Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-01-2025 04:47
General
-
Target
2025-01-22_aeb744ec607aa7ff2c1221d94746a99a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
aeb744ec607aa7ff2c1221d94746a99a
-
SHA1
659a2df7f7805f19ba5d6be24fe73267a0e7f0bc
-
SHA256
2efd97e745021da0e60a32a9e4712fc134239f7bc9dd7e24194345b62fa20002
-
SHA512
8d4b0697bf0127d9f554db404a98b40f43a27c689d8ba78db9911be4ef81a8070330ecc8597d3a1df37b4a6b3de5d0812e2fc77d4b79fb2272984f00c080e0a4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-22_aeb744ec607aa7ff2c1221d94746a99a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-22_aeb744ec607aa7ff2c1221d94746a99a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zhchPsq.exeC:\Windows\System\zhchPsq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AwEdkuW.exeC:\Windows\System\AwEdkuW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MvFINqQ.exeC:\Windows\System\MvFINqQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ygfnnul.exeC:\Windows\System\ygfnnul.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dmovZnm.exeC:\Windows\System\dmovZnm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rpacPMn.exeC:\Windows\System\rpacPMn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MFomqtH.exeC:\Windows\System\MFomqtH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\enOXibF.exeC:\Windows\System\enOXibF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WCmtkuy.exeC:\Windows\System\WCmtkuy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IAJoLhJ.exeC:\Windows\System\IAJoLhJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NnXiOKn.exeC:\Windows\System\NnXiOKn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZSYouJE.exeC:\Windows\System\ZSYouJE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EfUqspb.exeC:\Windows\System\EfUqspb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EeyVzGs.exeC:\Windows\System\EeyVzGs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LkMMIez.exeC:\Windows\System\LkMMIez.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TnDaVkO.exeC:\Windows\System\TnDaVkO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HyPuhKt.exeC:\Windows\System\HyPuhKt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cippJxA.exeC:\Windows\System\cippJxA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BmHBZgX.exeC:\Windows\System\BmHBZgX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\idNxqFc.exeC:\Windows\System\idNxqFc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RuZbcoY.exeC:\Windows\System\RuZbcoY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a23cdd45007a7a2ceb7a91e19ee74329
SHA1a705b78bc18f6f92bd0126b7459218d7acb20d99
SHA256e07ff327bc97b4c36cb4b4ca65950c0f09ccd5376056afa1cc0fe058f7f6aefd
SHA512b65fd8623370876afbad2b9a3884689c368c68d3e9e432d7436ffe2bd67979f11735897816213f94e14eb0985d055b56762041653dc506b777e1b81a65c74ba5
-
Filesize
5.2MB
MD5eceb3890d1de03cb23236a039282cb1f
SHA1bbe32de796d13fe05971280fd846033f200dc37b
SHA256acb91cf4d52851b1ac6f3c702fe84fe35e76e36c0be286b016dbef705500e209
SHA5123fdd3aa0c7fac32cf553e8fa7be7f6b0d09c3941f778b5f7d3fde11c87ccc8b2036e6bf32f9f187b7adbbe4c60929e8ab999fcea8a904cc17002eae47862f2bd
-
Filesize
5.2MB
MD520476f151c8e18edc6b6f3428566bca6
SHA10cee012ebc61b6d54e03ec03df7c8336626a89cd
SHA2564b9bf2d04f0f347f94c1d43e4e2b2af0128a5e64952f6928b9ff1719af9dba0a
SHA5120ee401c2582103f6c90d999e79dbf190322f2c7be34134bbfafe65235a93e05c4b79dd206b58cc9fa04a8f0f92daa23f6e52da99751a930546217dffbf34ff5f
-
Filesize
5.2MB
MD56e873e026446ce28f0e9c3fa8eb8cd78
SHA1a3df5d201571b61a9f50c8bb8556a3d4bd7bdf72
SHA256f68e88f5d06bd162caccb5535fb4d9b7f0e463ab23fe1fb4a5bbd875b3603c53
SHA512e461775faa4a369ad3bc2efd0177c88f7a034aae4ae7b069bd0c148f62f0e807bfcb73388a563354c61a467591b644274973dc48c694a95bf38dd1b32bb324cf
-
Filesize
5.2MB
MD5d3ab56071af0f9761f22522b1ad2e127
SHA19aaf4886ba0a1b375359d5a0befa38b8ecfa47f6
SHA256c3615ba6ec526ec401e86edbeaedf3ee02494e1970b9e48a5f198fc9e1aac2c3
SHA512e9abfa53614de892161b6ab93c8653919bdcd4ee0edbc660bdf6abe09a5c4acd44c24a5741ac42f9ba5a8fdd4793d5422e12e5a3e7a7eb70e6f60e0330a5e2e2
-
Filesize
5.2MB
MD53354d59a641eeac58c68d1dabd1bdf62
SHA19d63dbbf21f41ab18d62da33fe85419e6322c2f3
SHA256ed2cef6361d94f7e22bc071f1fc8938fe62b226144c6979c7bed2ec43a487841
SHA512bdc4b532118adf127800257248dfb6c92c450d4412a70888c74c6dd9dfaa209f70a9ab54007a501e0a8d67d7f1e51edf156b08af6521fc978b20718fcf9fd238
-
Filesize
5.2MB
MD59454c8b378a4145905c919451a201c46
SHA1c48a3f39e6068e725f8bc005f5f2e798d8c9f8e7
SHA25606ab726a13f87c4345705edb7311ad332f9ff8ee87e2570db8e0f2d66608ea2d
SHA512742942df4b4386c8b6e2dba5586968083d1e65c7dfa48ab50270d3fe4b97ea2150fbfc36d08c5356fa7a61c751653e68c2c5c365b4c94c0337b2c90d5f275ec0
-
Filesize
5.2MB
MD57438aed6d7d47f776b2138a084831289
SHA1c5f5a60fa1fa44785292b1a5cadf577be4277a75
SHA256d5f738e78ecf7f412f3c159a71f3ae43d7c1e7babe1c7cf83535213a4e5bce31
SHA512ef99e8b0628a9b7220729d3061760943babc2054ce8906c4625d5f80bdf049ab695c033522e349b04a3499cef81d90d63e25bf5a73e8f4725a11ff388fb31c60
-
Filesize
5.2MB
MD509cb34a778ff3dff56190f6dea660c08
SHA18a80eac0d943ed22ccc70cf6db0d4db81a8d6027
SHA256bb59789afa9032aa1ec27cf9d86300a4ef61d33779cfa05e86cd9c8ed663b283
SHA5127d05b7692e681072a918928e1927bb0dbb2ee336c19e8263fbea0250485bf8e93338297385376231a7d16949d1b588d29dc1de38ade51dd3ddb7d200da6319ca
-
Filesize
5.2MB
MD56d0c9ed780fbc7723805e0c124e307b6
SHA1e3209a84d2c47dccd2d4e9530b91a681af27ed94
SHA256f1d98e002da233f3c8066c331098224ff631ad512251f52b20a4a224e7e39012
SHA5125d3a777015e8719893c9068801e2be340dc54ea14c4cd548e9667892e54c45d3f6e42f0b65b49dce96a5502c08ebe670052912f091df031081d738ac9b1b29a0
-
Filesize
5.2MB
MD52cd80dc3f602b36e2f01dc60b2418713
SHA1d0c085e5a5d3925b40eeca894a0bfef99c7d0905
SHA25673643564399a2acd48cb68e6436e03c949bbee2454f6027bb0511e604cf2c769
SHA51275ff379c08ff92f488c259ed6e9bf289b8aa2144b5dbae8af912ac462ca902edf545b82538f7d65e13eab33fc97afc23ba30db9247d980396bb5c233d5e6467c
-
Filesize
5.2MB
MD569ac22f5646a7f69f56484872b22d6d8
SHA1334b72822d69088745857354e9ab10437e8eb925
SHA25665a603fa7df91a52da576179bb181dbf8226c09d07c108731d33a54848abf025
SHA5125ea3b14609b4526b3c6552415c75fe302159cdf3ba24911b022bbb7a33d93e345776f346d6067a91623a3cdb6c6557cdde3b6380eddd55211c931c1764419483
-
Filesize
5.2MB
MD5fed6b7bfdd53077635f04eb27c4169a8
SHA12947c31c0c7f5250fc20f91eaa36a9080a536aad
SHA256e14f5afcddf25bc87005125b355948777b0b2a4a105062d11b0900b818f2aaab
SHA5120fa6447bac0c8c0aec443670c77435dd87c2c8d8e75bbcabfb254e7859cf1c532d170c1534a9407dbabdd472d286ce2cd7f1e99777760edd8a12805a08962c58
-
Filesize
5.2MB
MD5d1a1b544de7b1679172bce409d4e712a
SHA172da2f731ad25e4e47bc1c1eeb72ce0acddd1359
SHA2566ff853fdddce924f5b7f0d31278bf6694ca5276d39e9e1827571e3aa57f9aaa0
SHA5123aea7ecfe2d145005f063215aabe6331f107b9da9b172cb79fae29c2ac4b78d732fa67362b5f5f024489eae2ef02ae44c130d8fc7b8f86c4c3d2dd1e44fceca6
-
Filesize
5.2MB
MD5539aa3e5d5437d216dbb685df3862c69
SHA1307620e8c7063b7e2dc37e0032304de00dd900ad
SHA256bc63ab234e61181dab5e5bf38a0013a5c419cc0c62fc4b154aad753da1a84219
SHA51295c6ac84c24ac7d7b3b692fe5a22f4613ca3af92d754fba43ef0b6899e194697e49882ce9154bdcf299dfd9d8f9a20ff72d8d79c2f3fab37404e1394ea54325b
-
Filesize
5.2MB
MD5e97e08741b0badce6dea8cba3fe3f632
SHA1e6aadc721bd89baf94ccc732057529c59587e7ba
SHA256ffdf9c314364fa5921c725f81adb817a7dc60649ce04e0ae121fc049768927ef
SHA51222ef25a341eac88bc3fef11efc6bbe4f8fe6659e5ac7cb8b05e19c213e62a1d19b8b22325594248cd3d7fa39565a7b82e75bf509b92f503ae07a8f5f788f537f
-
Filesize
5.2MB
MD54ca218f225ebd87362b530b8383aebef
SHA1025ff7dc78ee7c7be2853a0a63894a9ca1d872f0
SHA2569b15024ccec6197bc58745a60d5d00343f2068be4b6d4af77457f5b5f2f4de2a
SHA512a3b84414c50838f83c7be4fc23818d56dced42d61adc11bdbba0d897aa66860381c0607253b2bcc44e8ec1dd7eb75c18becc3f785e78693cc38e5cc169ed5a12
-
Filesize
5.2MB
MD5d20c5d897948f9dcd3ddcfd364cad815
SHA1464d700d1e1a766142298d92a1666e6c4bdded2c
SHA2565eb22c7e1ba7c2daa2c9a633f8524824916d5e8fc863aa8678e5f318d5a1eb03
SHA5126a336a755d5f3d611177bfc7d6d47b0a6dc211076d4248786871ae114294851b316eac9bd0ccb8a811eb7fea6ecc0e7bbce027298df1a5bf7a37e8e24ef59ed1
-
Filesize
5.2MB
MD5f40f116713a3e6cd886b0bec05031aff
SHA1189b4172217b81f418fef5535e33353f29084c61
SHA25698ab55b8469f87f0f2c6f37a3ea40b494170876f0c40140293472c4202101402
SHA512049e657db613e01889738e8ebabdc422fe320eb02fed77be00f9ec04bf609bff2464a61e28f7ba1948c64d9d73aa6bf777c558dd5f1dedc81e17e6a8e1ede9b4
-
Filesize
5.2MB
MD50e26bcf82ab583424ac2c25ac4312dd4
SHA11645d5524fa21bb06fe2264cc8e0bd591b8fe145
SHA25693a3ec20c3a92bfad87623f4b24c42bc66277cba562e84b4933631cb39598f76
SHA5125905aa1827be6940dc3ba94f19ec85d3a0bd39864c30daf7453e2dad9f60e38ebe305ebdb802e238f1bda20e44a39230c229405bdfbabec73226aca55665c726
-
Filesize
5.2MB
MD51e3cea020d2821d4493e8a8b651354d8
SHA18c8140893f5254c873ce04b99fa3c8c2db1a64f8
SHA2561b7c949211de4d229e9ddd2063bf4a0017e04db83bb462cd6bfb6fa2d775d5e8
SHA5122ff51aaaecb5e73c2edba34c1cd56acad7d78ba8b09fe17f97ddecc3c9640c2c9863ec401438fb73b901abe3e35b6047bff1d7db7b6562504b1fee2d5d2379de
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB