Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-01-2025 02:12
General
-
Target
2025-01-21_4b540545125bc8e81874344dc703c7f1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4b540545125bc8e81874344dc703c7f1
-
SHA1
3169dabd986ca3a82abd3555b57873205519c2f6
-
SHA256
94cf35170e5215645f68cd6baa3c5512e96c2706f6e51ee9f038c25971a50c78
-
SHA512
d5087dd7af46998bef2ac472b429707cbcb43cb3ab57ac2380cd9f9a6cf5a5b0870c3632e8e11c5420652351d0408b70460590ae0e514666892db47902586d9e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibf56utgpPFotBER/mQ32lUt
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_4b540545125bc8e81874344dc703c7f1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_4b540545125bc8e81874344dc703c7f1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZYJHwxH.exeC:\Windows\System\ZYJHwxH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rTeelVx.exeC:\Windows\System\rTeelVx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XXKtrYp.exeC:\Windows\System\XXKtrYp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FIZnDTS.exeC:\Windows\System\FIZnDTS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yOKBhTi.exeC:\Windows\System\yOKBhTi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gckmCLC.exeC:\Windows\System\gckmCLC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QzGdlHv.exeC:\Windows\System\QzGdlHv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eEzovrm.exeC:\Windows\System\eEzovrm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VraSEQT.exeC:\Windows\System\VraSEQT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Vxjcazl.exeC:\Windows\System\Vxjcazl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hXXGTZc.exeC:\Windows\System\hXXGTZc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RDmAdvM.exeC:\Windows\System\RDmAdvM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AjIaoaw.exeC:\Windows\System\AjIaoaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aVKUhGv.exeC:\Windows\System\aVKUhGv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VClJPmf.exeC:\Windows\System\VClJPmf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hiVsGUT.exeC:\Windows\System\hiVsGUT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HesyjQB.exeC:\Windows\System\HesyjQB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gFsNRHa.exeC:\Windows\System\gFsNRHa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\soggBmQ.exeC:\Windows\System\soggBmQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WYXKmYf.exeC:\Windows\System\WYXKmYf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HvWXavc.exeC:\Windows\System\HvWXavc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53d6c97d2a4a03cb84395d33bfec2df93
SHA1d60945893ad38e2d801aa0b69140de0bbe7eb334
SHA256709b8264be49c66f00e78336b310664d0e510658f91bca4d70ec1c521e5c2b42
SHA5122e81a4ecfc838756e9052c80444c3b053cc4262d8611bcdcbe09611fff154f2263e78b6ebc00f7bceba945c6cf90156203c0b33f98b03f2c9a898bde14304dd9
-
Filesize
5.2MB
MD55144d8740c7a8612982ab0a0f306c936
SHA1be50309f51d5a3643353aecce1af5c60165720e2
SHA2563bd12da5d57e18293375deaf4ecd34cea8c0d9339fab167d92f4d900f6eb21e8
SHA512d2ca4667e2ebaf71c5393ef1a29f00da8d39cfdc20bae243034cfddc84ff10d50cce3c513b504441c6d2c5e410670e34ca3df3ca06c9bf06fe5bb0fd179d085d
-
Filesize
5.2MB
MD54689fbcf51930e41c6d3f2920736be14
SHA1f1981f76eee5a2c638e28685ed528adf3532d5ae
SHA2566f6479df5018889a47cba8f91376682ee87ba03967fcc3b868044fd2f9469a25
SHA512488ada507c166c62f49e192af4c9b966572c3bf190cdb4fdaf064ac8128e7c8bbac349beb609c928c315ffb8ee4e498d12404411998df297c9bb9d93fc310195
-
Filesize
5.2MB
MD5378f2ee782f122405f4e5900be8609c5
SHA1630c60135c653a987926bc80cd115f781227dccc
SHA256ca22cb14dd222aebe6e8ec96bf1d41b19458bb4a7e58364e24f2b47fe976b52d
SHA51208c939e698281d89877a67a2dc99927459e357501c66de25d9e55bf7a4ced24326cd28a17fd76845093418995a7055a1f66ae9015b300cb55bbcb544f224741d
-
Filesize
5.2MB
MD54a0040d87aa9fe221bafb62f644c936c
SHA162847530080cbd26a5e842966230426bc7953bd6
SHA256b30b9c5bf944897b65a8196fcd20872e1c6f4073edb595da584636ca8d67aa9d
SHA512367ea4a28012883b44ff59d25917aab12a49e875c8e637ea8fe6b56604eb32c2af0bced6108e5342c6411aa2d6d03a8b8c957bbf8451f98bc202fac78859f1f1
-
Filesize
5.2MB
MD5b937c3bea6caf6c0739e7046d1538a38
SHA1ae70561bbd1ab53c1178a0f55d83798e61fc45f3
SHA256bea579c9c8ea809095d9ad1a29a5d55f60a16de0dd9749d5a80107d6576e2494
SHA512ede4a6cb6d951e5191982df0266abbd1a27e713867d158abd4e05a0effdf990ca49f3c754e0630a2e7f52c7bf8a107a2f706276ed1e0c16703fb8f2f914cb22e
-
Filesize
5.2MB
MD598af918c6a00e7c47359ba3b6c5784b3
SHA17378e978a3faca6a951b0aa671a51d863590a2d0
SHA2565e9b0ebe1e477cb114a7e412bafafb14ade4cacc264044af974169e06f2ac067
SHA512cd6fb1b0f16d33153a0ec583062b4a33ecfa159046950a5702bf52a4488ae736295af475b88a47c228f3c79590e987e831ec7bb3686b403be6f1d858889b9340
-
Filesize
5.2MB
MD5888604704fbdf0e294d3e2dbc044b0ab
SHA1f55a3a062bedba3a33d910a0f8022442ae9344e6
SHA2560618541f7f8d13c6bf638d48e0b7fbcfe9a6c47838a519be86d17d3d2bb3b1ed
SHA51232014cd228708053429e5f440bdffcf99ff325a88f52dea957a2e0a159a394fe518fb33b3e37518450da469ced747c5a9609d5c64f351c678b0817a45b6dc94c
-
Filesize
5.2MB
MD5a283883d5683b42e1fd5696de306a622
SHA1feee08f1e9a7fe917b526712833409c9f3538dc5
SHA256b0ef54320918f33e4d7b99665ce1da9285eac9d29f3fa5224c08284a1b53f62d
SHA5123bc62db3dc05dbc940edddd0ee38699425c1fb2e47a4a55b929645afffd5d13c215c49e0dbab84c01e0d43680cfbcdd652c227e6b0e51c14136d1315c3210a76
-
Filesize
5.2MB
MD5193e2074ec8b3b22d01f5930899f8abe
SHA13a231711bc55c0da75bf73a5235cd275f396330e
SHA2563ea8a655683490d9f1c13c7efedadbd3b0af08918f2f5298a94869adb865b7b2
SHA5120ede026ac1573bd40ba1c19040be07894efd732704953d8327a01ed5ced6eea172c80468c6512f94b5323c11c8352fb9aab491e3b4bfa6cbd0cd66880c2c44d2
-
Filesize
5.2MB
MD5e5e6527b8f2b53c849ae8edb6e90fb86
SHA1ddd58d0166d4776bdae3ef57e82b5d051c384d20
SHA25675c4337b9cb25730ad94cc00db9b11596d35e5f9c18cd48022773e88f114d76f
SHA5129df58627e5358e4f75eec2cf4fd10474572b3143f42587641c64ed5059f1a3f2e0197e995d3c3721afe0d03a966c3cd0e95a21973a257b3d1248e60f53e6441e
-
Filesize
5.2MB
MD5b63e3814df15c50d487203c4a2650a08
SHA16436d5bf9a4516a27561fa08c7d1d3b4fe19af5b
SHA2564c3dc47c8a147fc768e40e39af01616f5e3dd5f149a9fbcb262b26dae5fdf8ed
SHA512314179c5ad3a5e89f3c54aa9560efb0cbf1b953911ba3176cd9ce81ae57a0a007bb02a98e2cbbbaae5bbad91d398b0716fc429b683ec801a9425d810781b9cc5
-
Filesize
5.2MB
MD55fec59bf23110565774212e0e8b9a1ce
SHA1c322537bd00723135d72bede6d0776501463a636
SHA256ecd7d3a3c39280b1838ee9d2e22e8f048e1492d3e934f6e66db1e16b2213d533
SHA5126096022f023aa63310788831eadca272f47c868dd89f9cbc32e966d7becebd28a5aef9c92bc8b713b27992bdedd852f4787b80e0eaf2b79d5595fac03814c6b3
-
Filesize
5.2MB
MD591621a4e4699d88f1584ad33ae8acd46
SHA1b194be8fbc5db62da107493a15fd906cd3f3bbb7
SHA25602011b43dd813060c3fc5ea5fc2cb3abde077978c0576548c3d93d5d7390a693
SHA5126a5abc6cbe6cf86ac4713b18fdbbd8798366df32a9539b3261936ed75f273b54c08b7800e0c76c35235e67fe8cea626df20dd099367222286299de220c79d163
-
Filesize
5.2MB
MD54e14a6be3f026a32f9a5ccaae8d4e346
SHA10061f15346d657fe7bfae9d15ea7fd5a4ac4c007
SHA2564e3aa9093f7c23f8ef464cad95055676df1b912360c6957b7e0aca47b6c8ef75
SHA512497ff98d973d244956c4b645736792c40c098535cac75befdf525f0a9fb98c5bff465a220b92e1937ebdca0716481cef94878fa60b1754d37178a6c7c8a867e5
-
Filesize
5.2MB
MD59c599d0b245adedc31bd1d0461c99c1b
SHA187d25760ac3b222ab88d399c8d9f256fbad0cb6f
SHA256762b238c918e7d5b818e9b3fcb5b5ac7e080d589e696215d60a3ca327a7450aa
SHA512601cc91fbaa4e1851a91651247914b6f89424df9011b0c6f3e73d57c6ac94bcea1a4357f7f94c6387fa2156fa485fb16a87f21ac7c06c6fd3c9927e9bd39655f
-
Filesize
5.2MB
MD55f435f7ed739a82c9bff024feb5deebc
SHA1f21faf63a0d4902acf72f03dd06b0bdeb8b7aa0b
SHA256570f4f736fc59935783b7585e21d8339e9c69b3f6699becfb8da7d85bef58ca4
SHA5125b68da85c51c378a0f4f9283354e7da1ef85bbe5c379d97e2ba44c624833950c2a600f00e10f00070841ff90970d920cc8a47954763a177b1d7e07eca2a22226
-
Filesize
5.2MB
MD5a0b8ee8f6d52472df40fd53f077382dc
SHA13e538cc947778dd4d85bf9f3294a67d93443086f
SHA2568ce9e7d2c45984a3e1b3d5e0daae5c7c415d7d92d6e4885f0945be806e13d3e9
SHA5120f030b7a0f5eae4f96506fc8839251fc9fbd97c856975d0208f58746af3381bb3387baf1b8ad14ecc93047a2c5bdab4f4d36a7f7b9b62f857644a32ee71506b5
-
Filesize
5.2MB
MD5f384320675a62104f44cdee834948bf4
SHA127d7339a90777033f8646ef70ac3a64389614cf3
SHA256f76366711dbb908565ddd0225b511aa859dec10867983b0fd65b895f48f2f136
SHA512f649a6bddb9463fde2d793c56837aebe75b3e06a538006e75e5641b1decc53bab195e53abfbdcbe1d3ce118fdc55ce2d77985c40c913cf68f50d6ed5fde7ff08
-
Filesize
5.2MB
MD51fe76c31eeb553cdcac52e89ceb4f2d0
SHA1373af078fde7a98ff06ecfed4e683089b18f7d91
SHA256d1fc8f539a87833b805f93b7301a798faf6dd65bd9fca1586a384428d5793a92
SHA512c2169343ff0dda3e4df6cca55d0458df2982c1d12589a9fd932624830778ecde754c401f13ba7b3722dd14350595856b7f731f2e77b570ae2fe6d105e05048f1
-
Filesize
5.2MB
MD58a358aefe7a4832737744fd2008e62f1
SHA15c4f2354a0b987c7993366f21aedcf6edfc9e531
SHA2564a0fbfaf1bde54796351270b20263d46f1281c0573549e35f34d12d68fca5a6b
SHA51213b97d6c25ad2fbc44597b846bf5eb34b118edad04f61e4106ea253c95cc683ab88600e947c3d1b3ee9608385f720811cc81a3c4322d9b9f4d44da4a1ff70e18
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB