Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-01-2025 04:50
General
-
Target
2025-01-22_fb6da05c571257dcf4ccac3fef953e5d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
fb6da05c571257dcf4ccac3fef953e5d
-
SHA1
3616b06d087ba06dfea65ff35ddedb8e40a6d051
-
SHA256
00db7fe16ba046bc17654874621993135123908db5862a69502bffe886893b96
-
SHA512
9a5a61a169eb15c585499d829abfe3794a1b63aaf8976a75f5cfd963851e3c787d83cdd311055d4118d7aa43d6f9f561d559d24b53be7e4e2d2e01f953911afc
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUL
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-22_fb6da05c571257dcf4ccac3fef953e5d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-22_fb6da05c571257dcf4ccac3fef953e5d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZymZjXA.exeC:\Windows\System\ZymZjXA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uyeHqZD.exeC:\Windows\System\uyeHqZD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mUFktiO.exeC:\Windows\System\mUFktiO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uLDXRmc.exeC:\Windows\System\uLDXRmc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HYwimUa.exeC:\Windows\System\HYwimUa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lvJjufa.exeC:\Windows\System\lvJjufa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZxgJavi.exeC:\Windows\System\ZxgJavi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qOrBJkN.exeC:\Windows\System\qOrBJkN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wxxQQAN.exeC:\Windows\System\wxxQQAN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DeLWEXb.exeC:\Windows\System\DeLWEXb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FBfIscq.exeC:\Windows\System\FBfIscq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AUQQKVj.exeC:\Windows\System\AUQQKVj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yOhXUxe.exeC:\Windows\System\yOhXUxe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gsggaEN.exeC:\Windows\System\gsggaEN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hHJgTCN.exeC:\Windows\System\hHJgTCN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jxWdrsK.exeC:\Windows\System\jxWdrsK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fTWXQDn.exeC:\Windows\System\fTWXQDn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IMdcxHA.exeC:\Windows\System\IMdcxHA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jdlRrPH.exeC:\Windows\System\jdlRrPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vQZKYUk.exeC:\Windows\System\vQZKYUk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GpuoBgP.exeC:\Windows\System\GpuoBgP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5260c9781ea7c86f21043e3934889115c
SHA17e6f7deb2f6fe63fe2f0c16521257abe450d7411
SHA256b6b2ebdcd8d53c0fe5eac9b07bed5f714b61dcc4a2dddee470f8ff686a7e99bd
SHA5123868763f2e5e9ff0439a40e950df9b4836a7bb9c2b59648fe0e2fd2ec8ddad406f996a48775a909c1a0707cea2ff0fbed1998efaa2dd6c89756781880bdc991d
-
Filesize
5.2MB
MD5b9fb8feed52e2592f7c5555089d37fc8
SHA15c2b4a6a47f60a42a5df1c1ce29eef1c8ab2e2d5
SHA2563bf8ea042926df61a971f56c13e8e6589dfd49a394ffd83268e352531ca13aba
SHA512ef5bda3471d53cf5e7c6b8e7bdad8e9b6b7aa8452c76b07ddc4617782894ce768e973b5524367997b266af1522fc6b1eb5e27020c6c52a2c9955781fcc4db398
-
Filesize
5.2MB
MD542eefb2d0c493adc13dcd58212dae655
SHA17c712c39a3d9e79a5b47801c5cb54e50f11b4b46
SHA256f855f523008a22f9692d192a48bd954b66b4350ab75d5ed119cd0143179dbe21
SHA5126c9a393bf193a013aceebd3a6a40e6cc0708405223aad9567b4aca4927a8d22fbcdc5838a1834944aa4451601889381b4c24200f5b660320431556055b45c1ba
-
Filesize
5.2MB
MD5aee354b1b952def9c961c46af3e9b9e3
SHA1a8a5e8b3dfc835178d6f9adbff186e3d48f40cae
SHA256e0d7d74347902c272d040d2140ab319c560ab48b0156ec67fd73d32ec920bae6
SHA512e85a230e71f53913b4cd1311269c472ea16dfc111e723c2f2c893a78b54a80d271b3ac688acf9405e151a58562e84c51a567bae4f973bbe72a0fc40228538545
-
Filesize
5.2MB
MD5c18713aaa264114389e5e3dc59e25fae
SHA12ebaf96e24400a3e6727e3f3ae2654902bf7267e
SHA2560c1eca311e8afc341c5ec24b8d1e3d45372cee825d3a6b41961f97e996566d18
SHA5129638cb3d75a18f19b3246646e9c0eb948d506638870e6c569ee9d247d9feed331c55c22ea23d31ea1ec599fecbca6d07ab773827792143ade770e6e998a863f5
-
Filesize
5.2MB
MD567d2cb1cbe126864bd8b38b147ca7508
SHA1074e6091fe3c97e192c136b85a636795ccfd11b7
SHA256d2d0ed2fa59b000b8ca9314e419109d582218c5e022f3e5dadf4ee14c9ac5ed0
SHA5129a2134eb5f610532cb86363aabfc559fadfc081b0066020f143f8482cdf84eebfb3fc35466c74ff195293471158a73c8ffa29727ed93c2e8e39e286ac40546d1
-
Filesize
5.2MB
MD55f7ccf6231f3cec6ef6eb0839b68a0ba
SHA18eaa5002b2a407ef0d6b8b268b8401aaeefa04c9
SHA256fca510f21a7264c9ef11d23ae51722bcf07e965091ecf91c18017e37e20ed2e9
SHA512e10af0fe0efa8e574b051dadb7d599143fb78e0528b4851dfc199682514d43fdbce99bddc4ea2ed273d39859a8cbe63f62a74b9751761358238fd003ff67b0a3
-
Filesize
5.2MB
MD5619b2ab77742ae481567a4d1eecff8fc
SHA14f51fd180c0cda944cf672ac5f9503805f2a7042
SHA2562afb835de07b1f95cc53fe14dcca86aa7e57da398650ba4f948a0a3d0c6e0478
SHA51202afc9a36e341a55bc8a921d2b715d81514327085e00383b662f48dfcadf65fd0a56e0970cc0eebb40521c8d76d3b0449f6fbf3cc50f150ee94440e92f296766
-
Filesize
5.2MB
MD55a36bc7b9e4e51e3f8de098d29203881
SHA19c8e271389d684aa93b3278946908579ff26c0d9
SHA256c5ecc127379d57686a7266804fc7268139c7ad18597859391ad3f8ce81b610fa
SHA512b926c06468d80316821713a354d0aee8e4393900ca7c411bb09fe7578684e07c190d0c21b8aac607dab2bd5267ce5bd51d8b8d965ad9b057652925d428fa831b
-
Filesize
5.2MB
MD50e1d515b76119b20b56b1bdd7fed799f
SHA1f2ac53c89333cb46e9109da356c60c81b60a1dd0
SHA2561756f2d2cd23597f1003139531c9f19c7545a26577f307ddf79c81ae52b2842f
SHA512434d35818700e741cadba8c01ef1b5498e141116a4e5c177fef815316f05a50c6665efe073e2d64ffce30ac634c845fda36fb7aca42d3a19b6ef8c1449627995
-
Filesize
5.2MB
MD59585b4a0c52177ea2969b49f2cf71b27
SHA11252077f58e7fe09454bdcf7f3aa62a52cad8c71
SHA25660594e6216b9d942e6683e331b071c0e2d7d23beb95ea25598d8668b9d0c4b41
SHA5121320972dd7138c4d0a4e89a3ecddd08c271d525de7414397271a3e1c6f331003b8559576ba411c6245d700f038b93e6ab8a191fd12efa2f7c5676966c141ea3b
-
Filesize
5.2MB
MD57e1404e2cd287fd475bda892d897ab54
SHA195e3a498a600c9f48688b7d28f062c9ea0c04380
SHA256d9b084a2cf9a59ebdfea7231b0474def719adc7e124fbd226cd801d180bd0447
SHA512e7c061536467446a00362787cf7a7735cbe1616d02c5c0e245640a1ee6e7dd4b3971e1d48af252acff41d3b9503a057ad05b7d00b4dc867a9a4155cefc470b84
-
Filesize
5.2MB
MD5ec89a000bf85f926d4e72e34957cb1f0
SHA1e3d3d374427287d016e457bb649c3eef89416e37
SHA2567e1fc06281baa2337162e5cd9b58aad604116e6267dc626ca7c82f9fb09282ed
SHA512a091f4791e77ced7ffe86460342fc1230e89bc7ab345057be1018955cc5fb84968ac00645d348cac0cb4571708bb8598616b69d93fce92c4460cb14e8e955daf
-
Filesize
5.2MB
MD5a38a2b341529f15106234d6eb754e18f
SHA1aec8f896b4f595c03da0634a68ffd5d56b9264b7
SHA256ea2c022800a27cbc0c1114e24db0e33691ea27593087f7c40f30a01e9785bc12
SHA512e93cd1d469ab7359d5742c1c6b5272937898158aba04b6cb721963d51843497640683b2904949c546ad7a82cf6e36580a5204037de8aab35e0ee18af60dde478
-
Filesize
5.2MB
MD5ec1564a365a8f3f1649b42fd8c8bf3d4
SHA17f4e9490f6aacbfe15810080227ad5397684531e
SHA2564a612c7b5548604744abd5eaef2d623135e4512179c58bd48ce5937d007ac96b
SHA512a5d86eb9765d81dc120aa60d09c031336276bf3357d50411858bb71c35dc2dae68d5d881506916e7c2ca340f07acf84fcc384d1af866234e1525aec13bb62159
-
Filesize
5.2MB
MD5f34d978715680ebd6c9e303f5d53f4cf
SHA12a2b00afb0af5552ceb40d9ffea4f9897e409cef
SHA25609866bb2939eff813267b44d1ca79c9c7e4026d99811856fecb8397800e9d7bd
SHA512743921273f1462b5ff77cb68e9710d4e50007ea014b37764c8ba7aab756e1c08efff10c20c16b13bd9c4d846578f6cba35987d558bf5c21e5cf6049abaa7b0c9
-
Filesize
5.2MB
MD528c5b83bdb0bbbcd1f72e15229d40ab2
SHA1170d15893784a73b2267846192fb8c50d4a71a99
SHA25602e01afc162ceb11232d0ecdd2a33c3e10bed3c861a8835b75410cb65d3b47a4
SHA51230dd43dc2f520768337456af525c46d8fb1cf303d35bccc793da18b03b132445f4753ef75a1362ae8b9995b93046cbd1433248604a9d5a605d0f7b96385e7bdc
-
Filesize
5.2MB
MD5af9933666d75bfc9b69ca818dfb6210a
SHA1e09779fe0a423c03bf9d68ecbb1aac8596bd916a
SHA25631e1ac26b44a005459ab96f1bb7f5d53de0f44a3122bf7c03dcab1fdc8379a9e
SHA51263d2e79bbf340f19452a6b28e9fae93b18c74dee202004777b6a15f184ee65f2576e777874f69176d8ff872013ba54ba73b05b0a17c99203db66cc68fbd0b4ef
-
Filesize
5.2MB
MD5fcf8beb0bacb0295c0b6beb2dded3c6d
SHA1db4ae02ecc19b9ac2f7ca7b3ba7facae2fcfacc7
SHA2568a2df5f558f11e13a4f532a69b4fd4c1f175b1a0c8781af1d9d15afcff4c244d
SHA512ce8459b46b50a19b4c926c6c9fa620e9b8b047e436144e58aa7b96d1a2d7ab801954a10ec0c3842d45fa8b1ba9897507f7197a5a5c9432727ec8b1dd539811a8
-
Filesize
5.2MB
MD562f8db2768d19468747af072656dca48
SHA116e2a1d1b2d9acfd190cf1b45ca0872f28cecb74
SHA256649f6bfd87afb6cfeb48e440fcb56d068a8ddec40564df94894f09d6881856c3
SHA51210f05c6bff68fdb41ddad3b89bf548cc115d5c24874f8ba1a9200dfaf40446908468b027dd727626e60c09ab17df88a19fc5d6987a2cac302119436b723564c3
-
Filesize
5.2MB
MD5dda1ab3991bb5c4ccf0afca451b7ee7a
SHA1d15849b3ce92696e244ea8c10844f71f01bb5ea5
SHA2569c730a3857223fe0eb773d56575682724b5dd0c3ab3c7625f1b24cb65fc2ae1d
SHA512e1e6f9579a8b0967f9ff7f0eb25c5742504d39362f1887935ad2f4b214663f35102e031cf54c3656f25f3f0e2d9dbee4ded541e14690a9630d1b54e6c193b489
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB