Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/01/2025, 20:52
General
-
Target
2025-01-21_80dc166c47e692c88af81de096cc9224_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
80dc166c47e692c88af81de096cc9224
-
SHA1
3ef96a0f27a18f3693937f97cbaf180b60a05f1b
-
SHA256
13c4ac1dc16ede3e87d5682b1e1c2189e3c3657382855af323357f2ed13afcd8
-
SHA512
71974f472f370cca18209e28a425ba6afdaf25322e33fa8fc062a7b4196161eaec05717691c1d53e565bd759e2789435184e87fe6acdf80e649272f192678e1a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lU9
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 36 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_80dc166c47e692c88af81de096cc9224_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_80dc166c47e692c88af81de096cc9224_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RFYLfpe.exeC:\Windows\System\RFYLfpe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GCiBeJc.exeC:\Windows\System\GCiBeJc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZrPtAlH.exeC:\Windows\System\ZrPtAlH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LfuWmNU.exeC:\Windows\System\LfuWmNU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\laQfZvO.exeC:\Windows\System\laQfZvO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fmgfHcg.exeC:\Windows\System\fmgfHcg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tmHhCPq.exeC:\Windows\System\tmHhCPq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DqGdKFL.exeC:\Windows\System\DqGdKFL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dTCAwCA.exeC:\Windows\System\dTCAwCA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfKIRnj.exeC:\Windows\System\qfKIRnj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pgMxLAr.exeC:\Windows\System\pgMxLAr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ajgRkUV.exeC:\Windows\System\ajgRkUV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oxiysRq.exeC:\Windows\System\oxiysRq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PDvebbV.exeC:\Windows\System\PDvebbV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ebeKUud.exeC:\Windows\System\ebeKUud.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OELtgXR.exeC:\Windows\System\OELtgXR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZfvdAYS.exeC:\Windows\System\ZfvdAYS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EgYAgOe.exeC:\Windows\System\EgYAgOe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CqjmCKi.exeC:\Windows\System\CqjmCKi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SeJewSL.exeC:\Windows\System\SeJewSL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cUWunmI.exeC:\Windows\System\cUWunmI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54f6638f8164edd694733c8f1e84b75c1
SHA1346dc78b0f81e5ac9fde3e9ead05ae7ed33ee094
SHA256fc628f2e03655359ed822747c274abb3c1827f5de23f7aa39b115b07d945f678
SHA51288629b5d144e4a7167a4923171874a20c04e6343c077a1762619ae1850da613fe6ae0b1f684447c2d01ba9a25de71089147997edeebc9b46d5ca83d1535f9bce
-
Filesize
5.2MB
MD55a20f62214b59a72b1497a493a5e199f
SHA12c725b982c1ed80304b93e45e359c9534e7ccae1
SHA2567cfc7908fe29df176435e163ae49dfe3d56c1cbb557a4f9a5c30693fdcd24854
SHA5120a9f7939fd24449dbbb2e78773eec7534418dcd54636f035445ec1c6dbe6aadb03d4c74f58f078ec43e19426cce33ac8dc6046c000e65c901356e766daebd95e
-
Filesize
5.2MB
MD512c044a4cd223bba2a03f6f3e1f4192d
SHA1e4703493e1d11b5434d4da413708f60454944af6
SHA2567141eb468a57ec593772726f2870a219f0937fab972037f394445b1d4e8e84b2
SHA512cf19f6a1f823eea3da58d477a8e2f020c40f865795bea15364c371e945de00f80159e879485cc6c2599ce2ab9b4c2675e7c37ef662bbdb386c1a0b71ed61faf5
-
Filesize
5.2MB
MD55b3cc63cb7a952ec07ee50ef28fe2508
SHA1c810473d91b2a33b64670881be9096710a94b4b9
SHA25610f402b098a6e8560eafa6d0b6870d314c483b8d6b3806594f552c77c5ac3018
SHA512fe80e3d524e8945fe6d06d0cc466b9a0e310a6010f382ea72c925712e484363fc476d8456afea358be885c46c718b91cfc6c1762e0e099cdd53cfbcf3e8303fa
-
Filesize
5.2MB
MD5a28d91f46c30e0843a697e98327e7067
SHA10d104023d6a4228d579e4cb7abc6f96f6da9b6b4
SHA256dbf3a46a7e4cb41849978ad53c82a673f8ead9f8c5a7f9b73aa44b5f5ec2c102
SHA512a8403f9a1700d8849b46565d23cd0d4f93152734c07e5b5eb214642ef6c8bb2e96b0809481116e38b238a98505a2ec94da0a62de8b30140f7841185df8d1624e
-
Filesize
5.2MB
MD529f9692799321c32a7a4fc4baeb174eb
SHA1dcfaefee7e04171aeb7a0bbe2af0809bd1a3eb84
SHA256cb93228d2dd3fffb7c7ec026499b46deee753f6b04a9cea6c173808ca39584c6
SHA512096957d987905af531508b151045ba7af3ab809f34d846c1825c2be1032469060b979a83ef7a60af3202d3848168d36f594f420c1b71a55887734368c2330a8c
-
Filesize
5.2MB
MD5ce7e9e921953ce1eb3fc87b8c41473aa
SHA18a316be3682b92c30ca224fe0a87aefffc76d6b4
SHA256e8dd50abf83c9cae2ac266d980bb6fa849583e3871de8b5c0f6623dd3bfea101
SHA5125f59f1fd38df078db0ab369fbcf3765319a9f6c97fe98cd757fbd7a45272d0cf592da448fbb1f1af891ff434227e481a744a3a240edcddd491b35105016bb834
-
Filesize
5.2MB
MD5e2f2f9a2851554a80e30e106321560ae
SHA1803f2c8de1af72b0f33859802de01dacfcd8b5b9
SHA2569a97557944835a4a348ddb960bb1467087cd1d4414b7e233e082eb4d661d4076
SHA5121d28f9628913010320605fc9f63e812d7572617318ae76a95440561c1b6a92e4cd6f193718676324e1c1e2ca3f3a757af1ab3fc15777e1132a5fac7cb0c31af5
-
Filesize
5.2MB
MD5129220dfcd4f7fc97b8307f308920f84
SHA176bd46e4a110c87c5c247e02ee3170bdf0b815cb
SHA25686e60a64f563f0e9c14f63d7adbefc9a7d5ec2c09688520071c3a84ef241954c
SHA512764725d7077271745618ed63a2b8a7c13137c9954723b3ca7485f90c6742bec624174c2964aae8d17c38e91f8c794374cce42bdb0278f97fda9e4fcd6d9407b1
-
Filesize
5.2MB
MD5347f5ead58abde755b7295cbfbff1246
SHA1db38d2071cd6fd1eb534567a3ee85b08a7b6538d
SHA256641beebab9b4e42084aadeffd026e6c66fcd06406aa4d6050021509af7bc8c49
SHA5127386e8c4aef54a20957f7f09476be6b77b86159ed3098308cd7866284b845765c380e1147280a86f55b0928a70a5888a2b6a114d06105888196797f34e6abe62
-
Filesize
5.2MB
MD5d37f728cb718a94a588647887af5bf96
SHA10b426bc2b6f08846830a34b6fde0c5283cf76a78
SHA256ffa9ff19ea38ecfc41254c37f2f111552dbec6910bf9115579d26d47a12f8375
SHA5129207d9b6e494c272e331f90288f7e7b8e8c9fae12df4086193ba7ceb4f43098c5540a640a97c3443a77492049c28d2d507e71932a43cd7d51e8dbf6b013429bf
-
Filesize
5.2MB
MD54ed3ab52972a2dab1384ff2e56c4a43a
SHA1ff4436bb7e6a64d8a88ca972b9d957649a4389eb
SHA25658995efc806929b3a7942a055a9cba48213eaf2541bea438e233037186eb1438
SHA5127fbdd7cbf0a57b5eee3c38691ab9568e6aac93fff24264dc20ef146ed915278b30f4cf94c757785c91981c01b6c3cfc3b3a5267bdeabf70ab8b065e95d6c5e68
-
Filesize
5.2MB
MD5cbcd2bbbe8383702dba553e7a8b02719
SHA12fdfbaebe5c7e5c127baec96117865d41cd486c3
SHA25686dd979e8cb467fb223763956ecad6c8bea8010a770b6a91c90b386c3c56fd60
SHA5126e9b6accb4b01b6f9c512d57581619fde82a1fd0c3ba160dc8399d30fd95202a9f75e489e4b8f4e66c0ca7970a9c09eb98c76e011a1ce9fd58e415f5cb081a35
-
Filesize
5.2MB
MD595f71b593a125d13dda0256bdbace994
SHA1fc75935f1666368f0572f00508c4ceb092077f5c
SHA256b45aae1e6e4cb404031ee9531a22824f3a30cc0ca21a888be397762744416835
SHA51206f93c37a6075e9960ba3cd3122c5e621669b8a6235984c247f3720b74ac6141918d1025e30e915486675304d0109be03814394b57db84c20d6430202d3d7277
-
Filesize
5.2MB
MD5ad620284fef385332478854507261d8d
SHA1efcf46ef4d8f27eff5c225ecd068c62895b9a431
SHA256c634a02fe938307cbcf9111f0e3277c192b3174bbd511ee2539eca52a7e22947
SHA5123b82c34c836a3a2c8b98fedec7b13ef5f743d63a8cbd065232f0d81a8ec54ac5657945240ca4c7272e7ab64c7d8aa0488a9c3eea97a968988f8d7c57f8d910a2
-
Filesize
5.2MB
MD59051fd1d59e1faaeb31064455eeea00b
SHA133122d9a1d632f1c489cf2d01b407946e303c1f3
SHA256825429c9a21d4e353f6ee20c348e5f765b69341c74894e9cc49708b3493731ba
SHA512a105498df32e22fe92f4f0159f8ace2d48ea2e2003cc6780df4baf10a0bdb70f91df5d4106c17e6075ae1dc73d9c9de20dc6218c3745ae432ec75795642e92ba
-
Filesize
5.2MB
MD55e62bd3aa8bad89452ff668a0ef81992
SHA1b4ad0d9beec159fa38bb84106a0746f6d9043c0c
SHA2563f0d93cd94e4dfda1b56dd12b4309cfeeb7d2a5bf018dd4c26a2abc8bfbe33e7
SHA5126ed2f2b03b5e8565d075568bb17e1483113fb26a4bfe77c3213960fc0311afca78403c2cb7236851d447772a817fa96e3a082f752d5b5577836428108757a837
-
Filesize
5.2MB
MD592c0d120f38ddd0327e49de80ee4d615
SHA1a962819f06dd6f750972132a12698701ec13f335
SHA256905772fae4f9b2c7c78df4e65ebb47bdda645b5838bc5e941d57db3ca4524a91
SHA512ab2e02a6c6aa9fab2b56576005cebee1ce9df4b9c8badd2ba9c4ef75a388ac9ae2a375686cb4cb94793831bae1a8c8f07d0f6b05fe59d83221d601283be68ea6
-
Filesize
5.2MB
MD543b5b0bed3461db2f9f080711aae802c
SHA1570b46a820076e738240f6b688226f5984c8c351
SHA256fd870a6ec5620f1460fc01c2098b3a2a24517868c368767af071f269ec47206c
SHA512673ca963046d2ae89bfecedba0a62aa390d95f928721c804ec9716a73f7d6210f601d97e8a74599751276199893b7696334610839cf1a2c8072a11ae2464e2d1
-
Filesize
5.2MB
MD5fb5d286a52ae3d638fd1af852763fdf3
SHA15910537eed689af8ce6d03402fb98dc7b4250ac8
SHA256e597fcd03e17386a89699d6f9e3f908d4f0e8d75be6f6a4a7d70b22337384804
SHA512f2c1b13ec7f8a67f4547c18e773fbd11982f74c85da63f710f3bebf800b6791629dd84472c61f921326c3b1cfde71596850789c58832bfbe81e79cb1859a2370
-
Filesize
5.2MB
MD5edc1a5ed4d2182c344de7d7f973bac0e
SHA163b3940455fa8fd1cbb3ad3abf89d551f437c2a9
SHA256087afab040edc8a65cd37a0ca2127007ee1f64dc5f19ee909d7d4da2e6eab0a9
SHA512854acb164cace9eaa7ad5066b0daf3d67cf601cb6a72adeb0c2837298c7497a8da6af89d2c7fb238b56060b6b635a6fad219fcc263ade244be2f32ff71e0760e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB