Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 04:44
General
-
Target
2025-01-04_9eecbe2eaa2ba2516bbd75fb4a46b7d8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9eecbe2eaa2ba2516bbd75fb4a46b7d8
-
SHA1
2732ecacfcf53065a21f6533ce1b0a245d1b0492
-
SHA256
059c6d3e76e135d9ecc2c0de279d8878aa26487b92e1f1451af994d73f4439e8
-
SHA512
8e570f8ab52701d6f0e6c9a469bd9f4c969141f2b35d85a5bcaa797427b3e6ac8942fcebefd3b43b3f2b67eba28bc54211b5ccbc90d7713aa610897e6ad809ac
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUT
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-04_9eecbe2eaa2ba2516bbd75fb4a46b7d8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-04_9eecbe2eaa2ba2516bbd75fb4a46b7d8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bwAAFyO.exeC:\Windows\System\bwAAFyO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MmYVBTT.exeC:\Windows\System\MmYVBTT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ETjzzTN.exeC:\Windows\System\ETjzzTN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZDpTuUZ.exeC:\Windows\System\ZDpTuUZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UvqgHLV.exeC:\Windows\System\UvqgHLV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\keYemKs.exeC:\Windows\System\keYemKs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QhljOXk.exeC:\Windows\System\QhljOXk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ijFxbAn.exeC:\Windows\System\ijFxbAn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DXQoijC.exeC:\Windows\System\DXQoijC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MTfYApv.exeC:\Windows\System\MTfYApv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\laYKJAh.exeC:\Windows\System\laYKJAh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eAByTiS.exeC:\Windows\System\eAByTiS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HwyAkrj.exeC:\Windows\System\HwyAkrj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rIMLrRT.exeC:\Windows\System\rIMLrRT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZHeOrxB.exeC:\Windows\System\ZHeOrxB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iPhvCOr.exeC:\Windows\System\iPhvCOr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nMRfNDy.exeC:\Windows\System\nMRfNDy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rfLlcmi.exeC:\Windows\System\rfLlcmi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XSndGnx.exeC:\Windows\System\XSndGnx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FRMnsiL.exeC:\Windows\System\FRMnsiL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RqgMolw.exeC:\Windows\System\RqgMolw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5db29262b6902fbfbfbf4111d3145d252
SHA197e5ec0e79d2f6348de86bd5e2e2352f31520999
SHA2569c3e1f47981355ff938e22c8780a476f320f34895505bf25021868c7280a4e8e
SHA512632f57130b4b3d1d4d30e87754f6a8c8e29d780134671a1ea233ca21117a0258dd40394477569117b7ba496ad75256a2787ec0f8d93eb9da5949ce6ae50ad1ab
-
Filesize
5.2MB
MD5e28a4a7497b3e4d976d103a013d22244
SHA13ecdb9f7108de8a68fa6ad149c61ca3b6fd8cdd0
SHA2569d9e629e8b181216e025e2e8cba885f8ffc6ed927c7dc242b2247bb9b4fd9c44
SHA512bb22ca262f885fee09bf042848e15412bee9c74ee7a4ebbbe823af2fc8b7e8a441247856e5ea6e553cba9be1f328f6dd9faf9a6c2a406e48a496f5aecb90494d
-
Filesize
5.2MB
MD5bb70c08c32a65f7b94e92104b3df6f16
SHA1bca38a8df234ec32e5570f96c5b8f6ceb9e86378
SHA2565351608732d1ceed134170d59a16934bc73bf1d17016f3ea4fc867738236a0c8
SHA5122e50414cda71fd98397a7c64611da0933d101ecc61744791f82f264596b8feee2f5d20f3d755ad0b73ab2a7f07467425ea462d7ab74ba61aa3dde5431ba5ccc6
-
Filesize
5.2MB
MD583a5d7bb920ee60c58df41462edcd2e4
SHA1e8e8ecd349b70c21420a86832dc9cb4d8e5e5e33
SHA256f21f8df39ef404c6083839cf7b449329ab5d5ba50d181768d1b52c6459a03fdb
SHA5120ca5ebaa0a438035228df1f59d69613e05859f8f08a67520103faddef07fa09e6670cee52582b677bdf23a1f9e28dc94a360ae8c62cd69e7d2f0bdae30a46879
-
Filesize
5.2MB
MD525958c57872550df856ac79afe622fd3
SHA192fe552f579b21d292222da3d514f72128d41244
SHA256ee81c01b7439a6a1fff10d52307b8615add218f3cb12db55a2621fbacef78a6b
SHA512f25a146129bb07dc4c4b791ffdbf994b426cae350d9f840bbc031cda1e467a88bc18c38b8b65ad0ea8ef5f62d83acb6dca7c6b8e48d086f0c65b9789931e4499
-
Filesize
5.2MB
MD5eb8fc02f6bb374387de43f89852acf9e
SHA1be41767f322f1f3ea374bd4e10dc21950f443eef
SHA256ecf3ba7656cdd1c4c753bff3bef6353e75c9f0b130362855345bc6435e92ed08
SHA5121aaff41b3c5c203fc938abd007c54273a848a5c1bb7e796e6bea4317cb22b7a973ef602488b7cef57de6dadcfbb6e482d490bce69325793c23a6e3b704bea9d2
-
Filesize
5.2MB
MD50b01679dda6c9d4a5003510d9c595ec0
SHA1a405eceefbf0b0e4951e75d2ef5b911f4015cf5c
SHA256ef7c07ba62fbff4b6bbb4a92f9afc8bdaa702bb8b936b824bddb61ad9ab8270e
SHA5126b1f3eb10cf0120441a25b7b4630d61386063ec2dd5470c14a937818c80ac6fba6ddbae633462e71b98070a2564cf3d5763b0d5bb72b3c154cfc6e89662b81a1
-
Filesize
5.2MB
MD588ba67b47f478358db1aef4e2e639741
SHA1c9ee86a0e64050aa510defc17d7bb08821923a1e
SHA2562aea4db8ddd0b70f7464b9f58d0617b0b015182ec04e62c40689bdd43d09a9bb
SHA5123a81a06ee040641fce861581092732c0d644fef9a32da1a9b448f80ad2a3a34bef1f984a7e6f01ebec7e031d80b34d5ffe19e5989a9681435e03c91fef789dde
-
Filesize
5.2MB
MD5a11e34c33b900541a7c61ec5f7744fca
SHA17812f8f8b0055aa4b5ce1164d551c298b66a58de
SHA256fb1bc2adc5540170157e7537ae0f3dd0f4d0baed4a0bd968d2c09c82394dcf7e
SHA5120d24cd203e1cd6cade26ea866b26f0e220da2394d5f71711b17017ceb473f13010b2bb7cc03c70f588a9511ca92790a6100b5cd13026ea421779b95da0553628
-
Filesize
5.2MB
MD5c0a76d221155ac828bd744e1cef6cf14
SHA1542b9e519f6e534de220498450d4eaba66381585
SHA256e1fb6aa7cbf3969a6a5defe1c121a0a259884bda47ce66ded73e2945f755c818
SHA51231f60916d0fd520e49a794df1e14e75e70740d85a1c07b34a40931fe66a40561ba0754d50582f9da08011c7c9b21b00a875a6343e2df122aab7d50133d48258c
-
Filesize
5.2MB
MD5293c0ec54e39b8205ed999e57bc3869c
SHA1343b454e547ff9b3a486974ebc08e683620b9499
SHA25669c8df1b29201c034336346092aa112863aab15f7db97cf148e14f070cc2f8a3
SHA5123a3c720fd69ce0553fb8b013d041108a6e34e0b18ce3bc0d883f69c48d3ae82187790b7a2f0c5ab7c4dd8920ee285a2372bf482c13d358d6dca4375dba46fa42
-
Filesize
5.2MB
MD5fb40b5d069e558a890986fae61abca0d
SHA13a16a8e24a3e465e85aebe847bcb2b3656df73c9
SHA2565ccfdef77a3bf0612b939f92a06ef7730a36e351fe16532c91483bc6f76f4147
SHA512304cc8de99db8a721cec17dd30953b50ddc5c5c43429386d46a1acd04bc0f44e5e5d74a73c71e9269fe6d09ce94f3f7d80451ac9362d892db7c9d3357824edfa
-
Filesize
5.2MB
MD5282a0441e4cfed29b5787dac7c09d742
SHA125ad8f4941309137f572f0aadf9869d86e7f6a52
SHA25667e3d083ecb0fe662a705a17f5ee87a275743536630940e93a30ecb36f640dba
SHA512c7bc7056bce140586f50f995db15581a30c059262c1d0f9bce2edd4fa75008bea6a2620a2d4e84401efa10410bf6c6f1cfdd4decfcc4b225fc133e6eecabe533
-
Filesize
5.2MB
MD5bc358804a842d50f544d9300158948c0
SHA1389054a7474842a6be37c3d198f14d54857cd30a
SHA256bb2ff33b775c71633e16310021336a90f0cfb00efa04afd993589dfad9a0eb25
SHA51220641b510b260ac4f59f36c0e49f3eaad847c94a9afa68e61404ccd78e1a2d66d67cced06749f9a60a4ad7c6fbf062bd26c24d0738c0babc3c5e415f3ac4670d
-
Filesize
5.2MB
MD56a8582880280b6b36b493d7ef3c0e97e
SHA172edf0922bc5daa960ffa8ae55986270c90a15da
SHA25639bf51deeb7076afb1f2caa807b426cf1db615108c54e48eaf37f40fc23822d5
SHA512d3df4cd4830cef464671322354021395ce1950c301d53d8059838e67c6c70ed4331c194d8247cd8f40ee6cf130dce2e7124c46c016d166c8b6155131716f491c
-
Filesize
5.2MB
MD5ea5b9644b37983ae4ccf25c5d345f5ac
SHA135e1bc41093453001a399cecb05fe81138a24a64
SHA2560bf157f3817880443db50599d8fadb1954b2c7276dff2c39941b4c805bf76cab
SHA512e80f203171fd3c70d782eb9d7c8425dffb52e9062e124396742b824ce08c9530398a02f17d8a018a8f36baee74ba453932b78a3afdd54bb12ff70de24c94ee44
-
Filesize
5.2MB
MD54794221468bcae9f90a3c62c514d2461
SHA19c6e027aa068e64c48862ff196c67fc0be6be49b
SHA256acee68bbbc3170a9570235066500222109869fb313055b6937b84575215082c1
SHA512273027928e18c597eb6bb384f0251def1d3d21a7fcfc51b69ad6646f1771ba672028278c1b8471c8ce100133d08352722fdeada9660d5573c6e42a353f61683f
-
Filesize
5.2MB
MD5194095129765219445aba82efe08bbdf
SHA1e240dcd6d6e544f7e2fac3c48f66e49aba9a9121
SHA256b84f383b59ff7152980c863e1f9d6bb4095e9bdaa0c6ff22cca5c9437d91b055
SHA51281f1b662b86f617038b37e6084035385305157cd7db9fefbec18ee997f5f78271015bc32b7c564da99b3b2a2d7f311e4bd3b5b8556730633f9d8d0fc91aeee17
-
Filesize
5.2MB
MD53095ec6079f6f7352de5ae402b88a5c2
SHA1b7f50bbb6d6b2b10a5297ff53890ac09892d0084
SHA256817b083cb69288fe91427270f878b3b7651466aed806ba5accb43db4aa548205
SHA5125e399292ef421812761d9b007171f6eec8051107d7a04ab5189c4daa9a413d07bbf49b1a010023e542e3ab6584df8d7403edfbe176d93b97a2b01f228438a989
-
Filesize
5.2MB
MD57abaf3a49ef4fe6c35d5a94846e24aea
SHA12db045d0f3b40fcbee7750b4eaa640f1154bdea8
SHA25696a5c75336db660f27a4c0cbaba1fae6a08131e972e3ca2fd8ef69cec40c4bf2
SHA512e6058e23cc9fa9d6e85076e80e6a7f82a4a4a0d53d3c03af28f3e8bc564590edbbfe06d03943eefa3f01b34b47fecfa65d2a23de2f50fd5064e0f2fa9c4acb67
-
Filesize
5.2MB
MD55efb773a0d4fab5c5c7f2ca8bacc7094
SHA1aade11be8df329b663a8446f526b948a66dce728
SHA256b7ce20422fa84f8b5d5e68c140205b8e221199f3bcb6e363ffed7e99821a5608
SHA512eecf0df43f69d2e739533ed0c76b145558436b9150cbcf0970643e3773fdbe98c19f1e9cf61a6e05710bc75ac8204a701fd5ef88a08765f19a5284b08450edaf
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB