Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-01-2025 02:16
General
-
Target
2025-01-21_775cbe5c81ab214b1237e56b04ece24b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
775cbe5c81ab214b1237e56b04ece24b
-
SHA1
29e233955c835bba223d5d87397e34524a13371b
-
SHA256
193c4c5639254e53cb131a7d677bd05d6e6a23d7dd1b0f433417454d0811be51
-
SHA512
31f860d0d826ac8aa91420abf3fd188905298a82534401254712c657a72654911b84eff43dbf67a500d0c7b37bbff0285f9d767e14e4d3c9f603f1728e7535b7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibf56utgpPFotBER/mQ32lUY
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_775cbe5c81ab214b1237e56b04ece24b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_775cbe5c81ab214b1237e56b04ece24b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\doZoDoH.exeC:\Windows\System\doZoDoH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IGBmTsA.exeC:\Windows\System\IGBmTsA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QytclTX.exeC:\Windows\System\QytclTX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BMFoqqV.exeC:\Windows\System\BMFoqqV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eXkgbva.exeC:\Windows\System\eXkgbva.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fYdiPSw.exeC:\Windows\System\fYdiPSw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oKqUqbQ.exeC:\Windows\System\oKqUqbQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JkDDTBE.exeC:\Windows\System\JkDDTBE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PhBeeqi.exeC:\Windows\System\PhBeeqi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YKhnGbW.exeC:\Windows\System\YKhnGbW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gqBMISn.exeC:\Windows\System\gqBMISn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NDlGzNK.exeC:\Windows\System\NDlGzNK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jWdpqyp.exeC:\Windows\System\jWdpqyp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pfrFuzM.exeC:\Windows\System\pfrFuzM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hOIobkJ.exeC:\Windows\System\hOIobkJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wjaqBGL.exeC:\Windows\System\wjaqBGL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VwbZyCm.exeC:\Windows\System\VwbZyCm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CiCFNNT.exeC:\Windows\System\CiCFNNT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LerTcGV.exeC:\Windows\System\LerTcGV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sHEsMPW.exeC:\Windows\System\sHEsMPW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rLZahpf.exeC:\Windows\System\rLZahpf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53f2e16738f99d850a4dc366c27fa6720
SHA19d5b4d2da75cb0150fd29837ca92347508fcfb68
SHA256859b6e5ee4181c5d203edaf1123322b5dcc025ce7c0305a46ef2505a55f5b3a3
SHA512ba81b657fb3419d7584c712d857b4484f7c6fd0f3e24e29dddc47e0e732e4588360c60f02a7f6ab24cd0311300d92e5df160e8c399206baa252658968faf850c
-
Filesize
5.2MB
MD5f5ec5083a71a56a8794c04429ad0098f
SHA1f0508fc6bb8d18b50c8a0cd921ecba648cf95451
SHA256293559722d6379237477357e072914ab1e089a5b834114e6a71b04dd63dc91ff
SHA5129cb5bf5cbc7d3a12169d75ca9022b3ca77affc82171772325732b46368853afd3dcd093912bdb4c3d1d0d81ba60ed12785a9db9ca26cfe341803521d11db9c8b
-
Filesize
5.2MB
MD51053adbb36fdf377b7d6beacbfd0bf01
SHA12fdb574f7adcbf25a53eb64b5c671f03c5683a7e
SHA25671246212633942406f4b38a4b41d12e8abc6035320007bf3e6232d1cd4308e10
SHA512e6ba101029fdd3f67a240b8907efee9cec035ce9b0467601a98a27c4b1f49f9c1c7e3a95880b00177828d57411b96694d230f42b611a9a676d8c8861f1850f25
-
Filesize
5.2MB
MD522d179aebdb6e3e3a206e9f8e968fb8c
SHA154056a69be76a9e3a17e0a7bc6358c40ba7965cb
SHA256b407dbd323fd391d9240a6e078f19e208f5e978ae9261a7e5a6c5e19f7ad8516
SHA512117969e96512c17baa5762d2086157a32d00e6819739122df26d3d1c687d3638cd66773ad10892cf8955b76d3c0ebb875c0c1a358f332df3a33e6c59b5f82311
-
Filesize
5.2MB
MD540279d6ac566c2977165f630e0361a60
SHA1e5baee874ff6cf6f55573a5089bdec7c8dfd2f7e
SHA256653e410182be5c520296ee8694ad2f64626aa4efc82fb0b4b30c26e366abb9cf
SHA512400f64be37be1cb52155c4004eebc48d54ea8246f6d4b82b8ff5e8d7b8a000b6d24cddf3b1f64f47044279906f9820338cc6cab5aed824eb6b3a0f22b97b1bc4
-
Filesize
5.2MB
MD56785c3be42c7b3e609eae841f9630ac5
SHA174f4982b9259d235b9190a4e0c4332f40e35605c
SHA25676efc2bcad8e50909709b2c5b760daddd3813a5378d76edfd7c5230a7ab0f90e
SHA51296219a4fb0c5b6ef67803b2b762b6b6ac2ed1ae920462d0e30fb0c00aaa9e87550cc163d8d31c2c3cfc61492202b0b1d1676ded3b517c4f54d66d403ed4a3326
-
Filesize
5.2MB
MD5834de1487b4ae494f1b7c748df113916
SHA1df7f2381d1dfe64b4ad4400512ce3ea48a337db5
SHA256dcb16c9403ae70780bfd8cc5a2a24275a1b194947382140ecf7ca584c8ff7199
SHA512c938436f5220fa7bd9f579487da8c25df286dcd6d7eaf5efeeae2f9a0909d8910f9ad12848d88f8bcb0ca36ead69e77db59b10e2dd81b36cf4edfa48dd464646
-
Filesize
5.2MB
MD5b649cf0c013804c5b0801715eff47daa
SHA147886e4066fe2a59467608ec89c2e91652d42a57
SHA2562d31487795874275b1bd7392e6552415e629870aeae24a7e7113a3d73e735288
SHA512d1920468b519b516f075e4650b8f9213c0a35e4b633073c5524b90a2543b7aa296057c5dd01cd02ec596ac5e13b4ee4afade8519f8601722b7b1362e742cc20b
-
Filesize
5.2MB
MD5a523de7778b1791dfc42e0558a9d4259
SHA1780b2be096b0b724e2d98e03c26d36f74ccd3f1e
SHA25657479812da746ef8a51138d7b3b9d62fef5738a6078756bda83977db8f8bdf0e
SHA5126513c2c8b6ac8586bd1cc5463b194ea765a01efa2470285a06857e4c80a0d75aee061c74930c10fa1fc4e4b2be2950b216fbce1ab8d549a0fc8591d9f574ffce
-
Filesize
5.2MB
MD5a08efec1be926c7720173c3a0b8b2266
SHA1751f54f01ac58573d7d9ee3d79cc1f648ea291ce
SHA256ca5c4e2257000e94a5413b8110f98bd591b8c14037ed0be47152100421867df4
SHA51241520590276396f5fd627a7302c5c5bc907b6a7f2c3dadeb71d42438709f5752b81f9b1fb6dafc9d53451539a91298cfc5b8468e712ca7fda3c52b131f5d562c
-
Filesize
5.2MB
MD5ca34d3a27ec208968d2ff0081f693e36
SHA11388671769d5e9e1b63b9aa0d4f4f3acd018a247
SHA256f577ccb5a44e6ecdb88f0339e85941506c8749759097d75cf56a7afed2c36f1f
SHA512e878c425e5016aebe79357c871520fd0c2bef500e7ed5c96b2004b53201f2710c745f6d96ecb87aed109f7d655e5e92c6b563c0a2d2a03f1902f3c590b21d8e5
-
Filesize
5.2MB
MD59198487b401ccbec26976a73a97df1a8
SHA187a1e704e8f682e39e7cd66619419ccf272c9375
SHA256d1cf97ad38ba92539364d3e1a77e197ccf5c5bcd0b57a46f436fcd5d6f531a26
SHA51226adc92be2dd16f095f114d095854c8a1b9f47168ad80b7105a910357ed30e454c3a2d4cf291256d77451b298671766992b6c6b6494a6a3d813c9b418dfb8570
-
Filesize
5.2MB
MD53494190e4a0fac2cf9fc34ac6fdbd14d
SHA10966aa1e8cfd647675b0bd0b2dc834ca35a4ac3f
SHA256b9a210d4bb92e4e51368db13919d032a1f70e5ac0baa154d032f05fabf275b56
SHA51202c9b2afce087d6ddc1dd65a10dd92f634730b324d8a42e6c0a19af0ee3892d997dbbfbf55b19e188d10c227e1cff3ba6cd9b5841f94cd6d126bb3b81e32d53c
-
Filesize
5.2MB
MD54b9e43a86f945a24ec84ca28084e65c2
SHA18b5d0e975a02769caf5b942aa6fb6914201162a4
SHA256b0d6717a2d52a8d23c52dab9904c64ae1bbbe348a12ff23579e6e9d12a686408
SHA512d4880a1f36b892755fb8c51d06b386d92ed6b5fb5f6ecb3f94c2f142325a6e3949494567cbbe380bbed0d1a5202d4d7fd23641843fe599315f093ac09fece5a0
-
Filesize
5.2MB
MD54a242d187e923d218ff51f8d62ca3a35
SHA19b0bb365de4306958c04a90d1abd6005d5fcc4e5
SHA2560ca4bc33ed40c1ca244e06da745e25955eab8cc3b8c3b8121102a56ea836f00f
SHA5126ebdde7fbd0b2f3b10ed178f803c09a0eccf9f0a6a96217aa3eb18f668448f03120b427cee6d88d2add059b3900813d1531b099bffe55646d6c7894e0e2f5d28
-
Filesize
5.2MB
MD5947cf0d295bdac898b0a8d8d6a18b91c
SHA12ff6018c70161569f259d863d69f8102c9fff46a
SHA256a4e95d7efd67225b5797904abcfec3a88ef63ef50ae5934ba979017236083b3c
SHA51281edf7a4d833a35c0ea5323e64ff2741ba202c9b76d6e84a1f1480fc029a4c16764da0c5e1376f226570dad669b92825857d0888375710bc83d1af09ae33a36e
-
Filesize
5.2MB
MD5b436b615be5067e0d7072a66e19ff6d0
SHA1a47fe18a0b6cf1fe4482eb3b6e3fe4034139dd2a
SHA2565e686df6a082a18a6192d31114e7159ca13c042e0a25f89693e00f8de735f5a9
SHA512db1fce4b765f263e05d84d44753d4ab4e73039b62f3619b32c4cf6e3bd9327c33fb8cf48742d1883957306a52856ad4f5b58add7f723c9a78476281540c86aae
-
Filesize
5.2MB
MD5c38e59d5c4e7ad6dd660abf840a568ec
SHA133423ed376d973eb678c416fa5414a9e11d7479a
SHA256a610b40e0be31cccf6b76aeca517915709372794e815dff2ed47bc9c153238bf
SHA51230031f725c28f3a49814044049f16acda303e57a42db7d1dc67851a8a10645f908753417837fdb6df1cfc5a57cb23e8a3360df138af18e0e2b6a98eb7f67939e
-
Filesize
5.2MB
MD5076b3b26241de47d3964226d616bd89a
SHA167cdc78475abb5a95903cfa53683b4bed3d1a283
SHA2560daa3b9ead3d4b7aeccc2e8e46382879352d7ab1465608335bc1c1ed8f62f963
SHA512ca573d30f91f0fbd9d46c1d62498cb3c56237d6ac6767db8cf8494091849b08cbae2a96339e048df09661815042827f785d268548e43a49d811c4c3703085fcd
-
Filesize
5.2MB
MD540a8e12f36acb3b47c0785bbb3887d41
SHA1e7754c311aed910096a811a8b7b77db343b3fc13
SHA256f1cfe7e3a42fcfcb48a2385b1787a4ee4553749c98f324c26a3be9b7cb0f1623
SHA5120529cc601b8fc52a5f13fd7183c567da7d4183bdc5b274641482604dede5be5b9ebba69f68b9b9b068a3f64be7a7a863664f3196503fabcdbaa2eeb2616f1f26
-
Filesize
5.2MB
MD532ed4dfbca7d7841fed8c58429cd5e0b
SHA14274d6a36766aa74e462f291281c21eb592d376a
SHA25698a4ff50a67f897d52c166b626e07f13d045cf63556f1d0c6c859cc250b48831
SHA512b6e2ce1b21bbfe867f59a6e3b4014e3e8e733cbbb1dd2677e2dd73ec40bcd1934050169b98f099335e954e930509b06fd0b0922bd1de47dc603141bf3f4dd080
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB