Analysis
-
max time kernel
141s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
03-01-2025 00:52
General
-
Target
2025-01-03_199cefa00eb6ae6779e91a84c4410afe_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
199cefa00eb6ae6779e91a84c4410afe
-
SHA1
b53347967ff98f0d12f4c28f1b8db11eebd0d53f
-
SHA256
4b4c9bd94bafdca79c5fbef06f11c1a924b8a77f632e59dcc63d88ca6b160a03
-
SHA512
68a51241ec667c1ecf759a5623de724ca9263f2cdbb0289357750b9c47750c96d7b9b9e1d99482d5b032155ee4f7c4d4b22790d72956bf38bbb80245c7e36c4b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUZ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-03_199cefa00eb6ae6779e91a84c4410afe_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-03_199cefa00eb6ae6779e91a84c4410afe_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NPZvMcw.exeC:\Windows\System\NPZvMcw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mdDpOYw.exeC:\Windows\System\mdDpOYw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qSbYqBJ.exeC:\Windows\System\qSbYqBJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EralguE.exeC:\Windows\System\EralguE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MUIswUz.exeC:\Windows\System\MUIswUz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eFGEIRY.exeC:\Windows\System\eFGEIRY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uKKHJdM.exeC:\Windows\System\uKKHJdM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dmfLStd.exeC:\Windows\System\dmfLStd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QZyRWQC.exeC:\Windows\System\QZyRWQC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\migrlPD.exeC:\Windows\System\migrlPD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OZUkyWg.exeC:\Windows\System\OZUkyWg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eMxdXOn.exeC:\Windows\System\eMxdXOn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\taGaPOO.exeC:\Windows\System\taGaPOO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JNtNLdv.exeC:\Windows\System\JNtNLdv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qsADEqV.exeC:\Windows\System\qsADEqV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qbgnyAY.exeC:\Windows\System\qbgnyAY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UDcPdgb.exeC:\Windows\System\UDcPdgb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cHPfZDW.exeC:\Windows\System\cHPfZDW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AZAjBLM.exeC:\Windows\System\AZAjBLM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NYToXTP.exeC:\Windows\System\NYToXTP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fVdkHmh.exeC:\Windows\System\fVdkHmh.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5271fd207987c78ceccb30338e82fb544
SHA12997de94b903321e0e2ab9473d83654acfc7fabe
SHA2565ed5663acfee8003c4921da1321afd7e377f87b65d440a945550778a22dc7dff
SHA5126fd5f077bf848be487926dd1ecf63d02bdee12dedcc190c86a3163bb4cb52e6bfc46a4d9bc05b525dd2eab360dc60ecad48914c60c611943437b555c4b333e54
-
Filesize
5.2MB
MD56dd81c57cc2ac256bdda82f512481190
SHA1e9bf411960d3672175c7e391813e05b565346b35
SHA256bae1ab7b61c6efa38ea84ca0c94bb567e6e3971a961ec337323966bc55497db7
SHA5124952aad4c6cba58fdd5d62981b3cb6fc0880b2c6b4fcebce4a42c57a4fe0615b228cd1b845ab4f2819a3319c8c76ef36852a765ca6d255a33ea7761112100a10
-
Filesize
5.2MB
MD52c86b301f5121b0e8f5d428cb1597c03
SHA14a8ef83f6169bdd73b058adbca753bcb21fd64d5
SHA256a51b551cf74f5faded9b77776a938564951687e82c56456eb545877b6267ede7
SHA512655c2dd462e57f461f4c5688439e7b62085175cd4de4c087ba5a785dc1346cfd4c5ceef3effc048ea6909807332237dff44da0b6908d85dec4231188bceb091f
-
Filesize
5.2MB
MD5b30ad3d88edf49ac0b27a70b3a54b25d
SHA10c3e24b52b479f61f220d78a35d39e7e14466aeb
SHA25693007b0fe048c8c864f726cc9c9b81c7d890bb749a8f376f59bb13cb0f6ad76f
SHA51266d075a11a6c8fe1a531c12a67435ea3a25b359b9fa61276778fa7465a3e910458192b3bdf15e21e8bc0b3569a12fa40d41944796b41b37de306f23889ac14a6
-
Filesize
5.2MB
MD54c53a3a2462ea412fdc90b6a4db5b319
SHA16bc0f8e840c121c449cff0b033f347984019e08c
SHA256f650c7d7a5e9feb76d80b724d4c727ffe2e26f91b649c49fa02be308c06e646f
SHA512ad24f3adfa8bf4c7ca7d65ac09b0d49a71b00acecc332c293eee872d1495156053c4570f88810c47bcabe0cb909318f9367601aa81d930a3955f23aee85b3d4d
-
Filesize
5.2MB
MD54d3060995312ae9e6f049fa90c6ea059
SHA19c3df8d7f371d96293c7bd6cd3f58706d0287628
SHA256276196270b96dbea0ed4b120976a2077a633915745ad2195514f67c60e28a172
SHA5123858e27a50fdaca9eb4ee34dd457f32467a8de7758f8d7d40fa838182174d620d55bf1ae7b977665f32902d643c0ea4870422c0621880939c4af6a037047b03c
-
Filesize
5.2MB
MD5445305ddf9a2850b0eac91098f25147b
SHA19305fbe99388b432a0fb8871c1419970454325ff
SHA256bd17f8690797c945417aa40661cb8d340714b68adfb70c8bd54352c5c18a25b8
SHA51236d72d69567f7f44eb9b06255b6e633f0232e3f6cc8f56a6fdce79877edee960ec6620730de0f7f06b3a6950f9cd28a36cd061835bf340e41fa81c81a6590364
-
Filesize
5.2MB
MD5acd616c55787ad7356a16b5f14c3abc4
SHA13cd86963052d1a249f42ea7fcc6f30270abcc9d9
SHA256cdc560d81c66463b92c40843b6f5e7e40c6165d61baccdea317b3ed6af9f4c37
SHA51277ee73b1a1a8917cb3eb90752c8589d28c9d5cef0ada25a95e3a9b07991cd3c8cb4a9ddcf766d3ed658904ac1b662650ab9ae4a5fac45f3fafc63bd474336444
-
Filesize
5.2MB
MD52eb32bec6c9237968449cf8824176796
SHA18ef9b10fc96a8d8f1f372797e637eaaef78b8485
SHA256ca59dcdba7fdaa077c3e5255a82ef717ae61fba3dabed689b1b4f03012e96110
SHA512e2b9262c8930d13a78ab460b17cc919bced3e85b2827c49b6029c3ac5bc0ee103d1a0e304b9cbb79e021b495e65b3462e4a6f1dcab5e28ee6ba0f7330b35792a
-
Filesize
5.2MB
MD51464975203cd80cbd1db549835f3e60f
SHA1c27960e888f0768d885d269c59f2e6d5a2a62a50
SHA256d60a96c03c7ce964e896e6cf32d34b3a9bc04008f53b9328afe0f87c343f1f84
SHA5120dc3c309396740a1d48498b156106c71363d0341c7c940f4ddab301bdeb3bc94723612b792f8fb4b03f4d40c555993c8236f24b3b02c865b9eb46a1c5544017b
-
Filesize
5.2MB
MD565d04bc4317e50c724c8168f44d82ec4
SHA10f3f8b1efc2cf6bc40eaaa4c9288df331dd350c9
SHA256de93ee6a9a4303f1526fba06dfe21893f6cf98e51974f4234156b0dc3d51488d
SHA51276836007031c137b7c6de73ba7f0330e18be91bf27de811f219f003343bc3cafcfd6c3f1edb6e78d92fa64ac1685d0ae4ce1ec4588d61e80d5784c2b264b0024
-
Filesize
5.2MB
MD578675f9259d0eb7159442f9be18ae828
SHA18500a68b05d9b8993a7de515ffbacf15985dd983
SHA256192a3f94c3bdfe775ae7f6d65bb0e60145f04252f250a208788c4c49e650ba30
SHA512b56d04d97ff55ab22d434e75ad9d0565b8baa5f2d4dffbb7f4e28124734d47888ab189ffea9dcb4332fa1a199f8aa6cedc5a68f423e512b0f7f43f679e3ae9f7
-
Filesize
5.2MB
MD522b6d808bb05f1dad63b250873be432b
SHA13bc45d6b32bdb63004230512d184791bc64ec43e
SHA25685dc2c760ab0d476c4b9b21d482ccbb09317dec106975841a3f78dd994c8c038
SHA51294709a3c24db303200c1aca08327c58076bab39bfdd6ef8689eb2ad513e6b5bf9c37d6544f88b9b7d406669dd0745d8e134af82dde1de5826049b973bccd385e
-
Filesize
5.2MB
MD5b1fe412ccece85362d5587acf5af3ef5
SHA13e9eef09ad145f4bf7d0ec44055704f8930fb178
SHA25649eea96846e07aab0135241c7a43247c4d620b1158b1eff7b710b03d66fa7c03
SHA5122e7520b39080ad9998896959529113e3d5d261e6dfe500bf7945c26388e800b128d8ad3a23720801b003ca7f948e2f680c0e34abd6e1e77d44883371b5321a6f
-
Filesize
5.2MB
MD53beb16ede3f924807ebad5852d9bc7dc
SHA14ab9a1745a7ea5d98fefca363591239d9f56e63f
SHA25614edd273ad3a371654bfbb72c2d7845093fb8deb2474e1d7662bfdb24a2a981e
SHA512af063ade1e68bc131fc1baa686be8cd39cf65884b96c79f607117fad2888996d0197e89bbf6acc15c9cd1c6a36abc4e22656c194e047fef4944c2c4cce0115d7
-
Filesize
5.2MB
MD52f80c987df27600eaf111b2e225a6a37
SHA1eea7aee361a6b4af5ffc2f3ab0f25a79743aa7f4
SHA256fffc8ccbc01e1afa4f1aac3af032c8493e4b4ab48566f6055ca399e87e263a08
SHA512ed951c0e6816428e775df444e86579de2aae470a43d12b9307ae571f114824fc9e5ca570679f8c820493cb40193a10b2cfcf2de85ac42e6b0e9e79b67ee346c5
-
Filesize
5.2MB
MD5447ec5e0e9d891db2153ce36124cd6fe
SHA17b0adbee71bf609319001e3712081580e7f91266
SHA2565be0c7ca406c18b0d109e5ad12fd1f937c45a3870f6a1f3f3946bb5c4244cb9d
SHA51283d09a66fe6cb688afff54dcfc6ba8392589e3838812eb7565dfa1397508fcb8125cab7ad14090c4fb5f3b67f25a66ed91578f3205813d7922a0ab671c9c4c88
-
Filesize
5.2MB
MD54ae5e9076aa60d49bb2b7fa941ff212c
SHA1509fb1bcdefaf92e24d3ca5debf4cb3871e63bad
SHA256cee92de323871cb2fdc9a3e83912792bcbf6c93ccde6ae32683194143d256197
SHA51256829425df671d6d13e259124ff01daaaa816174dc8576aab89bea148436c0548227bcf7099896692ef1293247839906b2351c2dd872d12d1cd61957ecb69263
-
Filesize
5.2MB
MD53b2942c821d40e2948798f00f15535a0
SHA1815b87f8c1e70db3d1c352514254b6fedf7254b1
SHA2562a61b923ee46e96422a31c6a966246b735ce88749c6ce95db1c81a942127a89b
SHA51244af7c7feeb3bdbc53b70ab8cfd6d27c57b113355ede622bc5743c05197f9ab53fea7cd0c875d5376cd6b0d0512ef1f7588ef245f3d766d1549a1a66d2575c72
-
Filesize
5.2MB
MD581b0bebbaebf6d242cbe104cc1097de7
SHA1d177b8768e888ef6a7dc98b868e4fc4157589124
SHA2569a2b37baf464df6ad6798369a5fd6f19bdcc0d53ca3e5438d4be2ec8c13006e4
SHA5127be05a62d0d506847f577cbc083e3b8c45031d7aaa4dd0bd5a32b1d1c7af0cc95774795f85083db470fe488d49097370e78215a8227e18e874845d5ed12f2edb
-
Filesize
5.2MB
MD5614aa1dc9ef0469ab1a022d59ec67f78
SHA1190a7ba24c26e08bbc288eee51ea583f30ed1813
SHA25677557638ca38d12597586ca481a9c9a24ac5b38c90dcdb1c2646611e7e274d9f
SHA51290358e367c4e1726a56f3f94a589c0f65fc7e473bc201018afe802e9cb0c974752ba0fe2204fb9ec8923d3a38b18fb587b35ba63bc2032e9faba875e4ca93c0e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB