Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
03-01-2025 00:56
General
-
Target
2025-01-03_3e6cc5fb37506101f73db40ce5f216f4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3e6cc5fb37506101f73db40ce5f216f4
-
SHA1
ee76040bc2d82b105c17249952de659c4dbd2751
-
SHA256
d7ca279d3141ada4317cc80d9141e193dba042fa8099fa0c27c75af4a3a11b62
-
SHA512
3a8d60d5391b95328b755003229dec76e9b79ddc5b6b73c16cb39a0c47ed10dc47d40e3e965028619a3c908f51b7854fd7d11b24dbc96b88a9f19391df486c28
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibf56utgpPFotBER/mQ32lU1
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-03_3e6cc5fb37506101f73db40ce5f216f4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-03_3e6cc5fb37506101f73db40ce5f216f4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bcyZHnh.exeC:\Windows\System\bcyZHnh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ERGFDoS.exeC:\Windows\System\ERGFDoS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bVExTbC.exeC:\Windows\System\bVExTbC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qCzZewQ.exeC:\Windows\System\qCzZewQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oNZHJdj.exeC:\Windows\System\oNZHJdj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\slvQTVD.exeC:\Windows\System\slvQTVD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wLkupKJ.exeC:\Windows\System\wLkupKJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UvzWpaP.exeC:\Windows\System\UvzWpaP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QMPXpzP.exeC:\Windows\System\QMPXpzP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hXWjsDW.exeC:\Windows\System\hXWjsDW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kkqFIrc.exeC:\Windows\System\kkqFIrc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RekyBWl.exeC:\Windows\System\RekyBWl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vmYZhCY.exeC:\Windows\System\vmYZhCY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FnzmiEU.exeC:\Windows\System\FnzmiEU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rhVSKYn.exeC:\Windows\System\rhVSKYn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hDmFXoR.exeC:\Windows\System\hDmFXoR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YflrOeK.exeC:\Windows\System\YflrOeK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FZOeCYo.exeC:\Windows\System\FZOeCYo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rDEIPjY.exeC:\Windows\System\rDEIPjY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UTxznHU.exeC:\Windows\System\UTxznHU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xSvDdNq.exeC:\Windows\System\xSvDdNq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD558f36e55cbcd34e57ac4641c3275eb7c
SHA13959cc33e43abd6e2878f835fe638407226db551
SHA256a3df895f7842668248204e25aacf26e888ab4868094db9445b2740c1c8cfc389
SHA51203529fa6c43b6256cb43f0ee58c0566d4762b0460e2f33a3f23dd417a91acdca8e9909b3c7742c4a4064338967591996e7e1800ebc6246e0fc306e7098e41e0e
-
Filesize
5.2MB
MD5433a4d0b3e7501dc469de37e9a32ad42
SHA1e3a0a0765e05062a3a4fba5fd48d7f46d068def2
SHA2569fd490dabddff7cb0896a6a5d1cbab3d9d840fbf8012cb3b55aef1cef94de993
SHA512b20c1a8386ae6ad158943b2425cc4720f848f3ad5c7c64538ca5a54b8542c61b29b46e97d988e75bd90b49c12917d8baba94aeda973194ee96c972e064178a0f
-
Filesize
5.2MB
MD58bab2136797897de7d054a02f2298854
SHA1b30b01e30755a817856cfe7e708cad60fc9f7161
SHA256340eea3883865a2604d14a1a555a5d656d9a4d8946f926eaf874d7000972e8ff
SHA512b5b9f6ef54f2c4642e1e5db5a968cf5385bebef35a6c10421d3e5f9211637049ec089702d0f1febfcf2b3184ee86d2b64b8d1f950b2ffdb677c45965485a6692
-
Filesize
5.2MB
MD572935a9bc2d75abe3a0d774100d88920
SHA172031d454b2b8d9508fe5e9b3338a3cada0dbca6
SHA2562885f0c3dda71b8eeaf88c32d2b1593c1da48dbe5347342494ed876bdcb95faa
SHA512ed3754992b4237d67707289a1701125800c0ddbe0444aa585aa1f29b82a6af1d0e6d7345681c0bf829fd98ebdd8511ba71ea1e4ba8be20c848d5fc6b323a4d85
-
Filesize
5.2MB
MD5241a9e340ab384de26f7f4052d4fba80
SHA1d486549702cfd334cdb90041b217054403ebf0ad
SHA2569cc22ad37955569927f7d736e5fb19a66b5911f8703ed8aa28fd107e9d7c0ec3
SHA512a32e33f167c8eedc0a1118846658fcd9a2624cef611f0711e294bbae19dcd5eda77f1fa10545a9d5c8045b174c2b1d247b6bad5dd2e6a27458afdb1f0c9b2c7d
-
Filesize
5.2MB
MD54d44391885ddd1cc55bd8293d5c51fb9
SHA1b1fd7fbf735227aeaf705d84bd6f9183558761b1
SHA256147bfd6f528ded82b504adec542d530eb80e8e3ea1b34b28e5691facf03f9f72
SHA5129c1deeea5ee806311eb53951c384ff5079135ba85f52f1e3d688e0d5f9bea233680dc2befcfff3ef889a7703c307a2d721d3b15cf16a2a41dac20a0d64725fc9
-
Filesize
5.2MB
MD58ebf1d56b4b13b353f94bbed4b1bf5c5
SHA1ba1d0b728516f62e9182d7c3f0b6ecd636e31305
SHA25611015e053ea93fdb53c936d7edbf054f4ff4d49e6fb3ac3517809fa7b8105d58
SHA512f055b3296ef8726bd0d824fff84c58fd66f048477aee96259c4c3eb67b97ff6276909774a86db5dd12f5baf7239ffb95d9a01a4f5a73162ddeccbbd92dfcf66c
-
Filesize
5.2MB
MD5cd8b5fa755bd58a4353d61e139264904
SHA1ae9f2d3a7b026d8c0c8d356c11df016e466be53a
SHA256b1b40bc45dcb22c708dae9006f1e0eb7d6ddc94f9ad7bb5ebc66c25104754b2b
SHA5121648084692169f8f8b6c4b3476d9b26527e2b2bf9833f91cb21bfca34560149d00ef866c4e0b5e0cbac52a7e7ef01dfa28588281c84178382c456f104cf7f6d7
-
Filesize
5.2MB
MD520d2dcded8f1f33f66c688e0be89e9ad
SHA1bef0176bb513d17d8bc757b5af6d37a98b01d603
SHA25616dc8c3e011c54ac9d067a1fc53116b6b4af5a095dfa657a8b32a0d3d7516e4f
SHA512fb963cf0a0c650ce35a797671b8106a8b21085aa4bd90a4dc2cca2b1060b36aefc9043dfc73b0530a06b537767203456fdc5a54d8e87a3a9ea81f021709508e8
-
Filesize
5.2MB
MD5d5baac0654a3167cbb081e37cd171193
SHA1ef5acf2826b4b287199beb390cb44e41afb7923d
SHA2568802922a6e0521cb3b35ac1db0b8d9ada8c7e36ec97c2309fad12f9daa71eb90
SHA5120290a5e0a8cce183421a2dcfb48e0d0389e18d6ed2e7737b84269c4c05395d824b7ed36eab2615d5d1affc12ee74189849ffe7a5f34fab2141b66c13e1b15b7a
-
Filesize
5.2MB
MD5c56e3f490eb37071888c0722626c91c8
SHA19f3adec7ec4677289aa19238bc4ded08fe271944
SHA2561d0ff121448371bf853f5869decdf21e8209ba3842fac6b3e436b5b3aedc67d2
SHA5129d53e79ff1b92ad76e15b7b565f88e15894a8c8749bc88330e338e93898b7b0cf9b038a92b397160d0fe18d490be014249e1c98dacd168598a1d3d3dc8c4e70d
-
Filesize
5.2MB
MD57787de61733bbba7f23f148042a25748
SHA19f07510867a23c5bdc15a72a451cb740cf2bab22
SHA2560b34d32d755936a5cce6b9c040164fe4a77ab063aa5bcc78dcbe6d205eb47a7a
SHA51204ca171d493602f256bb9618a40ce3f642ca5d9a3e1c5053c69658ba0b9f3701af053e05693689148e2c9ceb21c24d54061a90bc4be04071c5f4ae7906648002
-
Filesize
5.2MB
MD521ace9cfc91d09fcfd1d8beae3fcdfd0
SHA1a835420e74ca0c871c71b4b93e981fc9a0b6ea44
SHA2562f7bac3d162d58af0545648bfaf08bf6a333b641787a8ff02316151a7b9a8e58
SHA5126552c58113aa502d34fdea5313ec8bcf86f1621684ba77a6e877713cd9c1a763ca144bfb473d6fe85248839232bf8dd3fa2f907cc7cdee6028a62c0b7303813d
-
Filesize
5.2MB
MD560b5e27991a64d3364b7c718711dcf01
SHA11cbbbcbd71bd4639c670e37d69862e4957d739a4
SHA25609f7bacf09bf4d3a54eb17c8f33dd6bcea6b08aba64a3a0ee5b2eb8fe9be0f7a
SHA5125b1c7bf757f32a30ff4c0a1e68eeea62c6a5ce7f86182b0d82e3f5fe6141fd1f9e80199122007997f3985f5b7f92c84abc2fd1f6c1c3bbab2dd4441544d68fe1
-
Filesize
5.2MB
MD50ee7b4ea0d6ba0cd957513f0c884ede4
SHA1f080564304ca5cb7ed257f687d037910ccc2e24b
SHA256b0be1bb1f563414603f6ed1ae2dd76572ec345220642c7b722893d53474ba076
SHA512ab8d484de998ff027d1d7e307e4ce6b9b2cfec4bb1344041e88d62c42445b074b453582954c51f5c3c28b28864e4489752da7de81d2624f64a5c8ee734a8052c
-
Filesize
5.2MB
MD535c169895c0355bd6f140877dd672391
SHA1fc1045446d2b5527287a884728b61cf5db455b65
SHA256b7b8614db8fe2b15e56000216e820601477b34b3a1515b43fdb13dddb831711f
SHA512079468139024402e231b310b782f5a0cb48c282c2c3c147e085781ddc0c2a6ab66dfafbede3910bc487aaaaf32fccd7d4f79f2fbe3bfaa987282bcc17f78fa80
-
Filesize
5.2MB
MD59acaa771c21bdaf073efdf05e35f11a0
SHA1bb920758b714498a36ee4aab5c584ad41984b989
SHA256521a67ae5b221644b9475f24a50ab82ccf0f2eb530c97a774ca98dd8518148ec
SHA512b667af027f30c6737dcbb258e26e6e171d942a2a7de4023ffcac5cedb51a5a3e1f4290b5a62872438d7517400fa4599dae9081b298d74c861853be4cee777298
-
Filesize
5.2MB
MD5c1093ae4c154b082a2813703d55daae7
SHA1aae2cc0323e1d27bf49aa00ee651af9ee13d2232
SHA256f273aa07859c89715ac600e4b8f78ab4ada9bcb8eb69441a9098c2d0d04db90c
SHA512b2e9d6ee99aef8813022540b9d2801ea5394acb28cfa1f724729d00765d21182c4fcee2eb70777f1c27ce629de9e38c601f210ee5c1acdf425d8eadb4ab99c3d
-
Filesize
5.2MB
MD5bff30ef376723f035d242cc80a59f622
SHA1c3785634ff196b92454dccfadb72e5ab4d8682e0
SHA25638f78650df6d45a06771427a10e984de362525d4b81bdc1645bdb10fa7c34d10
SHA51277c4297d1280f93c29c8cfff3140d43558489638613473f71c5ba1c7706d52212a41f515542157bec9d93d0b9bd8e7e57beb327a5737a00608182d46ce38e8a9
-
Filesize
5.2MB
MD5142d1da78d22e51985b03958b3ff9799
SHA1f8181342c67c138f4d430cacb86e7069d1d5f3e3
SHA2565f395d189b7fac2a27b8a140476c6bda73bba200814b6d10d0d7d906ac2b9868
SHA512d39de925a5da02865bb022967735db25cfd8c46fa6ec39317abb5273f4cf608509ff37a1da95b0e165204d6c2572417b1e09db14456be0783d067d4910e62d9b
-
Filesize
5.2MB
MD5377272834436d1d9594a33eb6d5dfdc8
SHA113e8b644455cd8c0ea04ef9c6bf0882590872af8
SHA2568b23c23424f4cf2f7c6a0598b85765683b220f8f4b26c196ac03281236090773
SHA5124f32993344f4c7bb502e50522ac9ae7ba165f5c613460789738958629b7a063f90933048b9d15c5d9cc28869f452095e81c7a12938bb782470353231348ff72b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB