Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-01-2025 04:17
General
-
Target
2025-01-04_5a8988cc40c93223fa13fb6d03bdbff3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5a8988cc40c93223fa13fb6d03bdbff3
-
SHA1
1d0d74cd16cdbdfb5c502f6ebb85523a2679f9dc
-
SHA256
2b079ccb33a85b7940c8f2f056c5aef0bc43a15f5a158b8b19c41f080679c031
-
SHA512
1318106fe80fd6d6af9b9fed04279c6dcbbfdee7afc3fe99f1fa013612d061d651b91fdeac67a91112355a6aa9d3100ea4f3775371156a9f5a08a2d48a3c6201
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibd56utgpPFotBER/mQ32lU4
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-04_5a8988cc40c93223fa13fb6d03bdbff3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-04_5a8988cc40c93223fa13fb6d03bdbff3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\umqlclP.exeC:\Windows\System\umqlclP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WfaHqix.exeC:\Windows\System\WfaHqix.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHlwFus.exeC:\Windows\System\BHlwFus.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mVAmdFV.exeC:\Windows\System\mVAmdFV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ULJCgBy.exeC:\Windows\System\ULJCgBy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FbckuMo.exeC:\Windows\System\FbckuMo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tmxGUhX.exeC:\Windows\System\tmxGUhX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yagfPkO.exeC:\Windows\System\yagfPkO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dvgfEdJ.exeC:\Windows\System\dvgfEdJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MykbyWU.exeC:\Windows\System\MykbyWU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FLWLGfi.exeC:\Windows\System\FLWLGfi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gBVThUR.exeC:\Windows\System\gBVThUR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qDdfraw.exeC:\Windows\System\qDdfraw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VvJCoQA.exeC:\Windows\System\VvJCoQA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XWrgMTJ.exeC:\Windows\System\XWrgMTJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zvnqXkE.exeC:\Windows\System\zvnqXkE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OZFeRzR.exeC:\Windows\System\OZFeRzR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dHCqJoL.exeC:\Windows\System\dHCqJoL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hkswbUb.exeC:\Windows\System\hkswbUb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dJgtbHK.exeC:\Windows\System\dJgtbHK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vjhiJqu.exeC:\Windows\System\vjhiJqu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD526d6163b017934f295f06efc84f9f7a9
SHA1b7303118985dcdefa4400a608ec81aae55900c98
SHA256549bf4685d61f1312bc82412086bb95f9d5341026364a6da1fef36151601cc7c
SHA5123725d7c23c9be8def12793dddff65a04dbb4e3bbde13b0a7b41efcf6e5d60b8bfa24fd70aec3a393be128ed5c4bc7b1a7d7901fadf8def4079767161d9d07760
-
Filesize
5.2MB
MD5bde2c49fd968e3b4ef0ef1fa737a6693
SHA1b46a39b334d8f05ee32aaa99e93196416b5eb925
SHA256da584c50f7be3e278a0049b2012b34fb38e0e8480981813f9b28ffe071007067
SHA512c8ab9d6acd16da55471e0d6f988343c6fea7d0a945f7cb6f1bc8c08f1d4e3e0c6ac7c3da55f9a93d0236298d393942c68a6906c22cb4ce6c77c30e81b19dbd84
-
Filesize
5.2MB
MD55eb30df784dcc0f832d263b0881ab9cf
SHA15e3bc2d7531e8e774ca4224c8ea34f5e0bb1006e
SHA2562f2b7c8bb4b10775c48420ecca8304375b9d2f06788455eeb0f52094d612eacc
SHA512bdde705cf6259852bb4bfa10cf2a391b21a53af0c2a4f0810cbc6d1361e54b579441873da20029d7c2f73891c1b44f174c989d9dc68d8f9fe995333295a512f3
-
Filesize
5.2MB
MD51be89b1ec1f7e550a5905a824eea7000
SHA194cbf03e54aa92d5fa93fc4fc04e3a12397d2cbd
SHA256556010db5b6eef44d73f34183e3d70655198db063854e680d251d10ff2cc5492
SHA5125d217250523a7c28a5c7f20620264e133bc9956b509d179a809eb05df48bdf00025b0b066dd01bd6f515c4c24acaf83f419565f9cded4570d70c64186c5f0753
-
Filesize
5.2MB
MD51a375cd9e23a3176c212f08802e53161
SHA1652f8720823c5c9aba1f2151baf210661fa0f76e
SHA256994367a0d7d837d0ef68b9d7dd20fb209f4bb20fae3c34f3217c8cae9cbcbc99
SHA5127afb036de267c1b4800e81507a20ab6938299fceabe0c3020698de4129b2e26d2c90d5e8184ae7c07d1023d2688c0610a61b868f569a39cca650a1fb82891374
-
Filesize
5.2MB
MD5cdbfe4fd00e67a43b37f94ce15df3344
SHA1297146dd4b3d7a6809834b2c82b06da0a03255e5
SHA256fb3858c8e628eed1242e2c3d532d7405ba6f7822d88ab0e0872f39629c01d3f2
SHA512b3e7051822675fae73913a3f6997d17ccf54a2e3b13bf98ca2a18829150470a6ce86f88e3db1047f3641eb3cfb4469e698d953e3dcc9933040c0f6717cc01cd7
-
Filesize
5.2MB
MD514454c7f60c62034e76d9acf5cf24079
SHA1186547defe66d371474c48f74f7d9c4609a1c997
SHA256d8af26b22c34b49d21c9fd66b632400dabd4e3493e7f51f37f48663fbd65a393
SHA512001e99ddd883243b092c7ae50e3255b7297954c1ff96fca5fa5fe0ddb7d900465d75c6b4017ca24783d8e7e4c1c9e426e67a66c86663e0b133a586fb9eba13c8
-
Filesize
5.2MB
MD5467b7cff24c33bc1b1a9b289b6d6c6fd
SHA163279a468f6ccb7fa527d4283188c9bf12aa4634
SHA25695fde9f1d2481419b59ca5526372953a88613c65f33618ccfaa9b7f8aa071013
SHA5129f97f751aa59cbc58e9c224c99bcd5ab4616b92a1d333f63c6612c019af690b54765b5bd5426969fa002260141e3fb42c578507439060b0a6de9cec98547f2e9
-
Filesize
5.2MB
MD50116ed6db0437530eaa9724e452ffc90
SHA1671b391b8f3ac255cd12578d9a494590803a2c58
SHA256feba4212b7d443b7a3d79f08b9011be5b5f2ef0a6250f5bec60b37e8b732af56
SHA51227bc8267b481404964f2a814d9e9afe850f8c1ed2635eb117efe62e139e84b82afee010175d5af582a3e11fcbdd28ca3ef0562272cc39c03e4d25a65bafc4fe6
-
Filesize
5.2MB
MD5dfcfd06a35a44f704b06f0077a5bc3f6
SHA1ae41d4832d53b7e8ee46f5825ec5d24206aaa332
SHA2566749d4334ceb364174c4b2e0bf97b22a13a6776c038844bd6481276aea4e5582
SHA5127bcffcafe65982de0df50184c91c23c8ce68806a6fa383d5c53978c8bca65a7fcc529d26691e109eead51728e94a33b79818d5576f31811b9f250c7b4a349d90
-
Filesize
5.2MB
MD52c17c219c3efff443c461b2a2045a5ea
SHA1ad9e2b6af7a955414d29580dc997c81790c687bc
SHA256e929d21bf62bc6783fcdb1e56db29c45c36a978e0e89768bfbd95cd297d73dce
SHA51207d592dd3b98d9f495bf440200215ed3fb25f930a031cf93403b9f8a6c6ef9d7bb72cb9d70f6a63f527a3feb4d76f9a1a2c9d116a2270a52bc534e57ab040ded
-
Filesize
5.2MB
MD5085891cbca6064ce7c16d822774f8b6c
SHA11c32eb017b9c4f271615a2aea5c772e946f626fb
SHA256de38a31585be0d8eed518807ca806b462c32d55fd92d1e47dbc01d262acf1838
SHA5123ef0b6a63976f094cfc4bd96c5ae4c56ad014b5fd35686e82495dc6cd4e2f11cbfa448f9eddfb01f44540180b6d1c8988fee70d4aba5205ca97a2bf118a2a173
-
Filesize
5.2MB
MD57d09e83e86c209eb0ac3f882173fbb08
SHA109cff36c6c495e9d1057d587b097310b98ab2bdd
SHA256d3ad3c60c1b8c272e0db8c1bc1f499059ebcc0e04a11937bd475efc55c9edd6b
SHA512a722196dc9578e0ee3e5a2dc0f08fbc1c78cf912fc4e002f21f722cbea5fe80e6f5916f7ee25d0833e99f43fba2205d6eded00cdf939b3d4cbfdad32f73d9571
-
Filesize
5.2MB
MD5b0774bd96c93218f4911a9e90984d7ad
SHA18d274e14c1a042fc2629487cf30db3d4fb2f0dd9
SHA256c2e6d697f9fcd575e3f1e713b4cad6fa5a241d06cd2346ad98fa7b4ca9538a12
SHA5120b0a3d8ebd36198f9056a53807572a70e871c56ee73522db48823c6752f0eb6b9943b5e1e0d0bc3207018a81be19f925a13f15f0f3ca163f8a86de0e470f6091
-
Filesize
5.2MB
MD51427c342c6fff2be4bc5929aa4f3d170
SHA1bd549f98142b360d509babead0ff581e0b3ae6f3
SHA2560b9527096098716bc3c217504aff015f42dc5d5d2ffa6324134372180bb29743
SHA512997460b1b36dda42a74e074329c2f671363ba7b884891eefc676f3ef5ca9cbcc9466efcd2fc1745ae4870145d5a937b29a75a2205f19523662e3a01b206ea2bc
-
Filesize
5.2MB
MD5da1e5d1e9c885275aa062e3e1165aac0
SHA1ed28c7ed5bfe83298abe27bae1392e458676170b
SHA25612ba92e14cd76a353fef57d160462b227334c3edfad445eece68e2d97b8d0c70
SHA5122333d8edcc14f40a8c73abc37b7e9f26c8f7dd1fc5269fdc0f633cc54c7265bd8b63bcd3e059c0f095b981647c620cc7007e8a786211e4974855b6ccaead758d
-
Filesize
5.2MB
MD5d5da675d7adc328403b73bd940be02cb
SHA1fd9963678f35a52c5c8bb4713ff0ed29c833f4cd
SHA25613883b3728e4f0e12cd0b62caa0b12fc39a0b916b39dd6c9be527dcf48782fd7
SHA51250a4f9202562bd80c25320c39661a1218d59415181e57645f437fe7e559707ee7e3f5b1e1012b008e30d1b72e22a35db7417f01b0b3eb00d1323324d40f2c4ac
-
Filesize
5.2MB
MD5e5942ac62391e55d6289ae62f87902e6
SHA1b2d593721416848b79b728df94a59cd3e73931ad
SHA2560571c41f10b6ce81099ce9aaafcb641c535e86734373eb2590a572465377c848
SHA512b7822b37f8b60c8d47ff75587773a984f28cabe087e488947a3044008c2e3cda5bd06189598caacfda8b224d8eed96ece5fe2ed02d09929a13e0b30213dccd0a
-
Filesize
5.2MB
MD5e68c6b1390f4a855d7aba1809dbca278
SHA1ff1d9f0e10bf8b5aebb85f94e3c808f310f681a3
SHA2567176fcf7aec59345126cd95fe20bb2f275b4ba2767bffeb0516ad1f25e14a918
SHA512ba58ebfe31c6f4d4fa68f6ba85b4b2b15f2a5ab96dc82c2c1263a9354a3e3b2cd746f637b58f755813cdab1aefd335310557746418419b666f601f28c790739c
-
Filesize
5.2MB
MD58e77e93f60338783ff987236774c8de6
SHA1cab41a02dfce1b8d71fd3254cc4d76b8bfb4a2da
SHA256b363a5782005b3750417826f43767a019b5a13065f5e25248fea76ca32a99883
SHA512641ca7db2dfbce8e543ee95e559d80f4a1b0585245b03d6ce89c0e30dc6c096d1b4fc0015273ee5b863b051a3067b56a9670e76763107d1a732a41eab61328a0
-
Filesize
5.2MB
MD5311e5cfa3a1a10574b4b63b1564f2011
SHA1099b0b6e7a53e91688c0ceba0f175d27d7a3f3f5
SHA256700b2b770af72b7e5445fab4805301327e5e2686dcf2d266a62007b3bad0e2df
SHA512999995a7164a4e504f7e9577b05872a9342d3865edb1d22c3f13b4504a5c1f5c10ad50c12d26c90d1b84e6f158fe01f0fb531de352f5f3394cad383ae41453b4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB