Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-01-2025 02:13
General
-
Target
2025-01-21_574b0618b2a739acaebddc226778e7b5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
574b0618b2a739acaebddc226778e7b5
-
SHA1
12322fa6b9d9966c7e1a406764e6e75f0c992720
-
SHA256
6f14d3c5e6ea26fe6945846a91afe1624552aafe9c146350b437ec3a0cc40e85
-
SHA512
0cb952eea7875523a6df86d1a9fcfae528e42c1c4f7cde20fed8ee65232e8d27bd2758e4514cb2d9a988b037af7c7d31b30caaba6a1dafe4cb141df02dc21735
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibf56utgpPFotBER/mQ32lU2
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_574b0618b2a739acaebddc226778e7b5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_574b0618b2a739acaebddc226778e7b5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hHGIIZU.exeC:\Windows\System\hHGIIZU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OmWPHJA.exeC:\Windows\System\OmWPHJA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KSNmlmn.exeC:\Windows\System\KSNmlmn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HTSMNeJ.exeC:\Windows\System\HTSMNeJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\poxdixc.exeC:\Windows\System\poxdixc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wrAEOVH.exeC:\Windows\System\wrAEOVH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mVHqMCv.exeC:\Windows\System\mVHqMCv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NHFjKGG.exeC:\Windows\System\NHFjKGG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JUKhXST.exeC:\Windows\System\JUKhXST.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sYscjRd.exeC:\Windows\System\sYscjRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WEXquXl.exeC:\Windows\System\WEXquXl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fVSCLCc.exeC:\Windows\System\fVSCLCc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nnuvywx.exeC:\Windows\System\nnuvywx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gtPGpSF.exeC:\Windows\System\gtPGpSF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\izsxXCO.exeC:\Windows\System\izsxXCO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bwAFgXQ.exeC:\Windows\System\bwAFgXQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YgFIUCd.exeC:\Windows\System\YgFIUCd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XAsDrxk.exeC:\Windows\System\XAsDrxk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bhHvRxE.exeC:\Windows\System\bhHvRxE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gLjyQhC.exeC:\Windows\System\gLjyQhC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OcYDFSv.exeC:\Windows\System\OcYDFSv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58c4bea136184a5c14793424310eaa97c
SHA1c72d3a3a2fa412b02a5d650dc91cd68f58a4008d
SHA25614af52c0e3e4a84e9ebe806aed6fd0304d4dc11d65d7b58ad2144eea23bec6f9
SHA512108f6634ee1bfbc386b11c9bebfbcfe7648b024cdce7f32ffa9ad26db83a64bd8f9cf80c9bfb5f0fa64dc183a86b520809a2dcc53e750144fd99911dd6cdc97f
-
Filesize
5.2MB
MD52c61fc8ca503eb7260cd3eb3568ca5d9
SHA144fd619294b2b773bd9fc7ff88c6cb84d27653ec
SHA256e23e39c0f0700504e14ec077bc608c12ef858e423d5f0842498656e0d2781bc2
SHA512ed6ec7df9e6a19967b356ac5d1a2c403a04f3ae9c083648b21015fced716adeda014edd15cc98bc6d76a5316a008adfd988a89da337c590846f37b152062da89
-
Filesize
5.2MB
MD5084ee9b0da3c7fe525953549e0e61910
SHA13a139064cdb22b502c3642f8a0a8798c23650aa6
SHA2567889f9844fab86e7aec5bdf1c4300d579fe55e5ddf57be285198ad4b70b4e0e7
SHA512071be7b339194bc7959464fe00fb777ebb80c0b55ecbcadda6407cd7e7a8d884d9e8c37818b63f927ef3f2cfe00b23bd6794ee4ffb0f135e8eb5f66cc6a77599
-
Filesize
5.2MB
MD593a520661e24922166f179b5b5def007
SHA1de8e8f13a899f2209fdd8231524085047fbc34da
SHA256e2331385434772835f951f0edd11f2cfd7d8f08dccff7633b0ad64137a7044d8
SHA512a850393f6464d0f8e794c1d557fa1ac907990883e1984234cb22845c28c422ae499b4fce0f3b006227a127d004e8be8471a5c0ea1eac95ce52f0303d2321ba94
-
Filesize
5.2MB
MD5161318ad4072704940c9c7af01f6e9b9
SHA1ebc1438b5e4d6f8262d0c6992a1aadf86a7b80dc
SHA256ed4bf49e19e6402100556ec1e2cd92e851f681f3ff3fd0ca1408640dc03afbc9
SHA51298eb8928ddf3835e39fc322fca57e55ab32cc13207ca13ba91133a3bd321e7005096be8d85e21a80d4cdbcfe89f938e17cef620814abd7df80ac873f6d82cdd7
-
Filesize
5.2MB
MD5a6215b80cfd2598e3a8abc4d112e22f0
SHA135b0ce1e694a127b873434f8d966f7b29601ce8f
SHA2568f24ac5854eccd9dd16eb8b3661a02d8ca8659dbd32f76b75e0603ca59f3c675
SHA512f203d23eef12f3da3dfd6e0e3fca32b5f5138acf2b74175c58154e3ba51a86f77ee85ee6006bed6e4548e3497e278f782503fbb4ff097bdc0c5e8ae3d94d088c
-
Filesize
5.2MB
MD55ddd4b707be7403fcf777d270ba13dd0
SHA18e703d9958d5b093ea34d8b6856eacfa0e109e90
SHA2563389b012dfc8ad371a26a951f8b98ea05677cefd0cbc799b6511433b05f32a5f
SHA512d6b6b2e8627bd61ca250f9bc6e4807498589f8979801c8d7dd679d7a4d38c31eb96687f32962edfb06df72d8deb6f68064736ef5c559b46e85ab834494e2c001
-
Filesize
5.2MB
MD52978986c07e75083276e17c9758ee601
SHA112eff8595d2e05d7881d5a5153b47b92a8e55589
SHA2562bafe0d971e6c82c097c5ef81832ed79f8cad3fbfebf5a804c6432e8eda98f03
SHA51254cff161cb9c209f0db57aabe34d4ebe7feca3caf1c0b6782ec6c1e4e9db7e846e52bf2b2d0379f6180a739b76216959c1110e283f8c1655a7dbab2106127006
-
Filesize
5.2MB
MD5899213387c07114b667310819a98c16e
SHA19da704a09734bfe20792eccff98144a68d9f45a0
SHA256704f525c66a8e2cb70437c2fcbe41968cfed2b7c8c9a3021e6bcab1b872f0707
SHA51263b82c830e9160ea6bd93bf34da6cbf0ae7802dbc5d5275b11b859f296e0e8d767f54e7a8dc764d16113defe7024a615df7aec0dbd23520f0779d6dbdba4e637
-
Filesize
5.2MB
MD528abd9fc5891e8dcf2ec43e9f8fe9227
SHA1fc5cb7a41737bef575cd957571b721754d7a773a
SHA2563698c34f87fc880f5d3251649c6a9fa3c285becddcb2818bd5d3bba08cc2d60b
SHA51207b6077466d8fe2c5ee80994cb6a312f9b337383fe7d66ef8ab65dd5640db39e50a9dbe24dc506c0c0347fb46e9d349ff83fefd2928df3c2616408d0753cee6f
-
Filesize
5.2MB
MD54b6a326cf15b91178cbd62561e3e1c69
SHA1ccb799a09f2eb8e86e1e2619b2db9522ea39f112
SHA2566a992075de0aacb4edfbef9dfc2bac99ce5daf1961d3712d5b5a68d5f28f0e57
SHA51249bd41dc8853cb47365574f8bdd548431d95f1456128af2adbede6e55ef368dd6d498b4d9cd5f0d2599e09817e4cf5176eba9c622312c55a9c9d72528b6cd2ae
-
Filesize
5.2MB
MD58be98ba4017626bcc752230472add86f
SHA13ee486afeeeec86838e5edf5622cfe3e6a21ba73
SHA256ea63b9b7807a34f9c6fe19686c71beae4633a8536a7e0472b41edfd43e5bb926
SHA5125faa413449be31fc279f31c67b192b051d4764776539bab8886b1d9c30e2b6ac77c6af6fb8a5231b90e6a55cc61c94842c192312836ba1fd71d84a6d91935612
-
Filesize
5.2MB
MD5f34dd34892481b872fc39330b4c79f36
SHA1c4401691173187f6b52838b37018d75674da4649
SHA256cbec283411e85cfb451af8f9b3b78f6448a9cdf1101c36a87796d345b0dc0a97
SHA512f796eb9760c2bc918e9efe556cec449d9294d181434a6cbd16743791b60f563a0ac9831cb3ff9c85282fa142e414bbea00773e6076e8661e99e6e3095086fe53
-
Filesize
5.2MB
MD5170d487648e093490989336468a4a38f
SHA104f336e9abc482df1c40aa7eceabda57f73faada
SHA256994dbc6793f1dded0b24e9a8709ac2c873850fd4b3754f38eda7bcc5850e1991
SHA512b229adc55077d0ff28f5f2b394dbc293a4b84d91e935e40c56c248fb5dea47d787f69d46bad5b523ea2597f51ed4e6a2b1bf7173904ebb0420ebd161fb050770
-
Filesize
5.2MB
MD54630263ea1821bee4990a642df4a2684
SHA19f46bd9aa3e05ad85e89de47a407f765e6a7d891
SHA256b3133ea74c039c2f533a8a697c65d128315331739a5e474f64014b112bf73428
SHA512ab49b3ec85d69a4a058086e6f6297859b09dab4f5a2d172e0311c31b3607b11e6148229d58970b5c34900f2ad551896a1f474e51de923b3d2a497235d965e651
-
Filesize
5.2MB
MD5e3d7e09eb9c163a6813a0c073a11a1ac
SHA1545f023fb1726f033c22334490ad20d4cc64ede1
SHA2568e27e8aefd6c7bc7a8978e97228c9fb41e0a87a5328ecb3a092722303227fe5e
SHA512f02f8a53fe4203b18ad3f10e687001ed6f47a00e76fdcd6445104a27d7f246cbac2e78333947d780e379f1cf6ebe47fe319fc99adbc024d01b0920a2447ab690
-
Filesize
5.2MB
MD5ee60532470951cae1d30c5d66c55eed5
SHA16d62d869e95097084b5ac3f73689ad31c85a7a4d
SHA256f71568ca3e306efa72354c2bffea8e11114fdfbd9ba28b3ff82188f8dd8a52ea
SHA512780303c8064c931407df1bb92d6b2ad7823c1952262654c3487600095620004a53935648ae503cc59f595d997dfd62a5b6cb0dfd97d3673ac0e34679fba80886
-
Filesize
5.2MB
MD546e898815330894d9ba19c87da6ca1a4
SHA102634964df6547416f20c569bfa112a0c16ad592
SHA2567dd5a3de71e227212000ba073781ffa61a8009f439eed14a944d689310990cae
SHA512d22f462691c8487639a2cf0ac3056db05e9480d643714d37c2d7f3f4e10294b03e7cedae333bfc695ddb74b274c744e10cf684499fad76d893986623f852af7c
-
Filesize
5.2MB
MD516506025d813031b376a2fc6978ec76c
SHA149fd7310e5abfa5c8f3512dc6d828b14a3d9736f
SHA256ac6cbb3d8d4d56e3cd5c7f6d5c6853fef88f67a350ced3fd5e2f135a2134fea7
SHA51205ee9af4831ae19205b1591437e023c26f745883cdcf97ece04e19f6053c41f588349f5e565d08378a365a750476fdf5bf59ceef572ae090833dda4ecb9b7b6d
-
Filesize
5.2MB
MD544d5645016716e610d98d79b1100e3a2
SHA128be58db69605a46cfdf5521db077ce7e052a80c
SHA256a3af8fd1bfc0bc5aaf3e345ab2a186b6fecd0e7bcf07856067312d92f8e8379e
SHA512b5927e8ecc973aba07dd31570c8d31f43f1bd6c4e97a9353f87907c27e5a0e83f63cd271f5886e51bc3960e953b6a4e6f34912ba45ce234d5f33fc3c1c5beab6
-
Filesize
5.2MB
MD581643d2430142ab35b16ae8b15788f51
SHA1f876e3b0785955ecec535c883f2d71fc5915ef05
SHA2565ba303a784a68b79d91acab94d91d132e86c8dc7847d72c22ea4d18fff4fa930
SHA5126da6ff77b840f10264183b926c0521ca426c93100d7054d19665edcc988651988822657f7f207566ba95e143ab0189c0bd3eb7f6e7f75df5a97f302adc8c6327
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB