Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-01-2025 00:57
General
-
Target
2025-01-03_48504766432811d5b6067c2ba7a4f8cf_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
48504766432811d5b6067c2ba7a4f8cf
-
SHA1
756a6e1d0cf8080295b5ca1b5eac27de469b1646
-
SHA256
d016e032afc66276f15e2d69e45e3fc8c16e166e971a59d5c57d90cf6aa6c3f4
-
SHA512
06f36c874a2f1ba4c768353529a7535e13730836d0acc4a2d47e9639f31013c5f4069b97396a7f7571c6891222995eb4c23c79f3d96ee3b41e9d08c76cbb3b29
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lUL
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-03_48504766432811d5b6067c2ba7a4f8cf_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-03_48504766432811d5b6067c2ba7a4f8cf_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ibJAhgH.exeC:\Windows\System\ibJAhgH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\edxPGWA.exeC:\Windows\System\edxPGWA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YsMfHVP.exeC:\Windows\System\YsMfHVP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xqfxKQa.exeC:\Windows\System\xqfxKQa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vArESiX.exeC:\Windows\System\vArESiX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pfcIokJ.exeC:\Windows\System\pfcIokJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dLvFpOJ.exeC:\Windows\System\dLvFpOJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ylOmhrZ.exeC:\Windows\System\ylOmhrZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nGfJdyQ.exeC:\Windows\System\nGfJdyQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hJCJBbh.exeC:\Windows\System\hJCJBbh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rRFcWBz.exeC:\Windows\System\rRFcWBz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\doxWIAS.exeC:\Windows\System\doxWIAS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZPtRDXP.exeC:\Windows\System\ZPtRDXP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WNDdYvO.exeC:\Windows\System\WNDdYvO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zVzqBJj.exeC:\Windows\System\zVzqBJj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KnzCZJH.exeC:\Windows\System\KnzCZJH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AGlXzYd.exeC:\Windows\System\AGlXzYd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cHdFwUD.exeC:\Windows\System\cHdFwUD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WVOpWoP.exeC:\Windows\System\WVOpWoP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CCCddTm.exeC:\Windows\System\CCCddTm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bpgUGBO.exeC:\Windows\System\bpgUGBO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53eb6f5bdf36de8ac0824fbdf65c587c6
SHA152a6ccd4d13190388316e8baf8cbe01e6c11d7b2
SHA2568936f6355fcaf4cbe53ebd65987d7c9b59b7e9285d39d4c82cd45d765cc5cce4
SHA512d81e36f37b87b2da6a88f298d34f010a3f133f3e088ea5f693a954e8b3b97be0238606132c78113b89cc81f17eabb4b5a891b792eecd1158bbe341d89c78cafa
-
Filesize
5.2MB
MD5bba4031e0fa43278e1ee93e4f7be30af
SHA15d892282f84cfbd7b4b7591e68064caec0d8c376
SHA256c4b642424f961941f0164ed4996109ef7aaec107e79fc4b782996213b3386d06
SHA512a04559440d89755d23a4778683a0b17882cbd67c1875ed4aa9c3492ee70f40b63bf93ea19498d6d6cf4e94056407d39521942fdd31af736e24389e19f1c5f05b
-
Filesize
5.2MB
MD5ef778b2d9e320e2cfb946c447a54981c
SHA1276f7b3920f584329041593c34adc28dbc7b2937
SHA256be6710d16f32240cc3da5aac6f869c1179bc11707b7c7df4e803b0a4174a25f1
SHA512cf4cd00e82726dd08bbb1f0bfa937f5c8d4ae0286af2679202d070ac1f90473104f48491d28adf96095ab84e7c97fefb71352e8968ebf5207519be065f79c0ad
-
Filesize
5.2MB
MD53f87eb46a71c9ca8c224ab8f09869e23
SHA1c4af7bcc98052126560a4116085517ff4d5da44c
SHA25692eb89424d28f5bba5af207beddfed6f2020a5864e2373402040a47354505ba0
SHA5127d70d9fc38d1fd87333abe7e1ec1a5e36ec2d3c583f86719f41a7cdc30a09972b146a35b936e520f7a608de2cb5cf7b45fe2660a6f3ca8ae4401e78c4cc9f1da
-
Filesize
5.2MB
MD55c2f53d4af4935e8aada01dad39eccdd
SHA1490769cbc37d79b5710a0d3ec8ff1f9812ba3791
SHA25675e9776e5f86ff4f56894a931e63abab31071be19cc226cad3e86884c118610c
SHA512a53f3a4a4dedb66978b0cf2cb2fff3049b0c898ad0999c6b2ba42ca2027ea4d1f01ff71f2b27adcbcf2dedd094beb2041596953dc8fd42d3b39318aeeb1afeac
-
Filesize
5.2MB
MD52eaa9cefb882e58034d30c807035af46
SHA170444ac6291b278f191ac508bb2acb0116645941
SHA256aa118632c51e2a4bd87f417618daef0686e05652d3eeb2b5ab537d52c7fb4cfa
SHA51237c8782e16c631ff8decc2fa0b3d52c58fa21ad8ed694cec2945024d8bd8398f3d31299c8ae86f3899bbcee0ddda382d99366f5b2403faa385589a99585dfb1c
-
Filesize
5.2MB
MD53c448e903330e0246c8b20e7f9f18ee6
SHA1051c713a79b19a25813269aff16cf912756249d2
SHA2568c4deb682153e5aaa72227c6e47136f3368f425b2d171e0922ee8db9a2df3be2
SHA512aa19662c069db9a44796c560bd17bbf5523245e98465c55de61f89af6d2bd449d5b5dc4ce4044b2b68372a86983845858a87d8cf9a6cddd9a3b6f28dc303406f
-
Filesize
5.2MB
MD507af4467ba805f528e143063d9bd5069
SHA14d98d40a80e988154e32d7bb5ffe490425658ac6
SHA2563c381223ed5383119e5b97e9370260acf95e63981d1b384b097d953b2342eff2
SHA51267f3836b25fb683e0509a9f92a42b42d8baec99f70ef290117019fc27f76e0abc24f8d0950c8fc3f49af3a9a8b2c03afd9148c67e3fb9795b06cf27bd19f15d9
-
Filesize
5.2MB
MD54b4a971116cc849c33288e800c489c8d
SHA1cc9f074b2dd5fc8f06d55cb5763035d545f4ac2d
SHA25678e92d73f914c8a39a6b8af8fb8bb5f18586b0cce478b491a79f2eb4bf49f13b
SHA51275d7707575711b133a7fa301db2759465b115f30e18ea7f6a755b05593e6f35de948401dcfb060e62cee2db2a738e2010bbed49f5929cc69d7562552752ef95c
-
Filesize
5.2MB
MD56a8b2d663167fc05bfe53b04379ab64a
SHA16b41c4e0f9955727faf71782f15d880ef20ecaf8
SHA2565ccd3e08b2c35132bf34e694a37c8e1bf519560955e1e897170ac5d4c23dbd01
SHA512da4e37dc58d7826ef0602bcbb60b9bc20c085147b55c886d1d04c1306568da456a8808301559f73d732c866c8f8059983a6c7c767d873aba3135e3df21681c95
-
Filesize
5.2MB
MD5c7dfbe31147fc1da1c60b6465cc345f9
SHA1ff4ec7f7eccafafc5f667d21d2c8f4e48542c1f0
SHA2563226f77c5c38c836afadfc4e291db91c4bad9d406ec68d925db85ca5c9726ca2
SHA512a95e2a6dd0ab93846d20fa5642d01463821717d635734256ddd5f3262a3a20ef9a9aaf944e090519f93a737cced6d167fbc5be732e558cfb1ef9dbd6fc648a25
-
Filesize
5.2MB
MD5624af3a0038b8f0b37f0d71698f7438a
SHA1961b09ebaf1eb31fe48fa12973672e8f0499a90b
SHA2566a25c5a72914ccc5cf8cd25249d5ddbe15bc86be9018474565f6bbe6d7f769af
SHA5124af663ed6a9ca34960ae8f870aeee3ec47f35d1af9e1a6fceab28bb10b94272cbb23ee1eea1a50a0ae72a9ad6fddedeab8c22ddf25048e5657ee7b1078fdf71f
-
Filesize
5.2MB
MD547886e93f981f4dfda2cbad4f954d9b2
SHA1516f18fc6605a403c648563598fb7d103de5f0a8
SHA25659fe711ca75399094b3ac5e37d25eeac38f2a25cf259f678212c24972ae8414d
SHA5122fc95c2f425e07e78c21906cb99dd276bd850d6cdc55502c5cc5ec8725e19b39bac253bd4033b0f097f0ffc75ada136c14e37a8b2343f45274c5243865e3f432
-
Filesize
5.2MB
MD56138a50cad2dfb5ec32e6066ae76fbcd
SHA1aded41dadca2493c215d973a787c4d327fc0d276
SHA2563abc3fbcc9f70cb119de3570d92b193cea86374698fb41abaf295ca86b715d73
SHA512e26ea6c47db4523e43bc7cf8361be5a69f0b0dd2b9621f36701c8cec86296674e808ef3c7c4a3ad4bc1dacd1f96071e9076a7e8ee4a98de156e3e2b36051e028
-
Filesize
5.2MB
MD52ec6b5d85ec2cfbaf986b60b6711b189
SHA17ed46a867852aa6ed213fa71065dd77cf80fdd81
SHA2561eb31c997f2e2cf7ed2bf9c8f256c3a632565bb636f2a51275909c5b0ff1a5d3
SHA51295bb1f9b97bb8de20482cfcdc7e1da2264705d24f91c73a18006ed86004f483e1b6c3508869c7ce5618703750d420a583c103ec26c68c12a39ff47cd8d00b531
-
Filesize
5.2MB
MD59e531b7503243f5d45f032dec7b5dbee
SHA19beed6c2e3c2fdd155363bf10e407eecc3a6afb8
SHA256d6bed5ba09a904d251a450e07599fa8bb1c39ee5b0d4b7745a71dde85767a97c
SHA512cbbf8c69bf54077f04370a50d085d0be6ccdace8f3751dce8fd38c784b182102a1a829cce7989eb5ba56589cc6e6e0f0650a933c68ee72dcf8478f7bc627a469
-
Filesize
5.2MB
MD545d80f092132750b7b4e2c6c77e50bd7
SHA110849726fb6a911cd35c3dd2fb64db091fc8a908
SHA2564b3ca0c304492e4285d19d98ed144a5aee83fb0fba74706e7cff55038354e9f9
SHA5124684cca0aaf722ba729251ff921c8e7a3eea0afe14f118d89a0e4867c554df84814ac988a4634e173532b1f05ce67a4d6e08831b588fa8b8a61782f784cab0c1
-
Filesize
5.2MB
MD5e35eef19a005373ec6e2f14255411482
SHA1f4938c04a254f8f09edbb837324ec1c6a6e8faed
SHA256125dceecc804beba71177fb331f9402aca2a1aca343bf92bec5cc1f04f6dcb5b
SHA5120a6112bb43ad9d88a6764345ecc6da7916eb8996fda88a716bf6594f9ccc9fdd781d2b11b1324504d4b6f324cb4ccb9d3d2d783b878fb30c9a82ab4b8de59ce8
-
Filesize
5.2MB
MD5255f3a8be05fa14b363001cb5fb85152
SHA1fce851a3a3fe4ceedbdb6b698c349df622afc8f4
SHA25627a1d4452785039ad63652f69a0a76c9ea26dfc29a49310c3b181ef154b608ce
SHA5122b0f41fc23a316d6eae62d9f6287d19d757a89729fc3b0c2ff4fe69faf29cf7ef028342308fc95567a60197bdee0674c3952307e66e2247dc0ae77b1a16510d9
-
Filesize
5.2MB
MD5018319fc058219a94e34c1386cd8a73b
SHA1dee9e23aea7d0a1da6f4a0fbcccb12c16435bedd
SHA2566b395563760e7cd215c8604e2f40e351ae50e56de6f8b4cbb5f20fcd4492ce41
SHA512f3ce88f3293c67e694f3d9d1a290957a78e2d910c2545af8b0b25aecaad34d6d77a75571f91958d1adda7b6af2081cdb005468b5e4facb2009130d6c3c5fc50e
-
Filesize
5.2MB
MD5f72528250f8ae81660c70b462ff04fc0
SHA16f614253eb3b12d0c4758f8dc190e8c2e1443104
SHA25645206137c592dbf077d531ea65c18aa91326983f3bd57ea8e9e7d71e565b06d8
SHA51221486a8eef618eae13c042fc769a081c9ecb539c2ce03a2ac5bf775e5ad4f3311cf358b379ae3129f7fe9f5448e0ff3ffebba4e6cd8efecba968a275af6bb1b8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB