Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 00:53
General
-
Target
2025-01-03_285c576fc1e49906d1fdacd185d0ba3f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
285c576fc1e49906d1fdacd185d0ba3f
-
SHA1
210c551e05b236ca2b61ea44c226ddfd39d6f060
-
SHA256
3c3eec6a8a56558b265eb377c823d16369592f43300132047ec1ce413514e64e
-
SHA512
5dea789dc71c6323fb5ec98787ce91e332e8b07d61d2f4305dc8fa59bb426847c00d15ffaf41c17365f0265e769690a7305c3e53f729486b9df3d14f46fefa10
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lUV
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-03_285c576fc1e49906d1fdacd185d0ba3f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-03_285c576fc1e49906d1fdacd185d0ba3f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LBxFdcn.exeC:\Windows\System\LBxFdcn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IvPSdTg.exeC:\Windows\System\IvPSdTg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kusdlbq.exeC:\Windows\System\kusdlbq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YvZWnRX.exeC:\Windows\System\YvZWnRX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yBLisCB.exeC:\Windows\System\yBLisCB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fcqGenk.exeC:\Windows\System\fcqGenk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mhSYPLA.exeC:\Windows\System\mhSYPLA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ADWShud.exeC:\Windows\System\ADWShud.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yxHfpHE.exeC:\Windows\System\yxHfpHE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SRpJaML.exeC:\Windows\System\SRpJaML.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oOcGLrF.exeC:\Windows\System\oOcGLrF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ADqPFmv.exeC:\Windows\System\ADqPFmv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VNgMJTp.exeC:\Windows\System\VNgMJTp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iFhKtIH.exeC:\Windows\System\iFhKtIH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OFAFTWJ.exeC:\Windows\System\OFAFTWJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\COCovJV.exeC:\Windows\System\COCovJV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nCQItHG.exeC:\Windows\System\nCQItHG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bNjNbfP.exeC:\Windows\System\bNjNbfP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UlTMlSs.exeC:\Windows\System\UlTMlSs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dxhrMvf.exeC:\Windows\System\dxhrMvf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MWIHXls.exeC:\Windows\System\MWIHXls.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD519c004faaa023763becf71569d91c4f9
SHA12a63c40efb1a938ded5bd4c18d732d589182d174
SHA256a5f3950be066b161d5b957f3eafc8f853705a5aaa0537713a59f83f0aa71f106
SHA512983a35dc6fbfc151f85ef18ddc9170c89601ddb03b65dafc3d1a809516fbcb941ceff865ba7b2e6c7fc34170d7413d7112a565cb3c3eb4d86f95c0351fbe33b7
-
Filesize
5.2MB
MD5ea5ee67a0dddc5c7edd055f07e01927f
SHA17137ef187718182c4568b509f1bc382e7e584dc3
SHA256eb221835d07a0d6de248d728ac78eff528e45af475ce998adb01d135370a261e
SHA512449a6c7dad81410e079d01e350fa6287ad446c04166de3d7b879188a7333e0670a8587135d425e34a4a1e0365f29847dfa44abce4206aaf4c234a08acc0c9f8e
-
Filesize
5.2MB
MD5f2dd3a0b6056daba276b81bb35316dfb
SHA1f611815c86e01e256804d9413c9a2432c3048670
SHA25656cd40de60cfb99fd3182c4e00e8a9befc678dd393a4184fbe159419f8fe77e8
SHA512f69f729b5b870a1ad3b3708bddd6a5c03c6ce49ec70be621fef6342929148da1dadfe1c4303f143725cf2b8b3ab638010a373614091406409abfff1beb6e1059
-
Filesize
5.2MB
MD56058f184a13f9cfa5b0cac0b90318385
SHA1e3fee3f0058c157af85e3db82daa13fe0fb5efb8
SHA256f49b98508f5089a90ab0bb1f95ba723177dd2b0aac44fa1454f3db96bd2a5477
SHA512dac2c8983edccd3b57177eff62f51f912f3e661bc77e43787b690e4659f99913d814f187c7adfccac10fd82968700be96688cc850ef31e19cf3d8d28efbe4378
-
Filesize
5.2MB
MD558b31b1d47f2ccc3197e04303472fc4b
SHA129bad340c95bd5e7f113a831a2be8dda7fee87de
SHA256eca053515c0ce955dfc786168f13e382ffa437164fe332ce8a68c47dc18a063f
SHA512abf2173ce2b87189f1a25df9d52a0bc198d6c8497796578695e4451101626dbdde5f2961dfae930ae5df0a7854233a7a522577b2f6cf5fd60bbee3be4ea119bb
-
Filesize
5.2MB
MD51dc10aef40cdef3e2cf3e82f839634e0
SHA19a1eef3ae298839f7513ee485ec88ec3adedb8e7
SHA256b5d396f20db97d1aaf62874145dc89ea5ba59e5957437e95d7eb61c0f245b2cb
SHA5128e340431b236050f328ee1adb3a5a316c8eba0c32533f67ef9e6f853aedd19bd1b772480715e1aa5376a4ee04d261cc7a3f8fc7a5dd7cdcf3b0f4b2ae8f67fa1
-
Filesize
5.2MB
MD5f2b467ba5637bed91fec091f9b832da7
SHA1f2782eb2e565d71d1eed96599e5d2f5233794951
SHA25617ab8d5c7853b1a1ee7224fdf088a72d3ea19ebd6ce297cf8948227c2991717d
SHA512bba4b722a5a881889f7d35ab1463deb42e7bb53915f499f5f2a86c766717968118ea37161511846e32679688558eb1d6dcd19d18522ea0af558e163ee98307e9
-
Filesize
5.2MB
MD5a3f9400cabc6ba66af3d3d85854d8343
SHA1c3330f0e73e3a65ffadf5b91718085c76c76172d
SHA2568fc0f01d29fc49c69736f20c362d61419fec279f15e7423467c245f9b529b063
SHA5122d5a0f110dc3149b4445a710aa26f835164dd3c405a0cf267967e8324bbfbf12602ba2518ddb0eeb4a24db82ce8dfd76dc06581b1007d7f86743fbcf6786b216
-
Filesize
5.2MB
MD5cc997521d1b21f901ae95ec10c5b192d
SHA15da5d85046cd7769344c06dd60144f4a46becade
SHA256ffde548d9f27a6704d2097541b6d3a3b93c20ec347f049e21ec1764d7cd36496
SHA512a7ebba3ebe36284152740fead1cf142ea976e27cf4c9a4fb909f3a2a176174e92eebdca467e093a5aae09959424b05074cd92e3891397732751ef67bd800d21f
-
Filesize
5.2MB
MD5c38bc09e9516c5f9f3dde70ff9d44cae
SHA1a99fa9e54c85686d77c0353f9048b29a7ba05512
SHA256d866947fd4fc8f92118cce2fa1e05dd82be29afb475736314a89f3222090bc09
SHA512e0412867867f924c66fa874c6dc1b1313202a18b5119aefb13d1c2e5e11398e25e51ababc155fcc4f7ac65876eda5f286fd31d832d330aefa103498dd16dc205
-
Filesize
5.2MB
MD514468d1781368530a54d9c7c5be80d3b
SHA130d05e71117b5e65e8ab653c26e460a64284228f
SHA2562a01685c25fa2e7a3e1e0af0fb490661a136a5142fe1978da581674a126dd51e
SHA51227aeef22a2c1b4507fa285d1641accb6b98b84e56aa8eef3fdcc58288e97c00e1d22f476c4624f15a1dcf04841f63b6c4ef12937e4e7d13eb3260f0691396e58
-
Filesize
5.2MB
MD57cdd43918586402216f8d47c7cea3d7a
SHA1a5cccbb5b4d0cb59f39a64fcfe7bbdaa91f077c6
SHA2568c11d773b77d12f1e8d8a8818717795a5dc4df38c286cc2e66ffe49bb7612635
SHA512167016e25c38c61f5919e060c33153285f1efdd56bd866aa3609d181b72d0b798edbfd84b057a81f33c926edb1bbc5334d9cf286086754760e25312253aa3975
-
Filesize
5.2MB
MD59f5d2633e2db6f7c8842facb4a206879
SHA1f941391273902e56e443b71e72184aa7c0c42ed8
SHA2563604a4e5dafdbb2e302008952e699735697520a80b6dd7fb3ab5acec3d27fc57
SHA512c9cbc95d942f5346dd05f9890e02083ab4375733defff4af1df1469646c9b40dd673e5c4c5e10cff701344b5e06912c450f399b62285a3ec4a43cf2a87998bd0
-
Filesize
5.2MB
MD5f9afadcf839c44f35c52b39c5a302742
SHA15beed59b6beed080cf374b9070bf3e139bd447ca
SHA2565c1c248aaa70494fdb706cb7058c51ad95cb58f95a91a1ca03c5514c3ce3ed3e
SHA5120a2ab7a019113d3fcf6f10da2609e82e7191a3f6faac5ba15ba6102bd1a737f62c491325164aa3dfe872032a272bdc5cf2d71b747ca0dab84113a47489dd1487
-
Filesize
5.2MB
MD57fe701a4ba0e3a4c71534e97d8f2bb83
SHA1fbab5f8ce7913f594af2e1c241b21ff5d5b5be5f
SHA25672777be9618c41b215aa6e5426b48e207396c20b4a1f8572c2cfb851f77fc8b7
SHA512f7db30bdf239395e5a19e0f5b585e4ec14c006d2b88db7478395fea6284705a426b8f0dbddb06858aff4de56c77f8c7765f888e75dd69378df965fcb27a6deed
-
Filesize
5.2MB
MD5ed1ac8ea793ff24bbee626ea6e212356
SHA1e5ec47102ed29c3f2d2da6bb1692b2f8f438c622
SHA2569feae07f7006165f6d4bb67bc39cdabfd36e251e13a8ad4e97bc0f1d5bbe3d72
SHA512804e020596240bf5118e2d44409aaa068fc1b2cf315f54b507c062e18daf80247e3943066fb71b67b4cec7ff7cc5a236e4ee9f8157ef81780fbfbf3b1d2fa1c3
-
Filesize
5.2MB
MD54b797bd1026feb729ef83ad2dde82e90
SHA17793b6d0207ed0a10d75c4ead06067fd89a2dd9f
SHA2561609007512a542ddbe936148825f05087443a38af28d5e5e5053b0a6fb071dac
SHA5122cfda8d3d36f7ea80037089c2812e79ba91ed9ccdeb5eb57ce3ca53ce240608992a99320d24a6a947b0dcc9a33853d337c896b9467a6ba0b96649e49d621cb52
-
Filesize
5.2MB
MD507daff7eff737b6bff634aee18b01413
SHA19a25fb4b9d36a1fa2c8176024f76417739bd47bc
SHA256feba8e94550fd33f366e43355783457973756617d2449c12a09b43b3f4d836ba
SHA51214f21bf8ee251d8f69e54cfadb810239587cbf60789bbb69ad44222ff680544e8e1da549190095a4a1be0d48deae7dca990831687ba673b6ac206e1da893c272
-
Filesize
5.2MB
MD53c83e236e358a892aee2a09dcca4c9e6
SHA18483c0242fcfe4b2d805283272a8ced80d1c2634
SHA256d2843456bc562d0918ee8faf8a49e90d389a45090ee03fc9c713a1cdd82e6731
SHA512d77b0f91a9a9b680d023a2fd3e5d1e56632b25ff0a175ca3d876e9d209257b65cf600e66c5a8f716eefc6f6afaac8dcdbfd353ecfb4eba64ec7fc4f944b1d816
-
Filesize
5.2MB
MD5958f579a4f14545c2e6f8341f1af8083
SHA155bb0e6c3d1eacafe3f53042131ab4ced2e0eb5c
SHA25607df0b6b72943ac786a0af18477091310a19702fa884e6aa6f11c8057759d926
SHA51217bf2069506b9c5dfb08f4acb3000e58d4233bd19e120ae384b6704dbaa2c881f28e6e46e6ec0c0dd81035feafa30bafa628d43016cc87b4d038a61fce475f6b
-
Filesize
5.2MB
MD55f1f47b5db5dbacad3e0fdae6f2b2dcb
SHA16c76305f768c962780e779ce14b8448bc1ee8611
SHA256c5e4cc59c0adc535eda363669ae0bf4a13650b54baf43371c3c48ab013bd8ff9
SHA512ffa5498d6f0903b1a30d4646bf8450fe4f9d1f90eaba63854b75a346037c7dba5f0163c651a111335c9f7919ce82756e7fad705590d1e40521781917cc1d7860
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB