Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-01-2025 12:52
General
-
Target
2025-01-02_8ab3d4435039feabca3af9d345215783_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
8ab3d4435039feabca3af9d345215783
-
SHA1
020004596869406c5dbc4bbc1e3b9b83f0ac3a59
-
SHA256
76841af22c2d920c2b4eee44c95499196257107069055de5cf575fe39159b6c8
-
SHA512
92fb512588efb9f1efccf33c775546e061331291655a6483de90a7094d7f6634c52a0fe1fb3bf4a00d82f3c70f377c2f3adbc7737f92877f08a8720f9d551ab2
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:T+856utgpPF8u/7P
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-02_8ab3d4435039feabca3af9d345215783_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-02_8ab3d4435039feabca3af9d345215783_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\EkXgMeO.exeC:\Windows\System\EkXgMeO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WEUYcdf.exeC:\Windows\System\WEUYcdf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dPAQTnE.exeC:\Windows\System\dPAQTnE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zHcOxGO.exeC:\Windows\System\zHcOxGO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cXjVPNl.exeC:\Windows\System\cXjVPNl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vytEuNI.exeC:\Windows\System\vytEuNI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GwaQlcr.exeC:\Windows\System\GwaQlcr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CzWlMQN.exeC:\Windows\System\CzWlMQN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vVBjVmy.exeC:\Windows\System\vVBjVmy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pkILfNZ.exeC:\Windows\System\pkILfNZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Gjbiliu.exeC:\Windows\System\Gjbiliu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nldHGbO.exeC:\Windows\System\nldHGbO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\inxtYbF.exeC:\Windows\System\inxtYbF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NAkUodU.exeC:\Windows\System\NAkUodU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BvLJDgM.exeC:\Windows\System\BvLJDgM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pgqMcWu.exeC:\Windows\System\pgqMcWu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CcHkbEq.exeC:\Windows\System\CcHkbEq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tOYynLV.exeC:\Windows\System\tOYynLV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NKFuFgy.exeC:\Windows\System\NKFuFgy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bRNvNSv.exeC:\Windows\System\bRNvNSv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JblxUqD.exeC:\Windows\System\JblxUqD.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5efbf94fd8f07deb2bac7184f997e0454
SHA1fae66fad47178cc4d552df0d88996a348d918650
SHA256484afedea68b6042576050b0a58cb203f0a05acfa5f9752b3404d8c4bcedb6c3
SHA5126325c3eb3c3ecdf4b007408c4945f4c5a5deb08761c206001bcee19ada9ca0423cb3ed6a8f1e69a45ce68ad5ae64ada96e42137f220a219b733bb50fd3677fdc
-
Filesize
5.9MB
MD5eeeb1730bf0ed7693bc80dc6a3383238
SHA1fca08817b997a7c4bcc309e422f9c4fbceb3bce9
SHA256d3760cecc27dc791f2e82ad8aa3472708b96202503468d47b86d3d883139380c
SHA51263a4c458515f4811bcb12cec1da876bea0affa4961ed5189ab1052042aba336b177d71ba886821f363b85f9ad67bd21054806d6702fc436164f41e20da301d99
-
Filesize
5.9MB
MD54d59c46dc5df61dd9fc23ebf05811885
SHA10bcce31ded6aefa5b302ae1418889dac05366ded
SHA25683c8fb048a5591f5bcbcce969bb7137ad1ea07c81cb9a1d48e4a30b937f52953
SHA5127eca05fd8e827c94634df182dcf00c10ecac6af3d8ca289d81ea3e4684b419f96fb8e13fac1868a7471153634aeb91394a11a44a86efa1dfcadb3dfd0ce6f137
-
Filesize
5.9MB
MD5d2a058bdf281a93ff7c1d1c9faeb4b48
SHA12457e840b32fc9a3b2996eb48f663740de49c0d3
SHA2561b4e7db192f117d973d2ce20d59daadd5aa4492195096d0aa49da86632e1074e
SHA51246dc307c4cf64a555ee1a8991a3f1b0fe4fceaa012229bfe30f30cd8def51d36ca8cc9996f4eddfbc113f4c43719d6b02c9f0edb5b03564c73249cc59e9b2f3d
-
Filesize
5.9MB
MD50ea0ae7b52da8e993d4d578dca08c2eb
SHA1da6c20ac233102a20917075f5550a29c10c0a9ed
SHA2566a73106d620b61a4d6a2876f4aaf336ddb84758fa80ec1b36151f638032af979
SHA512b263e40343e9cb08b8540e03e741635eb917453e6eae8bbbd6d2414b0c52da76a38dcc17663cd293079821ec8d8ace56b0a676b436aa201c15b2d2364c399314
-
Filesize
5.9MB
MD503d7822d6868aa06c24a8d6f49177f38
SHA188f15e81d8419ee0bf1865e66d6aa976bc0b6db5
SHA25655855030807d4323b30b53b425d0efc4de9268e51bbc1691cc37d1bf78dbab02
SHA512bc055834e3bd9d4f88bb5f9d622e622769269680aecff68e6d79cd796aa64d6ff95175f0cfd0c0bc55c11c2dd73c5ed954e7532ca01edac6799666ae36d0edb1
-
Filesize
6.0MB
MD58bfac853d531e1669e7d9278a9cb054c
SHA1bbc57654718e2ca6294a9f89024a9bc3eae621b1
SHA256ad79a254f690d95e37b127b89e985829332d53a40b19c81435dc76c51609d5bb
SHA512baf58098bd5e1264dee00ff61f414bbfbc36617b20590b3ba3adcd074bfc36f344e2602d412d7016622ad9af291be3c24b526d5b5490790f66f37bd14e3d5a65
-
Filesize
5.9MB
MD54684bf0a4163833669f55b9ff178ab81
SHA186fa7191e8b6ec551466cfb21680401a1b491978
SHA256d9d5b3f71de05a8e17637db6123fa6a798cc1b356c088dc657a9a2512a21ac5e
SHA512332d0f923a1fa9a1c1d51d88cc46f1268a20dfa2cb2626eef42747398a0dac026c5caf8455852d8179d11c026559fd13d5f5cf10d658c940fd1d258e8c40bb74
-
Filesize
6.0MB
MD562005d111956fb0becd33476be9cbed2
SHA14fdcb061cac3a5e34bddf42ee36ade8bfe946438
SHA256ffc24cdb94610b9d63e3e801fa8a72472ef361c70fc58da03b2a8e37bb681f02
SHA512e14ad6e801b58b01ae696773f65d91cd063a80f3fd3b8a89fb7ceb00e4208476f76ff24f4b99b0c6a88e4ab673f209aaab2233411f1ee60414ee50b56cc9a5ef
-
Filesize
5.9MB
MD561203d101dfac4927ce94a775d305da8
SHA1ee0573a1bc0ae370a5f9dae05187a05656af4206
SHA2568d5ad899954be5e2caf9a7664af8a653e634107f8b3f2b7d705bd685db57c0bc
SHA512dbd3f70383cec68a39b736ebeea2fa683088ec1d8d53e94627110f1a856cd8973f4f5ab3f72f1a9958a2911ef00213937a13e60919bc7d5c9daecdd36b646f49
-
Filesize
6.0MB
MD5362f3406d438a795c0776c22ae30fbac
SHA1347535842e7b1374414d35ea3dfda55255d21077
SHA256007564110ff3803bc712175f50d1ffb0be24dd359a80da0afda1644b1214afe4
SHA512978c6785306a87294c07394d3e84fbd66443efe23d1d4a48756d23a196961279adea1e29969190f0574961a733a8566cb7fb16926ddf372bd784c0102f9bbb6a
-
Filesize
5.9MB
MD50c724cea0d3fc852d1bd94164c2accf9
SHA1fdfa73a2658d295e0ace6c541c1ac2ed5b908c7d
SHA25621b33aa83e02af018841c78829d1a43d8c7a2bda0c149edac52dbf0d6683dd32
SHA5129d8e0ccb96801acfa919b8288ff9be5e80ee1d5da872283177db1c4050df6f7bd1eec84bda321071f0a7f493c4b9b3642bccc972433af6f5d70bf9eb6f835382
-
Filesize
5.9MB
MD5ca9082a1c2220b88582c0f4ca17bc444
SHA19a36c5529684d7f5a4258222bdb0283818f44599
SHA256aceb21e7152088ecb7ff1ddb0421695560065c0d4ae6e9a932f79d8543b09267
SHA5122ab58e8e8085b18b369c85b2850f5ad773d289233a0af8a19df3cf20624ed3dfdccae6c20f4e19ef1f93363d7db9fa6294feeec50e251cde32fd50dc49e104ef
-
Filesize
5.9MB
MD5858841cc79dde60805cea30dd6b35b32
SHA16acea6e9904f801d4342a54cf0df0ead9cef5ce7
SHA2563f969e9dd0699d7425cbe0d1dbc438c0dd959019522ce6725a912dde5f7d242f
SHA512099bf9f3b2311c6281bd5c13cf7d6a3419dbaaecd56721587eaef2e74439e68c61e1186d1b8ee30c332f43b4253d520e92074b6c6ae711edd9cb75015d2727f2
-
Filesize
5.9MB
MD52524e81cca73e36dac3bbdf929a4ad77
SHA12dde31e64afea7d434f019e1953201038694c592
SHA2564237a49ab31a1abf2c7211b49c519ad275c5d9500e6c835769bee7b8c43eae56
SHA512eb45529a4b8dcf7695e14cfbe93791a0f50080e863c0de5de5ec97859758bde6b71150225d26fc949ba64f30a6d6085b9af4a23ddef78c4bc1d52af163ec6822
-
Filesize
5.9MB
MD569209a60008bcb6f241061843c0a37f5
SHA17552ce96f2510eb3adadd80e85021232a63549aa
SHA25651dc696a4e315c5eec2de3f242f1c1b38828e0a3769186c104ba094aa7012228
SHA512e197d38f4696940ad06341f6a679bba3c988e8d1b4b78bfaa83dfa3f2aefa2011746248e07dc7f14c63f900aa337211dc5efeb2aad0147762f9c5f4957f4bdb4
-
Filesize
5.9MB
MD50b66e9491a0a3f8408e4b9749434f853
SHA1c2a533d1659296333c1dd93e32844bf6d701e5ea
SHA256f6c6d16bf12508f1dda4f09877306e90dcb5f3aa3d3d930801e4dea8ffe840b2
SHA5121a6d8fa9d0b4918eb5bf5abab5d7e2162b727840e73517c33bea08c2a0b241ec197d05bebfc2751f735f1527b3b2c0341bd3f843386a35e835d269b647e7eea1
-
Filesize
6.0MB
MD5b64df13502262fa14c5ea6a9dba4c2ec
SHA1f3ee1945d3f40c4e86032d16d7d8ea27628178d3
SHA25608e9e5e48403ef5c65a2f8839f5b72bfe44a5746cd6a284d97b270d64b7d4120
SHA512fcb8cdd2923958be816d887fd34dd09bef0200347cb86dab13d77cf6c686058bc01ea68c434ffb6b1ef84f1d8b4fd5c42d2054d939e0c8e0254988151c1ead77
-
Filesize
5.9MB
MD58e2cec19c00031e1a494c23d1b38a291
SHA1a12db8640aab0be9fcc49b8b7176b0540e978807
SHA2563a7ee713f9dc1a8586baa01bc449c643c17f14a018f0ab8d7515bc8d01c4c1ce
SHA512c1191175df11bc54a511169731efedc3c131d808fb344d0e96fe70c4222c551484ee9c6d1992685cf94db9c837bab23ec9535794812d3cb75fd0a3f9415e6c4b
-
Filesize
5.9MB
MD5f7735fdb81d6443a7e9a8bac638263da
SHA1bc6d17caf1b65092ce75bd3c1e262c6991cc4714
SHA25662c977c2fbbb0372f4be7e8abc644e7cb268704d6f93187a4f2bed8b216edff3
SHA512944b89f94953e477b7dd7838a94a187b302d15722145d1786b3bbe0556a5336a031eb72614d6795fc6625c0269a0accfddafc9257094fd180d49ef738a77a8f9
-
Filesize
5.9MB
MD527628ab916c98c2473fe95516e7724e5
SHA1ebb7ceba7495f3beef8f88bc5239c4c31812327c
SHA256bc4787ecf7aaf7412f913482437180f7f0c88bb90313941e2a32d9e7e617873a
SHA512fb900a76bf44723a1f475a2935aa7df15213dede422749e10240fff453969af1f4949ffd3bee91a09ec8f89e46fbe2ed793b917746dcef9e7be82664b9d00245
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB