Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22-01-2025 17:36
General
-
Target
2025-01-22_f6a5f2a13f66a3e1038739d0f233b3ad_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f6a5f2a13f66a3e1038739d0f233b3ad
-
SHA1
b678bae1c30937d26d72b8e329f3820c79b1a203
-
SHA256
182529da1e3726e0bd1fe21b221edad7513b240e1a0e5ed3f43ee9235e209631
-
SHA512
7d5038b1a94cb4c8e95385ffb4bc4987fb45dd540666c5e9c4a81e53c4859475cf28632c0dc1e697248790bfb28b3e68cf0f3ae70287b34a0a96fc5c2a1d53ab
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibf56utgpPFotBER/mQ32lUY
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-22_f6a5f2a13f66a3e1038739d0f233b3ad_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-22_f6a5f2a13f66a3e1038739d0f233b3ad_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dqUrGnH.exeC:\Windows\System\dqUrGnH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NhrhVEb.exeC:\Windows\System\NhrhVEb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MOWYQnf.exeC:\Windows\System\MOWYQnf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dMsaXsY.exeC:\Windows\System\dMsaXsY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ltBnFse.exeC:\Windows\System\ltBnFse.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IrPgvVO.exeC:\Windows\System\IrPgvVO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uAtDoVL.exeC:\Windows\System\uAtDoVL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UGHnQnM.exeC:\Windows\System\UGHnQnM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XohnNfT.exeC:\Windows\System\XohnNfT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JcwdOqe.exeC:\Windows\System\JcwdOqe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QjSlPtv.exeC:\Windows\System\QjSlPtv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OzEmymS.exeC:\Windows\System\OzEmymS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gOMKwHD.exeC:\Windows\System\gOMKwHD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nmRohqL.exeC:\Windows\System\nmRohqL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IIstAlC.exeC:\Windows\System\IIstAlC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VcdRNPe.exeC:\Windows\System\VcdRNPe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EmSlbiX.exeC:\Windows\System\EmSlbiX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uwyzQwe.exeC:\Windows\System\uwyzQwe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mdXzKsn.exeC:\Windows\System\mdXzKsn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Sutfxhk.exeC:\Windows\System\Sutfxhk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YmfYtNd.exeC:\Windows\System\YmfYtNd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD548998252e3c19f15c1d37ccfaa25c65a
SHA177dbaabc44fa2145b50cbf544b2a3012f23d5b27
SHA256e0d96a9202e178860c6cc30dfe10e8068ae41d5d92b90e9f50edb0209a522a18
SHA512b345d4ddb7ebd38384b937463d8aae0d5c38a503d2925151dd3d2ee3782a7bf51b30dbbe64d3a9ac2258391d040910a99e7302387e4f955b20865f9a7898184b
-
Filesize
5.2MB
MD53eafaf9f5d963271cf2a70c28455f99e
SHA16cc68f05e4c4943a6b7e09fbac3c36e256d18c1f
SHA256e8a614c17d3bf9900f69c068ef4af165e5e1f9a49e1ea5d3015c9be0916f0be5
SHA5122a906cbb61f5e276a8ee118c4d81b4b70a04a253457a8d8e4b115b9707361e925e42c5e7816288027d8d4056607c777ac9b5d2f322bf99dbed8adf77f63c6253
-
Filesize
5.2MB
MD59028e540569a6b900a0fc1f46d56256a
SHA1aeec10847385a68519ee11fe2bdb4e08bb87601a
SHA25676085a78df9e740d7d802cc2cefd957cd0c19bdf065098c0b9b22c6a89d5cddd
SHA51241f8c9b4b952b21d5ca2b7d635a0775ce9d99a657ab2189f8b706f9a7aa44a94f2e534b5303a23221715bc716076fee4caca4b7765285557559d83c2b262e027
-
Filesize
5.2MB
MD5396e235a9697d07b11107baf99745e9d
SHA1f39aac935b7ab038fbfab3a7d2dbdebb7212f57d
SHA256f95a0be882f70bd86494a6294639c6f7d1748b4d271ba1b774b7b4e49efa6596
SHA512153c15e7db90c8e34d23d90eb44f4a35df9ca263560f3a4cf70dcf7dce249691f149087b9790c64c6f4071c8164412ffbbb4fd65dde3be240aa5994a3b362900
-
Filesize
5.2MB
MD5c269cb57a4b511a350ad876f58265f06
SHA172b7659175c1fc25a708b28e20ab9d48c147c2e6
SHA256476d35c3e12593636659ded00978f169246d63d0e1bcbc72c2602ad816562a50
SHA512a4e98cae21bc06b02400f1e02780d80fd618d9d8ce72313a4b388629f3bd713ac6948b5fbb84282a09077f1d50b20ec4891b559387fbfe49caf30f1207838022
-
Filesize
5.2MB
MD5d6ab36479f9b03c198531dc26497608b
SHA198d7ccafa46865ffff1273a09161f561da1719df
SHA2564a5002352f79b9212ebbd29770016a91584916e328b2abf483cadb8d589b5efe
SHA5125e0074f55dbf06814dc3d26d96346d26cc42bdc60437aaa09a7c20c01723aaad899a96dd6fd1fbe4a7126a438345aac954c6cd7cae5227a4b1de9fcbe0114e25
-
Filesize
5.2MB
MD579ad0ce9365301f1b0d59f847d837703
SHA12870af378c525ed69048240d962ce376c5ad1eab
SHA256d1244a55107f72a2f3a95fef4ea22c521f78cd6771e6da3f176f2581e5324a4c
SHA51237e27d3ff823838c34c7fe10e5473df370d8d5023a116f1086c4a5904f1e7335b21c75379526e5f0d4a8358e35a7bf0f1ab0c738682d449abdc1c4a3be8272d9
-
Filesize
5.2MB
MD5ed37bf952be38b45b0a0362f420c56a2
SHA15a2b1595eb030b7b445ace11d0642d98b425d5c4
SHA2563d521a42373904272d957c5216db717bb8fa30158140e5f507711f33555c533a
SHA512634c18d9fd6fc5f8225a85d8a8c268b6ec46c1672e5b40e13d6d7d2a054d00b758203c179422558512a9cacdd880a3f204ea27f91df2eb75e521e6229a445103
-
Filesize
5.2MB
MD575086463125136bf7ecf62ba177e3f7b
SHA1c7a983510f9fb512d38c600f9d0e4c83a8154af2
SHA2568cec1327848a0a674b5cc7aafca30a67b667e3a929219df77653378b0c2767a7
SHA512c0e4db606bee917724d40d5b3603a4e39ea198400215ce041fec55fd3ec109cd1a42a303ff9bf8580b414c1fb294237098ebb48a6871b3ef5a4b780736692241
-
Filesize
5.2MB
MD5cd8ad680248166917b08c2b01da862bf
SHA1d4d1f67aa9bb9aab29d61f26134df23547415bac
SHA2562c268fd0424dc6e7471d1a3539b4427ade22bbc2eb26abe978d0e621bf19ea20
SHA512aed3fa78997eb61906caa4174f8b52b1fa814b3d97d964021bfe93d406fed0a1461a91b65b4adcfef62ac95444ffc8978ee7b3e53e8b72271b83e9ecf99ec2cc
-
Filesize
5.2MB
MD548b484eae87c591c875a85e28a82a12a
SHA15acbc32b494b4e2803f77b777a27fecc3ae46c43
SHA256f7909cd0a3d7f29442c950db3720f81b6ef26c8dc0f0fbc8c82fb330e1f07bbc
SHA512c0a33f65acf6509c2667e32a1152e51a9157fd620fdfc447aad5d1a9105c2fe513ab561f3d924db6b10d4f488886f55da00cbcfb53b9323b610306eaf61b99bb
-
Filesize
5.2MB
MD5e4da7fe08d73fb3348036eb99681433f
SHA14335d2f2a649b828810d10aff9a07b1ecec4d65e
SHA2564f92d87f602fcc18c9574ce29a423bbdf2f09ab6ebdc17895808687a8c75f6c2
SHA51232384c8d54194e269247721ac9e096d37dbce83eb8f5fd141f1255745cffe04434b7e281eb1dfb0f6e549edaf4767e239ca96199250f96e50c5859150f84bb21
-
Filesize
5.2MB
MD5a8feade12cdd7198a06fb08137f36c7b
SHA1e12b191cf57b26e75e77b12057eeb01f44cf0af4
SHA256ca6c3d513b3a2746b87f12ff8ce9da5a4066191cd4fc9353aca9b240d2e28d83
SHA51231540ad083aad2d6076d4c92f67e5b7cac8324a47c9c4706f0070f79094278c748fcd0d77d913ae38f738c687eb808a5b308c14b84f54f543d6f698d5780c01f
-
Filesize
5.2MB
MD5b8d28026c648b4fe2e8f28010f6d9235
SHA112c706cfd6620cbbbdafab540dcab521c17c9682
SHA25607740253e00f6681febbede922a4ff05568b1dbc1f0d8eb0e253ac017c393685
SHA512b405d4491f34be187a8cac0c76d38f29254b5630d9dd1afeda741b44043240c534fcd1d58a7b263b0a383ead2ac590fe25de3bfebf5f85166361fafd802d6354
-
Filesize
5.2MB
MD5576129f5abceb50706af82d27012ffad
SHA19edef40215554287d5d5706f96e2841dc024c092
SHA2568bc77afc981d5e0fd3959d6b08130020a031fedb5967f7572ac92bcd9533e30c
SHA512af9bf227e703c1de06fdc0deca86c081348c1a271ba900f38db173b6b67d3129c0295f412e5c15947321ac22733722299b68385e99208795395516d47de28629
-
Filesize
5.2MB
MD53a132ba23f792fac2ca0830a607fedbd
SHA1d63e9aa1d29151148b37632c72642682343f3f37
SHA256bae789f3b7e7c09aea10b15fe0e3feca46120f325333ee94aeecdba9213d2974
SHA512a4fedf530f3c4e8fd39e7a875cad7a0910d87962718f325ca68421ed0f170d20761c8f63da1f300a474677f4d0ad6257e4368518ebb68b8f314b66a6df9f72bb
-
Filesize
5.2MB
MD511dfcc37b1f59a060c7288ee0b38a1d0
SHA1d63e435f3fc29d7e1bff2aee2505b1758fd478fd
SHA256cc1f098c88773278ec3f7aff1f4b6545dcce1a703e514ebacb0be8333b7c20c6
SHA512a6007782738a69b4e1e982a42df2cb231dac9cb7e84d85ff7e2a7dc520c21b761a2d8abd99e7f6511af169cc2a2e2db0dfaea7c018b29619a98fed599fc10071
-
Filesize
5.2MB
MD5b0f78e0311bd665a9729d5af50bcb74a
SHA1fa577ac3a2029247da307900d54fae431416e3ee
SHA2565f23be7160d851bef6ed226fb4b96a14868887f3902715d2d07ad572704c9f60
SHA512ac36e75f383634cc1a5c04e158ef9e1120af9721bb40b3e4a3142408226916246f01e77b9bcf173625efcb511ab2a29920f9e57076d6dc0fb0366c1f9d919646
-
Filesize
5.2MB
MD54945f5b8cc5015da2b80f1bf19caef6d
SHA1bd33170c0ca41385c3422baceac35240c29dac7e
SHA25600691ecd0b8967a25e8e5459a39e1e942b171993ec45faa76b943f2502ba9131
SHA512582157d6da6438af17671c6869533fb028bb4ada0b956cf3a48da9b2cb9c5db559fc62280a6b53a91c7cf60d7a53dcc474e2fe9291c4042c5f8dfc0f4fac2f78
-
Filesize
5.2MB
MD5611c1a242f00518d071ff7ce610aae55
SHA12bb0602a77f83fcbfacb8f3742489ef49f1fd4b7
SHA2566fb6a68cb5dbd4107b18365d2234304bd4d169555678cfa0d4086a78f871d3a3
SHA512c2012d02bfe1e11dc866b5b779e0284dad8fce04e1755141ea583fb67a032c779060ad29b7be56769ff4e285a4291b2f9db05c734115e347750e38e03c1c19e0
-
Filesize
5.2MB
MD5021b176b81ea2d2595d044cd7ba39063
SHA1406773d5b71d3e6e9ed60063a0f41f202467645e
SHA2560638be61cd0e5d422c51bd660c7484c1b5f3dd5f9bbdbdbb9322ab5fc9c2fe1e
SHA512d397638ededa2d4aafae1b37940355988a95b96d4181a544d6e13c9162b1b7666b9e4230978b97c9ceab103e8fb64504d7a4b4c677c855e87b354f24c7a3d800
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB