Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-01-2025 20:52
General
-
Target
2025-01-21_80dc166c47e692c88af81de096cc9224_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
80dc166c47e692c88af81de096cc9224
-
SHA1
3ef96a0f27a18f3693937f97cbaf180b60a05f1b
-
SHA256
13c4ac1dc16ede3e87d5682b1e1c2189e3c3657382855af323357f2ed13afcd8
-
SHA512
71974f472f370cca18209e28a425ba6afdaf25322e33fa8fc062a7b4196161eaec05717691c1d53e565bd759e2789435184e87fe6acdf80e649272f192678e1a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lU9
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_80dc166c47e692c88af81de096cc9224_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_80dc166c47e692c88af81de096cc9224_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VpBzyQP.exeC:\Windows\System\VpBzyQP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlbAgsS.exeC:\Windows\System\TlbAgsS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IjqYJwK.exeC:\Windows\System\IjqYJwK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lnYhHoF.exeC:\Windows\System\lnYhHoF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BBFavUR.exeC:\Windows\System\BBFavUR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hvKTVJt.exeC:\Windows\System\hvKTVJt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DPERuFr.exeC:\Windows\System\DPERuFr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VFsZHHp.exeC:\Windows\System\VFsZHHp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fEuPccC.exeC:\Windows\System\fEuPccC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KFbQarM.exeC:\Windows\System\KFbQarM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LssWyvm.exeC:\Windows\System\LssWyvm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aJcIQDD.exeC:\Windows\System\aJcIQDD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uGyKVWk.exeC:\Windows\System\uGyKVWk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rIIJhGj.exeC:\Windows\System\rIIJhGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dHGHPBM.exeC:\Windows\System\dHGHPBM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XkryvGU.exeC:\Windows\System\XkryvGU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfBMWux.exeC:\Windows\System\qfBMWux.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BcCAofk.exeC:\Windows\System\BcCAofk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nPjztdz.exeC:\Windows\System\nPjztdz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZPqHsOQ.exeC:\Windows\System\ZPqHsOQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oNeJvxg.exeC:\Windows\System\oNeJvxg.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD502481da19b03ddf1ca5d0083b663e669
SHA1aea43e8ef2a7c5e08a30a5875262696b96ee4431
SHA2566c34e74e6a9246462f7a2a9107438b7f04af8129b8946f908be354085952e6f8
SHA512b339b9f3f95cb700e9f5d1430d65e4e7584253f5810d80069d7e78e26b370db423fe69c1eaf069d0c8f1e5d64b6567e0de1f087ea13394d6fad41db7f6850595
-
Filesize
5.2MB
MD55b3f5d5217005398e58c1cafa4c761ba
SHA1783a53fbe0627ae89b22137404a6bf30f683fbbd
SHA256a1c35e6f5934281d34785c167f4944a36808d64d4906e3b40675fecd6f9b9a4f
SHA5123e68e7ce0a8b8a33cc05460f3ec8812f68b67ab5702a0ae72468e07d390f83d5856eef299a326af4dbda7dee7d952fb8eeb7dc8e88a5c7dc906b38ce58029ee3
-
Filesize
5.2MB
MD51edd828fd868f73a16a5bd15f9aa477a
SHA1b66faf5eab563951f7de8842ca9951dc595d4b36
SHA256794f9ca8a5d143ff4a2bbf90de0e27b1cf8c6f85ce8ce1b9b7c69ccf71f4c77c
SHA512e07f5b435ea0d203278dca21fb905be02b51b1f4e857362f74e322a463c5a47c8c4f7016522026a2dccdb77043fb2f61024a8deb30ea008e6c286c39c9427e47
-
Filesize
5.2MB
MD5ead31b5c9606a9177825c152afa9a661
SHA1fef5939070ee43976243348eeb27b20e5da5c1ce
SHA256ab44897f1f5d014262184a37a068321f7364c64ad63b35d0bd89ded7e17ef041
SHA5124340f71e4f59e5db9f5a76b5f8a295fcf502e4b53a10cbc2da3534ec8ebe3a00c9c2197b73fd792383ede33942d63aeb4d70b8009813a5a6e0a5a270c9ae76ac
-
Filesize
5.2MB
MD56210ae0a3a9dfafa516b90a4ccd30a7f
SHA14069577b3ae7c4dbe0420a143280021151dd18b4
SHA256876c14d7cf78732ca43b1f264dd3c8f04651f1540dcbe076a42d6b961b4dcdc4
SHA512621cd695ebdfe4e52a187ba32b52e75b39eb79033dc8658eab9d5cf8b38d244b589ee899d8e8652b326aceed80751d334583bb7869a2a7e72d095564966f38b1
-
Filesize
5.2MB
MD50bb7ae474a1599700f42d83f528c8929
SHA12ba0d9003a4522704ee2c9486c907ccecf95de24
SHA256c40c84465f8f21d6feb5768f09a34f3fe79dfcdf0ebf368dd649b0c2a75e8cf4
SHA512e5554c4d9693759dbb6c8fced326e6011b9d511fffd7a30417fb829eff323201b4917914826b47168bfaaac8540f45774197ca20af6e140a21f86e1cda354877
-
Filesize
5.2MB
MD5028923db59ef72182f004658c04deab0
SHA10501f75120e82eb42cadb41c78aafd30b449fac5
SHA2569a226943b9e17c4e6d4bb770a0e268fb13d2e07fa6f13ae0ba0f9e15028d2395
SHA512c3b6b4d92b04b458e40906d2078f39a8679074d72bd8fb9d0b9923cedc7cbd0ceb656b9d49e3822c9e7c50edd1a784467a492052e0e554e97c653f713153ebd3
-
Filesize
5.2MB
MD582dfa60ebe7fc21c80512fbdc4aecdd0
SHA12eb7a53a76d0b65d1fd9641e5dbfe1f59c2d670e
SHA2560289b5b94765ce39be7ec60ae6f2b7aea29e1921b7e295642401fafa3a157198
SHA512e7660d5b984d85822640b6b062db66358b2de3279a3a630801cef4c83f4715ebc3e9e3afc5f03ffc8ece8087d64b5f9084b462de17db0ee71ad70ad9ad81d7d5
-
Filesize
5.2MB
MD51f450d38544573a0c1b632a3ee044a66
SHA1f197ee207ef4e747bcc3de34ca23df3773892c6d
SHA256925e920d42f359bb80d68f2122b78a4857a921fe058dc411c76d3b74e768ac43
SHA512727c62ed7833d0cfbdf200540bb7c36446e64040506b9f147d28bee65d7fa028f3bbea37f310f5a2225410b2b8b5386b2b96d8bf43c8d7683e42d2bdcc659c08
-
Filesize
5.2MB
MD51f0474a30d5da6f2d874841db957dd34
SHA1693844919bc2e4fec6dfef342d00471a71861ed2
SHA256786770092cac0418347f1b71819de912260ed7e6ed2a0660fc69d4f85fea1dcf
SHA5120c06c5ee981022911a2abaf3991fa54f5b6dc17cf916fac72998246ffd758c8d2d6aa04880832fde8bf29ce544930694f6df3b2587fcf66fafdf2159b0c3a697
-
Filesize
5.2MB
MD544d19ace7981710cb54e7e37e704d018
SHA177478c7055e539aea5e9a1ccdd75f175dd758893
SHA256b7eb6d3c1e30dfefe880f450f6993c6ff3aa6af7702d95026f174d4f1d4d19e8
SHA512ad8358de21da2a7eb7711ababad77e2361dd06d28f391a3d5450813c55f7c77fd39006f11484309eaa15b49f42c3c74bd5f23d664c1d5631555393e5f79374f4
-
Filesize
5.2MB
MD5519234a6dcd0cd119f8006ce8c82981d
SHA1d2db6987cce409063764c79d18afa0fb925a5dae
SHA256653b7f0f7233b9a4bfa1f193efaebadd42c6b104ccff3236192979745ce8a07f
SHA512c406ed374a0ac13ef27170099dc5ecb014cc810efded3500f7cee045d086d2ecd97baac053b3c0dfb5fd884ffd2982529ad9a2f54f66a6a250b94f9c62382494
-
Filesize
5.2MB
MD52a33ff9a53a1a3cd97fc8db819299bec
SHA193ab9fdbc6eedc194d9f6f77772d3e0e04447a15
SHA256fd376c1778c8f027e7532422e32e9a92872ef52a9fcf8913fdd72362ec182664
SHA51275b4d149dcae8cfdb5c45b6bcaf2b1ccc578cae3e33e9af7eb8453d9da3775a2ff725dcb9009b2c48c28ac625f78898536339e62fcce0f866b51dd7128fafea1
-
Filesize
5.2MB
MD58209f6f11eaedd2d5aa9b4c3870d4ae5
SHA11fc205b7a69ea051519c599931dc78ff9683953a
SHA2569bcbfd2e506b6252484327b4bf53a6bcfbab36543d33d15776984454268c41a7
SHA512b9b7a3710c07428a5be815354e872a9459a9233dd8fbbab2b45b2eba11e7e77a21ed9b8ddc12aaf074cc4bb76aa576f04098b4f733876fec6586c09d863ba612
-
Filesize
5.2MB
MD54aad7c7fb412ab5a0bbbd0c16da11754
SHA1c7d096270d750fde7981c2b1aaf249c0ef529aaf
SHA25659abcf83102500a5b9b208f88f55512b5a9f5eb8e47f2941a418e493f18ab78c
SHA51283e0eee036aec850ea6c2123bb1b0e3ecebdbd7d67c37f144af5c081d9c2425b840febc3900e0a10ee2c46325cec9257cb0e5f0a56d547d2dd8da266ab7f7aae
-
Filesize
5.2MB
MD5130c792409ae3049f5596dd7e0f08e8b
SHA16e9eac418de3367aaed991a88d9764cc7aaf667f
SHA2563ee63b66b8811eec47d10c72c2ef08261dab0690e45a24d935db9cdae9116cba
SHA512fc822e77e364474be0f01943beceb64c050a7c69d8f76539b5c07eb80fbf8799898638e6c638f490f7063460cace93c43918b218ce44a01783864e641ad935c6
-
Filesize
5.2MB
MD5b3ce25950201f385d52b277a0480e760
SHA1dc120015a8149af7394493ed924218a9cfa26782
SHA2564d053cfc80de5d49ad94678b8dcbce5f09e63989b657346ac7f5c7d90121a5b5
SHA51281f30ac2e47f9d62a5955705bfd9349ccdfc1fd9c88ac0c25ab49d7840c1aaa98e588a855825dfa7b095cd478080786d9ade830b788ab0e91c475360410def57
-
Filesize
5.2MB
MD572f24522bf304a85bc7b87fed26f6423
SHA1026462a35c3e9f8644ada8a64776e808e117e7e5
SHA256ed1ffd4c8e83ee447d19ae10c2b6dad8449a821ebda80a8d3ec6a902b4c931c5
SHA5128cecb76138094ec39036f0301e27395bab159c1524cb119859a805fa6c25ed73c0ec0867e61adb28c0390b541f6963c90fda1274784454217d2f28963c62fba8
-
Filesize
5.2MB
MD50af20e3da8f81022d3c2b73bc4f37817
SHA13c91a7c7c170ed1fcb0faddba7673224e42678db
SHA2560f3636231d5c1bb4b243e04ecfd35731927000cbae781845c61403d896c27724
SHA512f8c003ad2d14d227db396a68ab55308c41ad1b108c73bd92045a2388415ceede2c18879843b91a5e02fac8d43aff11fee44c65de4add87b01ba675a1f0162465
-
Filesize
5.2MB
MD54c40744233d01e745a6a1e82fbd6866b
SHA115367d8b9cfb527186ee96d9ae142d333a93f700
SHA256f56f558b9eb752d56d865c9855c189d7fe60ddd64a6fc9ac95f79fe70c1e3f4c
SHA512be58e7219e24464d5fdb4b43d80a75e850fb6d084627ac0df387573f07647e70d6a0870bc46284b3462c918491f104fd01c2cd58e8b096493782340e0db70ce8
-
Filesize
5.2MB
MD5f1d3961cc691cf04ce357402e24b04c8
SHA122a146b7159ef050fd381254524057c1b1e2ac6c
SHA2563dd90d36d6012d22b8f9eb829e165b825c1871f4873ad480b388afe2d3427183
SHA512bad8375497546af7e6d7c0a4dcf5ea125081736c679c21871a995ca3b765a25d73056e3bd66c1a0cdd8217d54eaaae25d8da84cfe1ec6b97c6e5c569982cf1e3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB