Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
02-01-2025 10:28
General
-
Target
2025-01-02_9c33dcfaaf1dca493d9e08d621e3c8e2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
9c33dcfaaf1dca493d9e08d621e3c8e2
-
SHA1
010832a7af4460766df907da87be48a50f7bb8a4
-
SHA256
b29ed74415ecc6764a310a3bf4192bf71cdb95f48a327f04087657074d0eb19e
-
SHA512
3d7b562d68df2bcbaeb499cebe82a7ad7149fe239082ac34292919bf179ce33972e36a0f1c9198b34fcd704b635370c0e7f3fd413e8a36cb3c526e6673ef2acf
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:T+856utgpPF8u/7u
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 55 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-02_9c33dcfaaf1dca493d9e08d621e3c8e2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-02_9c33dcfaaf1dca493d9e08d621e3c8e2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rPQGQwR.exeC:\Windows\System\rPQGQwR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KiyzkHI.exeC:\Windows\System\KiyzkHI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wGtHHiD.exeC:\Windows\System\wGtHHiD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UBrWcfa.exeC:\Windows\System\UBrWcfa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TNhzPIC.exeC:\Windows\System\TNhzPIC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OyjayYU.exeC:\Windows\System\OyjayYU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BrlAqZP.exeC:\Windows\System\BrlAqZP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jZxBMXx.exeC:\Windows\System\jZxBMXx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bvFsRNC.exeC:\Windows\System\bvFsRNC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RxNmmLx.exeC:\Windows\System\RxNmmLx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TeuVSox.exeC:\Windows\System\TeuVSox.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LJrHMfo.exeC:\Windows\System\LJrHMfo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HdFGLIB.exeC:\Windows\System\HdFGLIB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hCVzjiE.exeC:\Windows\System\hCVzjiE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QfjfSgC.exeC:\Windows\System\QfjfSgC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kBmyIwd.exeC:\Windows\System\kBmyIwd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gGmZCct.exeC:\Windows\System\gGmZCct.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cTOdENy.exeC:\Windows\System\cTOdENy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VADJJbt.exeC:\Windows\System\VADJJbt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JycDAiT.exeC:\Windows\System\JycDAiT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XDYPpJU.exeC:\Windows\System\XDYPpJU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD52ce94a839acf1a8c6f5305b376e0a816
SHA17ba74157f0ae2c07a68c4266f07840698ee481d6
SHA256da82476c4788d9854436ada8c5aabfc78d68050d8ed6278b2c9060be1b345274
SHA512408840bf3c4a7af5c1a2ca5f3c4f1eab6ed35ab3d5ab9d75bb1b8057ba810612b45c60cfb7dd7ad1346d0a3d229ec8ee98760c3da581ed972a0a1e247ddd1cbc
-
Filesize
5.9MB
MD5ee53569d8404a7b89ac1e3dc2d516f80
SHA152d4bc890c3be5d6050f69183947efe683607ab1
SHA256b40b04e919b47ede3417429908d5fe4ebb659fc68b0e0a926a5ab05f53b8675f
SHA5123684cc6ad854856262ef5e6f2b15ec0031eee0d7f21fed7047c6e4114dec8ac6fe459a96f2c282be8af63e68b48aefb3f27df28163cae0d9015141e87bd15029
-
Filesize
5.9MB
MD57d8521079071299f124eb8913eb47115
SHA1431dc97a79f59a05c72590ff99825b30f1feb6be
SHA25609a6d3cb1a27fdb218c1ef4c05e34038c63131f8acb7223e4a8ce3a38488a8f3
SHA5125b82c7ebc35a66b2dc07cc5620957dafbcaec355afb358057475bef990204b81c9adeba070c5e8746f87eba92f177901786a3fe1df27bfd7860f6639a55df511
-
Filesize
5.9MB
MD56ce6422bd0d989def35f56e5ef294126
SHA169b82d6334bf02d4e96866521e07cf501056fc5e
SHA256a6800cb3200b286d34d1ea82ac9cfe0386a461524c05a290fdb8e60e71ea6944
SHA512ef859e8a1563de0c5dd6149200501fe2558809457d8538856c76b3d4f61c80b71d3bea526a5b90a3698f2af75a407241d7723478b00ab66a6502619a46f7a834
-
Filesize
5.9MB
MD50b94af98df07e07efb84e829f4674422
SHA11b1c093c18ad878d0c265022b1ab54bbed6a2c9d
SHA2563dcad0d3432b46d7da38aee8c8756e75998ad837ff1795a3d4bea2a4381249da
SHA512d97571efd5c6ab33df0bce756542718e5e90f3ef651ed5358f4c3b18378741a406d62de8725f6ec55ce0b3d37eb6f991a029c442fba3b237b3fc5d2b101f008e
-
Filesize
5.9MB
MD56e2d475fc6524b0e40fe6d2b99a29059
SHA1eb006f3149d1c31939d921f92725a1245c4a213a
SHA25643dd8acdc2f2a248cac044de71263bb9aeb7765d8c339f16d00033d5649b0eff
SHA512b41a6f360dbd3a86c42345eff31acca7715fdc806c1c52ce809fd7e9be8976a776ccf54f1c50ddac0673f44c0826c7c73169beb8546ad03592243e2dea4b02db
-
Filesize
5.9MB
MD5cffd9483b9211488b8e4d4aabbc38879
SHA1ff3ad143bd6e6eff20b923f87111b0792ce592fe
SHA25692ec91509ce19a1003d87f5d1fee32ee9c5b06a87b8d23a76436e0e26b070ca0
SHA512b0e78bc430b24274e7c6ffd2496027758c85160705a7387231019bf6014e5eb19bb5664befc4598682530e80152a9511704cef33abb0e162a46e5720d4962215
-
Filesize
5.9MB
MD52e002af9b6f0970956ad3aec721467ca
SHA1823ae200f862a59776ca204156a9cac127ee5424
SHA256bd08b6205e8e0205a94238b3e2d21b2cca5565ded3bd7345f48001a714369521
SHA51202d11978ff60c74cac470256e5018e1f0f0e244ca0e8a23f1d0e6f73892841d1ccc0761af8c7f9492c59960b3c14f4ad20de4358822b67fd9c326ba7073307d9
-
Filesize
5.9MB
MD54d42af5b4d82a50abb414415d5897e18
SHA1454417da854ce78f5c20df18a0d0e1bbdaf961b6
SHA2562deb8a1b83c5063eff0deb2389a85604b3a463916f322aad8dd0d0df4b1ed48d
SHA512cf2c08ea6462d100f8106b47f84127a78c7f74321b96db45b1d654197cdd839014d5c10d0723afd00a1f0e6f22e66a2c6daafa7b00ace5d8472b3accd4d82bd7
-
Filesize
5.9MB
MD57703fba58337fba7e6b9c208bd148d8d
SHA13f9c7093cf31b5215ffdb8b65f161e6277d3004e
SHA256588c50ac6e1b8cd7ad56507ca1ee3b788f7c9d141a54d180bf07798331a845a9
SHA51224aa157e2bec6bf0286d936a6fefc338892a9d1bec3d467a808bc49a9f869367fab2a9f97d64b756e0acafd51096c20cda968eb154cbc91a71fc983cffc8c543
-
Filesize
5.9MB
MD5fb8110e8249bfdc033929a348bce7751
SHA142057c07897c7f3461c2a0e4b10926daa127fa13
SHA256e0d04fe0dc76e25d649125a9e51072bc70b8c82b9c9848f2f9d4a562887c664c
SHA512d51efffe72a4ef43f1771d81e606fdcdcfccb0edde9ff9630e9688ef0d2e8627ec878138f3bb984edda058044808a6d23f58774bd12ef8d394b0d3ca56916256
-
Filesize
5.9MB
MD5e5c17b88985949fa14cdb01b6d255ffc
SHA1dc848ceee0e1fcee01060721d1c8f7107f3f0b21
SHA256689f4735abc6ea005c46fb91730d65de4306a0d2f42ec929d25600aa1f4e7805
SHA512ced7cd56716594c88bf5c08fc9555c050b6dff85de73daef109c7700bdcad78ca5593a6d5fac1121589bbffc835183fb90fd38d8959c999969682c719376f183
-
Filesize
5.9MB
MD56db4a4512859efa66648202967ecfd89
SHA1d385ab069199af7c8c3c49f735b3999e5f1f3681
SHA2566a9c6fed17f6b1f5de310ffbf8ad0539323169df920050db98eb8bb0d0d86460
SHA51244e1098e45900afe0d70ed81a4ac804f16acc59afc021f0bb5a44d4a77d5bc95c23fb3d490f85d207f3966c8c1ce113b448aa3a264d95b664b313c42d99b4c14
-
Filesize
5.9MB
MD5c1cc780b14d46f790875ccad8adde8a3
SHA1a0537b45779d7266d0314cadd6f8b8ee6453237f
SHA2569399c90c8d4f6cfa70413bf142dae76a5529baed5674c46da767106c5a919253
SHA5124584b01581d63dba4852559cdcf99c4926c4c61b52497baeef679c48869a1f9f2a9bbdf537a9191de5ed73dcf43172308caeaca4ed821e75e414c2869ac94b2a
-
Filesize
5.9MB
MD50b456be107d0982048e3e82412573bbb
SHA1ee55bccf24e92f1abbf4c8beafee4466af17f50c
SHA256679e28b0f7cb017902060a863ddf8b0bbd7accc99ed4f9788d7fea41a9ff90e1
SHA512ea5900adddf7c5a4f43c2aaeb9e5170569f89af5a29081ab137297698f156acce5c37750786553ee6eaf6350a7ed091e45d355cc12f7f7d21d326e08a685daa3
-
Filesize
5.9MB
MD5f33e79ce4bdde66730a350336e49646a
SHA1ab0d09fb82612ab0037da9edb52155be9d38cc70
SHA256c6d763d25dc3fd912fa8a34f4ec534be9a403f3a17a62ca65318ed50383463c9
SHA51298de316c3f9e2a52863f36eaf98f6801af26c2192f356f407247aaf8dd9af1f6e946ff7635367f9eab07868df358c500c3615d14ba0f94f1a51720bfad9ff494
-
Filesize
5.9MB
MD5dbc00b6bbc1310472bf978864478c749
SHA1d53f5a75ab8b5131a69c659223d59bf6f73dc3bd
SHA2564f68e3182f93dfbc173fb4b9d696969a83d85748866281f102c66337df2773da
SHA512d0721842a4dcf1e6e79c056b84de94bff391a391d49f9382e2e04b0fa543d12211c9d878954e174caa489ab572a2030e889002432eeb7877dce093bf07ace8e3
-
Filesize
5.9MB
MD5faa0864bc89a8e9ed235bdc3bdb85fd2
SHA13b94e4f62b0a4eab01d2e4345cb19d0c82edba39
SHA2562f2ca7c1603552fe6fc3760be60b8558b51b4e4c461ca153e140785a3a71bfd1
SHA5122cde76b5ed87755c01d34905b2917170bfcb52805c658c7cad1a8ef3744dfdf95453631da8171842ca85f64b5d902cb6f8803da2018c26b6184e0f385e932432
-
Filesize
5.9MB
MD59dda5a4d59a93264f48a888e7ede9b64
SHA135fbd73081fcfae8fa59de576d0e3af23a418384
SHA2568c4ca45d039440e48544337a4f920c8b8136352bcd04fec5a8c22735f67d1e71
SHA51206b087a85a75c8fc4e6dc2cd1ef0df3e647ee00f0b0ab9175c1c17a3d05214c97bcb9e3cbfa66410758454f9b469d1231751079c0c43cd34b7a016c70a54429c
-
Filesize
5.9MB
MD5823cb92b829106ffcf0c0b54cff954df
SHA1b61bb3efb5298d09b8375ec11f842cba3bd2ecbc
SHA2560c3b1becd2d4d47e2db4cdb277e9666934826a7d76152ba5444c3f7b957983df
SHA512a006b4fbe24968220c2d0ebb84c811a2ebeefebe7d04a2d5802b6b46e3e68ce189769e7ed92ea5dfc451ae094801ea6478f705776b8b22c5bca45b0a40e4df03
-
Filesize
5.9MB
MD59426cb25d293de9b17f41a3013b7d0ab
SHA1fe863a3f0cefebd8a97fb7c6d09678971d5f4bc0
SHA256d5da02785f8716d9d877726fb67eb8c0145346df0ef494bd4d9b8105f7039d4e
SHA51282cea6b6b94f58c889edcb578bf700bac22973e22a64ea6da8f8ee3d87c9ff73aa98174430abb65ef6c4568b32747403e83ad834e0d3b887b4e20069c20b7aca
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB