Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-01-2025 02:12
General
-
Target
2025-01-21_4b540545125bc8e81874344dc703c7f1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4b540545125bc8e81874344dc703c7f1
-
SHA1
3169dabd986ca3a82abd3555b57873205519c2f6
-
SHA256
94cf35170e5215645f68cd6baa3c5512e96c2706f6e51ee9f038c25971a50c78
-
SHA512
d5087dd7af46998bef2ac472b429707cbcb43cb3ab57ac2380cd9f9a6cf5a5b0870c3632e8e11c5420652351d0408b70460590ae0e514666892db47902586d9e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibf56utgpPFotBER/mQ32lUt
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_4b540545125bc8e81874344dc703c7f1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_4b540545125bc8e81874344dc703c7f1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PatJAVe.exeC:\Windows\System\PatJAVe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qLxXfbe.exeC:\Windows\System\qLxXfbe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fwREAsf.exeC:\Windows\System\fwREAsf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WIgAsoB.exeC:\Windows\System\WIgAsoB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CVbRVmq.exeC:\Windows\System\CVbRVmq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RsxWEOR.exeC:\Windows\System\RsxWEOR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uIPhJub.exeC:\Windows\System\uIPhJub.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aajsEVS.exeC:\Windows\System\aajsEVS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PurQLGN.exeC:\Windows\System\PurQLGN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VNsvzmL.exeC:\Windows\System\VNsvzmL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KfXzywr.exeC:\Windows\System\KfXzywr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZlzkdEM.exeC:\Windows\System\ZlzkdEM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hKLqYJf.exeC:\Windows\System\hKLqYJf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\txugPZv.exeC:\Windows\System\txugPZv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gZnYVDr.exeC:\Windows\System\gZnYVDr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GHLYcSS.exeC:\Windows\System\GHLYcSS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RUTpNEL.exeC:\Windows\System\RUTpNEL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hQLGkkB.exeC:\Windows\System\hQLGkkB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cznuOaI.exeC:\Windows\System\cznuOaI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dLaZEaR.exeC:\Windows\System\dLaZEaR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZOGOLOW.exeC:\Windows\System\ZOGOLOW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50da9ce018f38336035a9383d43daa4bb
SHA1bafe42b80288e5c52661e04bd2a8dcf03e49639e
SHA25680705db30bf3c7f9facd276362b90545d91178c7d7e5a0e1b32defffd7c8c74c
SHA5126597500e34d85347e0d4b7548efbe719420ad1308da1f6cc7d95da94d4aca1681962e401fe2dd6278208dbe85e87855daae05d7a8908724f06238d4b223bf55c
-
Filesize
5.2MB
MD5098422e2b072da386f14388c22ec1cc5
SHA1c5bcd958cf17bd134357ef3f241a1b04ee2b1064
SHA256b5a7981cd59813cf8317c2a95b06d5be9de14a18bb9044fa613b35176833304b
SHA5120e3e8b70c6919d8b9807a029f49baccdf057c25ed4ce4e9d32ea546c5f42c219e8804ac0afcddd7223459b5dcecf9a0cf076e51754deaa7a5d7e511ab32bb16a
-
Filesize
5.2MB
MD5638612d1b5bab3bd686f16657262d215
SHA1744e29ab16105a6e4770952e604ea76078a1d43a
SHA25614cf41ad49888708bfea9170b075457b405d3a2c7b2c8304f78786b631529982
SHA51262c0e36f23def16aec87cb019b7633045a3936455333db856cd4311cb56f570b6a39a098b5573bcf7ad68da8fef83562f62da29a62279272b2d6c678032b97a8
-
Filesize
5.2MB
MD57dee25356472c5c24ad4feca18dd3c79
SHA1f696704d789db3de0fdd965426c33c7b29b2a4cf
SHA256ce87f3fabae38b391d8f01e823a04364f234e066cdad1041f7813826e9a195a8
SHA51283658fc6c5c5fb28a8c2e0bd6c07eb66f899b79126351b6098e1019a9baefffceed1463f869fdb0ab7004065a2e069a6a07575003f76415f2f71e221414821d8
-
Filesize
5.2MB
MD5300f0c18b54ccb0ad0b5c5d1f3c7ec1e
SHA1e8ac5cbcfa6f7a5a1a627bd73e7f7f9c3d4eb035
SHA25671303f7342be4bc84f1c2cf443edcd88c769be71d8c18ac9aed6a71cd276abe4
SHA5121026165cb8157bcf7616e42c8bd3546b48f3cc9b796a715e14978a17e062a706ff3bae9287b89108d17057f62be23e9472f57ff94f878b9a60fccd46ab1bac46
-
Filesize
5.2MB
MD515c4458aec8cbbdb833c9bed20101f21
SHA10cf0ac23a61000b6b31f85aed267c40c46e78e96
SHA2565be8ba0c69d9f8fb5742c2fe98202fdab7d77a8e560f9160960a017b5fe2d01f
SHA512c257dfdb9bdc1fadbde15e8eb0d92091b6d897e0c962886289166406ff198df88617a1a80f795ed64d065647b888744de2967f163d02177bfa3d7ad96cca848d
-
Filesize
5.2MB
MD5c30caaa6ad3698deec3960e82c3ca468
SHA11c5cab387caf5a3e338e160aa965061a97ef3754
SHA256f74755f8a069e4b1f4816608463d817519b73e038228aba9dc672e004127fb7b
SHA5128e19d17e3bd511e618ed14ed86bd32b29d2f8efd521842f1a08425decbe2c03636d3028155dabaf9eebe2ca29d49a99f35d4046411e8ea7e54c5268872c3104a
-
Filesize
5.2MB
MD59b426da7602c8fb2bc9cf56f5e5662a9
SHA156dc9d76861d36d29fd34098e63ad4a6c2cb2433
SHA256a581023843cfa0c2ee3a56810d285a5443f1c8d0cb26a35ad7ead25c3ee15d34
SHA512e6097142181694ad71ac4a69a64630972b977068dfdffa75ac51fa1937463e299d9b948328119cf29bc1ae213990c22b96775851bcc3096db8e44fcb4216c439
-
Filesize
5.2MB
MD57af23cb7f874a0f026bf69abb4962db0
SHA172a2ddf9d6ee1ed06fc51d380d1b0f40927c515b
SHA2569426e7a642a5c06622602cac81fd191ea97b7580a077d21dca90e771224b445e
SHA51268ab06883827a3ff03c629e68703c626e5c6c25aecfc9b29ae9fd3279a179a2ecd908a9d284fa5d6ebf759b98211f89ccf1b7e9aa213ab99c022d3b71869029b
-
Filesize
5.2MB
MD50ee1dc86fb2c733ca7cc812b8cbdf338
SHA137628ac38200d51ce4ec952a8b5161d87b0f61cb
SHA256665c7efd84daad20cb6f03488a7d2c6c222e2c6f98461601bf75d0b41d8eb5c1
SHA51202f43a8dad792310787da9644eb45422bcd28d348c5aa090565b89f6571d08cd00945a626e867d508ef7ed216ff362103dc62f176a1dec3125d3ff9fa8171e62
-
Filesize
5.2MB
MD55343cf7f31a1a3e02f7f538bb3c03be9
SHA1cc0fe8f179c75ee1a9ce1b613369189ac6dc7ab3
SHA2564cc926cc40f4d6a8baa501b7325e499cebe9c0c422892e1a44363ba0a9a2f03f
SHA5122d3bb8742e5ff905bce63ab9e8d3c183a947058f0a94c6a5fa820566c79e85b222460837b67e0add3817c12797cea0d7d99ac03f25cce095b42006c727f236bb
-
Filesize
5.2MB
MD5ccba90ba3995aa5fc9405bb85585b91c
SHA1e67520926cb9e288c070fe66673f3b64f49a8bf6
SHA256591a6c859538ca4f64dcfdba5554f91d9d5f0d54c9d35a91cd1f48ba73222af3
SHA512d35cade37d2884f23355ca4e4ac38c953351c7505290b700997e79be22bcd2ae16325e8a62ad08a943b730d8557a348a27e9b1c1c73d2393eedad8e824c42bab
-
Filesize
5.2MB
MD5114b4e9363358acaf0558baeac4dabaf
SHA1f7f09601887dac065001b4e082394543f4d0e5c7
SHA25669894c6569f888a606a580fc3c8399582428b8be17fa2cb2863ef22fdaa2f80d
SHA51256de96ac03ce716c033eca836c9b1921745b2a7df7e94ea589a53aa429edacf160745a54cbde7acf731cba2299546624547359ad2f7f7d580fe369f7410e7a82
-
Filesize
5.2MB
MD5559cf785bf4d0b241c3c69d83c376f7f
SHA133ced1b6ee85f5918fc6abbaa5d342e5aca9745c
SHA256c8b94bfaea25812b188d246fe6b03d80b75ff6ec19beae8d3ac4d6a720cd65fd
SHA512c892e0b3af21c4ff4260a845711d46756d512540d628f75affbadf212cbb53d00b5084253107b557522cdf996621661c65eaa97716327d02ba8c2bf2d0f726e6
-
Filesize
5.2MB
MD54c8a6b2eafeaa08346da7851346823a1
SHA191512dde19a7b216d0bedd407014db0c57282783
SHA25663b3e48fae01fd87ef4dfbb7b4aba362f6eb64bffea456847fc1d47112b01705
SHA5129e83e0b8615d2cd3450dbb05bd9d5d9a080b7b83cb80b33c38cf7d63ac9d3baf0f3e11f58c4400da1ac1bd2863d652a72daa70902a294a55d875c07fdd9be5ae
-
Filesize
5.2MB
MD5062c2790e9cf9a2a750dcf59b4f4fca7
SHA1c6ca9b80a16102f8c32124d2e4652696e9ac4ce6
SHA256359f85664a226760b90940a92b0a5b1b1c54f145d198abc998a10318803f34ca
SHA5122fd18a40721575d047ad230bbb59cd38e9541afd8768daf95a544564c3f9103b25c2c927cd6ff4b0e44043f7f9afadae41d029e99c1bba19c0743f8b6ae7976e
-
Filesize
5.2MB
MD53ecc010d429935a69fd9b90db31d1841
SHA11ef89bb14c3205ef80a91306838979545810140f
SHA256b1751656c111e42c6521a5467afff2cf79eabd641804e9981f30e4dccc6d9107
SHA51284242a42818633dd409065b01d392ae321aa830d3d96569bbb52144c595fe1aa710b6f5c3942c863c3e28b372e78c30e5a9cdacf4cb912680f2bf101c815b77e
-
Filesize
5.2MB
MD5052cc8218724bb15440f43ed4e9b06e4
SHA114df64d2d1b272a53da9dda928ae9b0db84245fc
SHA2565203038147724ce69de6d1e73cee672b40815e74d807efb83add39af3bdf1159
SHA51276a184d4304e2c2c88c564a5ce415c17fef9956089317f6029a37d044c8c37c392e26f64809162344343e31a075a8e7dbd988a824a6d68a497a7e13a11494546
-
Filesize
5.2MB
MD569be97304ea2abcccc7e872ce3beef4f
SHA1be3006c6f9843675a5b0d88899f2a31415f75c9e
SHA25611281e8764fdf51fa5a0a80a2a0399323c8cf7d86e467544c567828aecf704c4
SHA512bb72da47c32923d6c42a4e9966fd0d138cb92e092dff63e9173eccdf1a7f5373d36ea804354dcf8c60b4d8fa7c3e00c0d5fe68294677d0865cc8453d868351a0
-
Filesize
5.2MB
MD59833a31845b0477ddad43c9b67b3efc9
SHA146a2e9bdfde95cb5d3e7c720d2aaff504d981fd3
SHA2568d55c38db8ff70dd365ac2b14bf1ad6a0cc3eabe0b98ebf54cd0dc044df7b742
SHA5121cad03073f6172ff96fb81c75dd999bb0d503f9fcde0b917beb718633a000a966506101706b9390630e17bf8bbe59146a4fb094544c24d176c6045fdd0737063
-
Filesize
5.2MB
MD5738d422a1f71adb1f9083cf0b0cb4ecb
SHA18b718e13a7b6846cd0d614ed71b081c63e5f72d8
SHA256c30a1e89953ab699ef7ec152db1d8ad63f28b7d1e0fea1f334e76bb53a12962d
SHA512f0ffa2a3c3ad5e7df38b75564d978d392eea73cbaaab003c5f67a575a074dff0458a47919810d41f6a643d55cfb85630d97305b383af8670927e501430f0d802
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB