Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22/01/2025, 04:50
General
-
Target
2025-01-22_fb6da05c571257dcf4ccac3fef953e5d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
fb6da05c571257dcf4ccac3fef953e5d
-
SHA1
3616b06d087ba06dfea65ff35ddedb8e40a6d051
-
SHA256
00db7fe16ba046bc17654874621993135123908db5862a69502bffe886893b96
-
SHA512
9a5a61a169eb15c585499d829abfe3794a1b63aaf8976a75f5cfd963851e3c787d83cdd311055d4118d7aa43d6f9f561d559d24b53be7e4e2d2e01f953911afc
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUL
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-22_fb6da05c571257dcf4ccac3fef953e5d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-22_fb6da05c571257dcf4ccac3fef953e5d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ivDXfAd.exeC:\Windows\System\ivDXfAd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wzLPwSW.exeC:\Windows\System\wzLPwSW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fwqZlWY.exeC:\Windows\System\fwqZlWY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kTwKUZt.exeC:\Windows\System\kTwKUZt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LRnLyJS.exeC:\Windows\System\LRnLyJS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\soxzsbS.exeC:\Windows\System\soxzsbS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DnPFCJC.exeC:\Windows\System\DnPFCJC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CrzxJzh.exeC:\Windows\System\CrzxJzh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uugSRJL.exeC:\Windows\System\uugSRJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uOKEXjK.exeC:\Windows\System\uOKEXjK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\csXWNxb.exeC:\Windows\System\csXWNxb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AnDfKMr.exeC:\Windows\System\AnDfKMr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RnlOkWv.exeC:\Windows\System\RnlOkWv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NQxUAtM.exeC:\Windows\System\NQxUAtM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WrHZUlI.exeC:\Windows\System\WrHZUlI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KYgxVmK.exeC:\Windows\System\KYgxVmK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ddvgmPl.exeC:\Windows\System\ddvgmPl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IBKjeWZ.exeC:\Windows\System\IBKjeWZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zJlDXTO.exeC:\Windows\System\zJlDXTO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\odXvFJr.exeC:\Windows\System\odXvFJr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oWJxQFW.exeC:\Windows\System\oWJxQFW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ea6fa3a2d010894d3bdb0de23c2caeee
SHA199408c900c88f41c14e783383f3dfb16d740012d
SHA2564816d5ef73b566fe39287533cb0eb1c76f4e230f32aeaab080c0cc326305e517
SHA512a94d1ec7395b853334e736af9fab45f6714ea0f47bca942a8f99cb3d19b11c38ed9825b0fba1e29048513a2ebe339c6eaacfb6fee677e389809ed06dce08a8e6
-
Filesize
5.2MB
MD545ba3bf05b05d5201efa7f369294b934
SHA137af5207d43bf67ac3075711b93fa7505c5c2fc5
SHA256e1d1c33fdb4b3081c7dd981a1bdbb7a9cdad8964ee625b93dea48c16fab972c7
SHA5129c43f339595b40cba091f33a1fef40a561d467e0f1479c86c1e8f39a8d5023c4f2697061ed5921490d838dd4f6725b41a0ffd61e116d35265c12d53a00a45a48
-
Filesize
5.2MB
MD53430757cd8f74d3723f3a58321ba5efb
SHA1a6b09d7889a72ecc73f0c4deb7ff398a67019f00
SHA256ba92399580946278a019f44376baeadfa8c73ca535f4a186f990deff5acbe481
SHA512ac685d17b35d1fa4758998d038e48ac83571f884511e10b1f4beca9a2b651bc02cf0070ec7c18d50d90a24fcc5104999a6ae4486d732d7f4d4ec63d28e48773d
-
Filesize
5.2MB
MD56eb04a3319d626d701c28b467bf5baee
SHA1e18d07322a0b9b66a6faba008b9984f95cc4146f
SHA2566f2b2bc5e4faddf0511854c095e90270beeec337cc50c638db9e311636e4b40e
SHA512e6a9ddba83c76f55d9acdfaa6de0adbede7951f7ad503f9ebb0d4b8657be7c78fa10fc1491d32afe8d34eb5cd0d2eca095544939c61118db72f6d70b71cd4e8c
-
Filesize
5.2MB
MD57837ed402620e5ba47dd427301ed367a
SHA13067a40931a0f69098ef1ac174dff2b824bb5aea
SHA256d2afd740b5d5e84579b613578fff85e85474a095e49c0390539c1f818729a30d
SHA512e63f26f6aedf3f8fa71ca906624a632e5c416dfe5cb1c20fdb53607b3c2aa4d5abd1d9d79362c92aaf3da866c408dc55457d4f243f1dc3ae57c8c9b1ff630ef2
-
Filesize
5.2MB
MD5b08a92348570874a40b82540d8a17ec4
SHA155a0b14797d66c8420336dd65d235f5d588ed038
SHA2564bce3e7812ff2492ac86fa5e498df45fc093822feea966fc2e88bfd244083899
SHA512538a0b73f0b3a91a4333df265112da5bf7270cf51ac265944bf2ba9ef1e60599000fb9da52ee824b2871ced947006d25dd7ca2d272b3006fc2654b9e9dc7b91f
-
Filesize
5.2MB
MD58b274b8786dc26535349b41d8164e38a
SHA185b974ed2b9933468965be1e7a6b763902db42fa
SHA25630300dd91793611ef58ab7b007db975973e96e35914452ba6654549a19508f4c
SHA5129bc9e2f9d87880bfb08685c94cac93947cd17cb221e72ae42e5d8618686a2df27d50799d1ea58b62172d935f5fc291330436d6b9a0cdab448b3757872e1a5639
-
Filesize
5.2MB
MD5d5971f43d1a3ad85b3ed5e7b4a66a6b4
SHA16f9d51f60cd794555b4ad1a3f6bb145e24805ce8
SHA256de5dc1766f78449fa47dc13229b4977bb3d77e5dafe09ae037fec5344cd3d1c8
SHA5121ce34c5096f63cf1a4e011a7be417f66e53bb9c6c27a4e0a41e508711ea1942ad4742cbaba1b675027919f184bcc5711141eb13fb72a14642c574094ccf8e91b
-
Filesize
5.2MB
MD5bfb1d6bee01477fb10dc62b23fcc6544
SHA14b76c233bbd5e232ec79450ea8ceac5c42491764
SHA2565d57be039e3b62ceb5e8e17c2e2dba20bc7aca4db6a90718b0b83802d417f005
SHA51234b07a68be39239443db5a0311c5ae941ae503817b5ed22d164bcd3fb715783c17e5e312e36103a49ed61cc872c899eebbd918be9a27ef81dcf7848c2f515088
-
Filesize
5.2MB
MD5f8b97e0e53d91b5af794db37deb5b089
SHA11548f43203dde1080c9a3289625369e50e22c61c
SHA256152bf000b1c3b8f0bb5e199fb55eb7945fc0faecfc93d99fd190a65ec24769eb
SHA5129b8c280282e7374679a83db0e7d121e1c87f304195c57906d7d86ceb6d4131cc12d9e37208cda7d888845ed8246dd101f56a21ce7d0e5195a694d88384e1ddb9
-
Filesize
5.2MB
MD5aeafe257bd19db1c0e8c0ae40e8447b4
SHA1e4a1c778418d33378b4823c991672031792c7116
SHA2569451f7620cd96590b509f303786265bdb8c117f934d6d88379fe910464556755
SHA5125839464526a63f83785dcb1a3cc40185e126251c64da16e100c0e857188585c37e52b0b3711e733e0f092a66bef98c872e8492cbfb3b37e75603d4f699c826b4
-
Filesize
5.2MB
MD57f7abd9469e3a897d569436197c25048
SHA1e232af2a35c8bdecee61585b46fc4eeb2626b129
SHA25602ed9036e82041638815b3d397f0ab188860e358e3dd882919a4647a2b739651
SHA512fbd3df2dfb48ec72882197f4fdd515f096dd558beac694663202df86bc0cb0a18550763da6b0cf6691deb31a600940284f5991d8e32615f174a3715954941a08
-
Filesize
5.2MB
MD5419581765a30c819836f78ddf6d43359
SHA1f2e846f234857be2f80983c6baf7191fa3bbfe03
SHA256a8b5220efab06ecd06eabe944a54c9a3c768f6529e2b6815ff7d85910ed00bff
SHA51233ee332b9a8c9d23dd2b6e62477d7e38dc0d165e92e66f79c1be38e21bb380c0bf39bd602927c9ab8f969b62309e9fbdcc8cccbd4159bd93e46767505bf57bed
-
Filesize
5.2MB
MD52a184f405e1027219f5a45aa9a44748f
SHA1aea0ee7a521f71cb75e0387df7c99f84f531b5bd
SHA256e1251f4f445dbc8e6436bfc1069801a0d98434dbbbdc13ac69745bc4c5319f2d
SHA5129afc221594aa5fa5e2d57995e346e6493f5e017fd766f32f082ab3cef6cfbd1f8a97d2e322b77a9c264ef2e545549aea543eab9f862a8832981f8bd0197f0b78
-
Filesize
5.2MB
MD5f2c1a5695b69d72ed75a0f70a83dae34
SHA157cac315f09659ed327c52e269268adcfee8e403
SHA25695de35ac44ea8c128a43350ee3db7d77171c0399cf2e2d34906e1f218c9be2c9
SHA5124b1afc32441eb1db74aeff94f70f09b1b72292114e040125b6395ccacf34c4ba02c504569f80bfd7908126042b3fc6200a638c45e81129ac1e5c3ddfe1efcc2f
-
Filesize
5.2MB
MD5718b22e001d6967f1c5d528c6b23f9db
SHA192c1e1484ece20fc0895edacbed9da28d8b30679
SHA256962fde42b486543c2763fe7e3b41eea467c23e520893b85aac7ad77cb12ffcb2
SHA51227b40325a0482fa7918c5bc72a053736cfe514125dc24afaab4afebaf70648d5750cb6edc36392ebf1844cea9e02802075ae4840a7d600a4db85bae75578e115
-
Filesize
5.2MB
MD526cbfa78f15df7d96d199575a1d14fc2
SHA1b3e82c3bc053b76ac2b681eac927667c1a3d1f17
SHA256927dfb4f36c9d316afa09db43881882319cc6698875c328988b67adbbf65cc34
SHA51261ff9d8e270dd26d4a6dbebf570aee31d7e5755f6666b21a619be671b4701d2432ede4476a369f745be6f073d9cdfd9ba6cacdc6d561570fc80f4920e4811e4a
-
Filesize
5.2MB
MD536fdffbe7f48317261dd45b528aae87a
SHA132cf1280704bfc431105b322dbcf0f46b7e8e4ed
SHA2560e88acdacd493a9c82dbd9a978fd1af26714f6447240e552fdc8eb64cd766302
SHA5126e9bd3560d6b3e7037bfbe06a709e134627e903ac566bb421d34cfe7de81a17bf5dfd265b9d986be3108a5de9ab3a085b43eddba10dc88c5b4e3e200afe2ea56
-
Filesize
5.2MB
MD5ed1f96d1befa6151bed0c13679a7a140
SHA19ef6982adc402c2d02b8fd54ba6e2a35c3133ce6
SHA2563c98c5f1a3ecec930c180b73bccb4b7ad316faec0a1051219051eb4862a4bc23
SHA51298040ffdc408bc2244e0101b4144e3e963897a19160d158be70db88b806b8041939cff4a3f593af5eb1c0b5884c223c3013fdb7663dae09ae952661bbc83f054
-
Filesize
5.2MB
MD5f95b8868b8bfc2ab944c3fd8b2b8dd93
SHA10ec663eae11dd5d4849856265c71660f088fe38b
SHA2565c0f304db68c9d054c833f21aeb077da9cdb6f3c3d004d09e90f2274e5fc1b33
SHA5124781755516779f83b26c35d70cf70287c883295fa324b5c890e24d00063518b48fef09e4af12877efa834c9c48ab5cbd83b43eaec847da07b5ffb37014bb1594
-
Filesize
5.2MB
MD5e6e536c400c551b4e82688993fd3c236
SHA19a7e69c60e766ff629725705901de6a780aaccaf
SHA25617e6a5473c2e311d06b4eb1332c56eb219db94596d84c2ad5e39cf84a94f32ce
SHA512f47d2eef8a72dccf918a1b3bae8616c77f8d6bcc66d61082c067d34d3abb94442ee83beb18835a2d59641be739434271e7128f5f84dfc107184a2110d16897a2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB