Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-01-2025 04:46
General
-
Target
2025-01-22_ac9b360e1edab1500aa806476fc93115_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ac9b360e1edab1500aa806476fc93115
-
SHA1
437ba6d2e46bfb5b8b62961264b6ae0dca8599b4
-
SHA256
d0f272529021fb3e0a764960ba24d362e87679797be077febaaea6ae88129a23
-
SHA512
0701fffc4bf4afdd96a0e324aae0b05626b7b175d727daa7bb001dee83655e5574176b12c74b43f0b04eb2d729d5d76775dd8a177bc26da439c86caf42a32a91
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibf56utgpPFotBER/mQ32lU4
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-22_ac9b360e1edab1500aa806476fc93115_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-22_ac9b360e1edab1500aa806476fc93115_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LHUQeIq.exeC:\Windows\System\LHUQeIq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FOcXkEN.exeC:\Windows\System\FOcXkEN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\riAoqsl.exeC:\Windows\System\riAoqsl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NlSjibh.exeC:\Windows\System\NlSjibh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tyTiCQx.exeC:\Windows\System\tyTiCQx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hWpkmkq.exeC:\Windows\System\hWpkmkq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RCwxHKp.exeC:\Windows\System\RCwxHKp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CLTKYzK.exeC:\Windows\System\CLTKYzK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EYqZRwA.exeC:\Windows\System\EYqZRwA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tgNrWxC.exeC:\Windows\System\tgNrWxC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IMBYWSK.exeC:\Windows\System\IMBYWSK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nYNJTJz.exeC:\Windows\System\nYNJTJz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ePtMsJy.exeC:\Windows\System\ePtMsJy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EnbeMsW.exeC:\Windows\System\EnbeMsW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jtYyzFl.exeC:\Windows\System\jtYyzFl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xozxiRN.exeC:\Windows\System\xozxiRN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZjygGxJ.exeC:\Windows\System\ZjygGxJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TxXFTgK.exeC:\Windows\System\TxXFTgK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vMMfmux.exeC:\Windows\System\vMMfmux.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xaYAYih.exeC:\Windows\System\xaYAYih.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PtgcJtD.exeC:\Windows\System\PtgcJtD.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53df3dc9f253f8984e927faa23139d0be
SHA155f7c1bdc1db1e89909fa400941ade096e5001b7
SHA256da30d7d14ca63dce4dc92f73b4b5a2997207273f87a7b3e929b5d1d7c23a60ee
SHA512bcc9976e8576b95e937c339314604353e1f3db7b810acf7f7b23fdb00c07b2cf0811b338875e857488fe67e3ae4cc391e4eb9d862cfc569e763b49286e9b7e05
-
Filesize
5.2MB
MD5ce7289cad7b0ec9d805664320be66fee
SHA1abde79df0d2489bb0baceb119b3b7b047423abe6
SHA2560dca2d14deb03350402e56666d80537034ac6441f0f496fc2f80eac3c86ef7fb
SHA512d29f9be5e67effe4ea446284d55d943cd49c515600ea9c870702e12742a6eb08c6bd41d83757586e674ec016b1d8e02fe91e9ae193fcffeb29a62a911b76a9ab
-
Filesize
5.2MB
MD5d712faeb197889d945d83c46733f6544
SHA1fd131dfbe3776c4031bdba0a29b881eebba676ff
SHA256c01ffde694cba96cb645bf5ac8d6806fc6ba0965bbf0ae5c7affaf86a33591a2
SHA5129676e245492a278d600858af0620602ab21957fc3c9c50925b0b10ccbeed04ee89f30c96f1a8a9c883b74b805b56a1d481316b47bcd37aad67d5e258d0184381
-
Filesize
5.2MB
MD568dd6e957db3d3852acdfd8dda68e074
SHA18627984d859ce77f36d8f8288708d79a032ae5eb
SHA256a44b1c825ce7fa13e9b048c05a141bc85a2704b3af794b7581be5d8b2ef61465
SHA51226e61867aaa26b96c1f09db5b2b04ce3aa8f42e180220c23c177635fdc3a220015b0cf7324ddb5a6db3f8b51d832fe64fe5e36eee7fed165d814428782063d14
-
Filesize
5.2MB
MD5bdfce505c070b3741dfad30465e600cd
SHA12d0368adb63d9afe8eaf71dc0c2618dab88bec6b
SHA256857d1b24b13078e9bd2e70e3ea7f6142596d5924829d4210ac574715211855ba
SHA512320b352792a46b3ecfa5579ed053ac68491194ff999c3b9bbc9ff5b3a89e724fced98483a682217bd542eddd173780e3c6c1521bb8531dbe1ba762894b77deda
-
Filesize
5.2MB
MD5886bbea85952fdc1408bf71282c1d664
SHA191ed4b4ab073571351b25686cdb1ae0e735c6a98
SHA2566254250d1677d8f3dc2c6f0185845f56a78271462d2244e578fd95f43e075a54
SHA5125673ef053597999ac4aef0a8dda73e07712f977580dcb896bd4033564606498671714a02ea871b5bbbb4bef98aa0c49e51509a94c4f818f241d5e7021476ac58
-
Filesize
5.2MB
MD557c43ea675c2bdc534909587f0803f72
SHA13cec5ecaee648f5aaab0f0b38de7a12685a414db
SHA2568255b89d6cbf16e1517f6d188572766a75a3ce9306ce7f3fbea426e920b76c64
SHA51272e7f46392f6cae8dcce18ecef087c2969ac3abd73e278dc99f2410db2a1f9e03cff5364bcd438bcb5f3f2d511d8dae69194db89ba0e0f2565f21a47adceac88
-
Filesize
5.2MB
MD50bb445237df4c4e4463cc42c3df9af14
SHA1f9e7223d2f518961384b937f9760fa7aa51ee680
SHA2568bf8dbddc0d348b46a79234d485ce25b9ffd2bc87536dce0530d8e84a8d6122b
SHA5125df927f299b237943bef313b36a764427928ca5169ea30e937bad5ad4ca1bc1fab499f5e62be137c71c2fbacb3fecd3f44590f284de27c3bde8a2ca5b09e9077
-
Filesize
5.2MB
MD52cc154aeac753947865e7f089eddbdc3
SHA119012c260cf00f0ce9df6bdd0699c51b4e268140
SHA25673d312f44d8a250d8553340d8e3d057c9c974d457b099a1b37ef97b7a9358100
SHA512d79837796fe4c8e5605a99a100a57a40067de90cd222bf581a6be0b2210492a630d523d1fb427a3938a81595c551ff5e81091d5e836c9688a8a2eb7fe0f658d5
-
Filesize
5.2MB
MD5ea72ea8220d11063cdc72b29503b517c
SHA1267c184623ba29b86fda6c9e5ddc063cac6c04e3
SHA256b6068779f11ff93e36fdfeba1bfec32bc1c8fcb4cc4231f0940626bfa73cdc03
SHA512c8040d42e73181dea81dcf2485646b1859efd7afb05b740fd4ce6a00bc515ba42876cd2806eb23b6260c8b812cfaa790b3acebdc76e3e8b6d15d1211b914188d
-
Filesize
5.2MB
MD5e6dc32a08f7fd2ad20d2667f2ac49be6
SHA174f6a4e2c8a2326207b5562b5624dbddec456521
SHA2565173121c1cfb4bf83bf0b2d81c721566d74269899f104825cdef4ed5e66956b1
SHA51263cc85121b8914333acb7a4212e835ccde7ddcdac210f3a29cc9dd75e7415991f83ae7f67d5d6a64efc29b4e91b7bc24afa9744d614c50776f0b39e7dac52335
-
Filesize
5.2MB
MD512914025cb208f36260b62f9fd5534ad
SHA1db037f669dd7b0a2dd645c722813a0ada8e83a73
SHA256f9f09f28313c486e66f52e26b3472af46819ada01297868437fc79a14acda1c3
SHA512a0dceb3c4cfa29a4f0678cd77fc9ab63acde566e3992de33c98c138e1cbca531ca2402f5e7dced70ef7e2067625a8f67f575baeff13c76f82e14764f21afa47a
-
Filesize
5.2MB
MD5615cc7a20413cc9679511c21b5281fbe
SHA11fa1d86a655385cb782a65da8ea0980f3595c2de
SHA256a3ad871ef22524120d2812f72650bfd8c4f999b3edc0d314af6e1b7a842b64cd
SHA512ccd8d410fe046b4a63e382d06a57ac914861c6fa0f7a8b1b00bf1a8826906420abde987401df13654a93ae958c610cd26bfb814221ab8a6bcb0d16ba7c50fd7e
-
Filesize
5.2MB
MD5ef40aacc986dd6334cd0cf2f82c1cdf8
SHA10ad90a13bcd9b5a6c5820ee6a6997ff9b33cfb8b
SHA256626e6f304825bf057e4093988f179c12d7af00fe2760295a0345b385dd664312
SHA512a7e422c67386bfa5c68cd03a2481a1769cce1ea80d701d4f44cf3de29f1ac83748bc5af4f0e8ef007c92111ea57887ff7603a7f39d63209daf4f49d35947bedc
-
Filesize
5.2MB
MD55421d4268ff3ca21f5703a36f3455189
SHA17d92f12651846f761b55abf876dbe81c6b83061b
SHA256ca3e1ef9e8df1ad679749ade47ee53752d02f17bc7c53e27f7e89f78502243b4
SHA5121cafe0d045a277c4131051f8131610b5f3aa070b5e72bdb2c3a4e5093576e3ac629c1bb7a198ae078af3ebb4ec774706aaa59e20817a832b9a309c1b2bbd94c8
-
Filesize
5.2MB
MD507b0b20ed137340814544c0f5bf7cf26
SHA15ef9a800a89e58245d9222a32527f13e600490cf
SHA256fb67abf5cdbd0f3abba13c2f36cbeff9ff738755e425459e3aeb0b21f7e563a6
SHA512e323a1ec6a8729f920048980e33fa55a5a1a819447a203e313d121c691cdf4aa75a3c33f4ed911f0afbc7bfe79002696eebe98828314aa0551e75c9d29cdf5ee
-
Filesize
5.2MB
MD54a5988f467d692b783b6c25b35553ac3
SHA17987303cc2319870b290048330b426031baf7f97
SHA25676c6f9b6ae855b0de7f72bd7a82a2aa5b6c359bc9044592ae2fd9a274bb67dee
SHA51236cf0d5a2580bc4e0f078bac6f7dadd5c3ec3eabb3e0357546498fd63fd09721d750014979f09b7838b062877f20db3059f28281526d85f7c244ee784fff8d5b
-
Filesize
5.2MB
MD5839e792e735aab93914d3f1803bb0335
SHA1e7bdeac5ebaa47c93105c153110556111f321417
SHA25611f0ba4bd8663d018b448a232108e9c919e619621c9ca26dbaf02ca2c1aa7ff0
SHA512f119cd2a5da5ce91b7f8a08a9fc96528d219a84047cfed0aac120ab01b896f24a2d28c3713b2e197060ff6a3bafc0e7b7cafaf8db6defc92e7a364974af41197
-
Filesize
5.2MB
MD5557f2ebca3a16c34026a0ad4fde482e5
SHA1fad85f3c01f95d4f8ae7e5342034c7e3e7cc4068
SHA256b22a37254649ebac04a5511337b857bd652d18c2a46d3bcb0b886ea87f4ba808
SHA51262105eb1f326c383a1325e52c05ad8203a941d6d7189a5c5543014d3d9989aa5452e7d6babc044945a638417633118da4e022a62def38f1fc57c3bfc10a9427a
-
Filesize
5.2MB
MD5dbb624961ce6a2aab14b605231e1fbc9
SHA1cdba98a381844306d61f6d767c0d9c3f724b1171
SHA2561827becf4778cf46e49411df1f43bcba757a6bc41aed3d82e7fa7d3104e391e2
SHA5124c8f281e300b5eb0f3e8056af2cf001cbf72682db120ebf7148eb9dc1d3d9256ed392b9e649c2f7a98fdc65c259f2fbc3cbc8f6c314054c5088f0ea53dea9cdc
-
Filesize
5.2MB
MD5ba51f13df1cd6e1a283dc32922ae73da
SHA137754cc1496e6bafc3e464baec3e3e1d943ff9b6
SHA256c85d3cf84ddb47da7bdb534e1d77cec646be8d779346d0c16ad02febc04f58cd
SHA512d42a0463b2f1e9302ce6d000f2e0a74f0155174b9b28cf8d38fb9270f3edb6e6b211493fb136321e6de69a7060fbab67473ca68d83d010193f121335fb532e94
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB