Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-01-2025 04:47
General
-
Target
2025-01-22_aeb744ec607aa7ff2c1221d94746a99a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
aeb744ec607aa7ff2c1221d94746a99a
-
SHA1
659a2df7f7805f19ba5d6be24fe73267a0e7f0bc
-
SHA256
2efd97e745021da0e60a32a9e4712fc134239f7bc9dd7e24194345b62fa20002
-
SHA512
8d4b0697bf0127d9f554db404a98b40f43a27c689d8ba78db9911be4ef81a8070330ecc8597d3a1df37b4a6b3de5d0812e2fc77d4b79fb2272984f00c080e0a4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-22_aeb744ec607aa7ff2c1221d94746a99a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-22_aeb744ec607aa7ff2c1221d94746a99a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vFIuxRy.exeC:\Windows\System\vFIuxRy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nNLdiLZ.exeC:\Windows\System\nNLdiLZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dDedEYN.exeC:\Windows\System\dDedEYN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YgCUSSr.exeC:\Windows\System\YgCUSSr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NLrAEGk.exeC:\Windows\System\NLrAEGk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pXwoBeT.exeC:\Windows\System\pXwoBeT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DUrCyLF.exeC:\Windows\System\DUrCyLF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LgVTlZb.exeC:\Windows\System\LgVTlZb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\USvdEUw.exeC:\Windows\System\USvdEUw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oZAgCdg.exeC:\Windows\System\oZAgCdg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qbrJbPs.exeC:\Windows\System\qbrJbPs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hsdGGaV.exeC:\Windows\System\hsdGGaV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xXEeQjh.exeC:\Windows\System\xXEeQjh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cZsqtbV.exeC:\Windows\System\cZsqtbV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MEbXFYX.exeC:\Windows\System\MEbXFYX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KPOWGBL.exeC:\Windows\System\KPOWGBL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qxBLLpO.exeC:\Windows\System\qxBLLpO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XlKpBYu.exeC:\Windows\System\XlKpBYu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QMGpiOG.exeC:\Windows\System\QMGpiOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlfTuIX.exeC:\Windows\System\TlfTuIX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GtREUlz.exeC:\Windows\System\GtREUlz.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5fa89ae50dc29bd407217717e53680099
SHA1d0a29e32cea26fa46677ea37a106b42e739c5773
SHA256af3dd5f11075757cc46127e5ea019fdf49259610cdc9197f9dab75b5c96487da
SHA512e5c99d4b6da5beab9dea1be4c14a971c69631029de6d24f19a03446f13024794207ba9cd970d2ee31c7e953e8237915e4775acca66f9546f6c79fb774d63fffd
-
Filesize
5.2MB
MD5ed7f490b716b8d0cd6f510c00aa84567
SHA1ae2c57ea0cac0e0ab09d2762c0ce661bbee5e800
SHA256179c3f307a32d956375c06050228a029ea331105042df719c1673cb96c6ddc6d
SHA512d829ea90c16bd1145cb9bf8db29ec037cf105a3c1cf13e1d82d7c28944dfb571d0fa4c7ada7e9557d5ee04fc749feee448ee4b117db06c9ab7f0e539ae2fa64f
-
Filesize
5.2MB
MD556fd8681837bfebf3cf2d68caf11e292
SHA183bd0a0ffa8cf82a2cfd38dc29cd3fd29d1571f0
SHA25604c6b1cb3ba90664baeb27f001ecd45ad9aa2b0ae4f59883853dc2ce9584bc7c
SHA5123f9434969eb34ba370c378eb3925b8fc65632be4eca2724a86f89f1370f37a0f28be11a32cc3b075904d8e2bcde7ff048e4ea1ce205aa6868d9d6306d599ec5d
-
Filesize
5.2MB
MD57be92e42c2877156b806987b6b0b9782
SHA107a6e05e22be4624662973dd94c72002e017cbcd
SHA25664a197139e42f32fdbbc40889a9c17c00e7bad88681197be3b54ef5bd162242d
SHA512b9b28ba0e489fe33e4c16ef44cfc0c06ce51ed1b8bdf76d4ac4a041f29e76bd77d35a47e19222fb2c8f82648172850ce1eccd5affbfc7c100989809636642393
-
Filesize
5.2MB
MD532a77cb314a05e5e897995ccf029f0fe
SHA1cb521b880a97a1d043723bb2358c5645d3980fe4
SHA256ad0d598dfe01d9e58170377fa191e24e5b2236a2d7432731f025f28b29b65d97
SHA512acadb610969ae11cea1a888ce640e5da641b19993a1160c04875be304eb39cb012b4a2302e3f9fcff7e72472174e03f9ce248c83dd2d7ea03454a865e55a63da
-
Filesize
5.2MB
MD561b62fae718e42323a0e240feee3e139
SHA1e5205f97324d6324ef0cfa9cb4f2412fdcc4fb3d
SHA25666388af8fed75d9ec1ed4dceb298d7f403d45298b1b092197e7166bef8a01536
SHA5125ef16462047f85123da0f12cdbac69ee3733b8a6f2ee776f7cf83ab07609176b2e3083aef8dcb004a21fcd28c922128eeb393b91ad8a02f32b0a19b10ecc517b
-
Filesize
5.2MB
MD5cdb751c7104be1474135915ea0c1b7e4
SHA197687c4edd09d2cde2ad3a3b1a9f1706f3c5e608
SHA2560f83a8116c81a1af58dd78faaa44d1cb096f9e9118ec77f3a5ea679f645e9887
SHA512ed63ca79f5ac2356e43f20bff59a5f23c6b945147105e76ec120ce17075333061b4cbfd219156d96f00511e08ba26ad537172ce26537ec86167a6ce7134a38d9
-
Filesize
5.2MB
MD5e6296b166304555b3a57f60a423193db
SHA1f851d9aaa034692264326455f311dbddebde4abf
SHA256d9117e2416ed489c55ed7ed0ecc5ce802631d8835847828eca325c63287386e5
SHA512ce07d1d93686b3a74ab683b12e0a02b1d36c6a79bf2a15e006165fae1781cc3541611305b85d7c0acfccbdbe765aaa23a6a6de0716ec2eca73a8778b41fa81c6
-
Filesize
5.2MB
MD5878a862a3b01b0b5814407a63007f40f
SHA1817626dc6e040a5ec06d1ec0fbf3d3b9549c7bae
SHA256efe6127cf3fba86242ec16de7a6ef5f1072df3184731d48b7ccf93be9b4959c5
SHA51286da1045cdf9d8d6f1ccf338a45dc23c46fc9cbdf093d024940896b6bcef09b017380f9dfb652e440ee2010739eddf5ceacc79aff98d91018f926a7310cf17a8
-
Filesize
5.2MB
MD5bda28de04b2aa601dacfabcd33182cc2
SHA1652daeed08827865f3d13c0e38fd8afff36beaa1
SHA256019523bc181ab47be237b3ff951b77fcdd7766aa2aae870bfe0ba6dcff47d928
SHA512fe9265f51293c21ded66001a5c4c4181d46900c3cb10ba129dfdca9b01047b630f01d3ea5b9515622ee97d728453d64e45ae5528b7f583a3281f12d2e6955b28
-
Filesize
5.2MB
MD5f38330fda25b16d17a748fb239ff5d79
SHA18cc1407a396dd603e4e775de072c6215bfd9d0b2
SHA2568978b8aad765f22e852a7a6bef40ef604ae2cf60b2168bf10ab192c93bbb9142
SHA512a56555a2e508dfcf117f5e203eab6a303ef8b97555a89d2a1b50e5df401acb719efd81ac0b8f9f2897243debb757a1b9d63d64c8eacdf801b33b00921965e75e
-
Filesize
5.2MB
MD54a3cdb98a7e70a671dad4c708e750914
SHA18ca128e463fc6a266e7d11236d38770e99afb628
SHA256776b3b1de97a9fbef93cc8339ab69b28926ca7ca8743d13f05afce39425d3f8a
SHA5127e139eb18a46e22d39c406a1c65ac1615b460c2790effb2f4b6c767a405a8a5ad84eaadfca5f82b042544b28e5f6a461a26499f96bd75303c5f6baf7ecc46c49
-
Filesize
5.2MB
MD5a16bc7d672e38187a011ade2ce1ebb31
SHA1b6c04001d45bc4b3e90c6ad8a08b4ddd8b78a93b
SHA256f93a869172ff358b0fa8c56620c011be33c4fd07bee07c4deaf5d2ec77dbdaec
SHA512ea290f567016227088ef3b5fe6244ca109293fc140a3706a383c2092405fd6da3f53692385e7d7dbec1ed70a545ea0c98a6d8c64efee15801a7b41fbd0a87a77
-
Filesize
5.2MB
MD5a4381cf09de6903b7a75bbecbf22cf8c
SHA1276c1cef87164f981286d5cce3624e3a75ebecd3
SHA2565845a7c81fa1fc674bf0babc8aa8fcd75e1cf2b466fcc4a4ed033193bad55a57
SHA51274e137c6372c733fb505f955918c5b5e5a06601e19eeb3a9ea8102dceafca8a29d4bed4bb25ef975563149393dd2d213a44b4af4e54ad88030794c35f97f8168
-
Filesize
5.2MB
MD5bd5267e89f03266122690d23f090ceff
SHA1effb50edc725268f68ffe9f3d7323c173c0e9f89
SHA256058994ccf213d176264e8c013dbf3a795a26f9c491a4bd625d06a113061a842b
SHA512b18aa14b21cea56bc35ca1af4560dcf5f72021ee64d4172f3949ce74097c19bf1b3dedd0fa63213185065965c9d50c39d402dec4cb3f5d583e983b4007b8a7a6
-
Filesize
5.2MB
MD54776e39c334c616131e8118a22c968ec
SHA1742bb0f90394860ca4604acb301ab67a7dbff347
SHA25685aea1646fe1dbc0753606591786c06e2616e3722c728111558c2508a2e2af2e
SHA512e927b1617982a15aa7f64956ca2bc43165af751986ea52f5f0b0ed82e85cee6d016542523dcdbd19100aec02237b8f7af3e6fedc9f89b0ea2fbd8b84851e1491
-
Filesize
5.2MB
MD588eda34d791497ca4c44cb3ef9d1d18a
SHA127421343f318a91cc1f0e4bbbaccdecdf2eab089
SHA256cf27b816f39317882d66ffdba9ef30a66ecada9619442e0b804e3652771a46d1
SHA5120ae0cdf508f5dfe1d49ad3ffa591a7d3a0a269a96ff49b5bb0e5084ed948b2be16d0902be3af343c1b49cdb5c6af022cd54be97faee0c9230e6f9a68d359a840
-
Filesize
5.2MB
MD5c0612072f230cff0f9c398e141fbd6be
SHA16ec272835fb82c52cf9511a8f776777d56a7a46d
SHA256c60a6b62c029531130acabec43367de895c94c6968d4be9befc5dea1b430cc4e
SHA512279eff9d31e1e053d1231aae3383d67d303e1536a07c021e8698c9d8316e2361b20e2ab5d280bcbfbeeeca51016733acecc73efdaee23f5e0f8764c82602180e
-
Filesize
5.2MB
MD5ace884fb2e6cd22762edd584f240832c
SHA17915963872623b52461bc062eeb89efb36129702
SHA25620660b135e448436176629103f990f77eea79de4327d6b8012231380852f0dce
SHA5124e532d9cb95e6346d365dee3c8779005e0cadf3e2f55c85543715d594a49e1fadccd39e8e0bde08190281082b0bf51845cb391175f74f42bc1f9a184b2ba9f13
-
Filesize
5.2MB
MD5418ef1295cffcc21e0a9863839e7ae96
SHA1c98d9736caef49e5a3a9b355cd95d2276902667f
SHA256b4af7e313af618390b8eed3d575c61ebe6402566fe46b50f2e5024de089751c5
SHA512c7847a17c56517654bce2824b27646741d614e035356fccdb529555f395518f88ceff0f8fcaa79832a948407c93a752386e66ee947b58f4818697fb074a995b9
-
Filesize
5.2MB
MD52383b298d4a00269fc49445ade59d0fe
SHA1bd52fabee36eed25023f3391104094e093811c40
SHA256f122c2823f316ec4240a5e16666808b569210cbfc362c9071940f3ebbf4a9b31
SHA512b411d539c861d7ed070c588f47e64be46de842f41d053b502d406926aa21fba35427d2cc0d24400349355ba193076eacd92dd4f9b2794b4414a44b78d5ac9d2a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB