MB
MD542805ec61ce434490db541e27afafc04
SHA16176e592fb001e03b952cc576095b6f6c71bc1d9
SHA256ff017bb802d17348222ffd836ba247f2403e92c6488806bb8463e64d676d434e
SHA512788142e7ee209c114c854f81b3d7bbf765d1156784d9e9ecb418527a53bf01811691cf162bbfdb47ea0f6c75565b82c832f0dc7cc995a27fd33775843658afab
-
Filesize
5.2MB
MD5b2ee12b61f473bae9f64d35211ab98a4
SHA197c738f3f4e59090c241de25fe1954ac6c41b433
SHA256bbb9ef151def19bf36e3b35180f3061ad1f9a4f0aa385467be72b22cbe95c221
SHA512c1fe9afe9ff4d2d1da47ba5b4d0893bdf17e97591efee9fa4479ca028d6b9cbe42d9a526917b7993fc47b0ce23b5a39aabe4f1943cf126117f88e285810fadba
-
Filesize
5.2MB
MD5e874bc55ef2691e4c822d1307b4895eb
SHA1f53f62937537c5e8c872042ce3c0ce282c5cfd4e
SHA25633e4bf56da66d94a160302ee28f346fdeece144d2631822367ca48a0d11e3901
SHA512e698515966c88b96fb04a104003ebb56c509e615dc6a0bd2316beb1bc65d9f8c49b9959024a2b304731b6c000a704f94c3cf9cbf5021fb30da29a02298d4b0a3
-
Filesize
5.2MB
MD5b4d033fd66a07423a61fc252654c5354
SHA1cb030ccc31d0723231b8a3fa37dee50db97bebef
SHA25603a5ee943321a6c5636c25d2b96a495d7209e3734a3effa3fa3205a981f91121
SHA512e21388694e56a0d8a2d9adc1bce3ffa733951823da14a32688c17f36a2b89101ad2583825edcd727e8027364d8d4731a3c3cef9a184a91f70664c78c2b2ace5f
-
Filesize
5.2MB
MD53da9bdf4d9bc9f7895b98e16f4d3b1b5
SHA12024e93cd8a48b8ed43d73d2986e71b1cc9953e9
SHA256648d80102ebaafe5a093e41d70f9664e5624eff0d94eb57305522703a24c86de
SHA51255810e75d11c7153fdad12890f977520861b89f52e4fec2463baf12d1cf24d8edfc6498d0653a7d6b040c72dffe9440a3bd84e6cf50f62dd438b13d45f5c7cc7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB