Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
28-01-2025 06:05
General
-
Target
2025-01-28_8cce26f700360851155ad2c38e69a1cc_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
8cce26f700360851155ad2c38e69a1cc
-
SHA1
b799064612dbc420aa9b147b8cab995b09d63758
-
SHA256
72a4f416bc3a34ff9cd8ed9bc4a16938668a937e3a569ff50f80395db3cdc97f
-
SHA512
77aa8c5a81f91ca08ce7c060436a4176d7042cf85ee5d08aaddf6388d0244dae60e5d8a90d5dbdbdeeb3e4c5375e9cc4e4c9cb502056abb1e0a1c351c61055a4
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUV:E+b56utgpPF8u/7V
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 58 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-28_8cce26f700360851155ad2c38e69a1cc_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-28_8cce26f700360851155ad2c38e69a1cc_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DfejnZp.exeC:\Windows\System\DfejnZp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yVyqKtj.exeC:\Windows\System\yVyqKtj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MmwkYKa.exeC:\Windows\System\MmwkYKa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UNTGRrT.exeC:\Windows\System\UNTGRrT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IthGoOH.exeC:\Windows\System\IthGoOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OnICnHr.exeC:\Windows\System\OnICnHr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FmUdEbO.exeC:\Windows\System\FmUdEbO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DvEGKXH.exeC:\Windows\System\DvEGKXH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ijWxKNB.exeC:\Windows\System\ijWxKNB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WbRiWge.exeC:\Windows\System\WbRiWge.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SYsQDaN.exeC:\Windows\System\SYsQDaN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qNcJHVd.exeC:\Windows\System\qNcJHVd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LCcLmQs.exeC:\Windows\System\LCcLmQs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SIjKvHb.exeC:\Windows\System\SIjKvHb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gccmcEr.exeC:\Windows\System\gccmcEr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NFGCshK.exeC:\Windows\System\NFGCshK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wwnXnnj.exeC:\Windows\System\wwnXnnj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HlBgGZB.exeC:\Windows\System\HlBgGZB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\psQHrDt.exeC:\Windows\System\psQHrDt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\losrLDU.exeC:\Windows\System\losrLDU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WVAavsG.exeC:\Windows\System\WVAavsG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD51387b069c849208522f8c5632cc43f1f
SHA1c0f0477620f8b297754fa39159ee04e65a8d69ac
SHA2561121983ef6e5a72440a991a11062ce5e7a99be8d28d6dddaafda378d77cff797
SHA512644f0d920465c55c7677f4f48d5c5dff3c48a8b0ddc209df120c9dac0c766dddca5c0021f81325001e9200110a58c030194b8b741185359183201ea91bec6c61
-
Filesize
5.9MB
MD5a812ca0d39fcd8251b427a7aff7f6591
SHA187533897c190eb98136a19dba2dc74a7cfb9edbe
SHA256bbf4a6f86a4f87133b81737dd6180a5eff5dadb7406f0186f3c64bd9d564bd8d
SHA5128f2a05c4d2baac7e980a5f9de1d8ddd07f40b6f1b99985007c9585f022cf25c7362aa380b41db276131a6176dcbd1679c883ef749b1fa4a59ba87dd56501639a
-
Filesize
5.9MB
MD58af774e000df5b94f770653d12e15c83
SHA1a5ccdb1a75c93d848857e4bd2a277aca8a5f43e0
SHA256111a633d8d51ecf7dcf98f0655e230e042339f9613f396457d6d807ded08725a
SHA5120ab82f166f51cc84f9bcf4bf45f23f511055703b3447d7500416dcc5ab9481585abf170c4695f1eec594ba4d4848e2711b27d8dfbf0ddbfd1e6373ed64285153
-
Filesize
5.9MB
MD57b1e48dcbd0ea509c6383bc6323105a5
SHA159e22588a69ce8bb2b6b0053d891b6a26af9414c
SHA256f4143360c6bfffd5ea76cf7b292a635dfbae69a96155c47ac7d80177530af566
SHA512cf5d8e0a780dd45a30a6baaf2380ed4edc5cb5284f31dbd594b6a598e041e237799bf69c076655f019ac82039626020a43ad2d858588733287de42146af71b44
-
Filesize
5.9MB
MD560409033f41accf3b62ab3988b4906f2
SHA1848734b53febabc2b00ac231928db2eaddc40143
SHA2563c6c81a0038e3d5b66bfb725a1ee372ad64e4b3e62a521152a5726d91808cf02
SHA512555dafa57e165965ac9ac9bf4aa5393218f269c2cb79ba970f2567d30e80f8a011daf6071e540cdd5e715d529cc4d37611956f091cb2649b1b9e5159e8dbc249
-
Filesize
5.9MB
MD5a0982de4c8934f0f87e2e00dedd3e135
SHA178f7909890cec37105d6f4c9cfece0dd5009737a
SHA2562949521e9bd8e6ba4a5c051deaa1c9c8319ad0a57117e479638bc15a3672d213
SHA5122a2741f447476ef81450075736fcea7c36cfb020a6782c557e54d170b2917301c9446fb5b4dd3957fdad9908165c338b84918ca6efa48cc535ab4aea4d608c45
-
Filesize
5.9MB
MD5126e007a96dd903425b0b0b72d0c8c91
SHA18d6ca240f87af35aeeafe3e7b9bccc4048b226e5
SHA256a3d1ae3f6ed01febc4dd2ed3af6d62a7ccc4c45346d8945a2c58eb486f4fff84
SHA512917a4efab211060ec4308a79308733092c1381ea4b87eb16c249492a94aa7bbb2679025897974cdc3ac00a61a78b3b636c4f0f6d64e35a31f29ccf955031ea0f
-
Filesize
5.9MB
MD54d387dc596a5fe0b8ebc19132f043ce6
SHA173bfb09de2afe7ea97fce068b456eea8de957794
SHA25611f3ce70c17d213bdaa06d5c36ea085f0634557cffb1b6a1cef5a02c5fc48e45
SHA51263c631af6294ab00e8c8947533b0fcdea038b61103193e117b9b5f16562719e7d6ad24fc44bb1ae857fe361cc99de6e1313557a4c0bf6aebbd49deb93598d1ef
-
Filesize
5.9MB
MD58e77dce5dcabfe234fe3c16f8897c96d
SHA1ce69d966fff62253ac4385129131603cacf9d5a1
SHA2569d2e5f475c33c21ab4c210225bf7771e93f03ceaef2d34972e98ff409909b430
SHA5122778e709fe5e4f13f0f7ae8025226773ce6ac1af5f6f1a93a5da1333a522c808c369dd3201b538470c953479e265c41ff91efaf69c58d1395be056494bb67cf0
-
Filesize
5.9MB
MD58804dbb41e1fc7958703b8a2e4d65bf2
SHA18aee1cf61a8f9a416a1d8fd5cb4738d9716c50c5
SHA256570c272048a6e51596e744f70526ba17db2b97a315f22954edbd66f0e003dabf
SHA512c34fbab2e93205b0fa35e7323e23eec4c7d53af19b94f04a0fc42d51192106f5c487fd8910a76bea1b70e555896edac61cde94c80deb33b64d009abec830cc07
-
Filesize
5.9MB
MD52f55e98a09ffdc08dda1eaa08c882b11
SHA1a33e4ddd96770f85f67cbb292218488671ea35f5
SHA25638395e7f50207edfcce5ad93420064610e4d41f9d1b878b83425e31735ea7d31
SHA512a09f060875b36e6c0b76d351dd31f5bdcb336f1b67b6e5f0d37473a25895896575b90d80791e540c3203bed038c847731d48910f23b5864147029f1fb2dc67d0
-
Filesize
5.9MB
MD5aba195b34e68e5b0ce58afde0427c782
SHA106466663ed1fa4cbc0b41ae403f21a3c122132b6
SHA2561f5ccdca6e0fb88139c89c4acdb2fc42d9a16d105fcfd90f5a9c5f546e95c5ad
SHA512ef2324674a687dcf1279068ca079d7cb853a73455b518e45b5c2b2d12abd36fc14644f6a5ca9c6e26999e55323e20d4ae5b5ee56357defc2c97da8ebb0ae8e97
-
Filesize
5.9MB
MD5def51d78721589703404ceaf5a45004c
SHA11be0a0770a939c9318ec7cedc98e0521f9bb1efd
SHA256643f1f9e9c4d19baca93a47cdc7aa3e6521ddfdafb9b150894b66e964c2c5a4e
SHA51283e84ade820aa6e595bf042245533efefab856efb4572fbe5d4f8d97545b6d2bae353b59f5ffbad9ddd6db9a079ac88073cfb9c1f72011b6cc75b072ad0dd054
-
Filesize
5.9MB
MD5528f9e50ce508dd605e4574a52998e00
SHA15e2e128db28590ab434adfe1d98c5bb2426b2613
SHA25682a3fc13e8108b1bd5120f5e1c889d645862b4cad799c7d1292d07774088667a
SHA5129b2bdeb1649e4d737c5d820a2bd46a1a64a3fbba5fec959f018a80c5c05ff16998b99c612d7527c454a0d8fdf7e02bf94f9a024a1c69d736854ba2e348378b8e
-
Filesize
5.9MB
MD57027594c4cf14c1d2586fb25c8d3b263
SHA1f1b386e4dbbceb759378c2d44915f5d7a2cc6bfc
SHA25609383fca5d1fbff6416e8e38937aa47d9dace8492a2e70f5d9843d3a5a36c795
SHA51268e4f30e9c6a7ef245a51807fb256d66051bb24141e1659fa95be5d0ce6cb789c7d7ab87ce5689cbe2d8fd11bde5b44324792936ade7ba580b46b9772648e0e6
-
Filesize
5.9MB
MD5ae8a5e5add75b6047379e496d9ca2111
SHA133513a9d81a5280be2839d7d26c5074d540b49f1
SHA25657696045aee794f129e7b84cc7a77580122a99f88c0b3a0d9d56c50a6f2a7a62
SHA512c6423b8ab91112ffec8622e5dc8d0c5e29dc663516c04d6ef9bc015ed43c3e77204c549f70b9a31daf2a1b96ec7ede82f7c5c0412925868993923bd7ba3383a1
-
Filesize
5.9MB
MD54dffb017e6b11874ddbf552a0cddff7f
SHA13ae679414207cd987ac0f6817026509126af10c8
SHA25634292d39c739ad4fc7b2381c1ab7122724b5c6e371dc838b828dc8f057c53641
SHA5125b6ce46753e7efdabc4447fc1265e1c1432c1375e6a0c7e3de55c355800035ce4a85ec7d536f530db82b6450c1a3a7096b7fc6e511d662d6ba199366585c0b0e
-
Filesize
5.9MB
MD5fe99a980c1624e48d550e45ab6ad5581
SHA14baedfdd49066cd314aa643d2b771206a732275f
SHA256b43327154b2782eb6a6fe832b1ec6b696fa67f1762007693f28ff66a0979ef7a
SHA5127f796b48b0b649011926b15551f634a6c61ab647890f54d1147a7ed31e25c00c15f08b0155b3ffc2a75852e599dee0d7b1b6d47858900cbc9526f6a47ad9488c
-
Filesize
5.9MB
MD50927905b185209035c047d35504cc8d4
SHA1e82d385333a966f17b35d175d7193874188c2af8
SHA256a1197a76f66050cab4bf4c599786bbe754cc90ed1d5cb2f58cbd202b52a75513
SHA51286b68e53b2389a5086ef2813f2aad24ff1409c54ea109bfec6d5e432ad36e26fdd908d9933b6fd24e17b9fb134d027209af8f1f62cd4a503155f495aedbabda4
-
Filesize
5.9MB
MD5a3ba42f308a23dec738f4af19aacfa6b
SHA1530fc05155690003daddd3db464135346b0c48ba
SHA2568dc593849b98219b7f1797e926c2032d837fa103162af45fe63c1dd21df276ec
SHA512c1439b3b28a5b0316862f1b8747303f71f74b2d1e54bb72d19268fed61a4d571e4f451c321ce8f7b2777def1527ba8564e91fb60cd79a222da0a004805666fef
-
Filesize
5.9MB
MD5285f324c721aa2ca7cce8b2fcf4cfe13
SHA1895ec0c367ba09022307be53c7e77c8a64fcf519
SHA2566477b0fd10785d9b03cae80de3816f4b6d0884f6f4351a4ffe7c8733834fe551
SHA512b34bcfea3511a738dc73d2b67478f9c7e42535f9487d39a40f68d4f80031dd7b6eeedce59c05e6998135a3bc0cf778d1dc3f105a44884f4848e2451de5a7aba2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB