Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-01-2025 04:01
General
-
Target
2025-01-02_74b8e0b0f49f2ed1e0f24a3c4d2af36e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
74b8e0b0f49f2ed1e0f24a3c4d2af36e
-
SHA1
117e9f0de002eb08aaed0e2098c70c1b58e5b581
-
SHA256
5aca7945f321a72ac9cda60eab60e01077c097bc7cbd7c6e37bbf4e7850d5b76
-
SHA512
184d18b4389bf63bd0f374c5675f6fcb011b2c838bc3f8b2285c8726d3215969156d255036e5b75ed611218226c327a19f43048b661dfcdf78e07b7c4b423114
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 53 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 52 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-02_74b8e0b0f49f2ed1e0f24a3c4d2af36e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-02_74b8e0b0f49f2ed1e0f24a3c4d2af36e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CUHsXWw.exeC:\Windows\System\CUHsXWw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pZNPREJ.exeC:\Windows\System\pZNPREJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mMnDHmM.exeC:\Windows\System\mMnDHmM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hWtlybx.exeC:\Windows\System\hWtlybx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DsYNfan.exeC:\Windows\System\DsYNfan.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zpbIdVi.exeC:\Windows\System\zpbIdVi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GrLxxIo.exeC:\Windows\System\GrLxxIo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\srqaeun.exeC:\Windows\System\srqaeun.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KRKqMNK.exeC:\Windows\System\KRKqMNK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MdhTRKh.exeC:\Windows\System\MdhTRKh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mkmePAS.exeC:\Windows\System\mkmePAS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UVQZfSt.exeC:\Windows\System\UVQZfSt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Zdahfnl.exeC:\Windows\System\Zdahfnl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\APLCbvw.exeC:\Windows\System\APLCbvw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TgdCQGK.exeC:\Windows\System\TgdCQGK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gTXRuTh.exeC:\Windows\System\gTXRuTh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wNgwSBL.exeC:\Windows\System\wNgwSBL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\joKXHIk.exeC:\Windows\System\joKXHIk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ajRtCQD.exeC:\Windows\System\ajRtCQD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tCZEFmO.exeC:\Windows\System\tCZEFmO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IRJeCaq.exeC:\Windows\System\IRJeCaq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD574fc5262d38248355385ecaca4465ab4
SHA1dd02436d8d5282113643986fd63512f6187998ef
SHA256393e71f8e8bcab1c6e86d858f8e77a2917067c8aeeec2205771e9b5696f8ff1c
SHA512dd4b56991d59500f8de48efac33a1210a067a93099f241dfeea16e9b0ba851b6ba9e7c0721e6ec42e7bd989ccba4360c9a86f5b81b39eb12fa15cc0cf231ceac
-
Filesize
5.9MB
MD5346b19bec6c4d9bf110decbd375e1698
SHA1bd1505c00756e39bbff3cd5e53374baf0eefd438
SHA256175f2639be19a7fbec980c75e04a6df3e0133b69ac5159856846e305c8a068d1
SHA512c27e84bb1cd41cef093586680a755adc44c212ceca73abfbb1dd48dad6124be2def21a786bfce46aa5b22d345095752332f1b71eeae4cf25d27b08fc0945ecd0
-
Filesize
5.9MB
MD5738c61330468018e67544a2a7a47b0de
SHA1d0ddd2edc705dc4b39e8eba6972009a8317b4526
SHA256b6091323b143c7e8ef602ac82fb3660f7df38c50d0ee1fc91fc7edc36fc80517
SHA5122b4d1acc668339e50e7209e92fcb1e17c7fb3766aac40ed6a20dc9be4567b7289a8ec5ca173913b4faae7291e0a423307b2e0c17e9b030c833bc17aa897c508a
-
Filesize
5.9MB
MD50a85178f80af248fdf7559f06fe51273
SHA19b045a8a0883062913949b3aa5774856dbc45faf
SHA25639a7ca8e7472df680d123998f30d4a12a6a10fdf85ef0901fa5d2ab8439715bb
SHA51224982ceba5a8ddc4d8ac723a3fb27cad15c021b7d4325c85cdcdbbbbe30414dc87bafc785150278661c0ad16a2384e19a8c2043bf9432cb00bba3cb5a0b75c07
-
Filesize
5.9MB
MD54027e6009d3dfd362db90a3a24803ae0
SHA18635a635a3d297946e66d529cc045dac4e67f0c1
SHA256685a4839342bfa902dd6d6d0f407fd6cb785cc4e8035961686607904441919ef
SHA51246715eb24cc9a6746f963475e361053570170863a6fe851e8963b2dda43113c2fa95767e4db5d50812b16371f42946e5e5f51d12417b8b640a45330add9c3cd3
-
Filesize
5.9MB
MD5dd793dc9a032fd96e3da64e2020ee2f8
SHA1f4145c9bcd17656d579480b4e1f05b162a929e52
SHA256faef2412cd64eee97cdd584301979106add8adfe23c3ffa4fbe88ba39adbad0b
SHA5127c4326e9fa7d68585e09c260771ab14eebaca6bd00640814eb47927d8ba889ce34bf57cf9f924eb95b8cc682a930de8c0bcb607f32b1bcf5ab6341c32b252c9d
-
Filesize
5.9MB
MD593fce43f74cc416f805690df433641fd
SHA12a37a57fc9a0b8468884ab586fbd15e0298c03d6
SHA256dfa37ee0ef7e614ee35276878ee98cb07d463bf57fabceb79acb87716f1f76a5
SHA5127b3b6c317c61eedbe71b28ac25ae918c1bae05dc0c8b5b101b4ded504495c877abd85bb5cf001e4308942a9c2b5517ac6901612ab5ba639ace2eeb09729fcf46
-
Filesize
5.9MB
MD5597d2b137f86c7c221877f8e3269c1b8
SHA1c1578412199825490fe1ac896457107f74fb4f59
SHA2564a89199d9007593fdff15a06fb075362299cc932586e4c0940d809154e359cce
SHA512200f57f6974c1c7cb5b2d04c71e8747058c66e2f987db1c91da8805747306ac0ff45267edc1c857b50610b7dcbff23595b84057481f51fec437e2374d2c8ab9a
-
Filesize
5.9MB
MD50680f805bc1f146aaec4d689b69548b0
SHA1e600fb5e133760bdcc7edaacf356436dd2652d9c
SHA256ac3e7857529ee74a7a8c9e02f398b384b3c4a1b86fc38fb673b289bd4a2645b2
SHA5125fcfdb1685271b8604cf136901bf1904f2d3b00a9b0cc2bf520ff781afd3a038a9a2443d0944bda989e1ef8cc5f83cd78da5852feb4afd18b2bbcccffca72567
-
Filesize
5.9MB
MD50b896efcd322231b0157367ec9d13ac2
SHA1110ab05d45a16194f92f4307419f8c451928d5cb
SHA2561fc9b35b89eae7d3778dc8d4d7d776783d5750a54fa7af500e2b5fe9eb1f4b0b
SHA512b90439c2e1f335d514ea4440c36725008ff85eb6b24346a0e37e473b17331f607af2f836f65484dd9acf3a90b529007b7cb1aaa9705932177fced14080ef43d0
-
Filesize
5.9MB
MD5d1ab7b7e386fdef68d275518a4215812
SHA1b6b7670a56e485fb53016e45e24fb30d5542b36e
SHA25601dbd391f83ff220d2819c83b995b13f5fe28ccfef68bd973f1b857915c12127
SHA51285a5fe46714a54fbfc5c6397a1907582a01803f6439753fb459b5da51aba87e014a0f4fc06307ddc6ee93dabaf88f6aca25e4eb6805bf5a4840efb7722f5e92f
-
Filesize
5.9MB
MD566eff10b87e2e6106fa71ead7d6f0e44
SHA1c8ea9f4876ad3bbd263b857bc7f10e4806a348d1
SHA256b0e3c5a16635911a72464b97571579287ab63d4694bda551a76ecf0ee18bf9f9
SHA512fa56f74085f7f5557d57d5c18d2cb519cb949fc1f40a33ba1280678830991c33eca61e7e366eab399c4b60f59d3df77d8d90f0f90f090d9f7e1034c74317adae
-
Filesize
5.9MB
MD58e564cdadae744095504fef45fc1e02a
SHA119a3ddef0e15c6f1896e690f09e18a0c7291ec19
SHA2568ed44a2b1b934b8e04a0b9369af50bf32732714423db487afc48efc07f3e7558
SHA51262efdaa6eb9d64d5cd58a2bb3dd6b71de27ce00cadf338a85285660167c06429fee8e79e9bb9871ef998142361942052a298ae569b09ee9eaf6de8cf5b22ece7
-
Filesize
5.9MB
MD5e474066424217a4fcf1d8f6d7eddcd33
SHA1b63309e711fbf1c99210b4b750b18901cadc0908
SHA2563efdbdd793279f00195b05f5472a0335b19a8c49349a75478c7a2969717ab5b1
SHA512c0adcd50770e2963713753ecbd2d3a796dd0b7a4fced8c63d68fdb995f0d29e5dfa2c9206bf823ce46f44044784684da71e02219537986fa4a93acabfbf9acbd
-
Filesize
5.9MB
MD543b9796c40166f80eea44e567a93bc03
SHA1290ca2db03d8155a3180dab32a98922a473f0f35
SHA25676f91ad6c29cf43b83439fe7c673a85a657f7be607cb418b479cabcb47cbb876
SHA5128a0bbbf8b79364a8079f881649479f0baa64ba0970fd0d732bce15b98ed6c975a78ea611cbd09eb9f45545dbc80c5b21276b97e9aa009e8b69f6f31b601b260d
-
Filesize
5.9MB
MD5e620a3b40c7f94e63ce4f015ec077023
SHA13b94a967e674825cf88429553f6cbceed6863ab2
SHA256ac6bdc910126018e452d3b0d386c7e255c9aa504588cea9206eb6dcfc85fa9b5
SHA512318ec305fa16b9bededc3be2b426649dae70ff5a86378a9fe1e8d4c1d129db1ab6e99517e235fdfe3959d3b895a4d64715459910249de35c1d3890780ffb51d1
-
Filesize
5.9MB
MD509a8dc055f140caa2649b8fae96456f3
SHA10e1783ce522e62269bd23ee76df0fcaf29df2751
SHA25646a1e7ca1525ccfe1dc9ada748cf5ef66a850cf82f6f4975255d7f1a2cad7f39
SHA512c33008f418b08559d7a0c024ed942293cc4a9e30c0afb2abcc33093b8b722264b7085d56e1c729fabe46384990e0a94b907ffe33218199485d74d14d7141a748
-
Filesize
5.9MB
MD554205b9f04d594b6b8a6999a471763c2
SHA12c97296109c97c70266b705073361277cf7d163d
SHA256eb042d457a5ddb1ddc42c5a965cd1912b92a16f447f9a447b73577977f5bb5ce
SHA51284d05b74b2b33dcedb38706d08ddcef37147b4790b352f44ac99dd1bb8dde9cd5aaf55d81e9d366c190ed067990866efdb26d5a24974d4779d9d3d8468b68436
-
Filesize
5.9MB
MD52604cd32006cdd68647221f846efe132
SHA1e428b7481da6c9228d358d5a3094db81deacea97
SHA256bec6aefedd829b9716b12f6e49fa5873a994b0987d6cf082439a7af762033b53
SHA512a0524601ca783d55d12370a24da4c0994dea61fe4d18796cb1820907012062496ddf8a9b693df76216f4f19337f0116cc57bdf84c1534bcd7c5d6263ff8879e6
-
Filesize
5.9MB
MD5d72aea2785ab839cfc0073d20eb814d8
SHA13c9cd6bd97e0c4002b9ea226f6accf99ffac9929
SHA2563334c139c58ad5a2a79943c07aef66037c4a4cd3b81731f0aaed7ee5244c8a75
SHA5126edd87e4e5cab1cc18d95d7b1c83951379989446fbb0832e3c2bb51c7fd2b3e2853ae3412b8d60c2db248996c0b47da215a2b1eef37dfc3dbe7679bfeec6bd35
-
Filesize
5.9MB
MD58021f436be0b73c924ec16ba451d7447
SHA1684d7bbbd6241da4eeacf4677331acbc34ddb5ee
SHA256be3e147d5782d62f3e7cae46cfb70e666b8712b5c089c985efc82da33a6b9f2b
SHA512d4822a3e6b44cd5c8c15f57f5f943b79233b8857e62b963930096387ba348ccfd209041608ae45a735fc1eacb19d7b2f78bddf28d0cbb907510e7bcfc14ac345
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB