Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 03:59
General
-
Target
2025-01-04_2704a3f5558bf8c21d51b359b0f46e93_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2704a3f5558bf8c21d51b359b0f46e93
-
SHA1
c6a516d62193b5962c0b1793154bd616ff39a17c
-
SHA256
45c2cea9e2e9e40fed577f1a747e6292a56966e78b4607e2398c98669fca66eb
-
SHA512
305cc9d1d4b7c59257c5cf1be89847dc10c65cf144b47006943c81d63a528c78cec1bcdc8034e040bd99a8a0e1f1c56f7515556299b22cd24da9af6de4d8d569
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-04_2704a3f5558bf8c21d51b359b0f46e93_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-04_2704a3f5558bf8c21d51b359b0f46e93_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\trezKxA.exeC:\Windows\System\trezKxA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mJCgZHq.exeC:\Windows\System\mJCgZHq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xJMBpec.exeC:\Windows\System\xJMBpec.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YDYWYAP.exeC:\Windows\System\YDYWYAP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tbihyex.exeC:\Windows\System\tbihyex.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MmjTlCz.exeC:\Windows\System\MmjTlCz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GVsjHIS.exeC:\Windows\System\GVsjHIS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JdxcrPt.exeC:\Windows\System\JdxcrPt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EqyOmSy.exeC:\Windows\System\EqyOmSy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OYdOmxa.exeC:\Windows\System\OYdOmxa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWrggQG.exeC:\Windows\System\tWrggQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JfxdjGA.exeC:\Windows\System\JfxdjGA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uJULSYq.exeC:\Windows\System\uJULSYq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BcXEMVj.exeC:\Windows\System\BcXEMVj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BodTqvZ.exeC:\Windows\System\BodTqvZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qmDmTMq.exeC:\Windows\System\qmDmTMq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LJxibgV.exeC:\Windows\System\LJxibgV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KDnAcbv.exeC:\Windows\System\KDnAcbv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SZFFucK.exeC:\Windows\System\SZFFucK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fFXsFne.exeC:\Windows\System\fFXsFne.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vFyPtZr.exeC:\Windows\System\vFyPtZr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55d808332942ff158fe1ac5b964fca355
SHA1748296e9a19aae37000f2aa0cb6401c572aa4406
SHA256741c82e784aa6f9d2c2dc762e4b05a1d12ee559829d29d956040cb4755fc019c
SHA512c74db020ca73738422b7bc85901cf889d093d3efe3bdcf462948b81a82917a82bc1dcb1a6f8f94d126a42623550384b842117a7b056a45fbe171223497228342
-
Filesize
5.2MB
MD5c99f5edc0c8baa2afeee86d5db91f03d
SHA129059216506fa2a6e1044adc344fbf2915740f16
SHA256fa141f86a651bc9ea6fba3487bc0fca7a26c49ce8b010588b481772642c8e8b0
SHA512e706bbe66d0950cc10c294aa70344c46e97b5dcb1c43d92ff5913488c84f0cb96f01c2da9b0eeee59c1872fc9dadc89f70f4137ec51adc27536ec8babd6d6e26
-
Filesize
5.2MB
MD5da689ab2d0acd63ffdfc5c04555ebac3
SHA14215f38df1a0d7e43f18b3dd97a9e51432df19f7
SHA25641f3ce51ef1dda74b4a770efa26a31db8af256cd55e8bdee43e6181057481f56
SHA51265038429e4ae386af3c148efae0b5648eea880748245d3966b77033656a14de9360e4bde7bd361419728c3dfc69818880b535641b2d5044deebfc6d99606e50f
-
Filesize
5.2MB
MD5a4358aecd6ff646496b92ec3bebd8d99
SHA1a5d4344a46ecea58752dcca3995fac3a100c665e
SHA2562598e1782d5dd19bc8e8e39768a4ec0c3a8f1a774ae62a3a2fe2384c78624eec
SHA5122666af7ab01948c1d53c19ce24d3e9aacfbed8d6281a91d3d9b8035a2aee6d71807ef4e0f99268d89b166b711acd8634ce0ed22154b89e341e11126b4a5c649a
-
Filesize
5.2MB
MD567c73fbe89f592dd45f2e1e87057f510
SHA1f7bf4e2dcf447cac985339fab5cd3018a2121a75
SHA256b11e60ad2a41d98204ddc82265d9f3ed765c695a090248552c9a91990ab2c61f
SHA5123f7683370e155a528a405b36f087fa6c35f116fa170943b7f645045b2ba3c348101bd37b671ee61e35a1232c8fce6d68877cf5dc0a1f8518eb07f1f5e74b6af8
-
Filesize
5.2MB
MD5bb139732d3caea7e99f3ee721729fa23
SHA17efed716ca6d15a435ce49c2fabec13a2b499fa7
SHA256c8082971911fd577c1912607ce3c88297f72c8cbb438e230f9770823bf9c4f14
SHA512f17842fa3215c4b58d68ef876b9d606a42229b34c1a258ab1f53cb684d1e221d8bfaecb7624d345dedb67d6eb8848ace33b68b5eacbe4a35503f336acb7d456b
-
Filesize
5.2MB
MD5a74c43b9eccb958f9aac2514f288bb86
SHA1c763d4ab95495063683e12b3e5cde54d8f2a6001
SHA256fa15e23827de046f9739550b5c1d079e568fd61c0521b38c3374abe650d95414
SHA512459172f536d3228072410c7820324e9595595f93b5d1f351643cdbd9ae6b096ac76a77b14740ef1521bbb48e680e8c594a7dbf9d665f306ce8aab1476899470f
-
Filesize
5.2MB
MD5d4a23c84d241d371b610d2b52d7025c8
SHA1cfdc06e08b9577596442726a60caafb0c1d1bfc0
SHA256878d80fe38c9fc76ec41b0f9eb044f2ed0bafbdf12318ac5b97825a12aac5a3a
SHA51282cd6698c28e78eda7c84824c4f5543870f1b072c7dae80674e405defb06a7fd9f2b29a7a60973a073272abff726df4dc4020b12b95f6529391671a982651639
-
Filesize
5.2MB
MD551474cef7bec71c5e363dc43b8321b7a
SHA136c9bc9d8f8197270909dc84741193701b09261e
SHA25639370bde50666acdc880b887ac893b20e9391b0ec885d52db2f4cda052207cc8
SHA512b7b7ac2296f481dde89633c6a50fd3810c1c2a47e03f75d1217ebc927941c682720d69259f76f315b6321df8bbed44ff5df97b119a1727b998e0b63db0d48882
-
Filesize
5.2MB
MD5f59552b55afa98d06fe23997bf97550a
SHA1cb379266155951036e2c6abe75b9c739581eba98
SHA2567f66faee22e0381610083519649d57cece30c476983f1120375555a4c5dd79fd
SHA5129c5e4be75f24e8ab370da0d7eb404aa6282326c551099c3e45f657036453d4780e784077e8f41f6a3ae4a4d0e3e46de881047714c623527dbd89fb1e590f0f5b
-
Filesize
5.2MB
MD552a11baf5fba2101fd0dff17c53bbc58
SHA1b2ce7ecf7f385d92ea5d83f72c011976689e64e4
SHA256943a72630a91864ebb355196262a3124336af779c494dd0d8ba28590b4a5df31
SHA512bfbc69ebf8de7d21effa971dfae2d2bbbe1b4e40ff5ee3f1b43ab529dd6625fba68d41e5767db38f4a34595f0c3da51f16ab69c1d6dea84a0f9daa912fefab25
-
Filesize
5.2MB
MD57544df8122d4acf6068d1e52ff10b205
SHA19d6b6ea5dfbf0ca1856e0c7a6f2f86a1c125e55e
SHA2566394aa3d3b78cd9c336cddb2da8dc889606ad009b634dbffd742a55faa979f89
SHA512cfb083507b537c8adc17ee7a4ac0346cf0225965e82e816bae118c81955785578e1c4730fa6fe79690362b153a51e9a0d1db28e98711dcaddf70cc537eb02236
-
Filesize
5.2MB
MD59172c43d041d090897d37b7b1104ddad
SHA16f4dc32afd4de60ddec64860ed5667bdecaa3968
SHA2568ed79f8810462e30ad97a3dcb411d515e6546682bb471174c094537f8ad5730c
SHA512fd547b8ec92b142bff995a3117bbf5542831ae4e06266c888ea8dac27c5f6be3c0924bcdc444d1bfbc2b66c1b49cfb31f73a49b770cf7e1ea4993f5c1cf7743d
-
Filesize
5.2MB
MD59f1a4ef09bf702dd8adf5e2f539526f8
SHA15a9f18487667df2f2fe0a0e507b628f14a86c969
SHA256553543f4cc3cb9445ee02c227faa25d8be126ed49c14fcb1b6783766060c4a45
SHA5129887796df265490ce65bf0e0392e3c6610b42e700d2e5010493bdb88634207d43468c1e6fd8ab9348b030e748dc130c6d7c37a08825599f469105d9a418dece7
-
Filesize
5.2MB
MD5fe5a88bb4f14a2f8b0ebfbae3e184e1e
SHA140a0cdf1d8120572400fc61dfb0a06dd25e9d86c
SHA25671cf1f25d23de52046b991501785bda80e30a12d75c3ac021ec40562f5724aed
SHA5123a4de8fd9c47bf4f16d9e50b6f6a12024ee6ab07c6eb1842b99badfe38bbec7db01668a00ee3abe189a77f7d21eeb8f485506fe2e79a0abe1f55de31fd35af8c
-
Filesize
5.2MB
MD5383d13a103a98b4398f7e8fa23b29ad0
SHA112ec9017809b577312a8efb85684bb28fc828411
SHA2563a3ff33e1884705d32ea21571b506a42282dce13b29a237f1b3503af2554292d
SHA5127f0c50891bd92825ed187999ef2dab2bcf78c962aff030713ca1491adaea2eeea32e26e398569dabc09c693a07e425b2806b3365ddbf82933401269f4892248c
-
Filesize
5.2MB
MD59b1b08bf1bbdfaf90546b5df66d72e88
SHA15825176a7e308a6be66b6a88175c8e7959074945
SHA256b8efa4175c920668dad777057a6a405ac6d66d05174f1887670e690e64a7669b
SHA512428834a4c116ca6d786171820dcc1e968e8fad66bbcd37c75a248652df90e5dfd5ebcc7cadc205aca9a9efb969ecd2757cf925940c359ec5b5e930c598cb271a
-
Filesize
5.2MB
MD5c1fc764c94141530b3829f0e3384c00e
SHA1784e6d4fc376ace2b55c76feb642eb4653d7da40
SHA25631823d1c66ef1c3f4e329e0296cf3b3837adb6be7b6aa6a5cd76ad30648943f2
SHA5121e4f26c875ee24ee571dd5a86d9aeff00047e35d3935297ea775894c3d91ab2f225fd410c732bd503706063736fd8964ccdfb9ea9335f26b5d74b65aa8785d87
-
Filesize
5.2MB
MD59e169172a8c69d4c1c5c684b8b75d66b
SHA1ff2b446f55943cbd8c251e9ced8a3445e4e0927b
SHA256a4670b7f34d22ed99638b7266a67afeecab7f49f51128102507678bb63fd75ad
SHA512a96d6456dfb6debec505f6912b3a0a0cef9ca0dcb9339aea7e3eee418ec2e37f4d293f2e98adbb098c34e1fbec4f58f09ddce0b8878d869c11f845815dfe90b7
-
Filesize
5.2MB
MD5ec7f526cffec970d9f2ec3e486220785
SHA1bb6b8d4c9c6c65a1e7982ad3a33611dd9d4b6298
SHA256cb6ea885dada62201e6ba64abc7735d8948619ac6e3282fee3cbec559dd97ec2
SHA512e8b6e0786e4c25e6bbd090550b62f1aecd23c28297f5d7bf198ab0cd7a4dba95cdcc8d3de8f68186272434116ab0118236b3ebfd404bbf90a7ec1a5eda5e1caf
-
Filesize
5.2MB
MD5d6a4380c680c3d83668f2086ae1df80d
SHA1d7f20cfc717d2d366b7a61b3a07316c07bffe2e3
SHA256993de40303d2cf5b174e748e0fac90a7c266b5eddddae2c282d36f97cd3a0c24
SHA51245310bd5cbb234704f8d507a23ac20800bbf6d4f7c98ad01c4420ca5b5f6c69deaa05523bdded34d9b4b3015cb94b995e56ea03fd129d835f48a2ef9676c9699
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB