Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-12-2024 20:47
General
-
Target
2024-12-27_ee12c8a1ca0471fd6ee220af7a22e514_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ee12c8a1ca0471fd6ee220af7a22e514
-
SHA1
f56bf90eacb7677fe25d2dd72347dd4b53b328d3
-
SHA256
a5e4c1e155a70bd1b69a43dac678063fa72e93903652a67476747da77ec09600
-
SHA512
ba394b7c3634874818d0d72dd30a4b1a437773908743ef9a0f9c850e06abcc7a87218b6075db3cc265296380312a912f97eee6c6d2ea8db8ede009899279ba78
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUv
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_ee12c8a1ca0471fd6ee220af7a22e514_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_ee12c8a1ca0471fd6ee220af7a22e514_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dpDpWNY.exeC:\Windows\System\dpDpWNY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZgLkIqG.exeC:\Windows\System\ZgLkIqG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zQINqgD.exeC:\Windows\System\zQINqgD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iesJxgu.exeC:\Windows\System\iesJxgu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CinDXFo.exeC:\Windows\System\CinDXFo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GhgtdhM.exeC:\Windows\System\GhgtdhM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wMFPPZr.exeC:\Windows\System\wMFPPZr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zCkefxH.exeC:\Windows\System\zCkefxH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RThzjDY.exeC:\Windows\System\RThzjDY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CFySWlm.exeC:\Windows\System\CFySWlm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eFamLZh.exeC:\Windows\System\eFamLZh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MSNlvBt.exeC:\Windows\System\MSNlvBt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QGIgrNV.exeC:\Windows\System\QGIgrNV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\diRgRmT.exeC:\Windows\System\diRgRmT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\shCaIKR.exeC:\Windows\System\shCaIKR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PLsUbxQ.exeC:\Windows\System\PLsUbxQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tyFjQAX.exeC:\Windows\System\tyFjQAX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iyJpSWM.exeC:\Windows\System\iyJpSWM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fAXpTLs.exeC:\Windows\System\fAXpTLs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kkLYVPl.exeC:\Windows\System\kkLYVPl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SHAzsol.exeC:\Windows\System\SHAzsol.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c029207f3ea714e6d0d8be4d9f3301bf
SHA1089e33e1d44d1b4f415da2733f0b0f3c8c849757
SHA2568c2b37e8eff0584edd0c348bceea6cd97524e8b60c70fc38b1b699f7203028d9
SHA512f15129419b5ac15807af46e1c5b98f2d0de4d4dd31a65f6df399474b0bd68c65e0a2272f4946799ec6eb810571636a3d43578e54936989e0fb9ee9b3527dc5e5
-
Filesize
5.2MB
MD5901ccb024603874249d0852ab44fa305
SHA1a218a866098e2cc63324b76e79d16585f30d2258
SHA256329600ed53e2514f2c4d7b3484c93e488128134292c733b5b5b0f75468b80788
SHA5125692d308602c9a6881a95ad4e1b34269537fe68a51f2ba9e4ac83c2f4a449acdd85da6ef6a9fd90329e92ae116e2b268083e5a21ca4dbfa3402fda5aa16d6f4d
-
Filesize
5.2MB
MD5bfda57c2cdbbe98563cfa4efea197488
SHA1ee9f9ae1c65857dc2c89f47744bbe39502d092aa
SHA256b6993142e48be12be3c0f2c9e1b6017c8c1b41a32ba8992f132772f14c385cba
SHA51269762ccd0a49527d12b52c40e531c1e6148a392364e36b8a013cc306180d40f366bbfaa79b20737bcdb1f372aa82964fe50715b037b39a2284f0e1878c2fcdbb
-
Filesize
5.2MB
MD576bd13c8f9c7dc72a02e3ad5d6adc6d0
SHA1874a8e34a5221af240e26e99b2fba4c698df06f6
SHA25614a8c6eb56f4b478d216fdcf72dd7dc7e6fd8fa5911426aa2e0d075d150bd661
SHA51214373fe30bd0c69b0b916c0c7432252deebc0225caa64735a90e17adb6039661b7e9ef40496810d992a38b90f4f5545e0c3aabc7fab7b70b4c26bb5b87889569
-
Filesize
5.2MB
MD5454fd27d2c084205b586f41d37f9cea5
SHA102fba616fc25119e9d702c5502756e176df27da9
SHA256bd3cd3697ad648cee296f58942b81c11f1adcd69e013bd35dfb106ec3367fec1
SHA512923f04f53de1e8b38040eae68f4a28f763f2a9bbf7d93915126fecd1c099f31ebb8d75d1ad9aaa861970a180db3bf707d7add00db4e5cc1f181051ad19afa9fa
-
Filesize
5.2MB
MD55dbd9f82ad2a6f7e935b672d48e9c3ab
SHA11156d9969d8d3d96304c1fe90ff9cef3fc653ff0
SHA256bf6bd8184ef8e452814d72e27c6f6374f48b5cbdf08bc99da30dd02b1e55f702
SHA512376ec943f716466bdadd2475a9ee5549548ab56e76f525c72282896d3619b3e25ef0647026df70af45a29a3f7411031ec7b67ee17fee740c28d575c011b5f231
-
Filesize
5.2MB
MD52fd88f8cf7b442eff42851c37c20686b
SHA1ceaae5a2b464b9176b8cdda7733ab16dea54e50d
SHA2561211f64a526e83bb7bb37846553936719d20f2c31f649f6fd90ac47778144926
SHA5128107dfedf0e2b53b0eca7dd927744efad3e2a3bde18f778d3c7100726ad965dbafac8295194d928889b27e7556c60288ab640f488069cbbbee38279f538607e3
-
Filesize
5.2MB
MD5dd47902992bad9d1939f24bb7c952d71
SHA1270dc5a51084c61b11b2350502f7a4b5cbd03094
SHA256e560387784155b195a48bef3d6af5e77c284b8ca589f2f1699619577267a0772
SHA5120e3f47964e0d5a8a16225a87cf2baf7729979ae209d8ef67146b57e024352db77b9de931fb91ab74dcad183149d4cfd343e1bee3bba49fd7da91f03afc43d3c3
-
Filesize
5.2MB
MD5669585920fb01c1ef22298bbb7e5f506
SHA11221843a58d5a19a46cf5c60bf0013ac6e0e7f6f
SHA2563ea6cdee5b6a59ae924f08bc0d406325c37ce1691e3296ac2aaac33061eb144e
SHA51200d9e18892e926ee8d0a97657710a38234daebf6d323a8726a4714adf2d402c32ddcf57925af5f9bd55acebffb327f710579a40c5f413cce7f78aa6dc7cd4854
-
Filesize
5.2MB
MD597e045db4d96c4ceabec93ef0b0d0751
SHA18bb0f60bf5b27e92c491252754e4d17945dbcab2
SHA25685422bdc45971ae68ec181f1923d8795d5a58cf1dedc51f83de6375fc88f62dc
SHA5121bd20037a02b5c2eab8bf3a21a892260bf48011bf4603b4234b7d16fdff10f634ed84a84bed43d7ecc7cf91e683fab908acbb00ceb116ef86e3028ae844831b4
-
Filesize
5.2MB
MD5af6f80fce7d515977251c9c956e3d328
SHA1d3befeac2558269625311bf9619526e8c5f30c88
SHA25692f2267022d4cbc50b7aa7f59484c1a2142382588a771f3ed44b17626e9ad86e
SHA512da385b3361249254edb4c5ab23bf1e0bd836cff38594da84d1db25a1470aac7cb29b4f391e1f60dde4c09bd4a051f588290a1c00f10841c1175f2417cb7d66b3
-
Filesize
5.2MB
MD552ad4ede02fbb4e5618c3ad8c2b21540
SHA197cce79d581e35e201cd2bf06ed72445557895f3
SHA256c50e857153ec3f78e3821e1148bc5d7309478a2e880b2be2f10319b044443812
SHA5123f934469a93a3c1006dc2184f64bf00dc5806303785ef7a178d07054b4894dff92add34df764f48fcc0cdfd3180ae713e564aacfa228ad8625545d6cf2a96bda
-
Filesize
5.2MB
MD520e31e2481b12a073375dfbb79611983
SHA1c5ccbf7cd47d7012cb2e993c6788f76979315a9b
SHA25611ff3cc0874067d607a6e21cc88d787914e8d8a30d44da865611999613e1dfd8
SHA512a0e1991be2a5ac9d486e7e17a01e28cd38230d14b786cf50a8ac5d1f36b8982aff50149dbc02b1e84453edf4e9dd7a63059051eebabdc01d203e8393a52bd54d
-
Filesize
5.2MB
MD50d889f0966e1853a313e657e39b994d6
SHA11ef5fcd85b7bec90643c39308e55534a931dcc47
SHA2567536cb97e46545b410e5077694184011739778b29b1aec0c2c83c66acb9b9f1e
SHA51245d779afcf8901c181707a676ac6fe3928dfb77ad2a24b5b5049731642d7e8426cfbf485c577ab7ac5404bf2c7620252d2ee49b5ddc0fa1c61e30fcc8c6b9e33
-
Filesize
5.2MB
MD51eb9b80177ac6a72a297d1bd994ecfdd
SHA1d1f0ecfaed62122ee7ce60edcb6966d505de2f7f
SHA256cfaf5f1322aa3e17f1527314b7d8f0880a9b4148840d9af2f34b0676726e9cd3
SHA512d10d81386d73ec6e4fbcb84017b7026925d8638ac1c9d8f03e494016455521777b4f91ef76fd06a8dd0fed73a2eb197eb7f679f71f2235a1409ae4a65079a3a2
-
Filesize
5.2MB
MD598146ab7798f642eea02468376878c99
SHA1f01dcfd5f40b119a0754e7e11cf66324a6c5d048
SHA25681ec3f580e389b7734042ea533be9cab415749967e1b415f0034bbc5cba54c30
SHA5120a576bdaea3be78900e3ebdcc8db3ec48a111b1c1896e3e8ae84d80741a8c22690cffbfb6a49c54d377dd8039b456e04b1bb1b560928fe7d2f884eee06774495
-
Filesize
5.2MB
MD5c12297dd2307da48dba3ae1d49ee132a
SHA14867cff30aafd84cc2ad424022cb8a900ba301e0
SHA256e09cc9721d7828082b51b84396e39e592dde846111192c053cdb36651214361f
SHA5124d137be992facef79bc7cc041dd9fc4cec626b8dfc79fd5d490b297f86738fead6526b61cd6cf4e2f1bd9a2e4862453ca03a738483ac7884b8d4094a1d04f84d
-
Filesize
5.2MB
MD56910e87c3d35c3c80429afaa8f8d8ab5
SHA19df5f48c334573c0de9f9aa0f35f61abf11f2064
SHA25601f83f1c7bae396a14d6c7e3550ad477779e56fa273195b92e28455dc1cc7fc2
SHA5122eb8c2a1faf6e89b79b5d3d4b907502aa404969defc7c0e9a7339888820b859bc51c648238838a31e329d8774d37dcec30fc8e1498fcda112d108a6e127ebdb6
-
Filesize
5.2MB
MD512e6702f07db58be97b78a9316d51c3e
SHA1531aa13038da9c821bee309c413af07bb97890bc
SHA256dc2de812cb440cb8fa999bfb00d440a37f19107e9c9dba48018db6b33a9a28ff
SHA512239c51416a0c502feb5297624065eae78665d937061064eb3f79501cab3e3b5193b41f25526430894ad6487ac0bb58e852f0b55f63ea4ee2b22a4dd952bc4468
-
Filesize
5.2MB
MD50fb44836416953f96b463cc0e219ab7e
SHA15aaa752065113d2d707a292953b236046d5c0bd6
SHA2564c0c64ee82b32d3ce326ca13ee519f714bde74e256c715ab325571ed55570904
SHA5124572a030a1d9ce69d6c83732a05362671370d514003e0e060fa2b4f4a4db7d9f1c9b171f6091683dc601293aa2c24c7975143373a6559c8a4cf1c58e5089d130
-
Filesize
5.2MB
MD5fd6179e36109fd1119c53096a004d595
SHA13bb111faf198b55f2b869325aa89f301bde77b64
SHA256107c76a6660d0777d838c097fb00ab76573eca95c72890e162f5f82e23dca651
SHA512ef1866215cc3c18f3fdf5c7548d2dd7edc85c74550afd2f7a40a90ec11c078f0de93e10f8ca960632df753bca543e49a868f8ba5702c31d54ec84da2f39eb8f9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB