Analysis
-
max time kernel
133s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28-01-2025 06:06
General
-
Target
2025-01-28_ba68ae26a3c58fdb4162cc4c2ee13012_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
ba68ae26a3c58fdb4162cc4c2ee13012
-
SHA1
46952a1c36a3c3f6bc908dd28e471f036f127ae9
-
SHA256
5fc747c3008aa2ab87523b9242cc0f104a4f1df79d3789e871f49d994ac1dc03
-
SHA512
779d76b6ddf33b6c4a0755962809629b928d86978a7e2d674538d3cf1827f5c916f25c61ea92f00d214938f8c30abcad058f110b4f81fed84cd675cc69dc0834
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUm:E+b56utgpPF8u/7m
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 49 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 47 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-28_ba68ae26a3c58fdb4162cc4c2ee13012_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-28_ba68ae26a3c58fdb4162cc4c2ee13012_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fntKBBp.exeC:\Windows\System\fntKBBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vuLvKZs.exeC:\Windows\System\vuLvKZs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uUHgTIc.exeC:\Windows\System\uUHgTIc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pCDFiVT.exeC:\Windows\System\pCDFiVT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\edNgqBm.exeC:\Windows\System\edNgqBm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rYlmAKW.exeC:\Windows\System\rYlmAKW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nrFPWBF.exeC:\Windows\System\nrFPWBF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rymamcw.exeC:\Windows\System\rymamcw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RlOAEDG.exeC:\Windows\System\RlOAEDG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rYRcABB.exeC:\Windows\System\rYRcABB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cSrknCU.exeC:\Windows\System\cSrknCU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MtAbBVn.exeC:\Windows\System\MtAbBVn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DjdSXbp.exeC:\Windows\System\DjdSXbp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JzcAecJ.exeC:\Windows\System\JzcAecJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cEvOtCU.exeC:\Windows\System\cEvOtCU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NKVRSSE.exeC:\Windows\System\NKVRSSE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KbWHhFu.exeC:\Windows\System\KbWHhFu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RzezDzp.exeC:\Windows\System\RzezDzp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tBxzabu.exeC:\Windows\System\tBxzabu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IvVtowK.exeC:\Windows\System\IvVtowK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bPlIYiw.exeC:\Windows\System\bPlIYiw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD570f2be84153809514587cb7f0a35e3fc
SHA1f2efcd0d6e40063f36742e7352538bf4223e7531
SHA2567fae277f0831bcd39780a081680b9bc280f211cf526649e23bc1eafcbe6d83d5
SHA512002aef80c937261ee7fa73a492ebf329262dda571cad0243205be6bb938677eb90a5ef8696761a29890550744a03e1a50481bb59e2245c33a1d9e41c086c430e
-
Filesize
5.9MB
MD565d39e35a405dda8769354ab8f3a53b0
SHA199a0b6ccf45f5671e2681f2eccfb6e91e2057613
SHA2564f9f03039007f026dfbcd631c0fae560a0061538be3d1a260788fac36240d95b
SHA512ac330fa0aef27bf253dc6478dd841f0901e4f72b19f3d175231a8ed7e02c0f4fda7a276c12a7869198fe97b45b6a540404a80db908909687cbef189467028ccd
-
Filesize
5.9MB
MD5014b32a6c9996a9ae34a2f6b77aa62fa
SHA16607109e684b3889a2c13667519334b9d1507e25
SHA2568d163d8c4532c87aa120d09d4da1b42fc918360d3d130a574c8e6f3f6990c1b0
SHA512a3c4a1405822d1577fd5f1bc2891e3a9faef6d56d7c07c6e411148eb4bdd23e544f2f406e99c922b714c18a09d091e15a19078398681aae943c120e2064cb556
-
Filesize
5.9MB
MD537226beb11c4c6badf7eb5fd88ccbc04
SHA1f05d53abf193109abcbeaebaacc2447219805768
SHA256900fde47b6a6b64bc0e340fe9e51744dddb82f88bf313efc77a2ebede0c9f10f
SHA51227c7c6d010d205530fa68872d9d6cb1e612f891288c7cf5d0348737a586b55cd5e2c77b95bfbda3c07339e384e67789b761c3223a6c9a97e30cf29eab81a234b
-
Filesize
5.9MB
MD5276a9f3c812c2acced8e9653d520a82b
SHA15acee35dfe747b961392a4d4a83feb066301e024
SHA2560a7b4ac2aa02f4933c290f58d93e77590b89a43de855fa47bb26e0e01ec959e0
SHA5126185ea452c496a2bddf5a91c855d4ed999fdb3ac0f4dbbe11f19fcfee90e3c74137c5f5e687c6a65b5c9c545257ff68dbcd015196fe4ebb85f005ba20abed3c9
-
Filesize
5.9MB
MD54b0abd940ab33f82e931838fffff07b5
SHA1d8084820befb28097e77cbf3236042da73bd618a
SHA256237ba8f266ee608f38b77010af236456d776d275d51e3cf65f9ad6051878e29a
SHA5124e5dd31bced5cdb772d874e98d2b7a0bab862dc6467f58d8199e1dcf444ca15fa62354b187e9c1e21c9643abaf9581308a9144449607a52d43b5e2e1463e5d62
-
Filesize
5.9MB
MD5526424c9ccbd90805f91a54fa9587588
SHA1fb49682c3722142f938e4efc0911a6557194faf1
SHA256b2ff38989f782c2027bfa18de839f7ce2fcabb4f9278e1ecec2964eda49e0cb1
SHA512e4550021ffc06c4c4d6405d616652494e685c6cc8ae356c6dd9544282c9725e8fd28316571b8c0a3c2cef55a33b805f29a7f1f6d0fab3123e3740590210ca3e3
-
Filesize
5.9MB
MD566c8f2031af752438bd2057e536d6cd1
SHA15e1f429564071756a42b25b87985d23440390ccb
SHA2566a9c25f9feac2977689aa4e59a5e069601c026e37374983cc2fee94026cf04c2
SHA51299556ef1937e9134cf102d1b290062dc981a02b7b92dcd6bab0ccb8fbd93acbecf51f0ef4319e50c4d02554b3dade8a27f2dabb20d8e5256581b4166f51d3512
-
Filesize
5.9MB
MD5fae5e68d739a5ba95ea998697f2f7328
SHA174345f5638a178f0a2063edbd68c9db53167ec9c
SHA256c3ce4046a584ef402a9bf7888769b84df446666cf8984ff8c7800912f8c52032
SHA512ec90edfb32bcea9735b9294dfa47bbcfb2d58b1d09f7a37e4e6637ac25e52f1662f1cb92d28848e8b07f87f1310206a165008bf4d9d4e77ea25a645c2694faa1
-
Filesize
5.9MB
MD5adab395065f457c5efb3d3fe2f2996bc
SHA14791b7e4403374ead2da570bb606dbc368a06fcc
SHA256ff1aed85631919758c12abd4f6a0e6bf9831b8e37113ce21ebaaae176740baf8
SHA512bb05fe6656b7ea2242c22b71162b0f0f589b6a8c46ae95b72d36f2be0f49f61edff0115e789f1863a483b430da1b8f180d3fd12a81d3e51311e394be777cd6fe
-
Filesize
5.9MB
MD5dcbd34e50a44beb4146685903a3cf04b
SHA1e5a187132cd6ad0cdb1bbab4be07c1b5445374e3
SHA2568a22879f35b4c30b2d4ce6cfa88719697750584b1ba7d1d492d272bdf8c71cd8
SHA5129b8534e4f5de6e8a6c5db428b13a1d839dd2b89544125096e094756834f78c6033657cc11db2fd15c96354dc12f30d8f28f43a29df8d0d6745e23dfc1880b8e8
-
Filesize
5.9MB
MD57dba7f0348feebe7ded6a447d95e0f8e
SHA15d7d79a22d2bf6163f602fc8c924cf3d93d724c7
SHA256b1a80c926f70503428a776277b7ce6fa0a413d4b5d48a0207b2df1abe50009be
SHA5122c8c123b3a12b51753d419bd839a0b00d98fd0ecbef188019593d6d8731ba542f2758163a1c7e60ff1bad43015e67706141aeb00b1e7c4055297b2001ce6abd5
-
Filesize
5.9MB
MD5334efad0dc1389af154cea5247292fa7
SHA14e7f06b989deb240d6aa1929894a0317508ab6d8
SHA2564a7c40d8f1d85ae051cd7dea94d2579b51dfa15c196b213bc24cbc0de56791a1
SHA512221ff91adcf9135704eabd0566fa7fdee8e3a435b80e19b2451ad3b9c9e01a02b0972f574f21b0a1a74a45ea3ea378120103775967736ce7ac0f0cd952003756
-
Filesize
5.9MB
MD5ab2384c874084de9efd8fe65daa9610a
SHA19fea68393819f6a10e9087828b295149dd25a7e2
SHA256993ddb1483337d60fa0156b001de1fa78368b9eb85c0c5366e08662f618549b3
SHA51276baf862295ddbd3d39909b8ada2ca431b84c4cc918efc206a116ca0596f0c7a203a69a7e6c6e6e18bfbd5f3468c65f8f2964dd6b2ef14e4279a32cc37136e3d
-
Filesize
5.9MB
MD5456bb008c84cce17be2ad4375cf66023
SHA164dd86c495e8062f4d7358270d5fa62b1fd746d4
SHA256b24827646af1332d5860b12aabb77f23a8d49c750999b80e1bd2e7e03eb12e4c
SHA5124c576de520c284b8986e8f82c068fb4b08fcbeaa882279c2bb865106edcd771845eb54734136d7a3364c6a7a8150e6f96ea154a35f276693c8f3d143885d77d2
-
Filesize
5.9MB
MD5d262eb7e8a1a2389b54da1597a24250b
SHA1135e06df1eb1bd3090bf0e70f6b15b83e3f032c4
SHA256132f986387eb3fd6de1afee3f0a1fa5be1dd95210e7f1e4e4caf77dcfe530e06
SHA512fab57bfdb2e994cae124c2a1a9755dac855833a90edec8e3b940e5d7038ef46ee263da140dd83361cec8c820fb77efb44d77a3fc6881d82b57bf6b379d68014a
-
Filesize
5.9MB
MD585b3fccc13d2ad36c529c84694512938
SHA1d895a30996aadfd75ed2da2ad99f54959d36b9ee
SHA256be5853c930e063d9e9ac6f48d54d9adfc713ac40d352c23b6ab0584838b3cee5
SHA5127a48fe6f15e770e46567c954555047017088a0f6c7064201f6f219a86c329e62a2286947cb0b13b85ade110c10b447e42dc56d96be5ae00826d13579cae7ff44
-
Filesize
5.9MB
MD5256d6c93fa93736442438ec827fa34c3
SHA1c4867e9fc66943fd29967e5e1697582cd4b4317f
SHA2569790b94605e582eb9749f59c2d228d66472ed8e3213d22f1044db28d780aabe1
SHA512c4791c58091eeaf19667b76e1dec7bd4c599fb0fec2a87267778887da753d0989408d00511cb10342b5e5d45cf6e62780e4dad38f7ba65f1ccf7d7213c4bec0e
-
Filesize
5.9MB
MD521e7617f608c4fb78d64b0c8a5ae7037
SHA1652bf4286488aab73bf3a7bdec7fd22574a56643
SHA256569587249c2ad8cb350cdb34ff4d6cb1627666dcb285b42514a30698f8b91711
SHA5129d6ef7782402eeb4b9685ad43598079a7c7da39896fab0cd5835e1c1faaf85dc474fa1e0152cd9aae453c01b83b8fb437c86c4ab315352ce9fe5462b75ff9fd7
-
Filesize
5.9MB
MD5f4cd4e99b74c68375902e70797f4ed55
SHA190d0b6d3c8a8331700841f6374be2d79b2a4f2b3
SHA25662150fcf35ae60a30061c1a22e4d537c292dfa2a57db444e87c651ea865e3962
SHA512db88623e5c6a13c1a26a6fcc58388f76f37b9b1809e6853dcbe83b8545c1a5f3f23a0425368751c8af2c5dc3bb1da55ac176e714c1b275f07fef2287216676f9
-
Filesize
5.9MB
MD53f5ee1731e5bfdacbd80c35ed9b9a31f
SHA1db4729102c575cc6e4e70b7daec498272ffdbed6
SHA256474d2dfe8894ecf49394ea4058f43634103e8a0aad524479cb3752d9bae73733
SHA512d395e627ed1b0d0f104a0b76f9aa56916b2e7131eb8954e2d2180285a6bfae968f8e21f9dab994500a654180606e7353da00b68384c82cae7cfd6c8fb3fa5474
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB