Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-12-2024 12:50
General
-
Target
2024-12-17_ea2aa2cec88fd2ca25dc41cc026ab413_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ea2aa2cec88fd2ca25dc41cc026ab413
-
SHA1
dc1e6c4d1b102df1d692f5cc095f04d73d2deba7
-
SHA256
4b607402f1d0e60ac61197c7c7f8d5f147abfe047ffcb2097d6c2a1931759f21
-
SHA512
19b127eff1e265d35a1264c198876d57446fd96e8ad06434f6160700ab27f6d83d403707c0a57ef8ba91836ecf8536d64014cd9ac541703da2b648d4e2beeb0e
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBib+56utgpPFotBER/mQ32lUF
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_ea2aa2cec88fd2ca25dc41cc026ab413_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_ea2aa2cec88fd2ca25dc41cc026ab413_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BqzWjFC.exeC:\Windows\System\BqzWjFC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UDceXKK.exeC:\Windows\System\UDceXKK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pEtTtNN.exeC:\Windows\System\pEtTtNN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YTeVacE.exeC:\Windows\System\YTeVacE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cAMfgfF.exeC:\Windows\System\cAMfgfF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wlXGMfh.exeC:\Windows\System\wlXGMfh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PQkbLQq.exeC:\Windows\System\PQkbLQq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UmJeGph.exeC:\Windows\System\UmJeGph.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EVuUmxF.exeC:\Windows\System\EVuUmxF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Qpzusyv.exeC:\Windows\System\Qpzusyv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PuWxCBv.exeC:\Windows\System\PuWxCBv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Rtulrdt.exeC:\Windows\System\Rtulrdt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zdZealL.exeC:\Windows\System\zdZealL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aEPSGaq.exeC:\Windows\System\aEPSGaq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NmqogIZ.exeC:\Windows\System\NmqogIZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CSbqiQb.exeC:\Windows\System\CSbqiQb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mMikhKh.exeC:\Windows\System\mMikhKh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ggeoHIa.exeC:\Windows\System\ggeoHIa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IXZBaCk.exeC:\Windows\System\IXZBaCk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fvZkZDM.exeC:\Windows\System\fvZkZDM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UXUNoKB.exeC:\Windows\System\UXUNoKB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58d1eb5d314c26076d8097a7974251e58
SHA1c19abee1438ff786d4d5e45e864c805c47e822d4
SHA25682719642a10577abafa92de7ce0b2c2eaa20b9541ff07edd1a504ee5dc11a4a9
SHA512464218b7e0fa448ec386e9974182d305dc08ad3d80bef1e7a425d6bc553d3c6d108a26f34f4c01df27c7bc8fe1ef34309f3a5704d7b7ac81eec63577065c9a88
-
Filesize
5.2MB
MD5cd08cc0515cefc39c1dce4e38455e720
SHA12f5d97c28ce497d752ff7179c2ac68e2b60fdfac
SHA256f4ca5a7297d24cb4c16c74d1065d32dc91a8a3617fcf315d5bf5482e39e807a7
SHA5126d9908018378d62cb63bcf079f3ee811262def81d6c457626bf508633ea062ede0daac985ab20dca1c53220e1c100b9b73909d6b07d2868e54e5d951d50c4d1f
-
Filesize
5.2MB
MD59d1b2a74864f1d5223dacb757f5ef674
SHA12ffff910e8a900cef999585fc116652722eb2a56
SHA2567424e2684e51879f9422f317617cdb5f5e36c410707181715bec70f3eb76ca9d
SHA5129d8681ad9f1ae57eae19bb703277654f77f6086e8f8c093464801cd7f01a810f3bd8e5b252013e48593b93069eab203a37bada7e276e31d2ec531405803ad078
-
Filesize
5.2MB
MD5c362d34e136deb9b0cd1ef22c650880d
SHA13f1db2eef615aafd609a7decd549fd1d1d9f122c
SHA256015be3fce8da1a17ebefac25f6cd03552382b41edf74e8f290f458a118dedd1f
SHA51203eb5aab2a666208d13d5ecd8040d7d1c918ae11c9ef4297f21414d1798776e62ccba10a1859129ca1e7d290810faab64130bc48451c10df70b92d5c0f0ef7e4
-
Filesize
5.2MB
MD5e6d287b503679686eed0187bc703f229
SHA17dfca8f96572bda8a2fbf5ba6e4da9cef9dc7419
SHA2569e6e67aa3dc283da553cdcc2b8525b40bdbcc8d275ec88e9d525cb642a944b40
SHA512204414a248749bf33f4db46c1c110fe92891669191e4f96fbf44b82e851e7e37994fb99b0b01b6c49fdaf6185743c54651fa875606a0829977f4acde28fbb3d0
-
Filesize
5.2MB
MD51b23a4149fae7ad0d65d3e6d54a3be13
SHA1e222c3b3f2a195397b9bceed6de1ca630da3381c
SHA256e7c5ea04ba077c21867a073f0d7d04e7cd0dee29444c9e8987423991c42441cf
SHA512b1e601cbc329458a6dfab961d38c02ce56940ffb24a6722233b270b6a85fe3140f5cd8256f113699a1386b34a8295e6aa281dd9baa8fde275417fd939e0daef6
-
Filesize
5.2MB
MD519af049cb0bea7859c718eb772d85942
SHA1235ac39b2e3617f49333c0e63e263cba656b31c9
SHA256d32122bfe0cca16972e1cfc661a6b27c3470f7416a7a37569d752789e6f50225
SHA51266fd130b191ad9cfb1e0651d139cf21b4f62cc6995d02eaee735315adefdd28ddb9250b5680f46f141fe3f32fafd7c153b241d49de709de3ac74c109577d5eea
-
Filesize
5.2MB
MD5dfec9b46e5466a843a6ff77d944303c8
SHA117b04b89c6be7f60d1440758e028ae3d9ee2d847
SHA25698c5f775a593ede7ffab6ad29cf29805aeb2536b60e6394ee09ac87a0164514d
SHA512df34ceff0b2274a550df0ecb271fd09cf23013846082344e887e4ea4d2f565dc3e5ee205e3c48c301da22a285238b668d6853bb80ba860be452679c3208c2c1a
-
Filesize
5.2MB
MD55327f039abec22260a9341bac13139c8
SHA1697bb83c7eead5a761cb57277c424ea278b71bc6
SHA256860508b0fc683f01f8adc3be89ac17646150ff5617d9c9c4d051e64f297f5554
SHA51237a51f941939395782ef56c7d4b1af91d2d6c06a19a2adf058a2a1ee4216baa13bcb84da994618c628bb79b4785df69d56e1fc6cff73f7a1910e31a0a2962a6b
-
Filesize
5.2MB
MD54dd7d2a46e68dfb8703d85796bffbf3b
SHA1a9998ec61db2c6eda3cdc84a3a2ceda6290ff9de
SHA25618b0e16ea17f2fc420a9e4bfefd301203bf74bfa205f1c2fe006e2a4c007326e
SHA512946a55851aa37b141f9ca787537e653d1bd846e3ad9668ab503b459d8b8c871e73865353a5b2272a5b97bc6b55ad5eabed3f107e6133ee271a4ccac4bc15c08f
-
Filesize
5.2MB
MD5c09d3cd2d0157cb396b6cb627bcef775
SHA15e2b511246bfe30fc8307f2a7bd972d2a3c269c6
SHA25614ae95cc12302d9228fa700de9811960c6731badc17c717654c239f329055cb8
SHA512050eeea6461a24cbab67f7b1a5e83cd822c89cf71b40a586714b2339347cadb6ace61acb26be5d5f9c2cfdf0d9f9f29457d317f5c68437a4cfadcfc78758bb8a
-
Filesize
5.2MB
MD5c8a4d5fae7ea30c8d7c8d1a61f737950
SHA1901583f964548bc886aaddd2e599714213c6d8f7
SHA25642296fbb36cfb161114555fc33b8b4b3a7766044ad40ba4393ff0ff5e6f4f63b
SHA512f56b0fb3fd949c87f30bb7b415d22b81c972ec6b4b97199a512a16070f2407ddec9903b76d45ee717c1b3f7d38816d836186f98173c94573090f08a6606e0f56
-
Filesize
5.2MB
MD5de0348984f3470393f4efa6d36a1b01d
SHA1a435923771d85a3b8e7720cb0e30717969ff2454
SHA256d9269c5ffbdfae66ecfc17547d343d137a2e612df1b3226460f166a2e01a7530
SHA5120feb1f66ed90a67d10a7df2423ed09b9223420989705496f35540c943b3516f5ccc84d17697a161fc3db5419a830433fbba1897f1bde02d5b56e2661e9e8ea37
-
Filesize
5.2MB
MD58e3d5f3e666291f29d1298f2f68df7d6
SHA110fcb6127ad87a7fbf37fa85aa1e9e527475da5f
SHA256a4b69808f49f42efa17b50facbf65ef08ecdb5b7f738b285d55b547cd0443f29
SHA5127de2ac65349f28f7729c2b115ea1d4257783d7b32e69d8fb99fdd4556af211ba45a889d421e0b0751086a9a7881aec2f2afb291f0c4b3a76c2d3406e98ba0993
-
Filesize
5.2MB
MD50c0da46798d714dcf74274fdf1c268b7
SHA1a8eb4d032323b18c3a38503b2775c32c7be15ae2
SHA2565814ba84aa5db223f7c86f6ca6313a59cb473b522580d9a155715f541089eac1
SHA512f6dfdf896743135118e9f2308ce048d0879f6025dabe0e4c57c26b79140b676fcf2488d3090a85aa1645cd2251d8df957602cc49cab16ad8460f49dc4eddf980
-
Filesize
5.2MB
MD5a30379ecf0451ea52986f27f6fb97c52
SHA1cbcc3bbcb8f32dce815bee64601f883c4c3647b0
SHA256c27923494df3b9b2e942478da4e801098705b20ffb8397c0162cd95b5970c48d
SHA5125adc82a3c251f6b231e869150fafde9a4b18d45c7b67e5674d85e9b2e3cacc478fb6d7af6f2cda065b3db0306e33c194dd0f345a52a5e4fde2df0f76f5c1e354
-
Filesize
5.2MB
MD5c6df405b2e604792364d24355e0de205
SHA1771b2f2dba970af760693d6d28d963313873dba7
SHA25653e51e84fecdbd83df06f86b150e1dc33cac6483cece1883c020d2031161aee8
SHA512c72ea75c67e2b121f036871892b9e463aa8a366943cab2bb6d03e1a1ab683f03f6ed5e3f4b3d296e47ca2a66e4bfdb672df2b764f2a89b9f3e96276f5f59ca7c
-
Filesize
5.2MB
MD54b32e6d142c0f0f39c35fc399922a8d3
SHA1fb752d908ce366a4de37947b88b0e1e506db07a2
SHA25655305b9011956dbfeab77f2d0e366e48adb9a11c717f4ce09a9566d31e5fb535
SHA512e4fb41931d9bbc438cfdcb79b14f17b618eb7322f8d2b9a4d67641ccfda0e73658c92bd0e04cc7c1abf5987a6ae0b38035635d0273fea789571fe2ad06a9813c
-
Filesize
5.2MB
MD5dbdd63662a5935f56e3d6537ee8e570f
SHA1fee065aae747c7b8e1c1c3a726d58edc239eb60d
SHA2567d7e3aa9308c71d186bdc57a00ed1e572c58d85409a76d4c419fd52856dac74f
SHA512cb2809345be7d74711fb78eb9e70d56b414080503c7bcf424739ab4c4754fc6b8c4c906642340b7b67d008d03aa358eee3ac3ca59da98e20fc4b001fab0ce07d
-
Filesize
5.2MB
MD5614785946ecb9a3050eea3dee8a67146
SHA1aab0d0558ac0115a7128cce491f0dcc09c465fd6
SHA25686313479f80bdf9d7acd83fe310a24b757cff4a6a189845a5a282dadccd24196
SHA512c31ba960b8c5fa830599ea61e4147ad6021e24fefc60329c8b19703a1458f0554f8ed4a48d6f13e5ff48c0fc880d0ab76445586b1863be49bed8743ad14fc133
-
Filesize
5.2MB
MD5268c51be7b2e0451a3b9ba313ade4038
SHA13130c8b16e3600a1785836e16f49af9424ee4d1e
SHA2568deae48e785deb9c958a579cddf088183a2791b38464c055b4d7234140392a4a
SHA51254f5b359ec8a5ab36eed2f9e873c1bc463a9dff1036860c30ecafdccaa420846dc5ba3cf1ad2ac953b9036b2d31ba4300952ccbe0a2c18be125b8ac05981b478
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB