Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
04-01-2025 04:44
General
-
Target
2025-01-04_9eecbe2eaa2ba2516bbd75fb4a46b7d8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9eecbe2eaa2ba2516bbd75fb4a46b7d8
-
SHA1
2732ecacfcf53065a21f6533ce1b0a245d1b0492
-
SHA256
059c6d3e76e135d9ecc2c0de279d8878aa26487b92e1f1451af994d73f4439e8
-
SHA512
8e570f8ab52701d6f0e6c9a469bd9f4c969141f2b35d85a5bcaa797427b3e6ac8942fcebefd3b43b3f2b67eba28bc54211b5ccbc90d7713aa610897e6ad809ac
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUT
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-04_9eecbe2eaa2ba2516bbd75fb4a46b7d8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-04_9eecbe2eaa2ba2516bbd75fb4a46b7d8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rHVJecd.exeC:\Windows\System\rHVJecd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vNslMgQ.exeC:\Windows\System\vNslMgQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OWfyYbd.exeC:\Windows\System\OWfyYbd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PSqkuCU.exeC:\Windows\System\PSqkuCU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EqTHJHK.exeC:\Windows\System\EqTHJHK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DpVVMOB.exeC:\Windows\System\DpVVMOB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GmWsbQO.exeC:\Windows\System\GmWsbQO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XbrkUbH.exeC:\Windows\System\XbrkUbH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FoiUvlE.exeC:\Windows\System\FoiUvlE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jEFXuKk.exeC:\Windows\System\jEFXuKk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BxlOMLI.exeC:\Windows\System\BxlOMLI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WTgufhz.exeC:\Windows\System\WTgufhz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nmrHoTh.exeC:\Windows\System\nmrHoTh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\czwIWJD.exeC:\Windows\System\czwIWJD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MnyujCJ.exeC:\Windows\System\MnyujCJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\buTYDap.exeC:\Windows\System\buTYDap.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SXKOiOG.exeC:\Windows\System\SXKOiOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lUBAZyb.exeC:\Windows\System\lUBAZyb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QOfobkm.exeC:\Windows\System\QOfobkm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UzZgSYc.exeC:\Windows\System\UzZgSYc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OKLPLgk.exeC:\Windows\System\OKLPLgk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e38d6aaa55119c1b4fcb544aac51e69e
SHA1303260852513b74dbab06a737063acac72b71358
SHA25683962bfc720bca54e09ea2661047566d0acf3f222827509e33de218a49d827a7
SHA5120f0c1bba4d6d890765da84a165439434c1c06d3c143793b1230aeaec8e40e08eb9cc4c13c111dfdde642036b9f6ccedfc78c9fb231af3746c8ddbf906e0264e6
-
Filesize
5.2MB
MD5372c17084075b0e823b94e75d7e9889d
SHA10aab80ccf5151e09c73415c81d6c02ec45f9fcbb
SHA256e4d4cd9bac43d76736815377ea0ed8be5f4809121555281ea14135a1a62b7e13
SHA51211a4e6b0a0402f43a84e1c81486b952d01d0bbcb6fb935842aebf029e39348c43b981eee4c99c6f45d9b8bf22c05fb49c803aeb4d91573245dd0dd8d6411e1b8
-
Filesize
5.2MB
MD52dc0aea6a7bec13d51b404170e54647f
SHA18de1f60d5f0c2111778a3ff4c3087edae2673838
SHA256779660627fc4564266f41900c1e860cd308c768adc79dd118c0aaaffecfed1d8
SHA512755a9cb0bc35bff150bcd6cc80ae668b1d7400a5f39962892d3117e94cf80ab217aba1835a48b3494c1ba9c20222e6b33b2f451d82729b13bc949addd878bdc4
-
Filesize
5.2MB
MD59cd7e2bbfe4a6441a9a428f49a837795
SHA1fd566809ca983d927261df9854250ec3ac4ea56d
SHA25601cd75d57e8d25843a2618079cf42904024b9dcc2c850de1829ac4afb4c0e908
SHA5126d6ad3d457e6ecab7f555a9b0b8683fa05687e6b0743ddf7c380aa13b7c61e2c3d6ad5691d8c86275a358bcc73a7d598ab78f1314b91e3022e2f92350998a5ba
-
Filesize
5.2MB
MD554fb6e5b6695efc71c1f5346d7b5b50b
SHA153576107c55da9094cc612d617ff6dbfdc57ac4f
SHA256439d1286ab4324023a0b227fcfc9d0a82f000813b03fe3193035053dd5435d24
SHA51276d2ae0209a955ba681bfdc8db67f048a9245dda17be7b91162407a45175f6e5fbeb3b8abad3a6f5ea3b271e6f6407d97c05faa12ee38643a55f18b0d377653d
-
Filesize
5.2MB
MD547d38331b94a8268534e08c06f96eaec
SHA10ec2a90e53f422cf72e969a73658c7c1ee598869
SHA2568e00f0c936df100af9851e19a488000869fcef2549d52549d93e99bb80c7121c
SHA5126e247ca31b34d827592ad86f4c32d39e2aa4c8f7bab7edb77aa94ae68d0ca62a297a2b80576d709952fb97a5e1bd8724d26c8e3d74c907c082f6402aa2096e56
-
Filesize
5.2MB
MD5fac5dc7d95bec9a908b6f5f8a0564b58
SHA1af1abf4807eeb4b4b3693a836291882605aa1224
SHA256f58791059ccacf4495bf9f606152725112fba021acb4fff7d07b9dd0fafb2b48
SHA512263fa3a7123306408cc620588b1570df87c786569cfd69f47b7983345af33e3d39936de3a9ea98db67e9bb68083c72ebde796965e21be4cfc86afa3149a14133
-
Filesize
5.2MB
MD56cadb0f49f1fc9074d64bd5aab41d437
SHA12849216fac4c0cac561f8fd71620ecf2311ddc93
SHA25678dbdcecf5d5ea614ac3de7e2ccde0f9c533ba399a31776f7d5e68b7a68ea1f1
SHA5124ddfd262ea5905356eb66b3b16ea82fe7c773c1bad61efebe72ed60dc6cc65e0aaf5fab9056c455ed130a09f5a67f746db268d4d09f0b8e479393c49ffa130dc
-
Filesize
5.2MB
MD5787970f646a22e729e44d160b712ed39
SHA1e1a437fe2ff09b084dce932aba3c210ff1388dbe
SHA2566790251ba36fbac347e20f22b5e4433ce36e6ab961b149668d282e9160990601
SHA5120d3563519bd144e89930baa5aaea382874878b7ab44fec4ec083c28d06602f56421b90b2aba5a1b9e97d26aa61f639063ce0ae8a173bf33aeb20b29e1a879703
-
Filesize
5.2MB
MD549be47dfb38f21d171856f4dbfcaac4d
SHA10eacfca53f411ddf30c94ac9fe34a0612977b271
SHA256cae165ae6f2515ca3a6c82eded6561f5433b85dee165d1f7ec12bcd42dd58db5
SHA5121b11b95cfdb0d685f87f58756ce8abba7490b0f0728c8a1fcfdb8f0e15804d97b787c074b32940d0d2fae8b9e1a81277028e69cd80cfcb7e977fbc258a1f2029
-
Filesize
5.2MB
MD5688b45e8159252ee558f220fa13a44f6
SHA1dbdbe480a0617e3fee45ff7a733ffa4432b5ee4c
SHA2564969d165e08d2cbab8159bcb5ffe18b61382e044944517247da5860d8389b884
SHA5123edc21c7b4346d49c2f5f392f2af3fe2da147fdd6caa48de8db639e4cfe0d2b98eb752ad9afce40bad459dad3549dbd2ff8c07ced953e2edcd288fcdb429d898
-
Filesize
5.2MB
MD5d3cc0be3f7bab03c8601b6ed30a7bef9
SHA13d178c51c60101f45b26192c9b65e7f9b47fd4f4
SHA256638a0ce14c1189e72ca324f79de7826ced5455145af9b283b7d477cbfafc9f7a
SHA51238a806c0a6af8f5288a69f3a9959943dea74397ab2bd7bb7ff23bb432c72797bc6cd47171e26d20da61cc5a09e8e787c72f10b93826c3d38f63eb6f182db1a22
-
Filesize
5.2MB
MD5c57d123290996d1d6b6ec6c5d86dc181
SHA160fc34c2c700b2cc9c8bc5db8348dd9f4addf5cd
SHA25642bbeacffd3cc8aecf7e1b85ba98ad5b6d1948d1849b2683b79dedfee08728d3
SHA5127ef56c9cd38d7a26c67b2dd43c9c1fa8d800c3a5b54b1262a9e7e94a3fe3f736281e52ab6d01f1fe53252a3cdbb66b194f4f7934c5b1a63221d6f0dd8ddeddda
-
Filesize
5.2MB
MD591103974e99f068dafe50abf210e0b0e
SHA18e4167a80b35355c92de44381bce84cc215a0841
SHA2569911eaef1b12a41a2a962103ec6360a7c30150d7548b1c3bb358f8d82cb2ccf3
SHA512e70c96e55f957e0864a6f98dd1dc647b0e6dd36205ce33491a7f9a782daff3692ceaef42248b4c407766ba7d1c6aaf802f1bc85a194bba25988a00fe5893b675
-
Filesize
5.2MB
MD5f97f4663c58a9676f26b55690fb9d51a
SHA175586c613401c3e1799221ac32e1359c0043a3ea
SHA25690fc75e576dbe7ea074b4be11ecf230a57750c6c2ddf1172f15389397f3ff35e
SHA512dc29998544941e00389953cd65eae5656f3f6dd51cdcba7512b42e9f886b1ea9e21c22c1f064b38ccc1721154ea05e6fb569f3703d19a4b76ab845825a17bec7
-
Filesize
5.2MB
MD5ec176590013e04d84efb72b69b661d45
SHA1b60e27d2cbf974358dd90b478c43822697ca61d9
SHA256e894edd6bbef53b7a71b964687753a3052c5a6a39519a3a857e46d0557157821
SHA512daeb35d52c6cc688f0c8721722338dca25252237617108e53a9e74db297b01938b0c9250f90385b50124c39e00fd2f0b56611ecc9b2e66f254a14c9150e01528
-
Filesize
5.2MB
MD52430c3d3e9b2f6525f0bfdc3cdce3427
SHA116e9d7707ccf07b96827bccd62432eb7ba4b102f
SHA256ed7cf5f7e57ac3adc890b1d25650a0a88fb6b63e3227ed5abad65e9f22021d65
SHA51242a622c615b9d30a15bc0e1248077d51d29ba6234dbdf6aec25bbef465b0190c547a54833ea6c3778718422bc1f5587d96bd9719de4ab3176154168b2acdfc64
-
Filesize
5.2MB
MD555f9dd9b453791b16f10afa4b4a7e2cc
SHA1eaae8efa5b4517d340e5dd2a9376222024a90a35
SHA256d43bf68eb1f29e83ac96fb39f7bef1eb5b0cb5c765d8c3de6c6d868e7ea2dfa0
SHA5122d9f3a74c67241aa96c2bf9e041677d396f172e20acf5fc335aac7e1ee4ac28bcf74edb7810fade03a9e71d771152872521c401ed1176b44e6f255813a18d736
-
Filesize
5.2MB
MD544328d8fff00985e13b607095cff68c9
SHA1e4f5b126f35e3a11c1fcf8ae6da269a69d9fc1eb
SHA256ad206acf34112e5cbc576874645f835f62991be9086d7c2dd4bd5d0c4c271442
SHA512ea57dd9dc2d37198184aa1f9ceeac9bccb258ffd404560d698813585caeaa838abb7cc28bd8112c5191ce97fe913fd73255ec2af998d4bcb886c3c9edb73b34d
-
Filesize
5.2MB
MD500d42a7599cd61b3f1853079845b5d01
SHA134a6d5990fefb21f88f526cf10230de92b70cc13
SHA25648b54bc6e2b9a37c3e5a950597f9442718ec196d571b33798f8af8e32ff9f26c
SHA512b7cc3bdaeb01b0f5b4c5e9ca34e3c88d4c3f917801da2dc5347d37c02e5f61d92c57f820d6a47bb8934c376b30897922b2969af8d77e409e88e58221e6a3271b
-
Filesize
5.2MB
MD59728501e7560031a6c19abd5eef5b85f
SHA1b761ab76cdb2626655a4f8cca8442a2fc0afdd14
SHA256f7fb1dddcdd0c91a84f8fa02ce65d49bd2bcda9b62be01650db96e69480839ff
SHA512cd4b827fde7f3e043587f029a28040aa0e3811d4f78fb0db9b27783f1dd6996ea2b8221e565c0fd20ad48f7b962e8e54fe3c6d3c996af6f17b9a2c4277e52a36
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB