Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
03-01-2025 00:51
General
-
Target
2025-01-03_0f22040a4532916552e0a48954133d48_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0f22040a4532916552e0a48954133d48
-
SHA1
b6d9bd8d34664e717964fa3815f89911ccb32e83
-
SHA256
24595cb20d712f9871692c5a1e39f7b5f19327f9551b6f6d29873fb13e965c6a
-
SHA512
bafbe736ce8f8377cddd0d56baf495c49355ecbd60d41250aa168af00b349adc22ae39f7c4bd92070d859d45a0b1a7677e14549dec15236c3435a0c8fd9875c4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lw:RWWBibf56utgpPFotBER/mQ32lUM
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-03_0f22040a4532916552e0a48954133d48_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-03_0f22040a4532916552e0a48954133d48_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SjksMsZ.exeC:\Windows\System\SjksMsZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GGlAkIh.exeC:\Windows\System\GGlAkIh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WyQidVu.exeC:\Windows\System\WyQidVu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PYkMQpg.exeC:\Windows\System\PYkMQpg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MipLyRy.exeC:\Windows\System\MipLyRy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pzWCDeM.exeC:\Windows\System\pzWCDeM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GWpDIZk.exeC:\Windows\System\GWpDIZk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UbOblGi.exeC:\Windows\System\UbOblGi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lryiDet.exeC:\Windows\System\lryiDet.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LQZumkJ.exeC:\Windows\System\LQZumkJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kalYMPb.exeC:\Windows\System\kalYMPb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rRknRUj.exeC:\Windows\System\rRknRUj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GRaooXE.exeC:\Windows\System\GRaooXE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YvSSlAo.exeC:\Windows\System\YvSSlAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UfcffSH.exeC:\Windows\System\UfcffSH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tnidZoZ.exeC:\Windows\System\tnidZoZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QEfpSjg.exeC:\Windows\System\QEfpSjg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ORSZWuT.exeC:\Windows\System\ORSZWuT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TAENIaz.exeC:\Windows\System\TAENIaz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OoYRnyG.exeC:\Windows\System\OoYRnyG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cXLrWmj.exeC:\Windows\System\cXLrWmj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c62d105bd39fa1eed30980e6a043a69d
SHA139b21d35ace92d64c46f102831b4caceebcac386
SHA256361064b1c067178362b8d5087c52fc53e731b00f11e2898f476734c2e1c8717e
SHA512aef53067939314241604b8e4a403cee5b20a0f0f206f4f21afe3dd3c8b89810df69377f7f4393a6145f7439632ea2cfbf159539a03b0e68312c011d92d874c72
-
Filesize
5.2MB
MD573ab5d289030ce7328718689f7a5a5d2
SHA148fc469c1b1026b6e9738642acd1804a91e86ff7
SHA2562fa6018af11199e24f9524fafd11236d1e48f82b787508a98bfb00d656f95848
SHA512703a2f6587f2c3156dce07893d20f89d9d254bc9cf591f94914bb4056e56a3f5cb171f31802cec95b32c4e3289ea1b9ec38a4b9c0104bc12e0abcabf1fcf8347
-
Filesize
5.2MB
MD5319d6a1ce958920e058c732239051b62
SHA11e0fd9e50e0208590bca4f56dcc9ee99cf1abad4
SHA25628304566bb227fb0659063cfd42ca681931dff89f17db8683aff6413b65c0dc7
SHA512d172e8bd82462f19ebbea344cca10c1075fd8f160e0805cee336389604e479ff7c007c445cf1bfeb3649b491217845a2b2b55a963ca14cb7c58aaecacc6d1e7d
-
Filesize
5.2MB
MD5bf598f8931aae03ec65c2c9b74a01cf3
SHA1a8be7225b68e65c3d64ffdd4cb118831c167afb8
SHA25663413fee83d439137c848a3c85287bb2634cf97b7ba406ba70645be188331890
SHA512c23bfd8e20f3a21ec88800fcc2a977932be3c0b55da377f4c4e610d3318e998c0899bf023c49feb57a532d5e4cafabe4bb6a0379ad3e0c960e3407a753e4f41b
-
Filesize
5.2MB
MD577377ca7e33e359533d2e8370dafa887
SHA1cc8c1eafee98312f97be92bf8c4337b3f4134a6c
SHA2562245a5e4fe8277541d5cac9930b8944352e62eabeaef2fdec2d43a62d7d8e652
SHA5129fe3cce14aa7f305573e274dd61c7aaa35267e8869af8198000b7e143f57951c9c5534d0c72e4009e9e3b8d9d2261b1b5b263a544bd8bd653a33a98d724295c0
-
Filesize
5.2MB
MD53a830d57974853e147dc2b5572fe8179
SHA1c011a9dbfe9e2c554b607f8dcb324ebcccaf9f03
SHA2560207afa5562dfd7386808f04eff945064aa4af6d84558ca39579950530cd9646
SHA5127a87e457d30a276b5885fb714237ec6dd4022af89a4793865e90d54b89e3d3d66835588d872b2c49b032983f65ea537d199e901911416af6c62d8574c7b95d4e
-
Filesize
5.2MB
MD543412a95719591c20bf87116a8b6b3f3
SHA1c08ce6c109978a4d79db6958c03b05e5a489b988
SHA256892ff897e71933ba06d50aa0028c5f71b16da3a26a348a3fb69e1abd7f13b2e4
SHA51280156a30085dbb178ca3d67f3fa9acdf573763b04ca8402bcf13823f5f7e31e0f488ab9d1c75f3f613deee3ee85e9bfd5405d4abb8fd1bb3ead2b751eec43cdd
-
Filesize
5.2MB
MD5804ccc56b0679c5f08d23683aea12e5e
SHA13e494454af7397db4c7da80436aa86bca79342d7
SHA2564700616c68c439730a9ed7cbe4de9173461564e6211bf472fbf4fb5e3a0cf2c1
SHA512c18218b76d2bf56a706075e7af2809107956221ef45544c2c74a123959461c2f71ada09a4c69f8f20e3cbc71593e413b282048e6d3531ad85aa2f4b54da3590f
-
Filesize
5.2MB
MD55c7febd0eb8112e22d25c21e4ad19620
SHA1f6b5827bc9ccbad406ec4596427ad899d9dd6534
SHA25693a893190070c23c8205245b1478f383d5658cfce5e03f413017cd05281dc390
SHA512ccd6b31975ee4a3a12d9fa364da9b34442dee82f29589a8005c0ba6d3146580c9fb347b33549ef34a198608f3d1f50a9fb128412508fd02d7a465ea872d38f1e
-
Filesize
5.2MB
MD509d15cba8a175779120a560f764b18b8
SHA1ce5edf80d345a440d7e6f6909b17f23df0af9eec
SHA256e4813ffc89916223b0f65b1ffb45b57888940dcd08f0f84fff3044eb4c760b48
SHA512efcd9b1bc98115f56813a97311e1ca2201f89df486b690de9bde2ca766dd43db6c808bc147a34a8234f6eaaf5f69eda5d953307599d6a8220c543cebdb25b480
-
Filesize
5.2MB
MD5a8a6bcbee78fcbd526e945c54ca4fca3
SHA19f67622c446041c6517af881aef37209d80dce61
SHA256eb7ce54799ae67ee84161c00510275c5d281f1c85ec5043b63d092f211ec5cb9
SHA512751890d8558046d60f4249b6e951a075176399342d9fd419f2658a6d8e687d1e9f6c5c48f4a443230638a4c5634a416b055229db27af5d8093b8b6229d7e0cfb
-
Filesize
5.2MB
MD5979e17855ef736661ec652097a8c015e
SHA17f3f04ff0b926ef9e91e80c3d7accf9c7710cb21
SHA25643a1fa490f5249752397f21338f4586782f3b9f1151af759df34995bba1844c0
SHA512733c9141e01a8d1d96165df22e67ba48f607d878f45860f621e45a61f2f40942b472a609cb68ec968f08ab119527df3715c4afceb8a8d1c18bab2d959eff3db5
-
Filesize
5.2MB
MD56ebb9b078ba1d59acd08bd93c49b7005
SHA160f317577337424242309767a679497c43b58946
SHA256c0e23d0cd5cbbb862b9602c873d33f3dfb218204c8b9bea738893ae7ce1fab96
SHA5128dbc307d6e3297976717b4e147cdaf70f9c9e3cb10ed7aa711ee5bec9607f0558c50c85392eedd672161212961f071f47c1903b80daff7968138b27281352e81
-
Filesize
5.2MB
MD570ea838123d3273b2c8af988d6af15a2
SHA17323823c4547265c412e37e3d0937a7328a7aa08
SHA25692e8594e419cf70a3b8ed88b4989cff5454682fdea3a743c6a6dd8b6b8c8a7ab
SHA512fe0a8b0d9c5a9bc4da59f783ef2652aacf479a7f8da6c3b9afc41de3e512b32fab2874fc0ee71d5c456483bfd0696e11cb0b9bb34aab4c8914e2d88cfae49e81
-
Filesize
5.2MB
MD5af0d2dc037f1a99a3d4f17c059f96161
SHA1c8be9bea733563ca59ccc5b6def52a27a8a6225c
SHA256e64308b3de583bfbf5b4908bd0f28c91f7e4ee0b1add34e879612ebb0401a882
SHA512f705e48e8df256c56a9a7bc5609bb514712912934f494766804be4d437f7285b04188bd1be923cbf7846b6dcb80400fcf3e5a42c2942fc53a9af0a85275d569d
-
Filesize
5.2MB
MD57f10b4e022a2ab9c330d456b3562190f
SHA19435dcb1e4d8e6c5cbd494982edfdc7de635e1b2
SHA25608da22fd741df9682f94b7e8f648bdbeb7290800c0fa3f8d1af76da24f691c80
SHA512314ddc13a3f25a9781898d79743a82ff7d38093161b2ea9e9897dd75b21b1d79e2258f63b221831448024068c123fb28b008470392b2f7f0d52f0ede63d4792f
-
Filesize
5.2MB
MD5997de783aac4c565c2abfd121929a63d
SHA1aad50fece82aeda51602cb455cd98af7d12d64e4
SHA256616ecfcacf9b727a687ff7ff0f6a44670321dc133d4319e65684ffa14686d15c
SHA512dd88a056fe308d4dee37bebb0f7922f3b49070bfb0b49639e0db914816870da8e1530b64948834d1adc180db6edcb7feba8f39acb9d648467bdc157dd177ae18
-
Filesize
5.2MB
MD581c2df9e5f84f571e07115909ef014a9
SHA13d0537e9d3191f27c51b98783b7c57d6c4fe18a1
SHA2564d70d345ce3735a29c9a2f927d08e7aa261107f3e59f630c0b5fb6397a9b9930
SHA512e01df1aee9dbf239c89d03b224eb86ce8186d2886f12f0d5a756acf009311f3177a689df96d89b8fbe78a5b85ab07528c09bac52ff8a31e333426ba1fee6e21f
-
Filesize
5.2MB
MD548de7351452fb18b0d0de7eba78003c1
SHA1cff4d2505e239a609bcf056ba99f3a9c14321b83
SHA256265feeb8b0e4d0a04d7ca95d809f1d1da72a88217d17f639ca9edb5f1a209679
SHA5128e05726e84dbf4478483244ab5242d3254f946f9271ea34e235093134f7310c6e9514a691c8513e0aba0914ec14f0e472175c6dea1460a710fe62bc3092d743e
-
Filesize
5.2MB
MD51b11dabc71c4ed65ba3cde534731b703
SHA18104a42cae3b19b6b82ac106c4a45b5f1bf5319c
SHA2564c9f32988ac77b8d4e994ba22f88e9655f3c592a8a8bbdcdcad45ad3bdeec1e8
SHA512c453fd652ace2efaeb771cb60cacb197ed0416202e907d7d144cafa7a5316a1ced9d923fc7b0b7f0e9648a41913ef6d07a1eebdc96ea36da12eba449bde84687
-
Filesize
5.2MB
MD5fd6807f6d2d7bbd12f1d0c622696446c
SHA10d74c1df526bf55c19ec4b1449a6678bd6d29c95
SHA256f07209c857a4842f91a7366ca2e4edc9454cfacea0ed4eb5ab4fb924b52f5136
SHA51218b9480b09ddbfaca68f903b83c6436a121be105ff0edefd0898603307943774f0277082d3d948786d985e29e91997ad8298a8d6bbe099dd2771738a50bb949b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB