Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04/01/2025, 05:08
General
-
Target
2025-01-04_e0a98c69e06689cb28f24d3bb17d476b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e0a98c69e06689cb28f24d3bb17d476b
-
SHA1
675f8589724fce0a905b3a3b546d1309f938c7c9
-
SHA256
1204529716d0c29be68eeacdc4a24742037bb8bcfa2a7b9444e52a6ebe54e2dd
-
SHA512
f3034aef20b32e04ad191d412f0ff98b71e6e56639417496f9a87239132833fb7739030b34b4ea493ea71ca09904dc5dc2770331805b27fc41c8d16003ddc778
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUP
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-04_e0a98c69e06689cb28f24d3bb17d476b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-04_e0a98c69e06689cb28f24d3bb17d476b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\EQBCUjZ.exeC:\Windows\System\EQBCUjZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VidWPLH.exeC:\Windows\System\VidWPLH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IZDKVhx.exeC:\Windows\System\IZDKVhx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hVeWTyf.exeC:\Windows\System\hVeWTyf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KVnDCDr.exeC:\Windows\System\KVnDCDr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tbFTLCz.exeC:\Windows\System\tbFTLCz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yNVQsNy.exeC:\Windows\System\yNVQsNy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UttUIgv.exeC:\Windows\System\UttUIgv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DdXjMMg.exeC:\Windows\System\DdXjMMg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cUhdvrQ.exeC:\Windows\System\cUhdvrQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SmAXpdR.exeC:\Windows\System\SmAXpdR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\syQOOsn.exeC:\Windows\System\syQOOsn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wojklOX.exeC:\Windows\System\wojklOX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ltLjsho.exeC:\Windows\System\ltLjsho.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BVFKJJL.exeC:\Windows\System\BVFKJJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lgOWxNl.exeC:\Windows\System\lgOWxNl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CfBKYEG.exeC:\Windows\System\CfBKYEG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FSyInVs.exeC:\Windows\System\FSyInVs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\egoswCA.exeC:\Windows\System\egoswCA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VdTjFnY.exeC:\Windows\System\VdTjFnY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cUiKKoW.exeC:\Windows\System\cUiKKoW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD557d5fc8a73f79ab5c96f85c079a90587
SHA130d9a2ba2fa15641ca41b5bb2f2968045c9a7ee6
SHA2564d11e88bdd2a96fc2bdd11d1183bf5599fa49472f557c9d65582fc99e15d4338
SHA51240dcf63abf04fb89416464995a62f5cabe120d48dca10298194b49e91ffb4b82744eaa5f41fd3b45f3c079ec031933e38987d4ec2ea8866a03ade55f3df3052f
-
Filesize
5.2MB
MD51b9d99e3ceb8c4106d142e51ceb96582
SHA1a1c10f2b123ce8bca389e438aa15ac9d37869e3c
SHA25664b1d4e5672c00ef5dccb9133a327f9da63d6a1d456f8c5e57138d1bad05c80c
SHA512ab8299d971885f38f17e83490d3c526250fc6914b048704c9be0b8b9fa5e72df68c5a2c971d073e85c1f020cc59c6ac282a80b026a743ff66116326a7ff0c4f1
-
Filesize
5.2MB
MD526f72318c58016f3ffd408b89b3ddc50
SHA17b77302d88c713a499dd40accc4b62397289503c
SHA2568e5ccc5cea4fcbc1560c3b13916db10fd4ebbff0c0889066d3a721e443734ecb
SHA512a0175443f5786ca73fe8faf26e2c72357c4894b6688c453781f06bb5ab4b34f70eabf103dd745c66d23ca6f7669326be9e164f306047b826343ef820d0cacd1e
-
Filesize
5.2MB
MD53689d039d456aade5d94052ea0b78e86
SHA1fe9151c6f3897e2fd5fcc23b6846a0fff37bc0f1
SHA25673e1425cd42488739f31476915b77367b961358e68e007627113dada54c8af89
SHA51248c7dbc28afe7df9aeb9dee15a699aed5989d256f7f2cbf52747e01dbca2ca00f77c17305f61846636e565af66047506863a8d8efc5bb54e950c868b61876c0b
-
Filesize
5.2MB
MD5eb053137d01102431d9093e8bd7b4547
SHA165a2d452b0dc7169e741ac1b62174d70803cd183
SHA2562de61e90a35b21c2c7ebd9d928781e2850f1db62235c3accf9650f638f9ea84f
SHA512cdb9ad15c4562061b43b9f400f4c86804b28dff78c3aa047e4102a12d02886acc935ef6f7cf3e309f988bfa44d4404f9b5368f4a83c096555a002cfa943e4a20
-
Filesize
5.2MB
MD585448d1608f0bdc03aafe98cbe39bb60
SHA1a5fe0980a61e3904aeaab6eca819b4fc62870727
SHA256d30a14669ba98df58036547403c6875fd3f292d6d0e95d057fd38879e8770ea7
SHA5121147eabc60ff9df005eed2a9336cb8db141c1e885a9031cf9dea8755d88f2540f5f90e904b56f02242b90a2b4a242ffea7ca973659d0018d962399e402b855c0
-
Filesize
5.2MB
MD511bc9da989c7c270b5d571771397a2af
SHA1c1e9c42f634ae2cbadda0c7eb2a4a35e8f18c520
SHA2560c0cd2809e4eb8807cff0f825145320e49ed8e6693ae7f22e549695e9ce6d4dd
SHA512cadf9a38d06929e9b56ec4ba65e2aeccbba2700d3993807e2b69dd82b7f44d33f200d3dc9a9cad8837e0a89a7b3379814cf87354865aadd0d415b5a5f9709ceb
-
Filesize
5.2MB
MD52113247f1284447804f9b740c138e290
SHA113329205458cd1b4220421eaf688a465ddae1689
SHA256180436d0cf736c2c60a5714e072736235d73be3a51cbe7e3e9e6a45dfedb97b1
SHA51278db4179fc50a4b476f057e4a464db17e6eca97854026bfe7175e0a09eb031986b412514ce3ac6b6b9b2d4b2635f06e473c5793c6a673c777d86948b9bc9b00c
-
Filesize
5.2MB
MD5407ca8853d72c44242e522a00cdc3254
SHA1ffdb4e9a8f8252e636dd4dd3baffb822f02e622c
SHA256d571a56c91c0a6fcea880aa35490cc4f79a865a13891563185e5e90f1aadbcfd
SHA512d0c2e165536745c588f6878fb33fb25f47920826ab639088c8a793b2be82a85242107df19714d3a470d4a59fabbe6d6ba985958c104e713a9cbd321ce6e3e3fd
-
Filesize
5.2MB
MD5b056a743bfde8e06e29563b04c72de4e
SHA12d9f8992659ce51259babfea55390dae12b0a557
SHA256ea3b942fcd6c2366c8e98295032d2164f4e1f86093df0788b5033ace6b7cab4f
SHA5126ca16b7f95aae2078c8d3e47dfd6ae79f15296f4600a6f724d340336d8597983c48a8302cbbd8678fa89775e32750798fbcd4deb167812cf6c41bd40e89fba03
-
Filesize
5.2MB
MD5c516cc27378de0ed97e6151f7788a307
SHA1dd6139fea3b470130d85c3cd44586784c351d453
SHA256205019b505b1444e1322011f90cd374950c154dc26dab24c1ac3ea415e13d950
SHA5123d8f2f529a37b355413bd508de2b22d360cf679a84c4e21d4593a55db4b778bd40e4ce6496337906f5664bc6f63ac9b02c642f6bf1c882408736f8aca8e7702e
-
Filesize
5.2MB
MD5fa6c4d76df83fd175ec1f555fee59c9b
SHA10e4ba90aea29866728eb96c21f3aef1ce10b943f
SHA25643c138a7c1950b1797f6fc6b422e7e273671e60fbbd3bff68452cbd3ff5d9e7f
SHA512aec130451f88d70b41fac0c72f3895a82187f4e7c70282169d940a49a4aeb71b4b535dadafc0825e1a985bec0bceae4359dd7d5c2104d0584d2ef1975c5f8262
-
Filesize
5.2MB
MD51c8f0cb67348a4dc460914612ef8dae9
SHA144df8fed6a6d6a832b74a86ac53022a3d134ecb4
SHA2561c1eafafed258989c1b66cb81dcf9f4fb20eb9e911a56ad31848126cc54ff8c5
SHA5128b72e9ccb03b4095ccbd58664da2219d61131861363a7b11f8aaa9db6b11c96cc5b90420745d48f73e00b80317aa8d8db1d8b32b9a08a390ef8a6a07cd150b20
-
Filesize
5.2MB
MD57f27818ae6abddb993c12e2a713bf9e0
SHA1949f241a776a67d034f35149b8a1a02abcc25321
SHA256bfe4eb39361462b9e6882c0ca49e556afa705c028122d83d48ccd8aab40408cd
SHA5121d6e66c3379a01bbac90f0d90695085d562e54b3cb2e0ad395afb25b15fe34dd1e8e424458f003c4d8f392ca496efb81457f827bb82403b3058ff0c2396d2fe6
-
Filesize
5.2MB
MD54143164a2f88187d9bf4cd6276e64f4a
SHA194e0d01f96be9698f5e506b1c06c7d7b2bb458f7
SHA256b68bac33e3f6937f0cc496fe237f708294e31ed158a482ea91f5afd33338abb8
SHA512bd0b2957aef212cccc42cdf23c25392129749cd91d57d9eb5710f82040d85af4d6acbf4d7a4ede6b5059daef1cda9e48abdaf7b2982b05950e09b7639dac8c1f
-
Filesize
5.2MB
MD542020920bb70bc1f109a9ea14e309af7
SHA1c68f161b2dd50e4c9704df160c58eff8a8caa6ff
SHA25636eda800939ddf1544b92397ab5087c3a551e3e48f747d1f043a848d982f2e59
SHA51258fdcbd590e03e1d0189dc9cab6e02e95d3bfd1f82455e88d587fe99f048e68671aeecd75c9264dac6caad024f56b8be2fb4a17fd300e34f33b10df7a72ebec0
-
Filesize
5.2MB
MD5ecffc38f4ee006ea5d6039b759ad6a0a
SHA132b31f07f2159167437e38b7ac05a9a5f5ba847d
SHA256ae876dd7eee6112ca6daacfd22122534cd338c20cc9844bb49c74f88e77aafed
SHA5127f564d1dd907e84cdeb0284b3d91cfcbb8f1a9f4288cb1164296cd9dbbd96e717203264df2db471c37f02a5538f4f504aec6a5a41724cdaa277bc6251c10e3f4
-
Filesize
5.2MB
MD5d8065f48dbe8cc594f4ea44b2ae03310
SHA122b21bcf2a9faa826f28ba6ec4cd902071c25dfd
SHA25668085ce24d58acb52425a91fe7a934faa4ff5810d8b9995928c1106eaa0461d9
SHA512d91895ce3eafb831a530451830332398ed456c6becef20e34396b83ce395b7d6c141a4637e541c0dd5e69a4e80ed467044fe443b5567baaa8aa981d2d8fa4922
-
Filesize
5.2MB
MD554f84cc14d963c07d91ab6a1d3b31e13
SHA13379e6329334b6f433f9fbc1d859738cf1dc3fd5
SHA256cb24d8ea3dd507c7d9466a36b83334f487ed2dc860b046647fea69e710f74f64
SHA5124e51463251b2b6a37ee4802e8225a4123754eaf76e1cc59f9db201313f2cafeafc6d1c430d4424995a4be0efef9e90018d3b432a225c3988b6929786b1fe7593
-
Filesize
5.2MB
MD5c4027ca3747047554ed69d2db96edc30
SHA1fc7f736461a98c7bf3ccc4fda569d1ed08479781
SHA256baf0206d7647ab688976a347561c0c427635b49303bc97dbba0970c2516e70c7
SHA512b1986e81a11ae13c148641383818578e10f100c6e66a095a11de0386c786afa6b40ffb3f8e8215a0d85f6b183dbe1731f929dfd5e66b8c6b4edfd9104833018a
-
Filesize
5.2MB
MD56778b10cec11b2d6a3405ab6bd8a7925
SHA1ea66b5af5ca853fd2ad6f97488e4ea0a6f9ed820
SHA2566a47d9f086222945817165d291b102e2763b1475852cdb4c57efcdd4cd95a81e
SHA51232cd29b3fa300f6113587a1be776b3fdfc228aff008e7839e806941a881364b389334e274779dab7fb8bcf14b75df46519b3d3779a0c234726df34f13a61e3ac
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB