Analysis
-
max time kernel
140s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-01-2025 22:07
General
-
Target
2025-01-21_b860258632d157f379d4686fad8c4c62_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b860258632d157f379d4686fad8c4c62
-
SHA1
48ab204263be068280cabef1d332c9595484c46a
-
SHA256
faf768feca324a2b2b4d68694de66721fb381d2043d51a218dd77b55be4a1e0c
-
SHA512
0d2480d406789dcfc7f1fb1fdd367b78a05c6e9462eb71afc436849290ae6ad6fc1e62bc61da28befcf65b9322f1d4ca7b59300215a7c152245a817c5b86ed33
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l5:RWWBibf56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_b860258632d157f379d4686fad8c4c62_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_b860258632d157f379d4686fad8c4c62_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AsFVWhx.exeC:\Windows\System\AsFVWhx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VMRvzDI.exeC:\Windows\System\VMRvzDI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HNvbwYp.exeC:\Windows\System\HNvbwYp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EbPxcVs.exeC:\Windows\System\EbPxcVs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MKrngex.exeC:\Windows\System\MKrngex.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bgjUZip.exeC:\Windows\System\bgjUZip.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nZaSxlx.exeC:\Windows\System\nZaSxlx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zyDQYCt.exeC:\Windows\System\zyDQYCt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DvbxURJ.exeC:\Windows\System\DvbxURJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FrudxIk.exeC:\Windows\System\FrudxIk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zuBKzWt.exeC:\Windows\System\zuBKzWt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lIrfSZb.exeC:\Windows\System\lIrfSZb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rPiftFg.exeC:\Windows\System\rPiftFg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dfinSIi.exeC:\Windows\System\dfinSIi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rPLqQjG.exeC:\Windows\System\rPLqQjG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PZvOeju.exeC:\Windows\System\PZvOeju.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FlZXlqq.exeC:\Windows\System\FlZXlqq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tDfVocQ.exeC:\Windows\System\tDfVocQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IzSulno.exeC:\Windows\System\IzSulno.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kKtKaUc.exeC:\Windows\System\kKtKaUc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CZGnaxs.exeC:\Windows\System\CZGnaxs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58dff218d4a59192351692f33e8983b55
SHA17ab7939d05936f3160d8c70eebf40492590af61b
SHA256fdfc638f06a1603c31b4510bcb7fc0ac76a78b8b4bae6890506d20959891f46d
SHA512fedd8e6970a04470dd085227759b48f10469f39c333c75b5cb16a4f12f321e9fc8f31142c965472282c45f885dd6d75371b89b400000f8347eb20c0521bedb52
-
Filesize
5.2MB
MD501639c67f053bf033492b3c1e51a7729
SHA1b386c197aa85a25c9e0fcb3a269290209d241a5d
SHA256ede66d2678cfc5725c7d8dc15073f61c2393dfc219b32e84e41ad2d69c234ae4
SHA512437b30c134f2977c4169a251924398cb803627a4fa39392f1d4fff47850ac55864b84e9f7e26ca78d7fd9c09e5b86f94b071766889ebc46c1afd19ba92b01872
-
Filesize
5.2MB
MD5f7500e87d89b508001cd58e6f7479580
SHA1ab652be21bf7fcaa3c944fab08f1b807c0fe1139
SHA2565fd6c6fac8b0bdabb0aea43bdf05a8388d0dfdd08e41dc8c8b5962ad3b5cf526
SHA51236eb38494a9ed6ddd709119608b483ba42aecfca226dfc01348848d4a84ac8fb430d18ff9684905ed4dc3978f87f1cd3d3655f99951f82640383ea13b324b0f6
-
Filesize
5.2MB
MD5e570e78fe3446e71d39ed6ac7c916e10
SHA11a44aa67430bccfb481598902e508e215f6a43fb
SHA25626d599113e03f05935a76c1603de5817d63fb26be670ac5444b95b2c47e41a71
SHA5121a41ace335e397c04fd5b052e76b43c53a531216d50bd7628ee2c7e4700a1113afeb01447b65efbcca3d66201f1a8ccacea4fa819f9c04577f2e976357cdb25c
-
Filesize
5.2MB
MD5e1a6cd0af06efc7f1a64378625cd7732
SHA1756f8813de91ec751f6bae5ecc88bf8b87c39128
SHA25682d005dc0bcbafc7dbcff9dfecf1415fba1176e5dc3251adb020e4526f6fbdb5
SHA5122b9e637a08da937982b6eec6af6d3e02d5c773fd63ba7f621f8453603e35a61f2d5cdd1eae030dae3e947eecce58766d28dd3283e0f509aade96d2a770b5b4f0
-
Filesize
5.2MB
MD54715c583ab156e38969f6388a6c9525d
SHA1bb4babef190f2f8b4caf1dcd8785dde03ffc3679
SHA25688140e397e192a0c9dd3f677ccee5cafff79020070da9f7ab6e36f5f6f9f8286
SHA51262148a2ec4f135f918d4de177b02aaef3e867a889db4a79d2d0de404d361c5c07dc0f49148bc5c8a5237bc529574c83c66911ff090fad3b6357618a1ef6eea65
-
Filesize
5.2MB
MD5ffeca5efdf02774e12a8e5a041072829
SHA1f006c84233d3712b5319aaf1d906d4c33af55d77
SHA25608cc01833dfbffb918c989efb693a0cf0188bb7a26919d6ac7a2d45220835d65
SHA512fdf9beda8ea26c8a19af773c694c92993820c23c3fb9d0a4ea1c3b3e90dad87716fc49c6b1740fbed2ea792f030245ea66aaea98a7bd6be4a909ddc1d7c7b36f
-
Filesize
5.2MB
MD558c6cdab3e255725971ce15445c1ed61
SHA1bfc2012ed3d544577da47052d68f18e92e992d4d
SHA2569922b0e8cfcc8ae49228bea76aea26550e1fec6a0bc7f373d2983dfa87836393
SHA512df97126b9168c3bbef4284cdbacced0dab04f78be9587b9282b85469191d0e0140199418148b7660fd6be831b5bf24716a285cc7717a9f92db0d56443b351f85
-
Filesize
5.2MB
MD56c7649c60bc63d8c4778bbc2ef8ab232
SHA12b7b6e02e0eb687266fb6dd2c458c3bff8a0490e
SHA256a65d2fcf1d727fc6ffe13c6bec89de3203f9c689151ae7f092bd03afb1b308e5
SHA51262c4e98dc5bd54992a74c9f419820dd449a37cd63ec87c5d2b25cb567706933b8f5d5363884f44b94a635deb07eb25f00208418684ba8f43b65ea3c9622fe349
-
Filesize
5.2MB
MD531d216f1f521ea847845016e849d7fe9
SHA159d999fe543d59ed55889060b6d625c8929ab6ed
SHA256459ae73059e12badf30830b2c0cc31e84b484cbf977b9bb9915860a2b2d3c7bc
SHA5120ef61a6f68d76c200ecf4f5a7c1f3e8d574355c088806dd04b1c8ac8e4ddbecfd871a73a106ecdc6ca88c9a776fac64424a74bf2860fba729be4df3c133d2049
-
Filesize
5.2MB
MD5e0583669d9c26247d4accd18fd1fcf9a
SHA199c27296690d0019c7dccf7d9853db7eae0ea242
SHA25620a1778736ddad9f05b123b1de32c7863983b2ff1709006d13f235440c1908de
SHA512be954c4e7021f69b15a592c80937b494567efdabe1e5377962262e042ba9cb7be220d488e4f53542011857c633bc336d19f70e04e4c2d055c826264f54281829
-
Filesize
5.2MB
MD58b20c496a7391882a0bb8ad289ab5fc3
SHA122fdbb4b88fa1997c86676f5440546bfe1f38f1d
SHA2563fa5eed5beed87f5abc5cad873de946d8ea52267eed09d4d85549656861b67b8
SHA5125642e552f0d80fac1910a0176b51720eaa9d048e0dff8af4fe5167580cd9531ac0488d78e959cb3c20d1fac27b05ce6575151065b795bdec2a4956c9cdeb18e8
-
Filesize
5.2MB
MD5db22658e454975f361f91f0e93e3d428
SHA177d3fca23fb10e8a3e978c9ceb3efb3ffa9eb26a
SHA256c58a23314788cc75837ce48d01effff2d7e76c8ef06dcd105579dfbcb1378956
SHA5127f354705affc6dfc39e45a2d75b46fe2dd79331d2357a9876d2e9a55f6fcb0535c9811648e49981ec64ca99209f5773f8e88e4f29149950d4859888aa80a114a
-
Filesize
5.2MB
MD5763c3b8134a932c307dc23c65a7e13f3
SHA1f3c8804129e665d0d5b7204f06d3fa87aa0eaa76
SHA256031a86245713caf6f3cc6ec27833720c5b973b7c16423885653f5bb3bc255a33
SHA512a11d083ba5da5d658b4963f64e1ce6b1c62ada2896fcd1c279bf7e50d8d8c44ea78fc14686f176ce7a4d5810cca6c3279ba958ecb97103563396543d6af9d49f
-
Filesize
5.2MB
MD52370dec458158fbb32c01e259840a598
SHA13388f638c551af9af619f0f3836ab4a17b8b009c
SHA256fd46aa1318c6e89c4527d8eb333a47f0e53354e82ed2544dfa2d92ff7586eedd
SHA51222ff82781671077fc36fa1b4de368fa2349d1c438ba73ec5316497c06eb753e10b5dec6fbb9cdb0bbe7a9e01a86fd50615e2cd868e7f79174651e24e731791d8
-
Filesize
5.2MB
MD57f09bb1830d4fea21bf308255d393e34
SHA1a4eb304d0851976e8abc291181d977813e30563b
SHA25662b9b192406f216c3077c2cebef6db74eb9b34631543e7523d82741d99a5a71d
SHA5125577f5dea604998112f04905abc6d21538a041e87147da9f10e95f5238275938fc61c9d7c51e2b7fdb58ae56dcaba248a969cb09ea9565dd7b13dc86bd2ea21f
-
Filesize
5.2MB
MD527b3a79fed263322376694dce3d55fcf
SHA1f31bfbba6a87b31b864bf102d3640adfb5a9e297
SHA25612b97fdb0f4ada8a40a45e555992b4027b0bed2f3304e5fd14248daee392f9cf
SHA5121c86155b90f49ee38e39d21dd50dd350d7919929544218c302565e4a6ae3031fe5d830172e785fbcb9fff035582e51a772e237739dbe5870a54fbcfbe00e1285
-
Filesize
5.2MB
MD51351061d9c7a5b11bc7fdd6566bc783a
SHA13516ce35581e095a7423f924f8ade31744a13e8a
SHA256af542dcbb16688c1103586d3b45b8976d4420096e8ba4f18191855d0c86310b3
SHA51289022007313257c75a6839add1479a84324f30399807d780f37c5d446acb6c5a05a06f220d9d5b5d149c3a4ec5113ee29715332b076dcc54994ea0476e0c70d4
-
Filesize
5.2MB
MD5a8fcd36a503b896c9f90b5627fd19dbb
SHA1fbf3731d58673e46fce93bf3d3885b2e177b4c22
SHA256d1fc112363204e46235c4858cd9e41c8f8fde6578ff5aaa0f4fbcdd255975d35
SHA512bf2c01185b521a0a247a35f9183f869e87f7e218893276ad6f3972b47187f7c7db37532aaf27c8bd14dedf28576dfbd1519d908e6b1e18874760c487a34a4ca8
-
Filesize
5.2MB
MD5d7e30f82015f5ab18cf9b775d4fef712
SHA1bf4bad57fb41802e16805531d028ad6d03ebdbf8
SHA256610b98e72c71533845cb913942bf91df25df09ca453c81c3f7d4d46574ffa269
SHA5122ec20b98add83922c2a8eedf2074fe2afe5af9c9d6c0432ae5def7704d6f7bf5a6b10913172181bbaf24d1dbb67c88e0e678e46d1877b416c30196b0a55f9d0a
-
Filesize
5.2MB
MD561143db0e6583e7927f88600b07778ce
SHA12c41a21ff92a012b9aaf1af683dfd2f54ffe5ab4
SHA256046e348223b6310bb60922b46d9f2256113ad285d1aa649f3932c1e39708d422
SHA512c4f7d07a762a7eb8ce2a2ddd6ae53ba19d2c335da9be996a40f47e91599cab1c5227dbe16e0820527dd9ecf5590032cad0619b085dabec9550f2bc69be1ab686
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB