Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
04/01/2025, 05:08
General
-
Target
2025-01-04_e0a98c69e06689cb28f24d3bb17d476b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e0a98c69e06689cb28f24d3bb17d476b
-
SHA1
675f8589724fce0a905b3a3b546d1309f938c7c9
-
SHA256
1204529716d0c29be68eeacdc4a24742037bb8bcfa2a7b9444e52a6ebe54e2dd
-
SHA512
f3034aef20b32e04ad191d412f0ff98b71e6e56639417496f9a87239132833fb7739030b34b4ea493ea71ca09904dc5dc2770331805b27fc41c8d16003ddc778
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUP
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-04_e0a98c69e06689cb28f24d3bb17d476b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-04_e0a98c69e06689cb28f24d3bb17d476b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BghWBQh.exeC:\Windows\System\BghWBQh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JrkWNcS.exeC:\Windows\System\JrkWNcS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hiTfEWl.exeC:\Windows\System\hiTfEWl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HVAEyXu.exeC:\Windows\System\HVAEyXu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mmqIhVo.exeC:\Windows\System\mmqIhVo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qKafxVn.exeC:\Windows\System\qKafxVn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\okgfAfp.exeC:\Windows\System\okgfAfp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CmIYLWa.exeC:\Windows\System\CmIYLWa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BAXUfum.exeC:\Windows\System\BAXUfum.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IuQMmno.exeC:\Windows\System\IuQMmno.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oaUyCiW.exeC:\Windows\System\oaUyCiW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sYVYiKE.exeC:\Windows\System\sYVYiKE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pfLYJIl.exeC:\Windows\System\pfLYJIl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JoFEmBR.exeC:\Windows\System\JoFEmBR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CxUMFvb.exeC:\Windows\System\CxUMFvb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cAZKpej.exeC:\Windows\System\cAZKpej.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mfvTCjb.exeC:\Windows\System\mfvTCjb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IWTIfwm.exeC:\Windows\System\IWTIfwm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tGogGji.exeC:\Windows\System\tGogGji.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GtlFIrT.exeC:\Windows\System\GtlFIrT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RainKdG.exeC:\Windows\System\RainKdG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD516172bc047f39727d250e03ea526043b
SHA1e61d47295a7a9f70e0fb14b4533442ec792ffe92
SHA2562726a9974e816a655581923a43821ca2252dd9857439bfb82f87cc1425aa8501
SHA512f692d56af84f89e6635b753171cfa5c154ccea0b895343e5141e9afff479bca4a4ac81a316ed740a5d9fbe9466a60654fa583361572f13c5ec911ce91eacb5ae
-
Filesize
5.2MB
MD541933c1a4806e639a6511dcb0742ab6e
SHA12e7406f34ebb380467784c9fca0ddeb2fb03e672
SHA25619b8b111a23960f9f7a7ccb6e9f66d6c0ebacffd5a6b95d0d22a24092a8ca1da
SHA512d6235db8113f6d447b6f22552fbbb156a1396f8543487e2c9b60f338086134a15f9feb0776730c7533a704a535c9bbec3e0861520b0d1d34a882709dfe70ce0d
-
Filesize
5.2MB
MD5c24f59118e1c46ce1ec6039d3aa91ee2
SHA172c0187ef7e8a6bf798b6807e5af6793ffd1eebe
SHA256602111cd7a0468ca130d617e12432e7a257204441bbfcd6d64e9655733c21d50
SHA512219558ad43a33a14f63563ff403def991a295f76b4cbe4c23b949f15155f111972864e6803b711146831f0a0c1ad04f982ce300fe0f9d8353cd86d1bc5329b51
-
Filesize
5.2MB
MD5aae4d7ef10b7464c564c41088b940f87
SHA12e490f132e77f93cb6c3181e3bb9de2532bb6fab
SHA256f468115ddcbb8e8a622ed8747e2c7b8074eb648057f3bbffa7570e0c493ecc4f
SHA512bb25fd8073566e0a9f210fb021f39a784bf3c978202d8fea2f24c6e47dd2b6499df61285a8627d2c5bd578f6ebd4f9049d8120b02a0751b740228f33045fdef2
-
Filesize
5.2MB
MD58cf22f8e5e02a4b399b451bd16e91b5f
SHA1a77049421c3917dd333a4f27441e16fe0d19b2f2
SHA256a7226db8269d09269fe5ef0002ebaa6597e2343257dff7ae718c0978212437fe
SHA512152f484eeb12c2fa6950dfef38e3072b33cd9f81ab80dc199a9deef45b4257b6e7a74272d6b12573366ba1083943972fbe85bc887d07a810baf1b98f98750eb8
-
Filesize
5.2MB
MD5177d4019d4582598edb1e07733c1d30f
SHA11dbd63616d29bcd7db677a3785929e37390d7464
SHA25649ca9a79eb1a7c6601fda9fd16bdf10634c897c85acb2ce29d5296c367a050de
SHA512fd3c407cda78f081078b0e6a8e251fe380840acdadda3ef95ce25ff4af104720d1d00e6add75eec8e9f35d862c71447cec599a068440b73d78b993225e130cd4
-
Filesize
5.2MB
MD53da79807d449151db97dca17b4d7e7e9
SHA1f2eb367e4f9e225d54a988922dac47f67c7c52ae
SHA256ec9b662519138f5779bcdfb8cdc3774f0fd1320da22cf1dfd065c7e4e47ec44f
SHA5127f469808c92e2abed228d6f1df31c897154d603acd4c9b103d024a0df78ca0cb8770f019cd4063fe5d4d4a2273452d9f971f664d9cff29f813b05ea062de97bb
-
Filesize
5.2MB
MD5c07641cac2490fe59cb67d1697b5f0fa
SHA1eef1709537909c3faec7d145f7a26c488369c6e0
SHA25695a7de44e86953cea8313795157e961a77e52e6da019f55f3d219e3244d65461
SHA51264b8b91db7162793d21bfb8161e380604163acc54166cd4cfc95164f0e3c81d4de652524bdc1c40a6839fc2ef8b990f95b868e2165782806ccede4e1c389d9f4
-
Filesize
5.2MB
MD5cde78a8a7800f97df3fbf3c9274ea433
SHA127adef07baaf8869ff964af91efb8417c10d84fa
SHA256fb23ebcfe4db34a34a46c784ee0eb24cc2eb33bc6e364b4a0dbbf0c894c239da
SHA512602bff7dc45812053a3f2b44c70d0d2bceb6310b48ddd1d9f196f96044fa280326cf3f5566cd9d892797e5f5e620108cebe52d0319cf9c85f7f82fa97961c2c6
-
Filesize
5.2MB
MD59b0e731fa6fc6092f42e8f2e1bba0022
SHA157f9e3376558ed0880499b938a893d8d4c2c5a0c
SHA25681d237abd38b08eac27a2a9fcf6ad948c29eeaea52a78b89bff663ef0d028b78
SHA5125744eb8530491ae0fc1aae9582a607f4eef66e88c2444af2065f3b4911103594b54821cba3b1f7f3f51cb26a003a8cf096473c3fa5efeba4971bfdb41271493e
-
Filesize
5.2MB
MD5b38d411f950015fcaa903a4c5bdb2d8a
SHA160a2c08110dd4a28375e81fa4cb53ad7b1f6d9a1
SHA2569860425976034c2f1f042bc0931bda2342a79a642f25cfe175b5666625bc2512
SHA512932f7409c272d72805169284d5cdbbf45addd1b0dffc85db1b5345a15cef5ee1515dc3edfbe9a1201bcc01a9a9b79ef8086eabc1573b2e4a370517a438b4d61e
-
Filesize
5.2MB
MD5c0e20fb023ee5160e61ff0d95ea02bcb
SHA10193303b4cf7b0dd00113e975c04da51309d6024
SHA256b4826bfa969b3bd54ca6de726a61ef41bf57f8ecbbd2e0fb93f7cf73a2978a3d
SHA512c5c58e8950383899ffe9efe671fb49246a20848d9fd27955f68536ad288fe28516fc604be2aba8780c9c239035f36140f353ab2df4a1ffb6a5a7d9ce2c9fa6ce
-
Filesize
5.2MB
MD5bf0b326f5200546c4697abf54bbb995f
SHA16ad89d23afed1dd794fbc3523ac744a02d840510
SHA25678b4aec336a3e91a94d0b76af0351c738e6c3c06b6ef6afc73e9cc932b17d588
SHA51271f4cbab26fe0239a2f6e445d606c52959ba55bf3b7fb8655a70d7a5b66eab353be891c198d87ec18052295affd40f8d75e4733883f6fde3eb71248645eb206a
-
Filesize
5.2MB
MD5051204db894a2c779d3e8110ef97d3bf
SHA15130e035c4a75dddf8189935395dbc1482b94322
SHA256e29be904e4976bfa79725305aad1fbb3dd6c18c436d25de3f79c79b7f7a22d3f
SHA512b5b2f98cf0eafe013dfada612d0a6e74e04bd84957f4679e7b427e785f3ccf2428b9165d39c9b1433ee1cb37010beb868b7a98b250babf3df45118e6153c5193
-
Filesize
5.2MB
MD5e671b27968ea5e7de0cf63f7f2207aa1
SHA142c22b9120632c4d837df8d9c5db6621ac354aea
SHA2569f262849ae81cce1171b481dac811a6e49dda4de39c17f41a171b45544550761
SHA5129b0bac7f7afaee3b62150fa8209279f0d569301f56a3d2aa05e53493d5d115dec69d2b6c391ccc10f71b27eb424590d2a355bfd512299e6b16b847c3b4bd1329
-
Filesize
5.2MB
MD5e42ff55acb3aa1d210a890784c11d62b
SHA10ca3a3d52f44a253bb584f94211a4e7da65ce0ae
SHA2569f0fd2002864f83b4cdfb5368df516085ec2af55e608778ebae56f2b2787db86
SHA5124732ea9acdfff3283851521961e2e33215b367fa58283f52332dabdd41fd3186bfb25a54a7c749fd9820a63db632cc854aae451f7181e6dbb9a8865fe6d16311
-
Filesize
5.2MB
MD5c798d89e24b290af5aee13e9ac27ca3b
SHA1f42ba0da4c8ec8382a88c1ccee02a56409de3948
SHA25614d4c059b399975e340f7af96e5f8be25f5e404c5a387286c2554d96937c1d44
SHA51221c98b7d0a032261c91727e5247b8138cbf76a5e0f133824097b7dcbc7e4cbaa8f9e36ea88b765da1256c1da82e6bf3e3aa5ec2577d65649e95f051b79899d2f
-
Filesize
5.2MB
MD5fc008c3d5a5883aa4ac9b5b522536081
SHA10f8cc6e0d6e0a1d54f8fdf9fbf815d0779866ec2
SHA2569f1aee6ab17acd699cce8cdddba1b5e8acc1267ecfdcd0f3605aec17baa414bb
SHA51209c91a931852b954f18369308593a4a7cb753e9120d30dc05783b5e036e854298268f5d1bd1825775ab4e32c5f9a3c693921b2ac53b687690836f7c729416134
-
Filesize
5.2MB
MD5a7ee313de094c925861db7bc9ec44904
SHA1b0034797dd3c392b85b22b228bed240aed3cea4b
SHA256846142c7574f2061c75803c9a2e74912970f90594e7879f72d5e7825f5606ce3
SHA51287ea7e42c2aff41a2d858573c40e38e98a24d9518bcf4c939bc45b2cac7786df53274ac64fef51ce32faf5939a3f7a4cb166c0661cd822d409ae190f4364b317
-
Filesize
5.2MB
MD519e2bfde39b6d1445354de7acbd1b88c
SHA1f033ea0ddc67b517566d7aedf1de6002c8cf4089
SHA2566059313776cb71d744f990ca67d3c47f4a7f254b2d92fdf19bf9c04c386f4d14
SHA51229c2b4eef7651cc6948fc0708cc4ea2b64255fe0dab515203502d4c00659f04a1a9133a463ffdf6c23ac8e66bf27986434f99d6a6ac53937e2f01d3651f1b38e
-
Filesize
5.2MB
MD55d6f2466f1d82535f971d56775b91949
SHA13baebd21d76bd6635059fce0ddf2a5f32a756ccf
SHA2562583d0d7aaf43af10a026d56a0ab1e6fa00dbdad817e8353f9440e813c0dbebe
SHA5123a0e72309023e0cf276aa8841ff9c61943fe4d6a7abb49be44e5e92c0a7129f11376dd1316e96a1c69dfe7af14d761d7ec977b7de3e8ebd472b756842f85f6df
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB