Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
29-01-2025 03:44
General
-
Target
2025-01-29_2782ff77705baa731a0f0f3cc66e1b4f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
2782ff77705baa731a0f0f3cc66e1b4f
-
SHA1
f7f4ff056fa6b78d911a631353734725802b18bf
-
SHA256
fc943f765d451f9790faffb9f3627f70a1a1c873ed7bbfb7e710c07d3ef71e79
-
SHA512
09a700824db53f45fecbc32f7bf04f2071c48ef1af82bc15f8f117d6a1cb39fe25a89c61f0338834c6ef8b90b8eaa4a9bdea8252299c30cd8c07279d7de47b86
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU/:E+b56utgpPF8u/7/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 63 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-29_2782ff77705baa731a0f0f3cc66e1b4f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-29_2782ff77705baa731a0f0f3cc66e1b4f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WxKThcE.exeC:\Windows\System\WxKThcE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qttRmWx.exeC:\Windows\System\qttRmWx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AwzzBMu.exeC:\Windows\System\AwzzBMu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hZIQTCZ.exeC:\Windows\System\hZIQTCZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PoXZRRx.exeC:\Windows\System\PoXZRRx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PAeYWeH.exeC:\Windows\System\PAeYWeH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aJtsISW.exeC:\Windows\System\aJtsISW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\niHpRsy.exeC:\Windows\System\niHpRsy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qgXkJvD.exeC:\Windows\System\qgXkJvD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pSvYfmc.exeC:\Windows\System\pSvYfmc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fyJMdoj.exeC:\Windows\System\fyJMdoj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cRsUdcn.exeC:\Windows\System\cRsUdcn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XreiCGj.exeC:\Windows\System\XreiCGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cakpnAd.exeC:\Windows\System\cakpnAd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qykTubx.exeC:\Windows\System\qykTubx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vZJmIvs.exeC:\Windows\System\vZJmIvs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HjJbjxD.exeC:\Windows\System\HjJbjxD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pcDbUvL.exeC:\Windows\System\pcDbUvL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XjBvOvg.exeC:\Windows\System\XjBvOvg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BaayAzs.exeC:\Windows\System\BaayAzs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jjfhrMe.exeC:\Windows\System\jjfhrMe.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5cb7ee27453ac8da1fbdc1b5377a63f5f
SHA1ccf86be59163621d2610fe865a4fa238ca90f36e
SHA256925c431f165515cf72c7f1ec6d6ff2d5d8d2dc3cf4a839d2feed1c676736b699
SHA51252446316cc1c6205d8f407db4acae1c20a65d650f896e0caf446094a19430fcffc6fdbe63d7294ef55d33ec07e4d3a71901f400f2c3d76d95a2469440ebb70fb
-
Filesize
5.9MB
MD558e138d56be1b7cc59400756b97e7955
SHA151f2e8fe13099ec6ddf5c0e7c806b13503f72558
SHA256db648df7bc2016a792a2a5b6d96bca51908f2eb6c986decebc397d84a6e59314
SHA512fa66591fff9583a97b13ca6a2bdadd2c22604445558aa44e7cec011aaea4d49ca523fbb04e006f60d6933ee8d3c880e7af3c29b6a1fab3f977e7cc886f980491
-
Filesize
5.9MB
MD5ff3c0462d3ea834061b02ec8deaf8c9b
SHA12b6707b3fd1ff74986d936d939ff4a041d207eb7
SHA2560678ff9c2afe58fce1ced989db66ce2de2be562db2bbacef1c78629353202622
SHA51281fe10cc3c2964d5e54223ba31683bed73b4cd96045b94bc74cedd46a10b3bb92c97911b6c492cf7e97993f48075ad5ac038145e44122d13a8dbb1d12f7672ee
-
Filesize
5.9MB
MD5157f0abdd2f602b236f07b39890fe3b0
SHA1c20efe740669c279ae8a31df743f87b4bda4db07
SHA256643719fb353811b496795284256bc3ae7a7d01774495d7eefa4c8506069242d5
SHA5129e2b9ea7a0043416c03e3423ae7d6c5430a28c256e1b00e853603bbc230cff5241a6bad07d7cfe2e2086d68f517aab928f1dadbc1ac42716601c02b7ed6f6944
-
Filesize
5.9MB
MD54184567654b352eb936c4df531bf0bf3
SHA100497d168c4384f2fc95b09c002c82e298142280
SHA25653d42986bbae0d52767cc2ffbe14c8afd87cbf50ceebc0faac4678917674f7c4
SHA512678411641f7b1714500edba42962e69fdb0b8fb7da9c60e76c45c5ad076315ad4dfdcad149bcbc6d8d7e37a82e383b6440c8311a8acd5e410501f7b26f3fed4d
-
Filesize
5.9MB
MD5e50a1e9af737da6b9be92ef9cab2ded1
SHA1ff4dc1f26969c6a25acf04907f753c6e98701813
SHA25636c0842e9f696390eccf963c02a4f481e9ae8f28bbe7e28cd404f21489f1d1a0
SHA51222037d6de2ebf6100fb505c1b562a37ffa4f48462cc0c486a3160a9ef5a98f636643fe11859428247e43bcef20940bf449d56f30d0383a479ab9e63fd188624c
-
Filesize
5.9MB
MD534a8ed2b0b81862e27321704e9ce058a
SHA194db036f7ff04c1a2cdcf2274f35c383fbd75fa1
SHA2564fa2887ee21969864356da116a44bc5304b8be9a72c4d0933c6bbd1907fcf073
SHA512d2095ef54f443689a65446c339ada6af219a4a6299447a486085b83705e067702e9eae5406e224009863d0cde553b8efb1571c69c80afd777cd5c95110b86df7
-
Filesize
5.9MB
MD5d8d5d071c26e56363e4651af0fc684d6
SHA1beb58c9cf4837aa719a3e7a21686282407f299f0
SHA25609f2acbe7cad7cf0acbf4c3f0a6ad203e306194210e967459f53cea6804037a2
SHA512c2738cc4e5db2faa0d91c2d7ef1692fbdecd28545859f21883ba7b0d37135d36d3531f3ada0b814553819ffb44452f96f45eb13d24a1e24ae8830ceb5505c96d
-
Filesize
5.9MB
MD548b90882b3880e521396202f49a3bcb7
SHA109bc9023cb46e324a7abe95bce25072d496994f7
SHA2561b8e581e9955fa422438299412f414b9ffb2dbfa3b52d4d4c670b784085585e1
SHA5122331f73dd22613a2847f1ff0198460a6f6d41c1ec44ad7bb0332d08c5382bcf88248d6b1673bc5678feddeb78656c580bac37d558faa6f68545d3b782471aa14
-
Filesize
5.9MB
MD588b9d6cb13caf4aae8caf11630f073ea
SHA13207daebf7e462801fb8fd2796a37a32a00ec00c
SHA256aa4129b4a240129bbb8423f08e110eb6f9d59270a7dabc70975b6a9da8a9bec9
SHA5128a6f06db032f311b1c6c6248ac8bb1b74e1e698a1104076dda0d38332fa99bf64d4f07ef18c81892fc238cbe816f3710486f03e0757728c4a9b0f5633c04fdd9
-
Filesize
5.9MB
MD5c64af65655e14db2c4c25eb7ceddf906
SHA13f8b96ed4d1f1e7048f8f92885542e2aabe718bb
SHA25646257cf35254c35058bd32c6a53fcabda30c178b1916d73c14a7f0d1619a94c9
SHA512aad277f6c976811e29ded929a9a1873ceac23cae46fd5651d2f92a0da0050c7422c80f12ef9f8aa0b186cda9f15e9d89606a40b5280b93b1479a49ba900feb8e
-
Filesize
5.9MB
MD59d95f29a8dc15abf383716d0aa33ee11
SHA1694d424bbb16c1b15715f1719a6b026dd950abe1
SHA2564eb9fcd7c2f3d26dc7ad2a760e52633e39c937b844e0caa692da820e0a894c96
SHA5123041507ad30d92e9cc5c91e23f4a4fcace456c91a3440a5fc32dad2f62774990e02678436929af8e64cccb898242eb4b970e61da7e570932389bb1bbdbed0a99
-
Filesize
5.9MB
MD53644d1238e28a5f018ea169306fcb35d
SHA17680989535b5ecdee29060d91c228be7ae3ed322
SHA25605c8c264df59167437650211f51a09dca0688ed370194720ce8e082a0c4c9322
SHA51246cc7b49adab0363964929f74cf3927cec6619ce34bc41b4cbda5e42ea06c72ffbefebace6bbbcb0d55ca02fa26450ebfa64df08cfd3e9ca187009d4a2d243ae
-
Filesize
5.9MB
MD53024b9f4475e8c677fe9e4cb96f148e4
SHA1c0b3211f6229a921f0c293de34c7857349249691
SHA256469d5fa477d97e7306c9b43452eb7ae499582ea1eb95f34b89bdf178ee6723cd
SHA51279bd0cbf23d164173e1a507f928f2107d0a5a9817cc8465247f996084d5fc26bda2d0f679268f45a3cba8f49e0e6eb8680720ed6c18f9f507dd5b3a278c97d1e
-
Filesize
5.9MB
MD5e5f7a48fef2a5ff55052a9fc8b49dfe9
SHA19e5fb97dd6a7c4e0208870f8106b7adb9885847e
SHA256c4cf5faf589130879b955306d520eaaf557916944f574b7fb8e9d0ffb35ce814
SHA512bcb3c4a680882a3576cecb22d8269f7d3548aef469d8bea274d476e65cf3fbbd34831baa36b6ddabfa092ac409f4f42bc5e4be7fa4445b3571b113e1e7932d2c
-
Filesize
5.9MB
MD5040aa6402670c8c167202f684e703a0a
SHA178784c43e74d4a3d4bbe83db2103207e134a534f
SHA256c36c61c172ad32ed88839848815968825c27e3f4efba0d5bb029e48d3a2949b8
SHA512f87afa1bf7a87209ac5cca4ee1ec5d820e9ffcb66765a1c83528dab082e546f57e0fb2881f8d7d0d0728d63e2e80c7fbacaeed5d67e953e625211dcf19b23409
-
Filesize
5.9MB
MD566f8d67f2b498c8e15ee2b0725afe655
SHA16f5a624f154ad714fb5a113f3fa7f28a8856cae3
SHA2561fcee9d5a38b5859551e7810b360aeb18cf6ef7abec3a2d4f598b47351b298b5
SHA5127eb85bac1b7633fc068d7d34d9b1e716b4494f339c7d6e866bf49b279ff7e2d94af9a0d3057fa7a103637ac826a2b028888e0031bab38c20fbe5e3f4671d021f
-
Filesize
5.9MB
MD527c4caee8453eafc59035a8b8039a450
SHA139367285a8a6f5fd1248a537d1323131f7ba343f
SHA256407061baeaf12ffc215085f9045492090bba9bf796782236a830240ae2afb982
SHA512a5048cc60e17a983d120de7779663d64a877da7f9b5a9c158b1ae4df25a569d85ceb006489c2de70989379e30d5e13a8be7f5e214a77542b40fb7f9f79a53501
-
Filesize
5.9MB
MD5bb717b369e4b0a925f924ee4c03d7faa
SHA113e699bb57e7437fe92e2788c2fa3fa1892208ca
SHA256bd0fa05e859d09cea5fde2d083bce61aa5a24d7ce1e819daeaad3cfab7850626
SHA512e644fd73d1bdfeb999975f0ee98986055ccab519d8fde1637c35c5e3ccfafa9757dbbc90098ebf046547df8a9a38dc82ae67a82f1bfa4dfe5e8bc356a400af3a
-
Filesize
5.9MB
MD5208b0ab1977201db0d26831bd63205d8
SHA12dec8ac13bc4233dc0c9639c6155d5b598b81cf7
SHA2567c3a043f200c79cfe6316cd081d5f29e386b294cdb821044b4469b8425c9b1ec
SHA512bbb581170bb05c8849b5dbdb0f4085d284bd513d3f31e6238d5001a8270b24bf15c38b1385629d4db8e2fac242d6edea8c85c4172e3f83708a62becdc17ccc39
-
Filesize
5.9MB
MD598b2aaa4c56eb863b36ccfe173803a25
SHA19ef5a69e42ae64126749e088d02f91fffee7266a
SHA256dfa07b51ee1cbd408b9b85c86ab02832270ed409a4d47391e7449c8e38bc4131
SHA512a59b32f754b308940102dd2a5fc0eeb39b45e7f986b313f9af89e5212aa7f4a1c640b464125071b32ecdafe56bfb801d60b66d54cef609042287f650b7c349d3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB