Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04/01/2025, 05:10
General
-
Target
2025-01-04_e65141e45f708f047e405ee4fb27360f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e65141e45f708f047e405ee4fb27360f
-
SHA1
d6e9ab93bf67c8c5bda350d2ea5a01d2dc438236
-
SHA256
cd5c93da09c5b18ef55d244c0ed9b193a25aeee616a9c68350612419013362e2
-
SHA512
b777ea1882f03afbf52d676ded1fcb504ca5f161e5560be6296ea6b87b16e17e920f0ffd3fef02d1b29af87eedc7218b718ae5b65c046793191bb7c3fa9a7107
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibf56utgpPFotBER/mQ32lU0
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-04_e65141e45f708f047e405ee4fb27360f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-04_e65141e45f708f047e405ee4fb27360f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\JXWKFfP.exeC:\Windows\System\JXWKFfP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wsfVrju.exeC:\Windows\System\wsfVrju.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IRxNfZc.exeC:\Windows\System\IRxNfZc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Ljedkzr.exeC:\Windows\System\Ljedkzr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iUdcmdS.exeC:\Windows\System\iUdcmdS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ilBsGme.exeC:\Windows\System\ilBsGme.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\llFPdMk.exeC:\Windows\System\llFPdMk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iBLQfue.exeC:\Windows\System\iBLQfue.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PZmTzWt.exeC:\Windows\System\PZmTzWt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GAeIUyy.exeC:\Windows\System\GAeIUyy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bmdXlgo.exeC:\Windows\System\bmdXlgo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rVvTWyI.exeC:\Windows\System\rVvTWyI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cisRwgK.exeC:\Windows\System\cisRwgK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QhLzGpT.exeC:\Windows\System\QhLzGpT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\emiETiw.exeC:\Windows\System\emiETiw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dTFhndd.exeC:\Windows\System\dTFhndd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rGMryPI.exeC:\Windows\System\rGMryPI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EnwpsqZ.exeC:\Windows\System\EnwpsqZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jwuPnLV.exeC:\Windows\System\jwuPnLV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JgRNbQE.exeC:\Windows\System\JgRNbQE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UjAqWnQ.exeC:\Windows\System\UjAqWnQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c73a6946ba1fa47736fb2a5ebe61b7c4
SHA1d869dcc4f927d411bd3b29643c22adf5da9010cf
SHA25637420b91110443c253bd8e3ce66940b3998a8240b66f0ba3ff54b42719800e75
SHA5128eee155ea017bb46811e531fc8f95985bcfa97d2c74be54f43bb52354d04d4ca1a91511932d92bdab018cb0e65b1ddbdf466af0d4f1cb1d3636cdf4e02ea0130
-
Filesize
5.2MB
MD5c08d2fd4879ed6d866cfe6f1c23ad74a
SHA12e75a32eecbd6b329e5de76ebb7a42e7e4e39fd6
SHA256f6a9f78744bc5caa30f5cc0cee9db2b8405c1b3cc5faf41af28d27ed13f9b620
SHA5125a3e15e552a347fe77e7124eacf895b8441c870736c5c047d21cd38e42d6cd5e345f183ac656d83534a7e7be27824b4f903c9758f423f6c8f49abba15a445410
-
Filesize
5.2MB
MD5921a9d5be349923fddc3b258e8bf44f8
SHA158ae7f096376f552e2ee99a98d7c803b089c8ed6
SHA256217b5690471978dde7b9e8864f2a7072dd811e8473df821b3224806bc40f572a
SHA512953515e53a9e0ff081430779aecee450cfb12e2d5958de9bf29d0c9e04a3e36d33db7f190e77f9991d58a9ab4026e90b272da57a5c03bf84a5483915d8c84a7a
-
Filesize
5.2MB
MD5f1053297e152f7b5cc4fb0fef5a90251
SHA1effbf560edd05dc985ebf2efaedbd9080ecad588
SHA2566fdbc9a9708b83bde4fe8a233df3724aa3bb7fdb5d94d5219756ae30adc00415
SHA5123bbbc72d290b77b885d48679aaf0bace107429744891d7f68085e4251521f3925f5a3a5997e5ff1902f75b06525f60d80e30dc9e3a05c79b23d1cb590da2b502
-
Filesize
5.2MB
MD5182bcdbaacc2e361ca2d43e02162467b
SHA139f776c581898504d031bcdc9cc6a9749aeac91a
SHA256aa6003a9084fe3e8790f2a3cfde53729c13df3a6432877102ff7644f4d9d804e
SHA5123ed47f783f2652fb0507bc63ccc709cbdfdb8bcd708cb4d5eb1625bff57e3a3521374ee584561c281dd82a129262071799d49891da8746ee44c346bd5e5464f2
-
Filesize
5.2MB
MD5761c4d464abc44f58d8b738fa8e2b4df
SHA1d4fabcd4e96ac3cfbc975fbd2299d82ec9c33626
SHA2569494d036c6c7d39b8ff4ea8c6d54241881584b73ae879932c5fc56bd08709ca6
SHA512b87859367b47d127dab018deac319f6721cbd2e632a4ea4a6a5234d43fd8b9ecf662b460cdc1cca18a48478b820495382c7f996bf2166d2bd2bdb5f527e3eeea
-
Filesize
5.2MB
MD52363b3c71b62ff32bf2b5ebf07c6fa77
SHA1fdad476b46eb8120a92b752b7512d16b90764deb
SHA2562c9bf6e6a20124d4fdb2522c3c0468401018b1e1a00c50fea8759cb6ecc36839
SHA5122d3e5aff9d12527ceffd21f4d13d4d54f9d68c7647bbf7b0c21f758a87f6cc527b7704584d4a110a01a688d1963d1afd340f7038a0be8d75f26b20a4d037473e
-
Filesize
5.2MB
MD5deec4f649983ecf8e34d2635588e0e93
SHA17b91f03cefe881415a4f9079d35116ee993bfa48
SHA2566821f635ed2b5aceb2151cce8f9515d6ad5105406b2473a67fcb82beaed772c1
SHA512635ad2ba0639659637b62601168d5e0a6ead30d5de1a6559341b6ec315946b1c2e4026262f6c6df35068054cdd5e952f7ace00f9ade3f75c1fdd58d5dd3aad18
-
Filesize
5.2MB
MD581902da62c67ba067033dd79b114a98e
SHA1e3ff2dbf88d9942e6060e983f44dd819d0f885d6
SHA2564c00bb7fb9fda08c6810daf6ebee9458f2a9928e81963f504a6fde10aa00fd4d
SHA512a2895283c5329c508d050be61a6055a4bed5b1141bd317203624668c51a0217fb9559f446789fd9c6bb09c104326e5be1d7ad29fc7c42722da27daea946a9fc8
-
Filesize
5.2MB
MD5f5143e641a295e2112c1ebb4d287eba5
SHA1c95e3adb9ae3778888dab7aa9e519a43d2d57010
SHA2567fffb0b60c59a24f21866c3692c4f7eb88160df3bea38448788f6eaf91344be2
SHA512216a1358d639c2e8640ea297e8d6db899b6203cdbcc4d0aa4221aec5a935bfefb425512ded3c537d6e8dddb1b5f2f032e98d0dfac284370d0dcfa63a9bfd1bee
-
Filesize
5.2MB
MD5a5cc198f434b19ce8b3c2695633f5575
SHA1ff9c7791eac89d813e0648e2e51d588e03029f4d
SHA256980618bc2f5f2b86e514116f5826782f45062371ee317ad885123fe0ddcfecee
SHA512fb3613856c03ed80c0e212689295e901bd892ee401a9930fc4a66d0caaaa2f29081235e30f5edb632ba96c6334feb0c51d001e8765529847cbd7c80480cefc7f
-
Filesize
5.2MB
MD50c7a7f1721401ef3b6dc39aaf677fe60
SHA15ed77d15c0108cd9e0ed80fd5ff2af98eef917d9
SHA25641e3a9a6cde17759a397a0bed5a6f4c963b771d1641ae48109f0881cf4fdf162
SHA5128de853b204c68474fa49a3909c54cdeeb1552f42301ff943a858155f08019a53bd1a46ff7f3c88f041443e667bd3499c672231715ef061ee3d5e26193509cbe3
-
Filesize
5.2MB
MD5b8a9a36f7c6539071a514ffdd95191e6
SHA16ece22c3d0f4435185aa7bde53ab2ccdd4685bfb
SHA25683859a9b9cabd3dc563af3e943433785d9f9fbbf0ab8373b2d330d7b9490e7b2
SHA51227d6ee85c3ca71f44018bbcc9df6fb1ccb4c3287e79b6f3928e6f2b918a7f6a08a1b5e7c702d55f5bfdbbee3fcc1895e0b0c34b17c2d50b6763d3d1fdcbac2e6
-
Filesize
5.2MB
MD5b75a3ee36f6651e5a3f4f6b5e951f428
SHA1fa854486cd7fb2b30e1d9dedd0cff70f2fcd4b51
SHA25613ebc628ee1a6d69eba64318381e7b0bb32d277c61b27f05e8c7fe2b27c51d94
SHA512ef5d01cca76cd7f79c6fe78d68b1220e9428f91925cdf8a57aabf15592f55989a49ceb7881e4f877af10492db7ddc9f902ee08a56c39947f3c6ed145b41fd247
-
Filesize
5.2MB
MD54a604581d6bd8a10a2cf68171ef79232
SHA154c4a9c4b87b220d123a713f2f9522edaef37239
SHA25677cdf9e5e32f90e45593987cd40be8e096307ee1a4dc8276106b5a6a659bc209
SHA512e81f3b9dc4244244bf6c9e989f454a7ea42668b83885844ba997e11815ec90239a87dc428005d99f74016b2713280dddaca165018ed5705693714a36a1178447
-
Filesize
5.2MB
MD546f0ae4a2e3e67d8270c7847a8e1e9c6
SHA10503911e9c60469488c47a6cca592cd9eb09142f
SHA256713a3f2cb99ded4e2b1de54723baa58c50b2b997a7b17bddd806602f933d49a9
SHA5124f1ac8231bcbcbfba22e196239bc4336efc533a4fee78e08741a923cc090698af6bbe02b66dcc15e8f5df7e6fc99fce40ac2f7f6bc8a1500f41d1e54a4837cbc
-
Filesize
5.2MB
MD52cf6d58525780c88d4abc07773b428a0
SHA1a022e29f984a500c6620f5cc3df45f21118d7c33
SHA25678b8fae1c8275865bd11ba22ac14eb45679e0574fe763a258a5548433d89d308
SHA512da50bf9ce5e71c455b61d16fc9d6388a27094ddabb5a2621132e83229a5d880501dc56adca124cfe46a22bfb587e14dd573333764656cce2f0f522723afc9d29
-
Filesize
5.2MB
MD591c295611d273d6968dfca9be318d5e6
SHA172bce38e24745fffbd17363c1281990f24029ad8
SHA256e3743c0bcec66054e4828211d006d41e7791329358d337e30da6d9f7d1faca21
SHA5124cedd52f3942fc30991fcbf0afab61749df417abe6ec11bc95ddcfeedeae6edd0719f0be62449f1e67a4231ef605cffa192296119d03fba15fa634d9a099b1de
-
Filesize
5.2MB
MD5e59dd705752cc1f0b04d48202f7fb4fc
SHA1ef5de5431b043d7b3921ecff5ffbf90c5e6d48bf
SHA25681fba8300e9d595a789ac77124a0f2b7f32702ff58337863f17eadcc24f54607
SHA5122d087bfef7e00fb50ffdcd465363983ee1cdfc7015a36a7bc25f63dd8a9ec029276f18512220087ae10cfe5cb796dbfcba11fd5244e4c2e5b5d71ef0047ff834
-
Filesize
5.2MB
MD5fdd9d667181bc6efe78e82265bee973c
SHA18aa163885a79ff60c95473ed5d64984a132c42ae
SHA2563c77679f825ae39837e5a35a21e7717999c551d079496860ca88b5f9b344816e
SHA5129b55dbae9cdf41e9dc73cdfd9fe92a8b7d0d6a2d00f99f9710104cb14981127d63563758b1fed74193e19cd7ab45e4f5db12f0eeb35c1a3ea0b0aee2e79b470c
-
Filesize
5.2MB
MD5916dc3b221f9de1aed90520fc4960378
SHA133ed8485d263a4d9280dd033d6a557d07a17fd46
SHA2560ab2b70af26aba9bdc730190a758d3c19c5c5fefa44c9707ab9b8040100fc542
SHA5121ae6a40de258082ed9866b48cf965affa959f5d335de03075acbc50f6ba911f7bf4bb8b6732a81ff95c8157621deda0eb2fb33ef75aca0671d269b72b54a29c2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB