Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-01-2025 10:36
General
-
Target
2025-01-29_daff17c684f844bb75ab147401f0e246_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
daff17c684f844bb75ab147401f0e246
-
SHA1
7a5fe0567b0bb803abf35fb1ffb95c6d6902d269
-
SHA256
b18c5ff567e71dd847562e298d89731550ddd7bc13cdf98182ead29a7f4e1269
-
SHA512
b524418c6a937d656e300f2a3d9fe8ecc5bd995579d35201fd5b7292f44504fce960b484641be516220858dc4085acbcf158d05ab3edd2fa8265698c8198ff14
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUS:E+b56utgpPF8u/7S
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 53 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-29_daff17c684f844bb75ab147401f0e246_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-29_daff17c684f844bb75ab147401f0e246_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IVBZYdF.exeC:\Windows\System\IVBZYdF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EaznoOw.exeC:\Windows\System\EaznoOw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fWfYumn.exeC:\Windows\System\fWfYumn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CnKRUUo.exeC:\Windows\System\CnKRUUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TMLxSqm.exeC:\Windows\System\TMLxSqm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lvwFAKP.exeC:\Windows\System\lvwFAKP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dJDzees.exeC:\Windows\System\dJDzees.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fBPbcwx.exeC:\Windows\System\fBPbcwx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lOMclaj.exeC:\Windows\System\lOMclaj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cubrOOp.exeC:\Windows\System\cubrOOp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VKXhDDd.exeC:\Windows\System\VKXhDDd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KaMiUNG.exeC:\Windows\System\KaMiUNG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PepqtpD.exeC:\Windows\System\PepqtpD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KXjwQAu.exeC:\Windows\System\KXjwQAu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zakSGMT.exeC:\Windows\System\zakSGMT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\anZewPn.exeC:\Windows\System\anZewPn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jrvOpxu.exeC:\Windows\System\jrvOpxu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tvcLUIC.exeC:\Windows\System\tvcLUIC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DgVTnum.exeC:\Windows\System\DgVTnum.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GJAdcwu.exeC:\Windows\System\GJAdcwu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PvOpUbn.exeC:\Windows\System\PvOpUbn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD538ffda825295ff92086a4242df9d6c36
SHA119371ad8e185f39379fb297c3fd2d3d72a901c00
SHA25698bf6f0b324c42a5b759ae9a611a66c2733357b34b17dc858a7e810d52c695da
SHA5128eb07fd960b6b7df411fd23e1841f2d38f882bf0bca7c4aa00372ae0f3c8b5e046686d3dbf4a63db624f03672fd9b8b0c620ac03872cdfe96231c949f9b6af20
-
Filesize
5.9MB
MD527868a4700c8db9cf0c660643d68f712
SHA1385c3581f09c61a96e4a8f5d33bd8d9cd8e9df3a
SHA256472ecf2de89277be66f8963ad80f81a0869f7eb38c04f63cec6a9673483a66bd
SHA512bc260652c03c7d8d374120d87f6b24f0aab364d927852b5c7eaf08f57a84fc8119a18e0791a9828b288bc740ff47a3bcc512ae072fcc7dbe5974aa543ac086e2
-
Filesize
5.9MB
MD592f39e0b9472e2d9b908052f4b4ace35
SHA1bdac2b2965ce376129a0fda8664e3d23dc6a48c9
SHA2566f935647fcc821e41930e2dfa659550fb7d60ae651a67e351f2931e5191cfa31
SHA512241852fca8c53aa5092e5c73a775b626deb1962c0f77bc6b2b33ecd5f871704d85fa49892b19fe0c11fab880df68504c0a285f5d24278a69465167e974ddea3d
-
Filesize
5.9MB
MD51a160f8924c0a27fa4977124224971fd
SHA1f1d0a2af279931b8f356fb124a10f45b5a4b0b4f
SHA25607b75fb0514da3b4f28f1b4389f4c998a14430d74d96f54ae07ea02dd613f879
SHA5121ad60075ca5d57ce627e86fd2846f81b0ae732c28aecadec06780eedf6b1f2cbe7d0f36069a8683d413a1a771d0d59467b456fb7547af6092542817e2c1c7cb8
-
Filesize
5.9MB
MD5a35ef2447c4318351a8a2e898f5e6170
SHA14de164efc785b4b89ea9a5bc1d3af1de682ed390
SHA2566a3dd1bb47b32ee4210fd1803ce8f785dc863dc632c30314af9d9ce88294166b
SHA51269dcb5b44e1450f5ba214f22b81e64d110e575386f6d69a89dc2fd1bedc6799cb82570f451ac8d93b3657d2f79b8685f4b2281d4f6c0b2857ba783bcc3374643
-
Filesize
5.9MB
MD53f19af014995b3edb1e7579246860793
SHA199248a9e9269c4ca26fb16fc3892faf78dbac7bd
SHA2568f3ae59d1580dae936d208c5eaf3f00135fcbe2aa3d99666186d2f5bc841f2ed
SHA512d129b9f747000f64cdcc3932ab4b983aa1789bba8d4d7c8263cf2fe7d5b9bf8a702c04e30ca7393da20bfe966edd583ae31f4b292e8838f723c5a4aaec3fca4b
-
Filesize
5.9MB
MD5187547cb4296d026ac98bb348c7721a2
SHA1407def8d57e3fe2f9216e8658826ff6f271487cd
SHA256c9b4108d2cec077ab1011fcf9be15e7020b326188c2e878acad3acca9a1ca78c
SHA512a6f32cb21ac78591dd2b98f5ea51b5b3f7b5aad02c87be9e68015ca154948dc576db9f931d87a88ed06c258b026245958e889f1f002f044bb8d28f155a3424d8
-
Filesize
5.9MB
MD5c2ffe73f5ae05cdd86b8feb69f01f184
SHA14f153c747f45ff7efcedd9268ff010f7e12530aa
SHA256b1a9b0254d04db3ae5420f5d5754b2e35e35ad4fe20b2b93a0f6170815d9af89
SHA512057bfb78c8e2a9a5eb17c82967bcce7984a1b558be0d92956949b99aa43304137f5bc43391c8d0c50571f6a6d4f001bb2cac60e6f2c95beccdef5c1e2e8dd86e
-
Filesize
5.9MB
MD52796060097f6ac9e2e16e523a5fdcec7
SHA179d26f63adb0c8bc8f911bd9bfc78ca8f0e1e672
SHA256d733809733d0bf18b5fc63234fb841860b2c55e29ef6985722d203e1ba72cbb1
SHA51292b058511b7fbaa9ae284680d5b2adbea076626dc1af864a8778614204bf46b911635a683f207113688c1aae97bbbc6a5d57ba36eb8c390b0030e1423f2ea9c8
-
Filesize
5.9MB
MD5c33d4c4444b27fb575758450203d2b8a
SHA17b0864da7d0a726335bf58faecb51a560a6bf3b3
SHA25676d574e12a75b1c3f53ba810a6504d82b7940496e10c74360f964b7d60157605
SHA512967d5bda72b6aae7c6a20d9723404a085778236cd2599b1a470fdd6e7f05269d43046da33b9ddab4c0493edd8173c0ede963fcb48bdf28b6ee807a2c071778af
-
Filesize
5.9MB
MD578eb575921297529d29c0b04c665681d
SHA15d4344ec183bb33d94cf0e2fa4c4aea36c812208
SHA256155bfe0d41b55bd06430e2d52ba6ee3b0e1125e5baffff62fcbdf400c0d3298f
SHA5125ef2b604f54212bf600cd68589c5f4ac1c718a9f168c3f0e9656185dc2717202d9b2fb4d7a6fea7da306aaae921c3dd8db860c292274ff908744a24a51fefc12
-
Filesize
5.9MB
MD58611c839f730b88fd0d5e690e340b865
SHA1e76d548ab40d632f1e931cc41e3c2e76aaf62677
SHA2565d3c12446108cce640316a66c510984beb2e20b78d99e0c506b4277adb768eea
SHA512c0f0eed7584bd0078dcf8a37e7d6dc9d53d600c4b5a45e8a35f72f00d51fc8ec139d97b45a6a972f5ba3867d786ddba5c9b9f5c6cbc729bcb76a57616c467746
-
Filesize
5.9MB
MD507534e38fe073631f4e71e734df8a31c
SHA13efba6092bed477b0324f32baa151a1ced7b76d4
SHA25638bc796101c18f6a7530a7babc7eb8edb75549ed479685e68b3a4a0e322fa7a2
SHA512dff64f3025c78e778a02dccc74c2af50416c9a6d535621bef6a7248c1ea7e958c160e92297e937b240d72a01738865d13e830dd292f1a2689fcc932a70c4bf9a
-
Filesize
5.9MB
MD58c6bcadc49e0a2ffa2ba8a227e85ba48
SHA1f8d34a113ea17fcd8707f59712ff31a4e104f4ba
SHA25697ec9af446a0d1e38ec39d89fd2de2a606e4f6a603b5174fb57c560d63ec60e3
SHA51206d3dec216182c1ea0dc70e60922fef41fc3038b0f4a5e99d0c0281803ec9ae0301708fe07bddfe191d9e5e020aa6bb3a7747ce80793ed456f512e201cdb5f1b
-
Filesize
5.9MB
MD5c5c0bfad93f74a4f99235a8353e5c8f7
SHA1f4bc9959458d3307a9fa0de1cfd8a24f0ced0d92
SHA2562f22159d821f6f3c9ba7ebddea3651e471fef93e728af1d44cbf3e8478d9081c
SHA512d2c4194fa5c6ffeabd7b0202c28555d8a8743952abb3c9c43b893c8a1858359a6117e5bf370eee8943fc635066cf7e8989cf0ff8daef6bb8ed20a012c7e8f716
-
Filesize
5.9MB
MD5aa2969711ef82ed7596f6563f0f7ae9a
SHA1e14061634e3f23af1cbd88505e375ac23878bd93
SHA25688ff0bcb89a4caf15b4bce30aa437e6f1c7a7363ac80a4ee948a700eccddab03
SHA512e70945f30e06ae549c39a128a40cedf4c147ebf4beae0188871d9637ebfd938a6aeb3e9c963b3e6d832c78caa4f91420522ba4878b95ff1a05be3af557a09330
-
Filesize
5.9MB
MD5007bf4a144ca903d17099ce656dfebb8
SHA10af1d1543d506906c5863a3f327c3f4f894e24ae
SHA2562ba8a4ebe6fbfb3bc936100cced05adc6649024b8381b7f6e31529331cbe91be
SHA512a1454a631380588b84bd8598aba1172ce04282e7ca1612eaaeee10b4046fd0f2f36788856fefe6d06fd8e7cd503524a0407c70b8d859665408517aec47de0e85
-
Filesize
5.9MB
MD5ff4927b64fc906ae7592debe2d30095d
SHA1ed46d7043ac0d7ca5ed60f0f9ff5175baade9bd9
SHA256ca3d8ff9e526f72832521c062fb3ad3d90c84feddaa9fbe89271d7b28656e3ab
SHA5129a80a99af8b0cb268c0d8e7c3c7df035296bb8c6b684bc7dee17a2893ef9d171048b86859e2d15b2877b6dd88137574e781b5db4ff1b9da15cb903d87372bef3
-
Filesize
5.9MB
MD5f091f6e6e3494786dd1b39aefadef663
SHA1bdb42379c353624852f05ee681a706afa6b2a780
SHA25669c468d59b87c6e1ef76a14a9e979b1e5fbf8c528e22a81ebdc80f609c2c6cd4
SHA5129fdf541cab64a4cc8d4deaa7959bf987a53514dcac59937e7f8820c57dae5154721c52bf8f5ed18aa1c36396291b12e7466e36fc7ac8b23c4d72468b362cc375
-
Filesize
5.9MB
MD5c4c3d21c64cb34e9a04780504c1ea330
SHA10dd58f870638e9a56d0b42d5906875cbd41d2a34
SHA256bc6194ae560052d0880ffa91d2406edb1b8c29be9fe83cc68905abae632f8309
SHA51206640d2748c7603306a13a572016ba28301e5be7b7a4f2f597919dd4a28acee078c26a26dacb920e8759627e0b8385d562d0454937ec0f958e23c3f9c38e6af9
-
Filesize
5.9MB
MD5508a6bd879f311c87eabf146a7e5bb25
SHA1199f2b9e10e3d33a5466f24f95da328cca7018f0
SHA2563930b2e4260dc8083cd2290c63999c7d2a27e4e5b8afc99572dc8443824a2f01
SHA512fd67c84528c2419ae180f426161d726d2521cf504e0fa18195e20b4614ca115e68fef504026c20de43040c97d6041f4d073d1833ba71efa4559b290e735f8e93
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB