Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 00:52
General
-
Target
2025-01-03_199cefa00eb6ae6779e91a84c4410afe_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
199cefa00eb6ae6779e91a84c4410afe
-
SHA1
b53347967ff98f0d12f4c28f1b8db11eebd0d53f
-
SHA256
4b4c9bd94bafdca79c5fbef06f11c1a924b8a77f632e59dcc63d88ca6b160a03
-
SHA512
68a51241ec667c1ecf759a5623de724ca9263f2cdbb0289357750b9c47750c96d7b9b9e1d99482d5b032155ee4f7c4d4b22790d72956bf38bbb80245c7e36c4b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUZ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-03_199cefa00eb6ae6779e91a84c4410afe_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-03_199cefa00eb6ae6779e91a84c4410afe_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DSBFRAb.exeC:\Windows\System\DSBFRAb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lUWiIWV.exeC:\Windows\System\lUWiIWV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xrpjzNA.exeC:\Windows\System\xrpjzNA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VjoydPo.exeC:\Windows\System\VjoydPo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QbZHrfH.exeC:\Windows\System\QbZHrfH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PNSpKco.exeC:\Windows\System\PNSpKco.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YLaLhQA.exeC:\Windows\System\YLaLhQA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZAPXTeJ.exeC:\Windows\System\ZAPXTeJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KcPQdGw.exeC:\Windows\System\KcPQdGw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uyoJRCU.exeC:\Windows\System\uyoJRCU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zhUedtw.exeC:\Windows\System\zhUedtw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mtKNYXf.exeC:\Windows\System\mtKNYXf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iIBrHxw.exeC:\Windows\System\iIBrHxw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cpcZlww.exeC:\Windows\System\cpcZlww.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CIBSKGa.exeC:\Windows\System\CIBSKGa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HAXTUGX.exeC:\Windows\System\HAXTUGX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WBDxIUd.exeC:\Windows\System\WBDxIUd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kSjXBpx.exeC:\Windows\System\kSjXBpx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lkAENzE.exeC:\Windows\System\lkAENzE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TLVDpeA.exeC:\Windows\System\TLVDpeA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FpFbsNa.exeC:\Windows\System\FpFbsNa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD567db0e6ca267b9d0c78ff31cb88a4c01
SHA117351f94974d57da2b938e9384d819234f8e38b6
SHA2568d0fac378979500c5cb8337986a250743952df069259960f5641b109dadfcbbf
SHA512d34f770b9740b42cac7cf2199f786a4a58e9ffc5ecd47f9d53b72cf95a59139912e1c342cf847ebeceafaf27f007268677c4e36cd8fc374885d748f5fa363029
-
Filesize
5.2MB
MD54285d468ea0277990d837d028c899686
SHA13d4ca55097a094468cce4fa944ed260a1b71d734
SHA25632103652433bc47a868aef62395b5be5a41d44f1c60e764b081a8ccf57403e32
SHA5127496c01cec49306f13f15fa26d13d75385a8f9d7aa0e8c036c4f66a7a052f664680faeb74f9ee5759dfce3d4c180c39d78428307bc429c2cc3f386a5cec3960b
-
Filesize
5.2MB
MD56f4aafff1043bb63b07018c76558d1da
SHA1510d7d53ea062a0ff9563badc3ff0324d13275bf
SHA256fc4b82df6336bf679f05393f544d49d00b7cc1ea94fc911c5d907729e5c366e1
SHA5128701449c232fc51d9cb8d443dbaf9468be157e71eaf1a2707f1a03f82803f59bd29d6904d4d6c4087e89ba12cb6cd44aa15d72c83db3dcb226fd1f419eb3e125
-
Filesize
5.2MB
MD5fd50d40ae2c5374ebb1a8709068ae936
SHA157cfcb87e4e1f099bd0896565ba99fb1202c3aa3
SHA256b1b5c0317f708327047398da7a958d07c8dff47fe2a2ef285ac1b3afb0ca42f5
SHA512f0d800006e6cc42f6873d376e19383b11731b11e3bb2663fe96500e074106da2c77e72d90304d672b51e14f39d808230aeb514bdcdd36d8aa66a759a2e935304
-
Filesize
5.2MB
MD5edcf850030366ea9142071148d39632a
SHA1c70c4279a222ee388347b18b4bf26ad847179b16
SHA256f722eb8e2a04be36e4a80b0e7036f85ef8fe427af837aa9122f70222c0b12682
SHA5128ba788b0d05af0d27c5940403ea1b1fd479fc05e29d782d82ef04b6910d68872cdb43b835ece9d9cd07782bc4eae072352c12b4b3363c0771d318c3d718cd281
-
Filesize
5.2MB
MD5ff365429169f456889c43b4b88129f84
SHA127c4f0af3f1c6e6e61f805086f6fc70539e53e88
SHA256ba4515b9006bc7f45d9f81dbfcdaef18c9bc163f95e29d1d6baa10d0e4b5071c
SHA512c4562279cb7a742ed7cc6de7f5871e830feb70dede8f6f5db7ee255651a310c4755fbd5211905741a3c623687ad1812bd9961f82d7711f2e85a1a217671483b0
-
Filesize
5.2MB
MD5e5f4aa8a08f6ca5bdeb14b670e49ea65
SHA1ecd9795e8aa92df8316ffd759b1b02834c80d925
SHA25622334a919cdadc3039d320d9f3b16ee429fb7c2866635d84974cea4682ebc6f8
SHA5120ada850f5cfa70fa65a451950ef412cbdab47ebf27fa4909c85460bb2f7dd36b047501a56da3acb99d640eb5362061c29e67baac470fec8c859acb1c8cf90fbe
-
Filesize
5.2MB
MD50229725a64f8ff7653932c0d9e7cf25c
SHA110a00a9a97299b750cc7506b091b3775a833554a
SHA2569cde1487a6b35414b786a7d17063b8acc173bd87b8c22f51970d6283e3d97d86
SHA51214697123bf1f90901ba676435f1ef1cda65ba07dfaaa727e79a87b43bcc78c2bfa55622924cb472b67519072e225e10f08aade3a3ed6b758205ef6dec39e50f5
-
Filesize
5.2MB
MD55bf67b4423ee68215355b7d7c41e8be7
SHA1767d308fb4642139508103e0178e722d5553e49e
SHA256b2bfb6d6e7dfd4a2815152e9808740d8d32579e325e7a40c6df1bfb8c5d9248d
SHA512b2eb89ac4155c11f910308bf10bbd9c4b26ed44a54d7d3351db2d0b8856c054d7e5447fcf77d7f77a704f6165d101489898e239c07310cffb9041ef2893b6a86
-
Filesize
5.2MB
MD5a1b2efaf53629ca74f3586306321ec4b
SHA12503a9699b845e0dfcc401f814b1370754542d67
SHA25616aebfab731fe5faf0fcd24777ecdd0392ccdb064399c493349668e9269737b5
SHA51265d7f09e3000e4438f2d359aae5f8fc1bf812a4db19cd5900a099f200ebdb9ebce830955bb0aa8bfbba69e843e53f03b3c5a00a7c7241afc9d42be762d8022bc
-
Filesize
5.2MB
MD522238905effa97365dbda9265d68c263
SHA1f41917edc8519c64acb5c5f914f46269d8a0f59f
SHA25616dcbd7708ddd5041ada079915a9ec2e3a0eda9017d0f9fd5df91c7865080e7b
SHA5127294026ae80bee3ab7dafc6f5d135a641c3cabb98b7ed520f9291ceb30ea5bbab8b81ed9594e3804771892b1b3db91e0a700201b237af2ab1e9479322f47b85d
-
Filesize
5.2MB
MD5eaa41a602e65de443f9875775d637d4f
SHA1984d42f4434c3cd84ea3bade7d5ed630055d9610
SHA25671df367eff42b7d2aabaf6d5f9a949e1f49341d994f365509b4de13f08eafc9a
SHA5127a6f9b51c7cecfa40629dd45b05727a1712b8fbfb891d3ecf7b2d2d44858536ed47722f376e77ee27b543cd998026e90ebd3a9575d545f6a88797cf698da2d22
-
Filesize
5.2MB
MD5984544678ebc646c94ed880e0e543552
SHA1013805821578c9eeeba893f21dea0e4fb8712e53
SHA25691fa8ff0eb65abe0bd7dfbe7f27769fa079124df8d5e279b64167e098b6ffc6b
SHA512c7e8259128cce06d0eda760b8aaafb2de370cc74f4b277478b643ffc1a721d940eae415ef1428dd21486e5c6f770e6d801957e6b02ab0cd33cdd6bb186326974
-
Filesize
5.2MB
MD546a895b3444303a4cac13b41df5f9177
SHA159f67d88a7c09b0252fdadfee4b954c486b54d42
SHA256e98fdd75c1ac5628cbd7392adc580af23932792f74521a359e84ed27aa768386
SHA512464a223fe417e6702b56213779b04b8655979517fe4be521e4251c75325ac34612d358b2a93b14986c1dc9b59531288d8854b9f5a97681372feaf49050edc5cc
-
Filesize
5.2MB
MD5831f3e577c77bfd38f37947829d99032
SHA1526e355a88f113401f0f066f1a091b1231520b5d
SHA256abeccabd3758522719270a8f74ba626c1420ec486b5d39ffd1bcc84cc948bf4e
SHA5120a365216aced136e36c2aa8e08e04d0dab8a11d33a41953e3f8665532f3ed6e749dc48ae104ced16c527d9a780dad53833d321ab2d6555f34cbff510dd1036f0
-
Filesize
5.2MB
MD5b2856cfb5a84c520e4072aa811b11772
SHA11d947857924d3bfa2be5a52bc826ba6743b03cbc
SHA2561bec453dbcc702bacde3b03fa885953227c9811ec16ff55d516e57138793f971
SHA51267e5cfeac5914504b40407b9c0c777188590ea5280857609b66134f03bb5fe16e3222d0bbf934d1cc351123247130537f312e113858e34c07453ef965e373f8f
-
Filesize
5.2MB
MD5b7d7b7bc1ae1ff7aa9023a4b8b470040
SHA16bd6e3d25639683990d5f984bb54136338a60bfa
SHA256c19bc2b76ad580de05fe75435ce5dc9442b0e0e539553e322b5203fc9b8c0c53
SHA512debf5f4973ff37ec8c9699a122fd5e2c80f24af513a2d223c31314c45f1dc427c48971cd31575bf49ac4b60b9bab19a6b07a4c28c4e6cb8a16104557c1acfd5e
-
Filesize
5.2MB
MD59dcbabc4056dbf21c028aa4b58fcc656
SHA162ff22d6a47066ff860f51dd50eaf29954844296
SHA2562c0ff81328ae382453bd2313b6f1a188cb20128c34b2f8cba44e2f81e8423cdb
SHA5122401a042f19a82fe32c41fa439703ad1819249ec78822aa9f233bcda9d26e4b66702c1753789fb6e800cd4387131e8a87a18d295efad3ce6d268e48820a670b0
-
Filesize
5.2MB
MD5575896e78bf65228d61c0db6af796417
SHA1c19a308d82146941d240501c2170f4b528d2efe0
SHA256d3df33646044b27996730659b0ee96d6945d542454290c9785276a11a4f19bbf
SHA5125f3df3263f0e36019cd8715445608f02e8c1b2c332d16c93a96e7910e83c8668585d206203a797b31c5b608a1bc6b2af5f66e57d9adc9a62608068c776a839a1
-
Filesize
5.2MB
MD5b266995d1e490d171c1a203ed32ea179
SHA1db4259ff8c56055d867c95ff279e20f4008a3fb1
SHA256261207ffc1bb4b7c481ac4e86d745f0e631923cecf38a5eafaca4c909ab134fb
SHA512f5b05b900f012044367cb2901074299f1b2168d3ee731df6edeb0fff2374ef220d44ee527bbaa5e24437156f884e2169ec71cff1f8d312feac30e97e1683afe4
-
Filesize
5.2MB
MD59674546461d3a5a801d9430645980fde
SHA166a48c39370ccd2c9ded6baeda69b930f3c0c9b9
SHA25613f19de0cb07045382d12acf7c6399bd40a3fc8d37ed9ea8f944a4e4e9ad2eb3
SHA512183da81c6f083f2418f8a603f2874b530b3aafeed37da68a007f10ad4f681a361aa99017d039d26d7606a99ade9a732bc78213b75649f1e250fe228645cb01b1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB