Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 00:53
General
-
Target
2025-01-03_25ab1728560cf051a74f08b28f492396_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
25ab1728560cf051a74f08b28f492396
-
SHA1
f48fbab0c7b3393ee4e68cf4e9d1b8ba786528d7
-
SHA256
006dd734701976a99aac5048bc4b798bb3fe83d0cbc927516720cdda63c8441a
-
SHA512
b55415d5cc2db04178dff84edf34849317f847fadbafcbd7fd08c3a8aa9313df82029c70eb8d5c68e347463d571698bb8f007a5361515805b24efb3d6e15819d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibf56utgpPFotBER/mQ32lUP
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-03_25ab1728560cf051a74f08b28f492396_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-03_25ab1728560cf051a74f08b28f492396_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\inVztIs.exeC:\Windows\System\inVztIs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jZUHbaf.exeC:\Windows\System\jZUHbaf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PJEamsr.exeC:\Windows\System\PJEamsr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\budPAdJ.exeC:\Windows\System\budPAdJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gSOVunS.exeC:\Windows\System\gSOVunS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lBFzoKj.exeC:\Windows\System\lBFzoKj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OlJyVdx.exeC:\Windows\System\OlJyVdx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mMnTHjl.exeC:\Windows\System\mMnTHjl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nswTjyD.exeC:\Windows\System\nswTjyD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pXVHeEZ.exeC:\Windows\System\pXVHeEZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PRzmUwj.exeC:\Windows\System\PRzmUwj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hOCHSRL.exeC:\Windows\System\hOCHSRL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xcoNWNJ.exeC:\Windows\System\xcoNWNJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jIbXZpT.exeC:\Windows\System\jIbXZpT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mgMKrao.exeC:\Windows\System\mgMKrao.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MJrJuGY.exeC:\Windows\System\MJrJuGY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CpIoNOY.exeC:\Windows\System\CpIoNOY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EbxNHmR.exeC:\Windows\System\EbxNHmR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gFDOmnc.exeC:\Windows\System\gFDOmnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vELZzQt.exeC:\Windows\System\vELZzQt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DTtYySj.exeC:\Windows\System\DTtYySj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56bb68a701a594c25426d68bf8ed85aac
SHA1f6e716b0c460c440150a591cb6744cdc93c91c80
SHA256428a12ba32c7c189d7923d3630514a7cfbcf39e9852de7f47df4be9e4867b75d
SHA5127df512fe74604a029901e96c3b7b70f0194eb53dd74fbe1375ae9dcec569d9b8e6e451b72f09559b4d64a1d2991e4bf626e9f21ccac7593dc5dec2dc9ad53298
-
Filesize
5.2MB
MD53ca6639cf33499bb3f91eb6f33d8d0d7
SHA1cce13a3898b398251217e717c72c3f8d59dc2fba
SHA256404ee2a06e5eccf581ce26c2d6bd46acc1a6964f7d3839c2d95bba4b983a24ea
SHA512d45273a7b0750109a3b3a29e4dfd9740babb7abfe54d5d7c10cdb9488a5f480aa91bec11659c7192cfc27a215852aee9c8f395ef7067595eaa88f937059b614c
-
Filesize
5.2MB
MD59cc7f8e46ab67321d1298e10b028af55
SHA1b0754839efe8e95005581266cd99a9d14613a63c
SHA256bbd76d31345707d05b3474b6e2403f07c68e96f9c5c8556cba536886657e0d5c
SHA512f2d323ed3a76bf3cf9759b38e4276547db2061c987c67027e25ad9bb0eb8b637a23e230c8ec2639c9d32460eb29803f355aedf0bafc6d90c78f27fb42bcb1ad8
-
Filesize
5.2MB
MD5566332ea4030f86dacdf3163a7561726
SHA1e21590d2e9289f65cf65d03ecd64cbfb2de90a62
SHA256f33cba02752c7750b9c9760bbab7db5bfe5f0647edcc74dd80dd02d5912fb8fe
SHA512841eb0cdf8876a026402d3dfdd6be5c7912bf24e86d0048eccca86a28e4b1531711d2293dfcfc0f1e78e2ab8e2e974cd90845e1d1ab2fdfff023c7354bb6b424
-
Filesize
5.2MB
MD5619ec4b6f0fda9072e87aa39e1f8c749
SHA1ca3bc68a773036d099e4c697486b5610d8e02b31
SHA2560d7a7b5bd065a7fe8d39ce7cb862aca50afd2564c4215537993b1e7998a28768
SHA512b0a557c196e6b5c77ee75c07ff572de2cf20e7604d02485398181b8860fd62239ca66cdef96277e85e880bdae8f3abe0227feae0e01fe3879be6d4baaa4cc042
-
Filesize
5.2MB
MD59cd4ab1a6e97a52d1ce270fffaac3efc
SHA143fa7a735392bdadcc0982866e6ae715f8e99c82
SHA256340e1c8e13e054344894aa9d2c17a1ac7612d0fe5865aa1f9beaf3f4ad90287e
SHA51224c62bc9fee5abcd3c7e3a4008e72e7f2b4c0361990be7e411181aa2df83aa190af42128fa0f86e4f2d77ae1665890485ef69c18d9e13aa907ff88a0d5075835
-
Filesize
5.2MB
MD552b91d6d0878c62a1e9659e713d78c25
SHA17436c07980fc24fc577b026c3eacf98fda1f0dfc
SHA25646deeea418cb1f79ddf94be5bf69deb2dcc83d57d4b93f3e64ccff133f6e92fb
SHA5124bf48a67e6d62a5fb99ccd08a153f4ab8f6cbfb5a32834631dc2e044379bf484334232d5e0db6611d3ed203204ccfa1ab859edaceffce111412a680b9a0262f4
-
Filesize
5.2MB
MD5df2f194d61b2af51d4c47cbd7fdf9380
SHA164415f81b96665539a91410901543823249b5a4f
SHA2564ce3c00880045d7abf54398834b7165d0bfec31deb7ce85e4628423d7bb7bce1
SHA512e330e28fcc5117f953411a4f70d97a30a2e4c74c9026d2a76b1021d8ea5b7a849e043ff10a28a1aa1bb81d0b23c77d3764cb1e4e0af59e3b61f81a72b6fb9587
-
Filesize
5.2MB
MD5203a549259fae98ab3bfcccf5546f1ca
SHA1d5e6a0894f0406b75a9bcca295dad2c507c64f2b
SHA256231579c36255238fe4ca4f053793455fe7e77330d52dd357211ec0a2afe54f7f
SHA5125019318aea19a7ec0d03fc1f036dc09dfbdbcd2c5cfe02dafe4636b10474ee89d0189d666389d42376092ff8ae8d8b701f717198a112e99ac2964cdb8bcc08f1
-
Filesize
5.2MB
MD55113ecbc6d7570c2af5d7c00f914af66
SHA1f077006d2229d0b34544fa3ac3d1413376068f9d
SHA256e6c7cb3e0a42c9d998e63c2079896e647b6a7180a60fa06a81b2f9da2556adc9
SHA51258dccea2432e6bf2b5ab205501113576af4914d7edc51214758c88e958f4cdd7278076a9a378eb86d9866bfaf589e6584b5761bb06f867020344a47a1f62bf61
-
Filesize
5.2MB
MD5899fc0b76fac897d28ab702c94f66176
SHA1f061437ce7f1468bb83908d9fdb873e2ecc96862
SHA25685fee1ebe097599f535874ef90c0a3d59c0a8186ff6e13c6c5b2585221c55063
SHA512bd34a794868a441e17bd708333a2c6d4ade8cb3cb0992a901e82c783b356fb045ecf3e012dc3518b8f97d94de89e927b4f3750279fe95462b51578e030cd3ff5
-
Filesize
5.2MB
MD54a8601906a98a6118034779e0802b7e4
SHA1dbd73a12dcf067ca45459ff84abf83e284302203
SHA2569e68e59a8c38c06a8fdbb8be87604d3bf2bed5f141a8175b733e309e5a268e78
SHA51206af857d429a688f8560e11c1edf0e9dacdfb87c2a8fdeda4ccefba4c5974e6a3fb37a92de816f60ce73453a6a1bd76e597bf248fd1f19fd7b37f19f16076d8f
-
Filesize
5.2MB
MD576278aba8efd3536b34d5a0eebfa774e
SHA128f1bea31facad3834327bfa30855ee54127fabf
SHA256257ad2da7d51a7fef1a24694701726b8238de5d1b5c32405adbf1072929c883a
SHA51283d93ca0544c518b3ca50f4e51c5d88470b61be3fe7240b6a663c6526d68fd57ccf090169061538283eac9d06e7a42ceba19ed0f639dd195561f6d4d9af7bb43
-
Filesize
5.2MB
MD59013a0f51e35a87583183e75e3f732ca
SHA1575a83c0a4ceef09ed20fd3b120dd89e2acd5b3a
SHA25622546c3d4d2be95f0f245c9707d7bb4bc118c58c9059ab6e4fe587f755b32180
SHA512250eb3b7d78594272595796efdcd94f66c4b329acb88f560d25f3a4f8fdcf128d75dc37328fe5c17ad58b6e18377cfd4c8d8c0cff8149fb411b59a6adebdfdb9
-
Filesize
5.2MB
MD5a25b2c2f65e7a013e85652818069f291
SHA15f11a57edca974ea28177491a7ad4a5965271e60
SHA256098a5e84aa6d5d194e9df39dd1759833227e5581d4d9295d4d47a05d7661bd97
SHA51238283b705e8a1889a35d1c57f02497d41855a8d0cefa1e037626b9f56d385fe29d81b3b78794ec6b7fd72aa6a5f05d3d1ba092bb0930d411f0268bfc3212fb4e
-
Filesize
5.2MB
MD53d50126e782a4d98a46c42993abaa0d1
SHA1a502befd2d8d9cdf5ea122184bb7a8dd40f32e9f
SHA256f4731cc4ffb620af643f9d20c6ae6291b9a4c627562c5e1e5e952c43c02a44bd
SHA512ace5426b7dde92b33b1ec8ff695b66b976bc384c81afe4bc26cc5e32d8c4919adca38d702e31dc79b747defdad590c588a556e8bc1a31817add4da3b79491c3b
-
Filesize
5.2MB
MD529a1ae53f02c2fbcab4c21979a179fa5
SHA12cc8e79266786086523b6883d80ff7c7388768a5
SHA256f6dfbfb4417b75d57a4ca5198cef4ddd0e047f27a63da5e9ccb4c57f89287ddc
SHA51239b1259ba16bf6deb2fee5ec73617c02bb090093293612fd0bbac339f26bd26c131263590a47e370f3cc5e50193a850e15b9def36eba89a90d53e42f79d49973
-
Filesize
5.2MB
MD5172267e29881796eb526cff525762bda
SHA1d0ffe2a65c467fb7704ce27e16bd03d84f0cdcbd
SHA256989f12f7966f68f82b505a2d3f32c1d624a98686935f705896513a53baf89bc3
SHA51271c28b9b6c8c83924e657dd7ae9bce2f64fc45ac49d95aa8a87d59234afa6f58983b51aec17e2d1819553df1aa38237d4fbad11201d03a2ad99e0f2160473470
-
Filesize
5.2MB
MD51b420471d295092a92267c4a5c992099
SHA11f3157c5be986076bba5a4c7d87953b042c5c070
SHA256ab09d6fab54b6daf63bbf1b65108e8553e7aa56bdcda9d0bb7c1667a23db3772
SHA51258e6ebc6e5605f4cd4a356e3a57994d326bdb181d842d12e2b77cd2a7c474b3f0a5d97a3d1508b6e0806436cf3488e5019c6e37ebe6655327c21411aa187bc72
-
Filesize
5.2MB
MD5d284e8f10db3ebce8d3cfdf82acf448e
SHA1e863f8d90141e5c76963cd34841e4d907aa258bc
SHA256280e8722ac63959c1fb59eed97200f23537d18f831128f11897dd211f9b73113
SHA512587c449bfbbf8d875fcac70d3f10cde48cc2b9bfcf3bfb0ca4b7e4f14f6e51d86f0de8d3b6934d2f71e85b41a91fd5428990dd29c00eac7c5b97f26d12218f6a
-
Filesize
5.2MB
MD516943bb6ce91880209f397251630a8de
SHA1c10de5ca7e57fe08753be1688949ee8aa3182799
SHA256cc568955e6483111259dc5f985ebb6235c5e07001087ec76d266e4603ad4c95b
SHA51201d667b4760e35833d46e2139c492a1eff9e3fe99afd4d7f375bd0dfc755ea9455e3feae677e804af964965f0d6eab8277ea74443d7020c9462a783de5d0978e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB