Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-01-2025 02:15
General
-
Target
2025-01-21_5d9b93d2265f1b7a2deac8a0448b97fc_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5d9b93d2265f1b7a2deac8a0448b97fc
-
SHA1
e446a3ed9b7a15b5573d90f8a7cc294f037c11cd
-
SHA256
96f36ffd77540aaef0dd017c87ae44e5a52c7a61fe2d093859e81b5f5c87058a
-
SHA512
8821c21b03dfe9cc44d77f05cfdc10a9834d8a0891568ae99b0a744d8f18e00dabe893cbfc222fe442a2a8aaeabf2f49aab04240dfa77f67e62aba87b5ad7d9a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibf56utgpPFotBER/mQ32lUR
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_5d9b93d2265f1b7a2deac8a0448b97fc_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_5d9b93d2265f1b7a2deac8a0448b97fc_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vLOtLLe.exeC:\Windows\System\vLOtLLe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dQAZPBN.exeC:\Windows\System\dQAZPBN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZZYezBG.exeC:\Windows\System\ZZYezBG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XPGMjBq.exeC:\Windows\System\XPGMjBq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ccJQpJF.exeC:\Windows\System\ccJQpJF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yUyPTAt.exeC:\Windows\System\yUyPTAt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrLVweO.exeC:\Windows\System\mrLVweO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cSqrFkX.exeC:\Windows\System\cSqrFkX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kSZwYIZ.exeC:\Windows\System\kSZwYIZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QMzTLyC.exeC:\Windows\System\QMzTLyC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VQxCqIp.exeC:\Windows\System\VQxCqIp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfXHlxb.exeC:\Windows\System\qfXHlxb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fZoLJcM.exeC:\Windows\System\fZoLJcM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CVmGrUs.exeC:\Windows\System\CVmGrUs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nibRMJV.exeC:\Windows\System\nibRMJV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ebiSFKM.exeC:\Windows\System\ebiSFKM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZIYHEmP.exeC:\Windows\System\ZIYHEmP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FTZeIqS.exeC:\Windows\System\FTZeIqS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dORCNoe.exeC:\Windows\System\dORCNoe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXDjyde.exeC:\Windows\System\sXDjyde.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PeYGolI.exeC:\Windows\System\PeYGolI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5eb739af4b6df4867b8ea82eb7d2d5f84
SHA1921608e21af1a0e047d01ae8d4a5a244b5c2debf
SHA256e5c7381e46c012f1cececd20c9e10df8e0dd69fa2cae491cde4fe440d0add772
SHA512d0885ec5b39dfedd5c82bb6a88bcdac3fe14af2c57679bde7fbf71a11aff983843db7133ce931b97aff419b1ed7405234c28ba397853d827b27e356bc98335b6
-
Filesize
5.2MB
MD5471823e3833072c623fbfabbcefb2277
SHA141c30a8014300a6ce1f7378802afa9843a7e0dc9
SHA256e77becbe8acbdbf011daf84145605f28e6bad17f4d1276fd1597feb2fa34207a
SHA5121a15ebbe00348b929f77c90b8ff1a95f47d8cbfef0ba39abaf65a578e8e660910c9802eaf0975843e317d4e50327536f34f110f6870cb5aae6000be4e8bf6db2
-
Filesize
5.2MB
MD5a61d91b46b92e2fb70fa7189c4bfdc06
SHA14dd708d6359bc1c17c90a9781f71780d5c8735a6
SHA256d6e30ad30267b666d9c7e95984338dcae57663ccee3830b2779400765151a764
SHA5122868026a1da9372aff33724ed8b84925e867fde501457a2ea9e7761b66904ab1df15754f1d97bd912da19614bb0c5e82debe2f7f2242bb608607046f86374f0e
-
Filesize
5.2MB
MD5f31f8de07745ca15ca1d948c9e1e26bb
SHA1970f4c8ecff658f6fb7dcb80c74adc78bd224a70
SHA2569f387ed09423a70db2faf3b2cbde8a3f1b63ab242e21164835569f286bedbccd
SHA51212fcc98f108db6eedb7b14d38082f5ec1c62560eacbb18814f7d548991e30428bd2e406ab2492217c6b03a84fc63eee4e96e5067fbf3274d430a29dcea84eda2
-
Filesize
5.2MB
MD5a6d5cfcd29f96b53c16e73827189efc0
SHA19a2d8742bbfe50df0d35f934e92617447d9a9822
SHA2561d1ca6e70fad3922fdbffb44e590f234e64cbabc3babd9ae5294b621ba3a9041
SHA512c8e7e5ef078efb747114aed8d12553522f43d1a4b3640cc8ed5e440ee999f619083a04178552740b31380bcfb4d97ec8b6d55c5706e31743025d21ce78c329e4
-
Filesize
5.2MB
MD5396fb425d0f1220b1d8ffa610c7a363e
SHA19e99263f0ce6b37629ad965f6b7b62af97ee2e1d
SHA2565ff043b0d3a6d6a4e81c8b634c94972339ce192efccf124fa2ae451dcf1f15e3
SHA512f1a296139495817ac202957fd5c0ff463552111a9fa5ce0a68dc4781ec6e06d181d21b183067c898cf4cd7e4dea19e80870ed7a25c3a7d584e9ace0ab678a76f
-
Filesize
5.2MB
MD528ad6fc295e046f3ac2c3ef080aa6731
SHA160694cbbef06849d1ec2ea684e046868d5241099
SHA256b085dde0cd2d7b379936c84117ce31bcc234a35e358d130fae61bd3e20c53232
SHA5124132c02c34d80435e2363371391a56d75fa8ec9adc297bcf9468ade3510c8024f14fd616672ab5cb5d136c2ab10132ba19146b453908a9a0de0542cfe63b4eca
-
Filesize
5.2MB
MD5af6c276ba4f5b9fd0b7cc3f8d4053d46
SHA13251c27ee10b54c287c42a7b0803a325a715e9b6
SHA256db5eb649ef331126b9715908f309f7e5dd8de10549e41092b73768cf0f7f126d
SHA512c7dba50a6cb4cc0a8928c2c26137b43d9452aa4376215f113e99291b83f4c73b40279b5f4745528e874ca2cbbcafec202b1c754f287aa0158440776ce64dbc80
-
Filesize
5.2MB
MD595405453f4527a8387c848f147539186
SHA10903975fe468f2de575631076fc28cd22b1832fd
SHA2569c352b29210887a43153e1f772fe7a9d7bf6793718d0c65719009c6d86245c37
SHA5120245f55f0b171a9b090010abfb9468dd1fb2dac6411c93a8b2754d26fd943cd712ffc86478df80a442394d205782355546d1786c20269290795d18e78af3e82d
-
Filesize
5.2MB
MD5b24f6c254ea860e15770219548d3a179
SHA1eb24662829776a6b521bf3f16a6dd103bf1e9b30
SHA2566e72190a716c270f748e9881b94246cbb6e86962dd6521d8fd4cd5b307e59b37
SHA51219ed88ff11eba6a7461c031c6106b786d795ecedf2488674045e1f3c5635e0bcce225483da083e90de30512cea8eb1be61c516751eba18c138030d9010412979
-
Filesize
5.2MB
MD5149c413a6c5d08db2bc09dbee0c308f6
SHA17187c2aa8733ebadd26e553314bef8e4401bf854
SHA2569f89cb58f34e239d0ed1a1fbb3f208691433cd4c43e153bd23fb80af84f7b44c
SHA5124f5d4447f3262ad5be9995ab9414eae0a2b61d1042101f50455af8b54f9164b665dd2bd5d107a0a1327aa61c11543819fab050db233ebccfe1d0c691d380fbb9
-
Filesize
5.2MB
MD58104c2e9e1e3388b8f0a1d5189df3edb
SHA1827bd28eebe002e3081e9650efa8114f169f46bd
SHA256799616b214e20d0d6c3f34ef0a78f0ea7406d4715d1d41444affc43f195a25c4
SHA5123d4ae0f4783ebfcdf639497d8c6d13a72069103579ad48d3de54602d5abc3c45a30cd4faae33583fbf9835411b5b085d580fd9b8d77798c0aa9d9a530c251075
-
Filesize
5.2MB
MD56b5e2e62db4be28608ff50c6333e7bfa
SHA15e4a00a619f0409595ac27d855da4e6f3488004e
SHA2568ff225ae992638714f11b398e01b033589bc6ff5ac30ae253c57f18e403b72a7
SHA512120198f4100fdce6d9c034277f4cba6a11fc539c63cad0326798a90b9f3991f8accf81287153aafc37261242b981b71980b45c5c5d8a4c82577f7e46b8b0538d
-
Filesize
5.2MB
MD552ebab7e51439ba9987ed4041b3516b0
SHA106bc903fdcd70961c102da8b41ea36859f68a106
SHA25649cad1c1bae9f67821b1e46290ca6dfc0c1c2614d855fe98f8ff2ede2a7f7ed9
SHA512dea6075247219026e0fe339ab9299965fd3cc99fbb29dd79ece956abeae43bb91b4c9b506a57d7ca43a963eb61fded8f7173c66661c8779f8abc7ec07555b383
-
Filesize
5.2MB
MD5b1a5d175abf1289ae586a339efbc432b
SHA114a7517831de927934a0673655ce5ef6fc2bd5ca
SHA256a70ca4d09041838057efa0a4c0676ce71b7ddfaef8bfc4166fef6072673c189c
SHA5126284696448e44c1e47d832920f73603ae3141e8f6ec08c46ddbba2edeecbb748ada7e85fbe83898d98554a3d248de1d421da3dca644a1f6602aa999d8598e548
-
Filesize
5.2MB
MD5b1b16864e979c3b6f5d78dda821efa41
SHA1c4a01c56b7f6297338d50b104e2d260620bd7f85
SHA256a4a31c5d16ecfc4af3be3350e3290060315f9edfeee82bbdf5f5c2384e091727
SHA512c52c774af49dd91b3081acc3498e6872c45ac3a7ced6bf84d008e49ec253c69f4604c78706bf304df7047566f6de9cf0dd910019953c849f6ce7009d258035b8
-
Filesize
5.2MB
MD5f62fa2273fd7cb89a0739a7206e196ea
SHA1368073ae33054a0fceddfc5dac5a67e42427e368
SHA2562690da4c1ec34631da44e959f035fdbcf8959ece41f8fe7acdede9732190ea54
SHA5127f19b992d7e1b3d9c2f0150276817bc5a779dbd806a2e7a116957db86fe77c7eb51f2a6c367ff2471e52919370f387ec8942a4e6aa565161ff217f799530f166
-
Filesize
5.2MB
MD5a98789788d0f825c0ac69d48f3d393ac
SHA16aefa706ad47132be5245d1a8ae93abffbba1047
SHA25606718bb27afedb62ddb728def6f1ff09b371935b1b74b92399783dbdd54cc87a
SHA5120b33da4cce445d5458b29fa9a78182f8da9d41d2f2d8bb1bc5c9fecaf8233f6f2323dbe45815d73d4b82baf99d648dae64f66deff4dc1824865f3fdd31dc40d7
-
Filesize
5.2MB
MD561ccad0dcc0112f16e56cc028e4b112e
SHA1b50e0e166545ca55465959566fcc3512f4013c6c
SHA256e4323cc6f1bdab2f054854778932c86d90a8200f933ebd98ae4ed45fad70909a
SHA512f1c905887fb5d390ce9e550413b90d22ea07ee7a4e230edad462db10fc52c703bdd0999d06ebc925042824d9646139f96a5b89422a642e481dd86430010078b9
-
Filesize
5.2MB
MD5e714641c8d3c1610f8a7376b2b425126
SHA1ea5fa832103816f12b135b2e4ebe6b90db72ad6e
SHA256aa5fa78c622d23ca5546ef777bfc6f48ca39958839f4b0cb54863a96f96684e6
SHA512b612a842f3b59625bc2485d2da8bc8281d444be4631a645f91aa8a0509698de161280179516f64ffa4f2a145f3e813f48a16cb4c137815fab365030faf9ae2b1
-
Filesize
5.2MB
MD5d385b790ce2287be9b5b03841a30224d
SHA17214e41d0659d2978a7ffd4b753e1af40249f227
SHA2564c7f177b1b4568137ff46485d29a7ef2d4e225b3922c5aed2f43ae0a0df66ce3
SHA5127414c6a8eab03f543a951ae0e5904eb216397615c063c03db873331ea49618287970e05a4149263babbb82dd633eb87b0c51635a0e69165a323eb862ed0469c0
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB