Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 02:31
General
-
Target
2024-12-22_65aa2fc2828856ec41aaad8375ae46aa_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
65aa2fc2828856ec41aaad8375ae46aa
-
SHA1
cc07ab21f31d6470088818934513763e11405763
-
SHA256
31513725d2fcf3e7cd771bd4231c5acf26853afe5ce692b6bfb228b05368dd8f
-
SHA512
37bb6b4bb4da7c622ca9df20e661925d9a046625614e204be206977ec16e29a192511833f3c47036a4dd5d382a8861c3190c393635d14059c881e7a62379ec9e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUF
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_65aa2fc2828856ec41aaad8375ae46aa_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_65aa2fc2828856ec41aaad8375ae46aa_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DQayDsH.exeC:\Windows\System\DQayDsH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YhJLpwx.exeC:\Windows\System\YhJLpwx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ztQCrko.exeC:\Windows\System\ztQCrko.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qjyVkdY.exeC:\Windows\System\qjyVkdY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dzWNkBC.exeC:\Windows\System\dzWNkBC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jVDDUTW.exeC:\Windows\System\jVDDUTW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TZnBrtS.exeC:\Windows\System\TZnBrtS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nAZhPDQ.exeC:\Windows\System\nAZhPDQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VIDXrLj.exeC:\Windows\System\VIDXrLj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PIFXLNI.exeC:\Windows\System\PIFXLNI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EEiQLal.exeC:\Windows\System\EEiQLal.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qYLAAYB.exeC:\Windows\System\qYLAAYB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EUzLUiW.exeC:\Windows\System\EUzLUiW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TfDDIxK.exeC:\Windows\System\TfDDIxK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\brEVRMg.exeC:\Windows\System\brEVRMg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pvDHGyn.exeC:\Windows\System\pvDHGyn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PFgKJhu.exeC:\Windows\System\PFgKJhu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pSYDvVz.exeC:\Windows\System\pSYDvVz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pIcuhqx.exeC:\Windows\System\pIcuhqx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZGeAIgj.exeC:\Windows\System\ZGeAIgj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OZnGIYN.exeC:\Windows\System\OZnGIYN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5726a83d7fd64e82e3f15091291c3336a
SHA1915672d9f267e7ab6e7d51d8abe24b89bd7cdcf6
SHA256bb14791e2f16a6147f6d8e6d778d1aea910846a094f2505efdc7c011f2906920
SHA5123e9300ca617fd090bc3810df6085ad056a638ebf9377d69ef634410722f9d16faa9892598d95a0fec5356a10a6248eb139460103333104547e0e6cccbafe09fa
-
Filesize
5.2MB
MD5a44a4b342b681084fd26c00ba2680f91
SHA1821b32412b89e5626b43b6214a42e663f6eb4b0a
SHA2565c99eca449c16cfa466c75fac1e01ddace32340a7f89f00265a8db6650933cf8
SHA512f982c7cc8f52827ef364a1c2780e2c7d08b16010a57eb832cc013c1d49caabf7139ea608bcb69d8f7799ea4fccaf4bcfc4f9386de52c494edd89a79c7b23afc8
-
Filesize
5.2MB
MD513b4f17ddd962f6a504cad59af7d2093
SHA17cd70bd1382c722fcbf4492a477d6412d66a1e37
SHA256f2db78e098cb3937709589bc6fe2b51501c54f02a956f8e218b1d4ae741a97ce
SHA512a2dc66b9a7162e5e1e9b2918eeb9aa0b42bd9272dc7621fd14d7892a7296758e30a7fe26d6236ceeab895ad6b868c7440ffbffdd17d7fe04364be3334a0447bb
-
Filesize
5.2MB
MD5f59782f5318caf42333691391dcc9404
SHA193f225a86bac03e583efa3041c0de4922ae97f1f
SHA256d4d9b1461ef51128b29c61d0d1cedff7a9c5d8a34ee22ef8191bf6dbba7b7a4b
SHA51235ff7b1513b5efee79959c74ef29d6ed00309f3a23fb52edfdaa4c4286458c2fe434f9066611d17f7b2920e4074f37fd09dd2ed4c71f0426cde17099d36307de
-
Filesize
5.2MB
MD5683932e6fc838dfff9101a791ee52038
SHA1f6ef1a8ecbf8e789b26234890421eee1491e6096
SHA2567eda1d6dbeb7842b1b71253db5a58ca208a120f48286db5d5e012cfdd97ea47b
SHA512cdb32873debfc37af046fcab15ec79ec426caf9e00f773bf209455ca0e72b15b197cc145cb8f82a6e385913aee87f9a8de47ad8d7733bab7ac233c323260b4e7
-
Filesize
5.2MB
MD5ff3ebbd616bbb03f4b125d8c02a82f5c
SHA10e743352ed668f32376eb5a7eba5b43ba6412720
SHA256806793335464edb402c98f4cd4892cfd13c77e31d3caa6ff9072924c48061b3a
SHA512227ba4f6f3c8f592fbab24b46b4ff9563e7a2843ded1e4a6298d247d92d17e16b88a5fcc651848c6da42dd12821955fa2ec960d65570518643431e82244c9942
-
Filesize
5.2MB
MD50adff2e40b9047956792ea16a5988fa9
SHA13d3581a88041c9266eba16ad043abba3c18f767f
SHA256e857d19db3c0cdf67ce17ea80be2b2c50e2d8c3074c1e26d2f9380962f99d1d0
SHA5125daf0d7d2c4cba69e1bc06815173e30782f95d045522295f13a301ebfa3a0429d6bb152d8da415d83638ed61257fbc85ccef8c3fdbb0daaf07d560a57b1d2066
-
Filesize
5.2MB
MD5cc201c9df04dfeaa3377bef9a2b2b9f3
SHA1ea74f39c68faadc13ab9bee41a0f5e223b433034
SHA256033a2e173efea53b7d52cd5cedaee319abe28c0a07209a6038b8c0ba90eb08b1
SHA512e982e992a1ac487c1756f0c75a0910dc628269add4bced34f79d19bad69d67e385d331576c30b6bf210a8cbdea5574c923ce317e93e2bf21824481494563296f
-
Filesize
5.2MB
MD53e6bb8cd1bb76ea0682623c9ea24a9f6
SHA1da96f2bf3dda8e8330c70662c2eb86fa5c149e04
SHA2562f4f964dba60747626c7bb96db23480f384cd3e1f003fc6ac0a23fa40c4beef7
SHA512460abe15b0a3a8504942650e531b5364db98d6d173c018230a64e3408a6959938df4adb3abfe31dbc2fb28ea35175f7699e379545f2187be59141b93de2edddb
-
Filesize
5.2MB
MD5ef9cb688382ee11961a2de5f29ec0eda
SHA1c3287871117a1f14cb27711836e1547adb1ecd61
SHA256ad594f4c8797d1c97de429440d7f71d7c7d2f20f2386cea964c0f52f966fa2aa
SHA5128256091c980a3d6b6f3627028f38aebe9eb67207d600369c967631149abcad6efae9ea795f3b35e1b6ec0e017233d4d14a5f20ae84cd507e2026c980d15b3fba
-
Filesize
5.2MB
MD5c522b11fafa9a0384552ad6c09e963ae
SHA1041a2f1782708bca8864088c34bd122b0795dd14
SHA256ea1dbf415738f89dd340119e66ed45625f0b694932ff77abaadd0c99d21046cb
SHA512b16701a7f58666a5f044536874b4c6ac8af7f65a86d6c2b9ef3095b2a9bdfec14cbef86881788e9f35a2354a3eae3d5fbc1c8c40d61e844f6b9ec6c06d38c3be
-
Filesize
5.2MB
MD5393c5b41643125c3054fc8a299c018d5
SHA10c6c431d14c43ffb12fb17e849e00ef672ecb81b
SHA256e9019af93062c1ce7ab11b2e6365a601546a045315645ae0b4e4343efb7729ae
SHA512d08fbe67261c4c8c2e3a06dfdf204440624a63fe28951849648b2f260e5c1bfffeaad23133439d08529040a40818d6d81ebe422f84a6d119bda08d6a35cf5383
-
Filesize
5.2MB
MD52e05e05fd5f9ca6f6f4cec918f54fd23
SHA13af32d214733b75a5b5222d3351117acd40c9276
SHA25617b4aa2c2c9a487cdaaa9e4ceccef0c1b35fb895b75ea2d5f22e31b237fe1caa
SHA51211a6c88903e4fb41f8168084da82be7a2cf361715365606955f5626fb116fe0dc70558775e36811f5905ba85a14300e7a894c4d4445c2999e65a9879dc2945b0
-
Filesize
5.2MB
MD5a4491e22c93b05857e1259bd89ebc454
SHA1a510757d8c6a92102ddeb3e79b1fdebe580223f3
SHA2569fc9f4b7c1257fe7eabb5c1b1a5895ae8f261b54b602fcebd82a3a9b746bfe37
SHA512b291f34b1805c8680f5a10e51161d50240d40c62f670755b150bb9e4292729575b5b50b81513bc288653dca9d279830d2024de084f9aaf08bc5c2c0a2d6e7323
-
Filesize
5.2MB
MD5a1107daa19bc73d4c1b5fd441597c1c8
SHA1c96a94693a5a8b9e239c2b2f1dfe91937c6eed71
SHA256351e394640ba68a2fcb107b3004f938d80a957d09384fc6100b4e378d6c99bd2
SHA512040a799e9a9a2b4813f016e146a616a14a728bbed4d48ed533d1201663d5914b4071ca36b79d9d5f42e54a8f4c17512e4268f9d21e947acb53d72331adfe16be
-
Filesize
5.2MB
MD507a6df913b914155a63e995254279ae0
SHA13c31ff869b0a2c164ddedfa5b53bcaa7c3aac179
SHA256cac510523dce217ee6d9904bbf6d5168eaf2261cf01b72aef16d29e441e0284d
SHA51279b78e62321fa96e24a9dd730bb2b95839d4478502a16e8f266dfa3958a5d2b05c93de8e0ac81ed8db57b705b55f3e4fbb33f2bfdb566086baa3410ddd0bfe56
-
Filesize
5.2MB
MD52f2a7fe5b5f3c9e8d4bec61d38283cfd
SHA1d72327fed8f516625a54a7f3b962af3f4c642eeb
SHA2563fc883cf4d250e8740bfe4075084cd00918c28c9b7e45aec1543e3a9e4d079ee
SHA512fd9ad6260cfafc89d600793f42e49a808546dfc97ec95efa9e50ab3f6acf9c012ac675a88dacc241685f12eec2c95b73643e9c02f0b63c40cb4d26253ca6685c
-
Filesize
5.2MB
MD5ea2696131f19d60063011c99920291cb
SHA13ff61c32c96b4ecc1a5a95f13f66847d15990b3b
SHA256e90c267573a192ac9faffd1d77f382890eb7ea93c7281ebe7cb7271e3f2f4e3d
SHA51228e905e3c5f005a1e2d8f90e61186ba5ef20df81e724607a3850ac4dca854a7af3ad00109a4f3bb9244b2608d20c726f5936f93bed4b8e9c6bc98e7acdbfb7b6
-
Filesize
5.2MB
MD5774c64a8f0325954ceab94a60d3275ea
SHA173ef8ed96530387956faf883d39b446d201c60a9
SHA256549d04304fb7a821f1569ed0185b88ae703dad7d3c832a11499b9f7ee46f5d3a
SHA512d03a26eced60f189d360e5efaaac3dd58ad8d3f52ef7277ee35658e528efa930bdcc6eea97713c9a9b018eeea0208eb417c9004d458bf2ae3dc7b78c6fd01667
-
Filesize
5.2MB
MD53135ddeeec07148197c27bb599ac3d4a
SHA11b663272996ef78d276d8a5263fa68ed10af82e1
SHA256b77b40ac7cc08f88a00eccd6bbcf2b6390a428b08605d122d82ca38f19989e5f
SHA5122c7bb960156c28b4aa041094c764ab994f700ce8ebf3f35add97f163a196d57e9dcaff38adcf39c3223d01a92954b9a566b4eddb9673277e814f868903c95588
-
Filesize
5.2MB
MD50b07cfed573ef17ffb2e9013a061c6ea
SHA148ea133f8c1563248dd9529d275acfd643ec8d57
SHA25657c6862499c82b7edc8730e80374672597e994525a66341e330bdab8b9574245
SHA5121df80c25baaf802c7d1d0083668f6de3d56d2e7dd59cf5bbc9bdf038fbca396f38510cb04422b5acbc58e68e665195507cf8fd1a09e176893364a0b26683aea0
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB