Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-01-2025 02:19
General
-
Target
2025-01-21_ddaeef91ec250e43cb48972616af54d3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ddaeef91ec250e43cb48972616af54d3
-
SHA1
59c9278172ea56e5eda6f033cb798bc98ecb3f93
-
SHA256
f02cac56e6a05445f437af5b0dd3c72406d7aa7b6aa2f7a2d0708899586a46f8
-
SHA512
dbbcc528881779c68bc10e2912e1e4c671fc13a8b43bb9c981dac0e2ed909f11da828110c640b65a4a949d1d0abd6eb624523684c8030643b066cbb31a53be2d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lU+
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_ddaeef91ec250e43cb48972616af54d3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_ddaeef91ec250e43cb48972616af54d3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\iYXjrod.exeC:\Windows\System\iYXjrod.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GNCyUNq.exeC:\Windows\System\GNCyUNq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RaQDNbo.exeC:\Windows\System\RaQDNbo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hnZuAzI.exeC:\Windows\System\hnZuAzI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oCmqxQD.exeC:\Windows\System\oCmqxQD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KjNnGzg.exeC:\Windows\System\KjNnGzg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hSazOWG.exeC:\Windows\System\hSazOWG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VlYgFNE.exeC:\Windows\System\VlYgFNE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SQNAxVn.exeC:\Windows\System\SQNAxVn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QrBFGbR.exeC:\Windows\System\QrBFGbR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YMekQJv.exeC:\Windows\System\YMekQJv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lEhvUXK.exeC:\Windows\System\lEhvUXK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZuIjKPF.exeC:\Windows\System\ZuIjKPF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zprzzsJ.exeC:\Windows\System\zprzzsJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IEBAHQE.exeC:\Windows\System\IEBAHQE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jLiXcJH.exeC:\Windows\System\jLiXcJH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TgCWFNj.exeC:\Windows\System\TgCWFNj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NsJJchZ.exeC:\Windows\System\NsJJchZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OgSDKEo.exeC:\Windows\System\OgSDKEo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OMYNapA.exeC:\Windows\System\OMYNapA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QJeyXAc.exeC:\Windows\System\QJeyXAc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ba1e2e844fd900dd0a5f6b5d300c372c
SHA1bce72ece125bd7c970c12552ce2fb4beb660d159
SHA256bd2f89b56a9a0a140ae178e1bf522b1b4d4f5dc35992ef2c2a886f0e7a2d2cfd
SHA512a9904d7c1f06d9b1647807841cb8a711a177a43ed634277f43f546ffd7e96a5538195843b715f2d1eac3bff691ebe79c81dcdd311c6ac86c87b8dca83adcc042
-
Filesize
5.2MB
MD5af8c93ce24056cd1c35528df5da486aa
SHA167ca3a347ae34d0b2cda1c2f72c9efbbbc19f3c1
SHA256202adbb2469438924665958adc07e04419e5469972014ee37f85d9a47a9786af
SHA512f648f9fea5a29e3e9d4259faf8a0f3c0831b4b2e8f544537c554d9631797d3a1152ed0a5643a9a4c4b0f6ba6700d184aad70cd3bdfb96b9c621f934529a84f89
-
Filesize
5.2MB
MD55faad66239f2ea2a65600dab7ddd97f7
SHA11e3384dde5992834dd6525982d4262464613e50e
SHA256e2450a7fcf179f3bfd359d09fc4510c9ce36f26de876068346ff37fb13102c1f
SHA512a83fd8d8dd4ba25e7e30a8b22d2ae092add1800817ece83ce102b25547762bde7dde7fad07fe2a9437409d9ee6265d3fcf5cdd06a3e2ec7d2cf84e5309dd1c9a
-
Filesize
5.2MB
MD533a57e1b532a56162336d9d396cf9aa7
SHA168069eef39646739a4e99fe64601004155d8647f
SHA256199c1406df89db654e6b150ec03ba2cec5f31afa5c57059b19e9a391c3c3ecc5
SHA51211e584dc93beac73272f14d2512efe0fc4e7a50178eb6a8ec5a7109384336567faeb3077b1875cc9a47a674317e5dfc379704553aa11bdaacbc81aa1b0951e9d
-
Filesize
5.2MB
MD5bec9e9a7fbac746400cb650358b55146
SHA162792fa387e6fa07fb74a7cf8bab169c2b4a1772
SHA25605bb5b1be93865319d9c7be3aab116b7cd3fc0a68f9a3f85b441aea557c518cb
SHA5127b524c763296e3c7bbea3e9e0bba92688918a3d39e855886b1c68dde83cb24e4740d4d4b6ed10288b3592d86d22a8688872da71ac8d3aa111e05b840da9ab037
-
Filesize
5.2MB
MD59a446fdae2483b398d17beb719009234
SHA1a135a8f094c5cc1c4f23826bdbf68df8079cdc9f
SHA256c364a62aaa91d110e4046fc084599a1e05bf7abdcb3ec70eba17e95715789b96
SHA512ba4eabe5dbbf885854c7c3b3ff66394e8d7eb7b918760730a4d4b7619ecbc26a9db69d986b3f4dd210e256a0985bf8ed59539345efb83d31c3d6d6dc2b313008
-
Filesize
5.2MB
MD5f9afcd46ca0461acc5dab0652b702c16
SHA19aa57de5b54e06ab0a15565689de42e5c1ad86c6
SHA256dbf0f0b3b3e9f2f75fbb129cfa85b42e1a3f8e4de2314ac26d617e0f6ac4ae4a
SHA5120652b9e9c4fa740f7e21e40158648ce62a45024cf748e46e31f2d303a733dae7b885f266cd9d25f1894d8f59cc0c2c225d030c41b2c8dc8ac0ca35efd87ae1dc
-
Filesize
5.2MB
MD5fc1b3e130820c5024950f8e6cc0b77f2
SHA13813b42019a157ac2e25072b507474ce11a5391f
SHA2560c8dd43928267495c8648774c207b8528b3b6d53e6276f8721bd03ba1be411a7
SHA51205ad360f9afae2c9035280c6f6e3f810c917fb78ccb5beb1100dbba16787940d8cca61cf5d09def93650377bd27563cb5daa2f7c3d60952ac0aa664dc160a0d8
-
Filesize
5.2MB
MD5ad6741b4dbb0bb43f0c8552aa144886d
SHA1f550662559371966574f36a16961ba7aa399e8b0
SHA25652ae5e5996c5b32bbfda76ed57f5f66f25a49e7dcc8a98dca6451257a1d8403f
SHA512ea17dc83573ba1ae1c4fc5ce77af61de62e29e250a3fdd24affd257cc9d2c1fd55ce5c2948945732d4444da54025b818ebc080fd6ebbc3eb1b7dba8c34a80fa2
-
Filesize
5.2MB
MD52b1a79a03fe4f0539113cccfff221a5d
SHA110c8e2dc1787182c7561b52a3eccf7798aa7cf97
SHA25645179feecff3290b512cf01213a8b4e5a7974bd1da57b8886d851a49ab40db55
SHA5124f61231095816dc839c7cba902724f7943601a9066d5ed6401027bba010e4d3cb9b1f370842a805f71a460190e5272a88d60d6b951882f4b122db9c11ac0e8b7
-
Filesize
5.2MB
MD54f1f6f43b772070a5924ce209bd57e78
SHA14606a933fc7a870a6d1f63c59345b18f852a317e
SHA256f1303f230465069aa62c7e3fae46040fb5a968666ab62d819cf31e96a1b2ce70
SHA51257696a599f407098b426a3ebf0216c0dbff5352e6985ef22c8e140ed7338a93c62f783e69fffeaffd8ba4a3651b479ecfc59ede287bedc9f1447c639f4c284c5
-
Filesize
5.2MB
MD59ac8f73f187980faccef49fc7f797273
SHA1ebf08d31b820c19def151d9b49ea0214360dea4e
SHA2569c18e7593e50bdfcc8f0b2cdf4d38ead76c3bd660ecb8360e902e80b35a8c749
SHA51260cb421b322d020d87bc93834c1cd979106d8336de5f94424e02b8f786c90caf7cba64756eb1ae61ad83ab58318e4348c4538645e6c4f5cce6ba941a988a83de
-
Filesize
5.2MB
MD5fda877d7c64a78b73f1f41b151cce7fe
SHA1e68bd0d0ce8e06b60e80a31f64e9e3a00eef8a30
SHA25602e623ff5f2b3e4a275a769e92323ffcdaac62ee17d8210234d4c280dad2472e
SHA5129842fed3968d1d45155bc7d741bac5771800aea9c1d31324ebc8c96506bc817e7a6f1a82b7ec138dcc0ec2616ea41e2652cdaada4842b9e5143b7976fc9829bb
-
Filesize
5.2MB
MD541ae7a6464b0d7829e139b495df14d09
SHA17a960fb36aaa5a1511263214e4f5c95110055fa4
SHA25674afd7d67b12b758d9c9ee0ca92a1fc0259cd85e4594770a1f20745104b5896d
SHA512240bfdb00802d26a31f014826e6adc019a5d0035baa019763395958bdd45bbe72571acd0ecbd106e5ae83ae3757c07b4acfb64553afa4571e51f8fb4b21457e5
-
Filesize
5.2MB
MD589dd98b33773e25ae732694eddd886e1
SHA153f449dd671fba7503f828182fc387f0ae3f1cab
SHA25619355760905972d58eec754f716b2bb3e960460a41222df6e3fe71e7fc0efa43
SHA51210c20cb7033852a53e98e6b10ec52b47b6856d247d35bff020f8a870866f4fc7e48ffc5a44c022c797b62fd5cb93f4e641850ae515d635de776bcb354d7683b7
-
Filesize
5.2MB
MD59fbce163e2d01c3174c1d2cdcb0f2b48
SHA1aed7d3e93f68755356850554e111884ed57eeff5
SHA25641bbe020e1160f1d50c552b92c774d53bff7a256d7e91dbb924588ac736b4e46
SHA5122fb6a4108ea6ae9c96118e52af7f1826fe004b4c3460806151380e3d9d283957cbc3f92981d5f69a132c433651a270818229afbd2c33823d1f36ade0aa2893dd
-
Filesize
5.2MB
MD5d147318ff5013f3eda053b5fd61d1677
SHA1e7441035156732ff217ff980c735bfbc42b971a0
SHA2563c9f3dcf5ae57e03bdd1ecd6b7c034530009be52bf6079782f875a3b5cf526fb
SHA512394aed22b4e29d9a6ffa849c61acf51bc7b9730ba8e78cf06f7b7bb1b9a60f150df7fcb8224d63469106f6713414cf7d99fbffb37c69caa53268dc4b9cd9047d
-
Filesize
5.2MB
MD51d60cfedbd32f77341f678811c5863d4
SHA1b80c2f8f475dc1803c135cefd446cb8bb0ef4874
SHA256ab42df768a364034ebe6831d9fea30b842f5e42bf2304f6270f41697d48a8869
SHA512db4c4b66a94665a64d80d267486f1b6df9041a0e2b5e3ebfb7fb8a2069e959b22ba1c6ae4dc927da39b72015143b6cc914bc1686f5f37def4e431e0e895a5291
-
Filesize
5.2MB
MD5075b2856c84553ab7bd538753250057f
SHA112f125aeffa3f02fb25146de43b65c05bd376164
SHA256e47cb53c67872687bd5267d287ba362826c3019a01fbe5b5ee5d41df70aa0a86
SHA512180faec5720527a1e9631969266a9c594896448d5e5ee060c104ce0014c482247eb90cd8278c1b593591f660e9db838f4889aaf69eac72c9af8372b4c82a688a
-
Filesize
5.2MB
MD504a033a387f1960ff83e08e8b9941e79
SHA1b7f7e10dd8b73c5a9db2d4e18fa66f3a54e0a9da
SHA2562efe65fe9916fa98199668201a85ad637ebb624565eb6a510f8677e63f80babe
SHA512e3f7fd051ee20ca0ac3cdeb74b6607090f9ae9d79ddecb7e285d5be958f24b088a41ad58535648177f46e57633c7b7869251a18798454329c6583c51bd118189
-
Filesize
5.2MB
MD5d7aa9611df882ddadc988906b1ef1039
SHA111f3b5dee538e03b86522444d9513df02718962f
SHA256f4ca787ee53087975f6b0adb1410d2db5e83df73c38b6652122f8ebab714ec66
SHA5129c7841fbbbc90da010f5c36d83093cf4affb50ce910a2d96a4203fea0c1a8a452fd3cb90aa15fda3513378139ec25e4c127fd2d5d156159ee1fd4ccda4cf2efd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB