Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28-01-2025 06:08
General
-
Target
2025-01-28_de25a9e936c6c9797cda4308e055fd20_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
de25a9e936c6c9797cda4308e055fd20
-
SHA1
6b53b2521f1402c6a8ec2d88164b1a2ecb2d788a
-
SHA256
1c69d46987525c0cdd385b47c07d066a1ec9bcf120e223f6db89026b4cf6cc2b
-
SHA512
6f91eaaf3086d18fb98b574d7ad29d6dea81e804e49ebe7f0ee115cc4e94699a207b997342784365837988e5192d541cca8c121058556114ff142a5aa5739d58
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUq:E+b56utgpPF8u/7q
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 54 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-28_de25a9e936c6c9797cda4308e055fd20_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-28_de25a9e936c6c9797cda4308e055fd20_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ntEgLZc.exeC:\Windows\System\ntEgLZc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uYFTWRj.exeC:\Windows\System\uYFTWRj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ffiCvqh.exeC:\Windows\System\ffiCvqh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yAceGWj.exeC:\Windows\System\yAceGWj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iYoWMjv.exeC:\Windows\System\iYoWMjv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QmeZIfW.exeC:\Windows\System\QmeZIfW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vdvwRrB.exeC:\Windows\System\vdvwRrB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bzwolvr.exeC:\Windows\System\bzwolvr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OjIWjcO.exeC:\Windows\System\OjIWjcO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JpKqjif.exeC:\Windows\System\JpKqjif.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\herFCVs.exeC:\Windows\System\herFCVs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JhPsOYQ.exeC:\Windows\System\JhPsOYQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZBujWxN.exeC:\Windows\System\ZBujWxN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\btiBnvv.exeC:\Windows\System\btiBnvv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rjfrpLt.exeC:\Windows\System\rjfrpLt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FrjQAjG.exeC:\Windows\System\FrjQAjG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aTTKksb.exeC:\Windows\System\aTTKksb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vweabza.exeC:\Windows\System\vweabza.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fPvByxc.exeC:\Windows\System\fPvByxc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\joCiiIj.exeC:\Windows\System\joCiiIj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BxlwqJM.exeC:\Windows\System\BxlwqJM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5abab0defd21cb90397695cb606c9f764
SHA17a69f922c93a12117c8b9d6138ec1e2a84637e4a
SHA256234ce0ae3610001465cb85c72f62cb9d7e7e9b9024b112c74640e4e91d06cee4
SHA5125cb3d5b9926fb612916eddb7a981eb0227f4a51e937caa683368158651bf61875b01e12a3ad073d626460f11fe2cf623bedf9e20e304516d6f5bc404bbf09db5
-
Filesize
5.9MB
MD546eb7a0e1a7f68c89dcbd9ba5c900fa0
SHA1eb45bdacb23d7e3c62edcd385a077fa5fbbcf329
SHA2560af7c4b4623bd1dc3222e229ac8f36285f699e9bf579f3c70f446204384ec67d
SHA512e2387e1d636c47909f73a4659665eb5e1e475ff4728c52fe8e80d1279676293eec5f10809e0e2e0c80b50d402bd918618ad4f4809092572de81e94c6ff9a5b50
-
Filesize
5.9MB
MD5f8232de0a86f413d40b338d66fb98297
SHA1d6c7055aec3095a36f1087e8dda9083f3e63ae1e
SHA2561a81022be90707704d5b92d37ebcdc439f92f5283d0aebb06c6ee1e0ec92b040
SHA512c47d6ae2cf5e0f7a9ced790a8d5d075fc204d5b87aeb76f5e5911f563f90e3eb2447e3ca12ef7d67676084722facd216364ede46569ba7b443f2fa6539e5ae6f
-
Filesize
5.9MB
MD52158737548950a38e002692c4a2e925d
SHA16a67d6984b20fc40e4b654446fadc204edb0b10f
SHA256df23fe2d1f99d2f48258801a5ac7a1bbbec394f69da47f23d3f5d43acc77d5be
SHA512d73e279d99354370c6dc3c443680f5d7022be169030c213a079d2f298f338b33f4e9b166280f8a8f224c7897abe3d3b73f2657d1fc6261f8aff3c1f7d18985fa
-
Filesize
5.9MB
MD55a70dbbb74b2703e8359ae738693adc9
SHA1d0de23f18866391ebafc4b22597d36fd7477c5a2
SHA256dd3d3557891ac5b45ed4a83e982d18e2a7ff4349145a7ac7ef59f5ffe373ba2e
SHA5126d2b63f49777bb1baa6f26ac7c2d8c80dcf535095522e63a4de0b3b5cd463a983865235c8261c2772851cd36576561f19b4cb0eef0ab40a32af0a1011d9ef8f7
-
Filesize
5.9MB
MD591193e370e0f67980a104bbd2769f899
SHA1fb1bfca1614fa75fcae7bfe0b0c27fa31473ded3
SHA256aad22a6bf40d9e190c1dc0f034169e713fc6b5b7bb320960ff8a547ea5de734d
SHA51289876d642d8ec4e71b878505e31729c48779fb827c9c80f0f63d47db87bacc68b37c08eacd4bb38c81dae0e2b47c92bd15358a3655e08c2e75503df20745d65c
-
Filesize
5.9MB
MD5ec9dd5032aaf0a2a6a1b59e800bf7f15
SHA1e7e5506527ed57f46fb31d7af56af02a7e3af99c
SHA2563802781a3bcf5ef354087640600be7eb3f9491b706290ecb3890ac399724272d
SHA51212489a68cee3a491b110e3a1972e8b3701a35e5acd72a9fcb80d853bd440f511b80e0ad3ac01dcc09a0bb06873e84125cfd53aa8b1727593d15b3d0a80ba5bbe
-
Filesize
5.9MB
MD501019d64ea2aa730a6b6c634113240dc
SHA1933803f11587dd9139e07ad492139f034be3358e
SHA256fac22689e29a392ff6a9c1beeaf4efa0b0a7d3ba2e9ec56409e74c0c2c1c0b37
SHA51252fb9009ba9606b9118459710314467dee2dec6ba59a7e43760a458bde0310ec23eccfde83529b40f7812138db5e154d394e22fab86d4e0df0a0f497564103e1
-
Filesize
5.9MB
MD5acc5a693363be67b5a1a28aa1a6b2e11
SHA136183d67e81da3bb1fbdc4da8ead040165caa8ae
SHA2560f7869c40cced3bbf1188692ccda6effe399aae58011ccee16d21c5783be71fb
SHA5120b213d596f7c1b770e6f13b6a577a6f1ec04a17ffdb77dfb2e2bf8bfda32de2f9e922e3e5d1bbf8510e849d0eebf4081c45d1bc577bba7d526ef909946ee5ea2
-
Filesize
5.9MB
MD5dfaf23000e9c55a925e64bcbfc8587c3
SHA16f2220cf3ab18ed6aa73a7c79dc7089f44822991
SHA256549d015d124df7aa95a688ba43c93d95b4077f09d00c201bcd471ce5cc47701e
SHA51241669010a70345081919f036862906a09e515a8bddcc9441aace84986076ee013897b12b47483e48fc3f98d79ad2df9c752fbfa397077d000839dac3b8dcaab6
-
Filesize
5.9MB
MD5a92539ce14c54796d19e9b43e7ce0697
SHA1e533dba2b82c49203e8cd05115e5eb519f83db25
SHA256d40a2bcfeff6991d61b770f99cfb54c50e0ad665d329461e5d6398796ae56de6
SHA512252115f4967eb435a59d6956e71f57f8df1e7e11079822f0a143165c1051656c8cb7c8495bd702cc90a547d49beafc231d5c1aac6df91ee5d8094a28239c7259
-
Filesize
5.9MB
MD560e184dc9d97484a681c46947eac0b23
SHA1573de15dd3f0f048cef0b440aa63a238db64c51d
SHA2565e8eb037f61009ebafb88b772e7a99c43520a0d85955fe4f020d9887e5466847
SHA5128c0cdc2a9a4c45d4c5bc728f5c1dcc5b11ed70eff0c8ba37bae74b20ea234dc85966edc742a567b8e6a7da710efda1d0d4e5f21e2433ff73d786c41ab584ea12
-
Filesize
5.9MB
MD504045fd2052abaf86438703383452875
SHA12493ba6ab6c5828b298cf02754a7d5dd1a27d2b9
SHA256d13da941fbdcc4c88f33fa72226b2f33cc0ac180dea626ef34290e0910cfc286
SHA512d6dfcae9ead5489b04e1848f039b05dfbc68b6f39c289104254cf63c781054d3ddcc6187472c2fe56c79bde87c9ff55d2dc4957d9a4abe3bbd4c6e1d47c5d95e
-
Filesize
5.9MB
MD5e1990fa48cb19ab15d6c3c16c4096af6
SHA1eaf74a757eade5937b8c1e91e29407162367e6fe
SHA25650bd7af0abacf91c65986c137bdd8edca05d7d179aa4bd25d876daefe66fbc9e
SHA51296cd78bc9f25e7faa0a17b219a203cf32a4352def7823306c64650d9b8505086295d1e4bebe2c175068ffec8eb01417a0c21ff6328c11d021dd3831601ebb2ff
-
Filesize
5.9MB
MD5b949245e7bb9398ffd19df177ee709f5
SHA119ff5caaa4f7d17b2b3df01c6ca01303885cee71
SHA25688fdfc03039146e573399e6e70628042099c0df12001c5b7256bd0a41e98ccbc
SHA512634c39e1d9f72c8cca0004edb2cfd47916566b5bf7a56f528eb79bdf44732526aa98edcdc3b72f6ed6a9a6359d95f49a132aea072774fd3463bd84652d40e0f0
-
Filesize
5.9MB
MD5bd038cd8312ceb0f55c1188f7e7bdc7d
SHA1cb3c64f5cca0e2ff8fe58f19f918645a1c1ab5f7
SHA25629314b11283273aea0ba3f0a6c6ecfbd4118b0dbb4456c3a87b4f8ed62e7414e
SHA512cda4f044b954c7130ae1ef5a52e6ebee3e5c3005aaeab92600984dd4c78a17695c3f55a8e2ef8fd2c9a4802a1178882d73d95b18cb1f0a881a1f1016f3d1e65d
-
Filesize
5.9MB
MD552cb7c55404dc7426ec4b29b4f8ba628
SHA138ddabcc7c32582a9f46dfaf5664885ab73564b5
SHA25664f71dc0e04fa4afb23f44f46d1a6387b412c0ab9888e9a812159a5517fba6fb
SHA512469000efb091e5f8f39a6e68a91753e2846129007cae388d1c32c7721c21f57b5b660066c9d321ffcbe46f0126ad033c49d052c06cf82cf81c012334269fbf00
-
Filesize
5.9MB
MD5ca6d979f04d313b04eaf5e67260ece3b
SHA15471a11a60a8929adb5ba40028f67e298e18595f
SHA25609b2f61bef756955a1f735389c7a337c66b57c701d5e8ab12e9f8853e4115328
SHA512b6ed0a2cc6ea8f13b9fb1c2a400fe110a4927148bf9eb3cf55387103bdb7e46ca9b66bd32a511030204b8784384bde90a2a659de4f646b6d87ea6ceec7b8c348
-
Filesize
5.9MB
MD51100b93290ab10c3549b4bf8ebc8cb60
SHA1c011206437b368c85a1d76791312985fc4ba5551
SHA256f43df97697e306a7da0f65d6c64557dcbdbb20c2ff3571184af7abf83009a7d2
SHA5125023c9e3dc7a9be3fd31c87477cd1d1954b6c472fe076fd18e2650054df0b8cd1bb62e753123977c9eb6f8ee478917375fe504d5c232fbbaf66bfa710fa53daa
-
Filesize
5.9MB
MD522d4c3ec5d92f13f829a2fd24bbeb541
SHA17aaa18afbf478ac1698bd4275f2d6962763efcdc
SHA256758576cd1917df9ee276a5bac501b50ec80cfe809e7d9d853ccc3f824ddbc5e5
SHA5127a33f892edc62816e949d4d8361d5c29ff1f48bc256ff1bbc4b16144339690e7f952ffc4592b13bce7e320afab2c0b73c20a7f679693a32b7f05fde9dba55db1
-
Filesize
5.9MB
MD505fbb2370f696211bfea1b7199ed00b5
SHA12854f24d3a71815692cd4be91159fa476f063404
SHA25623f323b477d170f8bbc4aaff156a2f27da946ba4c6a117ea11a540b31f0922a8
SHA51291850969fedb38979c443295297dc3533de1344f3b7610e235437cbe156af50c6dbdb770fcc9ec4a33821d77655e63b6ed8dd9333f891740a45f70656d23b0a9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB