Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/01/2025, 02:19
General
-
Target
2025-01-21_ddaeef91ec250e43cb48972616af54d3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ddaeef91ec250e43cb48972616af54d3
-
SHA1
59c9278172ea56e5eda6f033cb798bc98ecb3f93
-
SHA256
f02cac56e6a05445f437af5b0dd3c72406d7aa7b6aa2f7a2d0708899586a46f8
-
SHA512
dbbcc528881779c68bc10e2912e1e4c671fc13a8b43bb9c981dac0e2ed909f11da828110c640b65a4a949d1d0abd6eb624523684c8030643b066cbb31a53be2d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lU+
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_ddaeef91ec250e43cb48972616af54d3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_ddaeef91ec250e43cb48972616af54d3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FDpKBLU.exeC:\Windows\System\FDpKBLU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eGINjjZ.exeC:\Windows\System\eGINjjZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lMeMMES.exeC:\Windows\System\lMeMMES.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fDpgrtj.exeC:\Windows\System\fDpgrtj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EHJGqTh.exeC:\Windows\System\EHJGqTh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rVTNQSN.exeC:\Windows\System\rVTNQSN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qtzdCmD.exeC:\Windows\System\qtzdCmD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DHhUBIW.exeC:\Windows\System\DHhUBIW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RuXSXOl.exeC:\Windows\System\RuXSXOl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlCdJEL.exeC:\Windows\System\TlCdJEL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oPultCE.exeC:\Windows\System\oPultCE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cPDIAnI.exeC:\Windows\System\cPDIAnI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JBhVLKb.exeC:\Windows\System\JBhVLKb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hzmGxue.exeC:\Windows\System\hzmGxue.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kpqTxyY.exeC:\Windows\System\kpqTxyY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DtpIzgC.exeC:\Windows\System\DtpIzgC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XBHXSOK.exeC:\Windows\System\XBHXSOK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KbIXpjc.exeC:\Windows\System\KbIXpjc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ejLgUnU.exeC:\Windows\System\ejLgUnU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IXBGmQa.exeC:\Windows\System\IXBGmQa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sYZnBJG.exeC:\Windows\System\sYZnBJG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56d0eb16da5641c631a457f10864ca8c6
SHA19a76768e095c1ac2224c0e99bd06ae204320f523
SHA256903403c5291361f7bb9a81d267ee35819f9c4196c22b63effbbd6f0ffd4f8787
SHA51244744e8f233299477d3de2431c818d28b9b670cc3aee01b746444aaa5430722e796e33df832c02beca556d0758cdc68d16eedfc9c1438729c62e5d968240c608
-
Filesize
5.2MB
MD5f4355b1e77ffa696c5087008843b2d4e
SHA1b6693a9e0c631ef326a02a33d0d19a8dc6139f4f
SHA2565e0e46a0b2e31703d55b1a4d960e0979620fd932107c9a52139679dff85f4a3b
SHA512f15348ffd1dac6cbe25141e53054c0b195b3e7447c1db60e69e16df2bbe2c394ad6eafe0a5874e18d31690ebef9180f8fe8b40b8ed2ca90bc36df892dbdb2b8f
-
Filesize
5.2MB
MD5b6e7ccaf18251b846a64e377bd5b4301
SHA15c9d8224f1599f279975f01878494f7ac8af4137
SHA2560c62236556265ad286f66ad6e774f92c080a8c659cf1a740a41bb41097627d3d
SHA51214829b5f4439865c591fd06fd8c3651c7b9c93c4e83807b5c511adc5874b47b9b6fc7f573fedb798d3a934cebd29035a51c256237257bb02c3b0cc474903498d
-
Filesize
5.2MB
MD57d4f94806ea0195e0f0eba1d124d3ec0
SHA16dde040021cc2a9afb355ed8bfbfe6ff2780f4a2
SHA256ee530b3ebd51e8a80d267efcdeafdc3bb3a1d13cf0d4ec7ff566fd7328059476
SHA5123470be40d7730a88ef7fed7fbb284e871e9a1000e25d6a5b84a6c1246ba67c719d0b242fc5cc29181337226e654c8147837740491ab75189a7f783a7359adcd0
-
Filesize
5.2MB
MD55fd27628715b9a7df069ec6950d0c9f4
SHA1b4b46b8aa94032d8c4720b68037ce18f72d7576e
SHA256c849095e1f96cf16c9d2925d7cd7f1112c51ef39587ec3eb5bcef249c1aa6eb6
SHA5121886f5f85708ed8216c49a4c9e2613dbdc9e0438386ff1590f1047c124049dca50b8e492c1a5af28d7404680353e2538e2c32b8a36dad562230360a532fd5931
-
Filesize
5.2MB
MD5894d9d44002b8a21dacc1cb2cb2f09d2
SHA1d292f9ab13736b29d4934d881431e7763adf712c
SHA256de7405b2b96bb0db325d841381ba3bee70cfb6d9b47520ce65bb3df050e3d5cd
SHA51267894e53bb2d9aef9fe16bef437c632b6b98b9e6e6f3e61cc92813bd6ed6028c90a2e531b2e9c52ec151c1dc6894022db5e2717ae259fc2b9b1bb3b05ec0e18d
-
Filesize
5.2MB
MD53d5ac9fe6cbd215cea82eb3de721de70
SHA124d8df0e25b7670712180fda9aa5b11bcf75173a
SHA256807d998f7358e7a8c08acc2af121c5dd0faad059843255d66bc4788d7959424c
SHA51283681e71542dcc928dec70fbf3c954147a182856bb0765289eb8b728b5a9d1582c4b4483661eb2e44fe9f467693fa6a4d51b2c2a2294ca7d538fe9af7d4dc4a7
-
Filesize
5.2MB
MD5b3d0b2c3439246f8579fe7406dfc5735
SHA168d7d0c999ace764156be1928819c3111a58479a
SHA2568421d1cbb6b050d2556742430132dbd772069badf1d46d3533f69e4d8a852ed3
SHA512dd5096a3e82f30c27083fce14ecbf1abd09454b758e511c03467a76be293abf4d05ca300febbb7383ea1a51a9bbf43dd0a3ab99ba742cc44b7927bdb8be48867
-
Filesize
5.2MB
MD58056d94475e061c014059eb94e087c82
SHA138f2a35c24c3f40981543b7723642423ae921353
SHA256a03bc2cd2a08cf67af0b648a19cc507468aac94b5facac85a101963a9fd868fc
SHA5126caa01c1fc947c71ef7f5360ce3b418e9db759c891b7b1eaba64b9013164d8da5b7f37c8956dce4ac7edc146fc54569daa5558ed9c0560ecb065cbd284a06c28
-
Filesize
5.2MB
MD57f919ee613d7475b8b64438a4e29941b
SHA150b14e7502b440e9bc683a8fa4eab0c8775cb9cb
SHA2567ea052b3945a5a145242574649f77aea61d50f64f3c7283d87eb033fa7a3dc26
SHA5123dfa75e951e4e3642bdcdc23e612ed85153ea5cb132b8fa0683b85c8d31d353c7c917655b9d24785ce322de927cc3910e94d7db9c48ac0eb03e8acf0dedcc90f
-
Filesize
5.2MB
MD541b4d801de5cf2c48b5129daa656109b
SHA10d85dc975e0962c61a243cba5d165904ca48b55e
SHA256622a1a8e26aeb5db2e6da944a5ba690b2abef05d4f52fec0665e2dea10c803f3
SHA512f73dc0e92af48956cef9c92ddf1774b2241399db470e89da9447035fd45c131c9b41b71a7b16ca6174b5ee2a8357f9b397dae9160d58d73e55c71382ac986ff0
-
Filesize
5.2MB
MD5f799a05939a0f1ba563f8923d950fa95
SHA1c7f5b5015d331ebde90a274d2d9c484caad4518a
SHA25613463d9faf55fd99229d6b984ad3b0543541649e4ee450ebd4333f004f0d6a91
SHA512352fc0f5a57b006303d489bcad88df0e6c77a9611adc2c0f8b27d87886c4f76aad3e47f8b3fb883f735dcde76d73f2731c986525b72461fc3f8f5004ec290304
-
Filesize
5.2MB
MD5936727cb9f55aa4ac2354e39ec415909
SHA130ce3a0a574273d882538447511fcaddc439e9e9
SHA2564b218417a3f765a6c27c4298b3d815411dce699740f2d0e5c74f4c75a2e99589
SHA512ab0b69924adc9d772d5f92b680f477e8d9b56e6a1153cc8d0c191dfac1cc670756ac0c1bfe9878f1c1b94b6058ab8de358c43fdff9ff698a3bdb4f91fcc4247e
-
Filesize
5.2MB
MD57c12b59da5e8b6495c0d23785c9f8947
SHA14aae7ee91d5cbe0ecdc0731f3fbdb1d7b2631bde
SHA256c9cfe424db34cbda0c878393ba95c5f64df329d915267f329af2b1b5d54fcd1a
SHA512db785025531fe4a5691e4eaff8deaebe33b0010b42142363dd6dec6ee1affd7a6ccede97859a1790ba8eb944be8199004972943ecdca7727a49aeee49764ac4b
-
Filesize
5.2MB
MD55dd2e5afc89274a8bd8bc0cb796f3497
SHA1329b64ebcd2e9583eeb1c6c53fe3e6c234c2ca37
SHA256c306725ff5c58365a67eb5f415bf6112b2dfefa7b9ef539675ac5ee0f51b91d9
SHA512e4f01c799e2ce3382d315b65f9f5be906dc11c547410ed9629f0be3ac3a203a856dba8f3b1b4ebfaa814811080bbe38ba7def494fe6c8f1930794066075d5bac
-
Filesize
5.2MB
MD50348c52e0f676beaad96fd1d6b1666a7
SHA120eb8e3d762afde02626cb0e238744b432abc498
SHA25619b4aee61da09e7d78fd038dc30846d5acd4696392cec122acac7caba51b1715
SHA512aa6f4f8883b4840c0e39340ea22124efdea7c48759c95cbcd43f95cab9a7bacf57f977fd7496cc61cb827580ae59e2543bb811b5632905d8057096752e067a75
-
Filesize
5.2MB
MD5cc169d47f918db5bf14800c3ce7d2188
SHA168951e16a372eed198db98ddecb91b325045381f
SHA256a72482da985612f8c277cc610593e6d331e827cee975d229e9703c75c2236174
SHA5122fc35e2af9892fc44e544b98e68a93cc69c5fd7137abcd63b2fa181e74ad79860a370c0dcc5a535463bcf86f96f28c869082ab8a5ea000adc63d95e233f05989
-
Filesize
5.2MB
MD5926533533268de58fc94fa195470df8a
SHA1dc2e8a7e9c79bf7e22cf8ae41a150ceab3aa7c29
SHA2564b4f363da171d7d9e72061fc2caca1e4ed26fb1613e1f382ca0b379b4c57c027
SHA5121b76aab59e00cc89a866acd4f92e146736fdcb38c997fb988c21f1c482c017606a668b95aa418ed179bee41ae24576f73d5b032c4b0d75c22a65472b2db5a9d7
-
Filesize
5.2MB
MD5e50d50909525df6b8d2cb50480795b62
SHA1a9a6ca6f1ec010a70d9b5367abfecd0791474601
SHA256b2be468753fa8df6738804ea425a58ae1a6bb5096967ca80cbdf3f52c7d65467
SHA51246f9650de6d7fd7825a2778e0fd7e94bc2a133cec90a0c0cb6fd503f05b564f99d2dc8c69683910eca1a4bce90f9085732ddf432787e885a4216aff8840b3d31
-
Filesize
5.2MB
MD58ab23149f93f2ec9948618eb2a06be9c
SHA1d00a7568063ccac305d2b5420380d43a2527a57b
SHA256f4596528e28620924989109fe23fd3c10df122ee437c01a1683a66925daa84fe
SHA512b448bc6082f4a53015dca585ea92d2ccbca4d6daf16fa113159e035d71901e83b437c0e9bdbfcbae71fefe07619ce63c7c2a90596fd29509e14cbd16681e1d63
-
Filesize
5.2MB
MD58fe88742396a5a9328413406d6236e07
SHA10691c7a5ceb44fc5e968aeb31a55ece38a1dbac0
SHA2566af52a0656f33b018f1b3453f56009d60a00c3e92548ac2c02923f01af7b69f0
SHA51284d63fa8ac4d98308b5580c773757fd1c8aaa5d8e67fb6d0ee793efef7d0195758d1f8097ed3e5ac0648afb122356f55a42cfe93163a4cb01a21c0a512efcbc5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB