Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
28-01-2025 06:07
General
-
Target
2025-01-28_c8972126fb84e311fc1d1ee35662b6b5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
c8972126fb84e311fc1d1ee35662b6b5
-
SHA1
31e2214fcc47f6b639c845aeafc37bb5770079e4
-
SHA256
f2832c18c928c227ae98b67754d8821af2f80d14d50330c4767e318e1b863465
-
SHA512
71492e0a6cba7ed19a030559841a80f4a0bc127e0531dc0c5dce44b5629579d52352a6668c80390970ffd2e68a410c0c8c33fd869f6a3307032e6bf5503a076d
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUI:E+b56utgpPF8u/7I
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 54 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-28_c8972126fb84e311fc1d1ee35662b6b5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-28_c8972126fb84e311fc1d1ee35662b6b5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PHvKJPP.exeC:\Windows\System\PHvKJPP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GFvpykr.exeC:\Windows\System\GFvpykr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WFJxHYL.exeC:\Windows\System\WFJxHYL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GjbqgDC.exeC:\Windows\System\GjbqgDC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MDRVODg.exeC:\Windows\System\MDRVODg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IgNLKGu.exeC:\Windows\System\IgNLKGu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LYywapS.exeC:\Windows\System\LYywapS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uRsDjyo.exeC:\Windows\System\uRsDjyo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qBcUKHK.exeC:\Windows\System\qBcUKHK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gIweOwS.exeC:\Windows\System\gIweOwS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bEhOYUa.exeC:\Windows\System\bEhOYUa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gkzmcjX.exeC:\Windows\System\gkzmcjX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wFaYtBD.exeC:\Windows\System\wFaYtBD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tHukdSr.exeC:\Windows\System\tHukdSr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HyjTtGw.exeC:\Windows\System\HyjTtGw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fDbdFPH.exeC:\Windows\System\fDbdFPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aYKfExv.exeC:\Windows\System\aYKfExv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BrJMjtB.exeC:\Windows\System\BrJMjtB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RPOvXyx.exeC:\Windows\System\RPOvXyx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wUFVaZC.exeC:\Windows\System\wUFVaZC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lXasPNp.exeC:\Windows\System\lXasPNp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD57f4d6e8ee2a2c1e64f5f810458599297
SHA15a818a5f524b6abc080f52a0e3290669892f63ec
SHA256929c0b05d8834ef1dc637136d7eb35c7e46d3696d1fb91115c5fa3b909bc5b1f
SHA51237ed735e6fa11a86bfdb945508c5584353ac18ba47ec046895ab2f506f6e593f0390f4624254f51df078e1150249af208dd6494a9fbdf2a2a57dce18c9927096
-
Filesize
5.9MB
MD502ad94f77fe0d1b7363a7f530d9b8c42
SHA1dc045243a86346508c34e49d31c1ad21ee07751b
SHA25682337091aa48bc9cce0aebda365ae2b452cdba5e3e7d02ae849725688b03ef08
SHA5127960e1ee83c3f467dcf59a6b306eac39098bdb5053525788041a137ea86875282d0907abb861b03dc67fd6b838813aa1fa0bfc179495f3fd793ff34c66ad6dcc
-
Filesize
5.9MB
MD529017592dbf609e58cab204a410e2e7d
SHA19d5c01b42ef464d5dad07a7f3da7c8135b53cd0b
SHA25650e9561f35b10982879314a10680daa51d59432c5cfc859efa1cc1b553961230
SHA5128e0d1ae8c112248060f81e79c9855e987a7b26ffb93b85838b2e4196fcfb6c20b2244b7f3db8ef7b885519818700e98a1f1393ae3d562b2ea1d090ef65ed6ef3
-
Filesize
5.9MB
MD50bc6b8c0161e4128f59094c5f8c01e59
SHA18fd5df250f614fba8c8aac085d1036db1bdd5637
SHA2564ce378668081927235af2558ad9925fae9e095e2523a273c9ce3243307e176e6
SHA512833200d30634f74a9d57655b4acde45a475e0fb7a58d37e4bfba0a9aca0fccc171a6f8ecd8295b82368530fd0086043738fb4914f16719fffd14f1248ee81be2
-
Filesize
5.9MB
MD567221417b97f268bec427f4c4f616fdf
SHA11609ae422e9175a2cc2df0f7cdf97e23ad079a92
SHA256ec3cd9d1d643facc0466c9ad2e8c96618d5f4ce21b9ce0abe7cc7fc3167aded3
SHA5122103ca266723565de4a7a0921bfc7c1a1d67facea2dfba3e9284ebcfb9d6aa2d3debd39edcccc17724a1c50a9f3ec7f52a3031662572a8ab7ae9690d3cffbe04
-
Filesize
5.9MB
MD5dc50ac4ae8c42477b9838f43df5d7f7f
SHA133a329663884a89ab260bab3591dff8516237dd0
SHA2569020b8bf021b4da01e89a022777f49d89bd53c4dfdd975278df11e96470f7a98
SHA5122e6328e1e054e9e6c6240163b31645a56c32bbc9fb9512a5ffb7d58f46fd388e4151d22f73d0bd6ea5295daef8449efc7e05203ff22f99d7a9446879c05f819e
-
Filesize
5.9MB
MD57a5d18c5aea599c95222768f8da24fa7
SHA1bf2b8fab4e04dcdecf512c4c8edfe9a1d5e07c69
SHA256980a5fc502abe63976205c2b61404624a44f84332c12f670b8c4e3fa07d11911
SHA5121d121f08f0a04c14aad1785a9f9b778d915fc455d13e5bc26b18c0a0a05a2fad7747d715397dd15d58daa4364ee465146b41d6ab79f9fe8f0b9d0123f4830362
-
Filesize
5.9MB
MD5dc5dd1a553b001f91c2610c951a34e39
SHA153071e9e975d8a18d72ba3164727b85ea03d69c7
SHA256c2e3b959d76b3ef2083dd35975d1f351dd248f7125e7d7b6b4a46a55d2cc9ea7
SHA51266884b00cda3c3b2862492206acd4ea0dc62394ceb1aac53ad0e0d4a5cac5f51663b028abc0899c8287e4ad493425b4f8bdc4bcbf95bfe482517082e6febc588
-
Filesize
5.9MB
MD5cc4df6725658314acffd5e9b8348bfd7
SHA1ee16f9458ca922327fc41b4dc195d788dd411adf
SHA2564fd5cb38407c4a166c4a0659eb9f47afc0688dc2b76d641be29a36c35a64b374
SHA512ebd88984a1fc3fe4bb416ca035852f6b7b693d26b9f6dd0f3981d54e4c3a9824f3cc8ad1be1a24112a6a6fe44486e5efb38794f577fdcfec8055a26da2430dbc
-
Filesize
5.9MB
MD5b699d0935336aca4fe6e9fc1847fd2a5
SHA10e1c5f6ec329f475ae16068fcc4737dca8ec6029
SHA256e30c40c405a7d5108496d512fc4bac2b519a724860b9dfc2287fdb7faa574dae
SHA51299e95027cde04356bfb9a1918d121943738917f351a3df76bac162b0c1c2f808a320b6517d429d05dbcd82a2c42fe34cccff9a295248fce96dc8d24904c9d6c6
-
Filesize
5.9MB
MD53e960d0c7a6e4897e28919ca961334e2
SHA145aef2aa8bbaa70518ce4ecbae338e6003530e3b
SHA2565915b9ac97de8d773e1242c6698bb54763cf307e1333ac3a9f99d790f14b8643
SHA512a23121c37379e51268d0287ff2e68d23359b682ec0d25a27ca255957551caced2c51c15337e00a96cc9aaa5b22d7113d149a62c9683d159ef6ef93443a488957
-
Filesize
5.9MB
MD5bde6a0bad76bf68732c4606e6e32e9f9
SHA18038435c86030821a8854b3bff27a27cc3fbc18c
SHA256af79aa375bca8024bdd91472148c5daa7d39b11b9c6addfbc1ac054ca72eff34
SHA51217a81f3ee4b603a92ac48630d522b04ba8c6811be4ae25d094c44fd3d2d5157ac9400ffe9c02babda4d9eedc2a8a9dbee7b5a944dee3c2fb829208e83db20963
-
Filesize
5.9MB
MD51fbf6fbf256a9c22c615710d981cb910
SHA192b9b3d28173f4f7a07c9335e48e1e334b5f47f2
SHA25639dfeb253ebc81bf9e2f97987481a2c842951429afd593b4b10b6f08ad77ea94
SHA512b5497bf821556bac90f981ef50676ad9b3fa3e7c4594061746d5786bc3aebf44775e4734390411334a76ee67c13445935050bf8dd65d308333bac3e78109192f
-
Filesize
5.9MB
MD543243a34a1175f79894ea3fdbc9d2af3
SHA174b2ff0a8ed3c0fdc85be04d4a5d5ab89f8203b3
SHA2569497cda5f7088a3635f0d88dd68b35fd19c8c55dbd0f413e9dae341950c7e214
SHA5127e3587d4aecbe10cab336204d7e2bf9854245853de8e47f7c25dd8afc0bc479d01322492680eb3a1b5e1bcdfe9a1fb860fe35d3e28a562984214aae200d809d9
-
Filesize
5.9MB
MD51644e28ece4fa59b2253fb68d78d5c63
SHA1dc180c91cb0103c278c8c8cf03b250ff80080e0e
SHA25604e5914305a918bfef8fc67782104469a7851c3265feed1ddeb4b6aec735d42c
SHA512805ca78742bf19c5528bc2a60e6516543743bb24a8011dc6c289fdc5396406ee04e0cc61fd2f31e98fb3a81ec1b3e20972bf07a1c481552e92a1c052b385e75b
-
Filesize
5.9MB
MD59981522acbee224e96d4ba5f7ea020e4
SHA186322df762fafdb20f9fcde7d27743179c410a90
SHA2568d41222ced783326e9c7b1baa8a46303edfa819c1cdf52515baa2b3f7f805590
SHA51217f9e262802ec2aaeecb5bab742c84a49e6d4f95c52774fd97050ddb760278e9acd9fa0c1f718868c6c8e285ce3382cc1dd33e7f3815de76ded575cbd9012f08
-
Filesize
5.9MB
MD52eca06ddb3cec1cacc3f27998820a0ea
SHA1c3ee7213049b916cfc8c06c607b166a4a7bd6d88
SHA256ff3fdb1caabf8b7de5c89720cde305027840d2af26ece29ead6dd9f0e4dc0929
SHA512bf3837f91e9c6c16f39b729a986d92bf6f079ecedf7659c68f446eab0aae31085c9858de935c779d597c28fdbe979e849dbba2990c82c2637d489248db424caa
-
Filesize
5.9MB
MD5e9e44cfca8a7806d20333fd8eeb14b8b
SHA1cc645eb3dfc8d2a50199db517e64bb97a4991566
SHA2568364a998d0a722c10b61fb0e49061037f7cf8110fba5bd43d56916bb0b2598d8
SHA5122e040053645f80ee7512d6b4991c3a20e4a1ab94a1b1940783a7624462830e53c0df8ab1deb3b9b6550894959409bf4ca05e18c85f781a7ae6d1eb0ddfb74859
-
Filesize
5.9MB
MD582035ce3ccf521f6a39f1593e5fac289
SHA11ca5df9da3a93055e9ca4bed12d16dbcf3bf5353
SHA256742522cee15aea0597b7b4d9ed7b96d3f1047897e41eeaa008378fb7e5d28600
SHA512ad748787e6f06de82f5942cc12420bf9c2c6c159b58ab8032934294efcb5062360934dcb2fef31a0abf3a38911577d748b5f65a73ab8c318c46617c626f17fca
-
Filesize
5.9MB
MD598fb1d340fb03e8f44c0afb6c749c834
SHA150d72a9231758e153bd8a26c560c490b252c7d2f
SHA256c7cbae45aba55abc6182bfbe478da664ecbc9e918c8dc1501f2c989857ededf3
SHA512edadf2d0563ea909352e3260e90c4d1cf4418af65bf95847d96060f5766ab7af218f85b1226ed5d1dcbacf2c7c5b134aa7cedaf5c1631a074cc3c37eb48139c3
-
Filesize
5.9MB
MD5fcca3e12762f0393c83d45a7c0f15bd3
SHA1899dc4781098f654ea33d5b585e23e97e071d8cb
SHA2563fecca5cce143fd7a1f6047b7ef3fece0f43a20b27bf31c0e4bf15b0b2a02664
SHA512aba11c1d898da206405314bd3a02f4e74203c8e8a4708b4f1fec4702229e4a72b84f5609f4231de598f1e6742abda374d12081aac27f49f4a5c7c7913819a528
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB