Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-01-2025 10:32
General
-
Target
2025-01-29_81d53acda2f8b4b88f8b07c4a0700fca_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
81d53acda2f8b4b88f8b07c4a0700fca
-
SHA1
d03d01366479d7d5794685f93852cc90f596b17d
-
SHA256
ed8f6fe064887fd31040f9b5155cbf78063b861b8c3b7c7b042d076b144d1097
-
SHA512
830f4449cdd2e146853ccb4027c9c38ec6ae05fa4d2969513090132e76612a84d8bd96e38f30bbd8f5d3c2dd10ea91f101c6ec170f8f06304a5937c213dcaa82
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU/:E+b56utgpPF8u/7/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 57 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 52 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-29_81d53acda2f8b4b88f8b07c4a0700fca_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-29_81d53acda2f8b4b88f8b07c4a0700fca_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UBroAMl.exeC:\Windows\System\UBroAMl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CCDAbrC.exeC:\Windows\System\CCDAbrC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yxMMsPO.exeC:\Windows\System\yxMMsPO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rNzpbxP.exeC:\Windows\System\rNzpbxP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CfieGxV.exeC:\Windows\System\CfieGxV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pMXnQNj.exeC:\Windows\System\pMXnQNj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QDOyKzF.exeC:\Windows\System\QDOyKzF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wOBhNRY.exeC:\Windows\System\wOBhNRY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dNupEmW.exeC:\Windows\System\dNupEmW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BdTKusG.exeC:\Windows\System\BdTKusG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VjwvcCW.exeC:\Windows\System\VjwvcCW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fPIJeGc.exeC:\Windows\System\fPIJeGc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eLatGAd.exeC:\Windows\System\eLatGAd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EadlgBn.exeC:\Windows\System\EadlgBn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XMnmGiy.exeC:\Windows\System\XMnmGiy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PxXXBUw.exeC:\Windows\System\PxXXBUw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CuUuVdO.exeC:\Windows\System\CuUuVdO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fzPxONT.exeC:\Windows\System\fzPxONT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TZYFZVd.exeC:\Windows\System\TZYFZVd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iTTnDcK.exeC:\Windows\System\iTTnDcK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RptSEgb.exeC:\Windows\System\RptSEgb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD54cf54ba4c53dbda66c6c303e1b55ca83
SHA180162fcdc7ccc05a67bf61ea1d69aa686c0bc09f
SHA2561641543132390907e0f175e39108ee0661dd54ee1fc5ca69e5327829bc26df46
SHA5123d0f4c51a4e1f8e7a5b8dcae5d1760401efe383204f382b7d6d49a7e7bd041d798ca0333765eb6da2495a65266ab23a712654201f7ba96b581f6e437108d390a
-
Filesize
5.9MB
MD5f8611ff5ac69cf3f6d32cc37b4fd33ac
SHA1960caff457a71661b9d30b884e15d5c954294745
SHA256a30b25c2b51f54ccb3c72884533a269c4fb9a311936f1710c02ae84f0c65e079
SHA512d48327dd3c272e96506dc9eb5958785b689d5e3628eac0aec6961608ebf3c52384d40dae552758dfcf2f6d0fc71d7a2997aa54dd589eb4bdba192feb0525f6d5
-
Filesize
5.9MB
MD5bb56b5766e8078cfb59f87eb00c49523
SHA1a86a0b4e23a038aff6eae65856e7c25b355e13be
SHA2564702320ea12abe1df3de3ced7f7a754b784f7cbe0640869b6218f015c78ea418
SHA512442bd9fb2da6f769e02dccda550afb3182ecdf0cc9f14004b7bf687e64c9df45281a862724871856a80fab911d5375d793442f4b6fa66e70247fa972bfb91157
-
Filesize
5.9MB
MD5be1e78fb98d746d98d6c3f8abe806641
SHA1fbfde4c8ab8f000e5c1f022d22515e5bc26fb11b
SHA256c7ec2ebb370333ab2c740f42d8019b46e6262fca50e062313ce883fb07eddc29
SHA51231e061324a71700e201996425ce39d0456770fead2160bcda91fce3dd68b0d3ce1d7c03f260892609c8a84bda983eeccb0632b02c52c18467a1f0596afa7192e
-
Filesize
5.9MB
MD5feafc0f00905ade37a59d990d35cee75
SHA17146d2187d4553cd837c380526b48ca7e30e0db0
SHA2568195ccaa0b8f4d2f245d1a7b48a49ebfd87936f39b5ed8d0b34e1a7460053ee2
SHA51291f90455fd5535fcc6860c4bb41c7c45a782ce1497fa885d7dada2f58927a2b19a2f4387b90b3389734ce16f03edaa90192f6d8cf2d394c4d66e0b1682efb429
-
Filesize
5.9MB
MD50d7e4715ae1c2ac4819299f22e623eb5
SHA1cd4bf620f068ccc85c63b94a7ba6a072534f0174
SHA25602d92c381f253ef30668176c7700c47669072e68e2f63173395b82ff762b5fdb
SHA512c692100732d5952ba99388100417fc0ee642912615a6773053bc1ddea6079f15a7527a46a68df585dcde055c7448a4567a6c4fdac8e881668ec8aa5df0b59c75
-
Filesize
5.9MB
MD59d4df0517e5601cb9dd3b7dbc7a37347
SHA19479523ad1b7e5544e1974d653f481e6376cf699
SHA256346a7706349e0bc6d63dec6b6bf6056268d99595af0d0b61f418c26f27b4be83
SHA512b380ee6a2fc7f3e7e98692dd335438231cc15f96c3df721d4a325497540024c87409e5657c48ba35a3015622f2dad410792a28fab1b253665676574cec69a8cf
-
Filesize
5.9MB
MD5d3f2cd32afdc08dc0b8bbb3935b5d38b
SHA145a7dac7edb924a1883c85df4ca13682c5bae72d
SHA25608c9d37269a46bff95dfe362d53e1f99c15e10aaf74c41b1b496f1844a0ea525
SHA5123ef8fbacca9e20ed8cdf309f2658f3a2290cb0003fe1a1782b4d9d5a3f104ca4696eefcd3608852b5e4ceefa55312529c8075c340c3176e62dc88ae7832d793e
-
Filesize
5.9MB
MD582d4fd220e7d4de901484f076977636d
SHA1125fc731b800f2ad0bb915ab0d7473c4cf4149e6
SHA256a308c8cba7fd7bfbf2abe45f85c76e6bad096d6cbc7a6b0dd1c9e54a0597606a
SHA5127f1b142a55fd05e2c81d8c61077a9c8b4afd052e921e75e2e5f0006c5ba9a875fa8b7866f27d2bccad9b1578e7b3a2bf3620787227f9da87c2824754f780a9c8
-
Filesize
5.9MB
MD52ebcb35ca98138d8c6268c33b415ec0e
SHA14d497548b3efcb1a4790ca298b5e962ad886cc50
SHA25626b995f871ff8d3eb9c2153615d6c9bd8ef7c3fef33bf383e07b6646af5e152f
SHA512c34d7a727b4593fb47154ee284f463ed4fa514e6bde6d9437d4cea61f6b06cf4bcd9df6522fb3c29585b337e82d7f75a034552625a3be0e29a4907921ea3950c
-
Filesize
5.9MB
MD52b72e2522cef0f049735e623935eba8c
SHA135705c3124b22b438b2633c25e6992d2e15d5130
SHA2567a94b5bec4aa25d65636a095e82f1c481a4a304341eb154b48c3976fcd52e0e1
SHA51205461f6b39549603c07d3eb5a045cf7d12f9033ac66555b99376ebaf54971e96e8ac736c81be671841e85eea13e44c317559a8b088135946538e2ad48d4435f5
-
Filesize
5.9MB
MD59ee3b882dd7ed311653e2708f7f0eac6
SHA1ab78fc47fc80dbb5672835084082b9069a1e28bf
SHA2565efc408527a5f1b7643392fbfac2e8489984fa3f789f67508609d877499fd467
SHA512bca8ef6838743585b804deed6bc4dc9301d41a8cc27eeb890ad6f03742136e4be6d47a2f058f3d87830d1fbc66b226d8424da6e1da0186a115c059910237e0f4
-
Filesize
5.9MB
MD5346514c80abcc2827332b57802cb0b5d
SHA1f5dd57fd85b3be57d9c42357aae6595b45c6bbf9
SHA2569553a51549aeaacf3ec9ce657228bfd7ee22d30a2a42cd5babe21b45e40fcb47
SHA5122c5b38a1591f7932a03b09444593f601f596b4b89aff0273f0f1019787fc5e34da9c95b93ae3b97bd383f8fbaab7d4f8c874465417e922a3f971f00ac97eb81b
-
Filesize
5.9MB
MD5d41d2c9e854d6b83944136c0305eba68
SHA169a828f4b4136ae2a9d2b98fa2c8d50147118936
SHA256887a2e83e163ee3738ebe8a5bce0b0f1bf8dfc4c83988fa1fdb110d230fe8518
SHA5126a8fd3b3024fe55a4e64a0c58d5660f407c5ee51a4d184d4ec856da1ca4dc09aa764c6d1844cb1a72006da5981b1249b64a82e92965751f3f46cf6a5eb5c7389
-
Filesize
5.9MB
MD5184cff56b7423a86e6f7f45598182c17
SHA1764dae545d9595a975f7b1d7812149a8cb943d9f
SHA2563baecf30ed079b429f642b1eed27bb8a024e53288c9b879bca7466a5ec0282b3
SHA512567f5004e97700d50ad262ef7ff6e4d81958b606e17922e8c2287e6062f01ed772fffecba13c28f80c7dd3dcc7192f98d591e27bcd24cb5c45bfdd754bb54748
-
Filesize
5.9MB
MD5825bd66aa3f0b2078e1f8871debe4e13
SHA1196fda79a96b318304d80b95313735212fc5667c
SHA256e22dd879127d57d3fa08895da250c4308ed1b29b036bc362a7d5888b06202b57
SHA5123a5a371c3039b584df0cef3ae9526cb03d0ab805ba3847eb9a57e0ce1e5ca94483388a533628c57454250e85860ec7debeae713b12204f1484be19fad2658573
-
Filesize
5.9MB
MD5f0e118fa49f65884eea87be04b93f864
SHA1d8eb8323d93d2a29f5664db6aa666a7b56ac8582
SHA2565b83005dcff0f628551e8011275dea92ba72e24c1558e0f32d551ce59fe3ea74
SHA5125d79bb7693f8763177eb5008d5e5774be1888ed81ece02849ae01366d6b004b3eb48d8ccbbb1fda0674022fef02a8e71a36af63f06c3fc955c70ca59dfd5ce64
-
Filesize
5.9MB
MD5362f19b86abc3dd9ecb18f987eb25e56
SHA1f0f086260e77f246ab65597e2bd12012cbea56f5
SHA256ce68687c968f947a6cd543b5ae969639c599eb149fb9fb64269404fd002b5bc4
SHA512c1181c1f409acc7d94132f84478be26bdc1b05b0aee9606c0c547a2851cb064b9ddc7c9f9ec728e7e577cc1dfdc2526279c866460142516716228bffa64d20ce
-
Filesize
5.9MB
MD5ce59383c97cf42a46a26c4a35e3b9a1b
SHA1bf13ead1903d2708f2c14ef4d41c5dad00cb6f68
SHA256161d0cdbcbf9094305a36b02832dda2868d0daa6c8fe5068711caa6a40dc4c98
SHA5120595a34a46abb774c75c70f5cab3d5f325adf1824bb2486f769c996453706fe0e5b234d4fe204a16e35fc1424ece49732547521d8e9fc94efc693c7c3324e85e
-
Filesize
5.9MB
MD50fd46a37ad68250d360a53074d9e5a65
SHA15998fc51f9026b8673920fc50403413bff8e71da
SHA256a573bc05fa23820a076b2ab687d517c6f33a186ee8b9e71ae61a8e2abf82d2ce
SHA51232f7b8a355d246d14313e72fdcfa70d079b5e502fbb244a9a38d0ce738c0ffcb4bf2db87a1d5547ab595977461aa3fc552bb631e9fceb76d07d52d7cbf35c356
-
Filesize
5.9MB
MD5e3a03784cad4fa020a9c20c43cde7780
SHA18031052364e557523e88cf92aa15a725f66eff81
SHA256e27cd7cd7a5723f071dd5a31334096dbfb071d6b7612d81a1b5f4945f72dff77
SHA512b684143ede28a60a4b8a1f248aabdfcdcf8092acc2de7b2a7ea9af7b34f4987fa6dea75c4632d833027d4e944292c4208b754cffd9eb70c2628b0e10e45797c3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB