Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-01-2025 10:28
General
-
Target
2025-01-02_9c33dcfaaf1dca493d9e08d621e3c8e2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
9c33dcfaaf1dca493d9e08d621e3c8e2
-
SHA1
010832a7af4460766df907da87be48a50f7bb8a4
-
SHA256
b29ed74415ecc6764a310a3bf4192bf71cdb95f48a327f04087657074d0eb19e
-
SHA512
3d7b562d68df2bcbaeb499cebe82a7ad7149fe239082ac34292919bf179ce33972e36a0f1c9198b34fcd704b635370c0e7f3fd413e8a36cb3c526e6673ef2acf
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:T+856utgpPF8u/7u
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-02_9c33dcfaaf1dca493d9e08d621e3c8e2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-02_9c33dcfaaf1dca493d9e08d621e3c8e2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vAktiWJ.exeC:\Windows\System\vAktiWJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fRrzmqx.exeC:\Windows\System\fRrzmqx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\exdmYsG.exeC:\Windows\System\exdmYsG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uJUgxHL.exeC:\Windows\System\uJUgxHL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jweulix.exeC:\Windows\System\jweulix.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RQNOMGh.exeC:\Windows\System\RQNOMGh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DcikiHQ.exeC:\Windows\System\DcikiHQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CgjwJhT.exeC:\Windows\System\CgjwJhT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dYxHxfE.exeC:\Windows\System\dYxHxfE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dgWvvPZ.exeC:\Windows\System\dgWvvPZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pqauFjs.exeC:\Windows\System\pqauFjs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LknxsNf.exeC:\Windows\System\LknxsNf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NmVZnOv.exeC:\Windows\System\NmVZnOv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KIadxNT.exeC:\Windows\System\KIadxNT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PDMdNul.exeC:\Windows\System\PDMdNul.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BhbCQfg.exeC:\Windows\System\BhbCQfg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xHsIYxZ.exeC:\Windows\System\xHsIYxZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZPtlMmM.exeC:\Windows\System\ZPtlMmM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OZDWIuS.exeC:\Windows\System\OZDWIuS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YjKgxfY.exeC:\Windows\System\YjKgxfY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jwgepMl.exeC:\Windows\System\jwgepMl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5d040521e5c17b81779dd041bb142f9f0
SHA1dd0ff3f3729cc08dd3b1f58df6e38b4432355cd0
SHA2564cbeaf078663f2aa34445e2712a8205c376748060dcf2d8b761273d7054d7583
SHA51290ab316c13a4cd8ba359de9a1ecda7f46bf368f7f1ec1e007604a9276e97a96a290942934edd38624019cb3dbfb8afc7782aeb5dcc1d833e376076b8199e2e92
-
Filesize
5.9MB
MD552f036800c8039559b30420b2952009c
SHA1e8e89a4e726877bf41a46e28a156aface7b1d01d
SHA25679ece29c6e8f877992c6f4e29937de28cb4e8f65d560acdf6b2064b0e98ac4dd
SHA51207cd5890deb5216b89c031fcdbf7c1a54f3d862599e0fa03b01b63fbd6c4ce4e635d46703c877bd307797459dd313d53f7d90b477a83788bbaafffb1f780ea7d
-
Filesize
5.9MB
MD5fd4de2f5614ce4af7dbf2adbe6288999
SHA165e2d03bfe5cda5a069ec4330fdab3fc2952d905
SHA256c88f92592b29d9f301e675a2d1570f8e6c5e2424e947c8b1262f0a25b5b8fb72
SHA512fb492234a3437f362893ccbdc215a38d1e3f3f7902f35dc04a4e30c295bb53f8f9f109ccea93ec9b88c30ea8cdbda38ea0db7b06777e81912c4b6cc57a614394
-
Filesize
5.9MB
MD5bd763e2f186480a4a6c502b8c1366df4
SHA18eb28711b44fc52c0f6ea236167738aca4577199
SHA256b016c3731562e99d56dfcc81079490ace7fb3bafb8503b1d544b65177d366a88
SHA51270979e38a64cd7add84169cc4dacf0943d6bf6865e3dc5c39c8b134cbbba66528f4e142aa9877cb04c900505bb1f090a6657880ba31262de091d1872019da910
-
Filesize
5.9MB
MD5bc1c4f612fa6848f35c1debc0fb825ee
SHA1a5bb7eb24160a98f812f668ecc81946559ac5d6c
SHA2565106fca57199f4519854f42c925867504a713eefe54ec885daf30542423cba8f
SHA512612b1c526eb8f9083f54fd8c2b921e3bd70d4a115bc3835fa073edb5142fea58ca7902f222d662ae1117548a77ea2fd95c618294093d62ffa20bef94b7bf4975
-
Filesize
5.9MB
MD594b3e4a0fbcaa583eed1f4924d0b8547
SHA15dbdebee25cbff457c7db2e9f3774c900cf18fa0
SHA256e0e103bea6e5079b924cd0f97bc3f07edb43f87194cad7e1feb6562a30399cc1
SHA512f824cc62591dfa46151d4256abdf304539e49603e7e23d0a7a9de9a1578f530a0fe92f7bdde5ba1be788409ab6fc4d041db980c9da726d39fc95657caea5a91b
-
Filesize
5.9MB
MD5bc8d72f33a45c7be2ac106d478e9913d
SHA19a88dd533cc7e75ccae7af9db9d906dfe0170069
SHA25635b0621e20943a5bd5f162ed45855a112c8bc168a3a646f5280042bba83a0ac0
SHA512ccd58bea722a82ee0d98268a46578ca837221dc94987ebf62c98dce6ed2fd69bd97693ac1b1e4df83f91a72d89a0e6461547ca9bbb89225bfd1dc6f350bd4865
-
Filesize
5.9MB
MD568213eb32f6969656fe6c90e14553aca
SHA17500e1d930cea1b421776bcf54a2daf38483661a
SHA256376c131f57720b1f70b41683db63ce26e3e14b8ffe1512d7dc8da8eae79bea0a
SHA51214cbaab0f0827cfc3b6a4b60aade5bb456f834356a6a0fe732a3b4e02e3959c2542d064c106aca665058401a2ca2f6477988c258dddf1746195cfd47a87fbaa4
-
Filesize
5.9MB
MD5fb709b9b288117f7acae70f2fe135ded
SHA169500613b443a3746122c62a0e2ace35a8af7715
SHA25622e416246f7996079f911933e0a37c4833e511274612b0050a4869a8cb13e0eb
SHA512ac47e30508d4a4bb1c1de4bab84b431441a6ad71558c6a524d4cf0cc9b567ff16891dcd331e284c73fdccd3c97edcf1750a37336dd5d7cdd220be91fcd88fd1b
-
Filesize
5.9MB
MD562bb6ca35c0ecbf89f8d5b07c7982d15
SHA19999ca3a221938d4d080eaf43c3565420ad36461
SHA2565065b96c445d8a1fab763a6b0eebf26435473fa25a1fe1b939b2d121db556f38
SHA512452913aa67267229f6768e800fe32961005ed552a906ec2b0d42d6842542e9cc9d91d5afd3e7d1e4dd86ec3206b627e0d112e503bc43b467042d3ee0c04d420b
-
Filesize
5.9MB
MD5dea3d9a53da4c9ff1218ac7b2a27ad4a
SHA1645555f753f2ae04ef79e62f2610f7b6bd5e1656
SHA25684f6d48eac6dd32482ed6f058442c421ea81f2a69ae8b2bbd3d16bd6e345916d
SHA512735255aa2945072c5a919e73606cb20d5c64959cb53d976c039bc2e12ab55e548f00845f8f89e0b828532340360f92debd7d00ef86088150f04c48070a644587
-
Filesize
5.9MB
MD5a5255b2a8bc82c2c4f370d00ae2c8ea7
SHA15804fa80ec5209bf247fcac5804bc23a0767d2d7
SHA256041aaa5afb674605fc5b9133904c4693518563df8ef198fd249995fc6b31466a
SHA512b6fe9e9097c873f5d2209649cccc2d80ea8e3606763072cdd5c05a7b43f6e70602971b9d343f3e45ccc9d25f262db80752a382bbb5b3536e537ff4a5e201d02f
-
Filesize
5.9MB
MD50ea7ac2018328697849c238284864798
SHA10afe6cfb5d8b0ac71f30bd23bac156be2ceb54fa
SHA25645e598a718d09d33e42d7c7884858a96bef6b405cae9b10bde35f74a4a3fba71
SHA512d720d3a765ab9601a8f130a4e389588fe0b8cd02b5d147f25dfebc602cfb0d7881a4fa80313ab34d54ee5968759afc21d408b48dcecdfcb14035b656af304801
-
Filesize
5.9MB
MD5573870f1fe74048f4639720c6aab9193
SHA1f18b62982cbe694afd67da13a5f51abbeb1822bd
SHA256d64fc7e20395d0a2a3fef6577acafc9abd371140de25b3d0b7a790557bb9a235
SHA51202037e1d7f1bbf9c882fe3a759fcde4bb751cd18dcc0ce0887897bde93c98cec5366b7c383b64c02c7cf4c03b2d273df39e9f88e2a43c092b45ff0f67f922e40
-
Filesize
5.9MB
MD52e74dc0a04902eb6f987338344fe8c33
SHA1b84311437668326b6657ba7c8a2c97060b16a86f
SHA25654fc088f05d55181a2cad84db529307cf28969cc2a266908de1eee930421ee78
SHA51274e07681643f8bb1ba744815cf0a15b1d0b9aad7b50db2514fecc3f8052de6f0bc0b2ad9d7a39f81120bc198d5b20870693bc410494dd29344871c5122630c31
-
Filesize
5.9MB
MD5c0564eb8d327b7e8a5cc3bf83b923d53
SHA1fb4b4c51ceefe35c9b4ee1aea92b94beb3de9fc1
SHA2568979c89622f728952bc7548e4931a38f1213e6bcb42e06573a43a882374ef841
SHA512253a993ef1b2cbe408370ea84b1425f23eb4c470aaa0b972cc8b629c0645046caa2fd7f1a994eab508a2639d2692490cffe504edd43878290579973ce2559966
-
Filesize
5.9MB
MD54aff61ae5d2747051e26263a5c9ab0a5
SHA10c09a4a2edaac219d4b899bfe9f45f68568bf257
SHA256cb008ee60799256ad0f342f5bfbc0991d97e9345a5f4a2e5ccf906b01ab29555
SHA512fa4fa7d50c5ace0ff4e63a2208c4ea74e62151781c04a128ac78260e4eccb297a604d577c18d463526a2ffbc44ec51de2e299bacb6010d7a8bd4c63dd94a0a67
-
Filesize
5.9MB
MD5e86e2150b198727ddf310e09808f8b8e
SHA1e06fdc807315790b264a1ee5a0afde25a55a2b9d
SHA2562208ebd777d3792a59c3b995c255b6a040a59589c086614efc48e75e913d8d5c
SHA512e216134a47b834ce3d39e4415b46ab7e4af3217d94cf2330d52798d95c7c87fbeac7a5448ec57c4a739a674d35d38cd77fd32839add738b0dadd21798eb5e3bc
-
Filesize
5.9MB
MD56ab5549178b87671080d0471c69336b4
SHA18aef785615c4df61fd5071a33d1426e4a073bd19
SHA2560b96780158696d4d4ec98f7a2b1fcf87fd26d52a6149b4eebd9ef31e5d138099
SHA5122b296aebd3488a72f5ade08d63bdb7d824bfe973f018e13a0c9b44a2ce98b04050343da0c256a7d40951ba603ab0dc49261500087be8dea217c209d52e4536f9
-
Filesize
5.9MB
MD51fd5a2267544034aa8e9d9f2d12dd77c
SHA11185ebdc6ec26151f01e783fc37db2be83a063f0
SHA2569db55b136773c87370cb37541380a53d774054cbc156a3581284c789d003197d
SHA51207ab4feb29c812189aae9d6f467bb15a75c402c706529ceb7e3326de37be961cf36c9e42f916710ad6129664bd58c4bdbd379f7dc2d851d210c8572072c8ab67
-
Filesize
5.9MB
MD5bc916c39b939c1a6f36119b57d8b7a0d
SHA15e66b00e7b005ee2b08237170f63c620797f8579
SHA256d6b5492c68b7f74812b3057a04e15700150e6b87b4d083cb2356dde7505ede22
SHA51224d4925e34187442c85c8c51c4f9ed3c34947798f24f263522d3a9cd6e084d625fbae6b3aec87fe4bd89b549c0c6ca451329359b8b0c0508ebd127d1e840a7c9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB