Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-01-2025 10:36
General
-
Target
2025-01-29_db50d8344f2030d5885d93ae182c7cc7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
db50d8344f2030d5885d93ae182c7cc7
-
SHA1
6f268127246240dda40daa97773cfd5bb45b263d
-
SHA256
d012d742917642db8785366ab87eae7c7412ef36fed9f840d31b595cc7f64f58
-
SHA512
a1cf73ed919c28e81c86a83e93f0f400ef34378fbe29091e5cc7b07cfccb1d9f8e4b203162d91f9e8e5afcf16b3b4e1e7088b8343439638b3590c6bef28b587b
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU2:E+b56utgpPF8u/72
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 59 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-29_db50d8344f2030d5885d93ae182c7cc7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-29_db50d8344f2030d5885d93ae182c7cc7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gXhNfwP.exeC:\Windows\System\gXhNfwP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wePrmoL.exeC:\Windows\System\wePrmoL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yYJRTsg.exeC:\Windows\System\yYJRTsg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zozDRFf.exeC:\Windows\System\zozDRFf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ymOcZFg.exeC:\Windows\System\ymOcZFg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SwPlGfs.exeC:\Windows\System\SwPlGfs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hraEohk.exeC:\Windows\System\hraEohk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QWciIuq.exeC:\Windows\System\QWciIuq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sOgBfzo.exeC:\Windows\System\sOgBfzo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RfUVsOV.exeC:\Windows\System\RfUVsOV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ujwLMQR.exeC:\Windows\System\ujwLMQR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cQKSnSR.exeC:\Windows\System\cQKSnSR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\arBQrkL.exeC:\Windows\System\arBQrkL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MDWSQJy.exeC:\Windows\System\MDWSQJy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\muCbjfc.exeC:\Windows\System\muCbjfc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yoPBaHm.exeC:\Windows\System\yoPBaHm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nDrQUzR.exeC:\Windows\System\nDrQUzR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VgMKYMh.exeC:\Windows\System\VgMKYMh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WFkrGgV.exeC:\Windows\System\WFkrGgV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KaGnDaW.exeC:\Windows\System\KaGnDaW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BLOedfP.exeC:\Windows\System\BLOedfP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5555e4f60937edc0e68c72f6950343913
SHA1250904792617b68324e800fa36540ed01dc8ceec
SHA25681db223a4f57b9da94efab633e4706ab3969355a7b9802c06d87803b40f8d417
SHA512ee5acac933baa80a602384c8234e9f05a91422d01dd8b5433d593fbc4152f1d85391c72a05c9bd3e1b60111ad39ca3a8f9815863a5694a5d73c050442080261c
-
Filesize
5.9MB
MD5613dab168df459ee6bc40ceff9e99ff5
SHA1a31c3c821c1b779123b31500497b30216ea1d51e
SHA2561a332d69716c26cca04a3739b7a1a68a365175b96b70b8966a1bd36425740d8c
SHA512481616491d8cc27bc17bee74e3dcb67fe46c7310289c949412859d1bb0f19093972bcbd216bb59ec9b8ece587446f2a51262f20663ac1986ab510124b0fd4571
-
Filesize
5.9MB
MD5b7b05d9c6f7d28a8f2d232e374508eec
SHA16d3719d883fdda2482679fa3ffa157b5d81e6f9f
SHA256b664df80cccacc3a073cdc88ed56e85538b6888dd3fff847eddb314ab1aa2e7e
SHA512301495e89df7655b1130ac7bdccd702f1363fbb250076eee280bcab993c0870426a587a6a5b3af431ba1d99076e4a7dab9d68a5d3b445570ab36b0b9b85d6543
-
Filesize
5.9MB
MD52228635dc3262b8564e7e8f8a48c6f43
SHA17144b059cda399f7699da698f9d41e44e73f4685
SHA256ab0abc377aaed5e101c42e4655962e77506bc9c902fa62928a1af0b3ab4b2f8d
SHA512e6f8abd5b1f3c2b98851fff122fd75d2afe40c3820aa3e6c6bf7cf9b3935246bcba06975d199c0ee235cf3f1d95d7c6e1ef32a022b4e2246b5b902ac080eeb3f
-
Filesize
5.9MB
MD59f954e287c8846b96439df491d759a31
SHA1eee492e5ae2e5501780b77e959c9bb86223e54df
SHA256e89ad76824b3f730bd6336aa7f37335f187a7b5cbff3fc6a881f6f1edec8d529
SHA512e0d4073debfd886cb69c56c7ad0cad7125398105fc413fe3ca64604927d9b4e731b3d440f57f7e945606335ddcd56041e517922af5f9ae545a836ca44b81f2b0
-
Filesize
5.9MB
MD502783c9327c48f09a34e20f1ad5353d2
SHA17b3e6789362b4f3ed63a4560e9f32ada55000425
SHA256ba23c7de0109ae82b82cb613a137e4d6df801818f2ef7a4db0b41237ac75107b
SHA512a99df263c6da4f5ce9eed12350d377011180c86803995e7db9dd245830df174fb0dbe4ebf21624a4d339391f5965fd6040bd420f550eacda8be611abda977047
-
Filesize
5.9MB
MD5b6e4f3a27eb92db6ce8e0a3d0313a90a
SHA1b204cfa9216e4e3ff58d34a646fd255fa79aabb4
SHA25656bfec7b58fbb65af0002df06b19668bc92e365f70cdd96d9ab320788383455c
SHA51254459e8d8aa0071b8e56718026648fd1245de2500c5809c66e5514b9d39789923243f235b29e9113042386aede60790e325267180551aff369ad5f91abfd28d5
-
Filesize
5.9MB
MD543de3de6998e81134a16e136ff7785df
SHA1bed7cc7b342e6e9bf4e2fe040c564705357ba51a
SHA25650b6dc8dd1e8dfc184e6c4463257ebc2bcc1ed05051c83775576888cb4a00fb3
SHA51205cb0c4b499727098866db65270af5726098188f34ced6c626938fca0c8387a74a71bfc7967a1c64709785c85f7d73c00f755526c63ad0249c06c71a83e1f8ea
-
Filesize
5.9MB
MD5a92c494463e7180fac9014507ef209ff
SHA1c353fb80ea535df75dbb0f6845fd9245b4ae5fb7
SHA256a8e31e3b77685c2d9cff070c6666fa0e73f45b179929cb224fc328e3a183a013
SHA512df0e6a5d312d0a03f91960c356097a83ad9cef09789fac36c2debb3daee778c7002e20556f0f5702c5c0935feb547489e456e2ee51db6bd2e7f99f93ad90ac01
-
Filesize
5.9MB
MD573eb2e4acfd5708a8601334d122668f4
SHA17946d23c80a106b0ea7ed1a549a124d7401ad0ab
SHA25623d177432ebb3f3a9d21bc2b8c998721fc610268a38672a5ca954b97eb15b57e
SHA5122862ca25da0b350775fe7608f1869f4b262fb1172867567a2e9b3688b19b40c4ea8ef63967f3346edf254bd5512760e0cdaf139665897b612be1d8618ef48e2c
-
Filesize
5.9MB
MD57b6b5432dec614866259224afbe1e930
SHA19ecc06db9e8c3050f0449a4cc8eeaab3225e27bf
SHA256c13ef815ee580394c6f2262ad68d0e6bdbcc909a888de4e34c2c3ab72d12d290
SHA512f30bb914635d952095dee92a4fd7af3474288f1b2f35a705f69b2b2511b751f2e03fda7a51a898bfb1df39ff4b3d346abf41c2ff0618715152150bfa94967b76
-
Filesize
5.9MB
MD5121cc267cf257796144f373f5cc57fd8
SHA1e3695dd730fc2f652a1ade79eddf3a7ba19797df
SHA2569444c5af5efedc16cbbf2431e1c6ee25e4439defca4531eeddaa524760de5ca0
SHA5124728e0f78461263c1e35679fd24dcc0e01541afba0d14d46f1806ae88fe2b4a87b6abb9d88bd05f90eadee318f07a8433dd27fc8d9a0ed3ea2b3c68dc9e240c3
-
Filesize
5.9MB
MD5495a4ec8b37f5339ea65ccd9d4831a03
SHA133d3710aae20871b9ae299a48e18b8855b4c6d7c
SHA256609ab36f3e9aef07ecc9f8f00106c881c8d1b57af7d56349e3fccabc95256462
SHA512375e92626f15dc5febfd75557aa2c0d38f34fec22a9ad4707fa75659db6a880f9ea0ba0536ea564e27931ec4e2bcaefdcc50bce4297d1fc3fc37bc5e393bb241
-
Filesize
5.9MB
MD52182a4d6779c1a79a826f4681d71408a
SHA1952941b04f8afe5552df48d12bd733c84023d4fe
SHA25605373935d83f59780debdebd008c3eb645cfe54a5cb36fc7a35ea6845a22d5d8
SHA512bd3d0dc0a61bcd5b7bc53b3819b218a63e4c8cc0dc2a089b1102b83d78972e94f44906391d00c50bc829b332d8abf9aa26ebbf4bca86b517dcb2d012c304c88e
-
Filesize
5.9MB
MD5e9434c2fedad7ea08226f82854134131
SHA1637dfe7f848d2a7a3d6f21087c05f269c665f261
SHA256949ea34c9cdc6c48ec11403d11c9c7d8535914ddbdb89f3babfbede404ff78bf
SHA51249afe59a1de6bf2a7a550a7f026081c5e9cb04e1bb5a2a375cba9410960d9460486f01327c6814d36fc6a4b0fbbe907d74ce63bce98c42b27bc69686674452c3
-
Filesize
5.9MB
MD570de448e3ac641e830ba6b41d59f83f9
SHA1ae5df0dbf56ad809553444d782ca9cfed338d6d0
SHA256c33707300edc6530b3ac0742a79be95dc45c539154c32659aa06194b4b282222
SHA512e564b2ec5cea9b7f168271074122f889aaa0c7367734b08f02943c242a1c31432d6822f773240fb57d56cf2c2c8a49487146dbd89a9ac52de46b90aef086867b
-
Filesize
5.9MB
MD521d073e508cc3222c1c7867f0c6f5e31
SHA18108dbba25c7b3b025bd806c6902f707c2350a8c
SHA256c040cdb3d9a956487dab38b0ea1c98aff6fbfc2df1a93f8d1283c43d19b863d7
SHA5122391c3a92061d04e05a1b7629433af64c0f65d4e4f1be7e46f51acf2a2b2216e2b09a1c61ab0c438670bb92795d04064da7163781cee353d6009e7778e6d7faa
-
Filesize
5.9MB
MD58b8d1eb005c53d76f1ef06b756d180cd
SHA10616a657999f598614b451d138636bfb6d809d66
SHA2562e6c581d7514215f53a8928221ad85628915869a91b03239957c1dffd753c9bd
SHA512317936d2a23dde7f16a7223c4f5cf0ea3032730bc23bb1e624b1e23380abb2242de2f7b46e41a27f6b3d9ee35109d64202c3410fd145ca71e96c60ab953f5c26
-
Filesize
5.9MB
MD531329dafcc80f4f84c8361f66b427f9f
SHA172602070f81ee12c32a9fa107471264874ed1c4d
SHA2564abeaa5f6995c0681cbb744e9340220c0b02452a770af98c4f8cd5c2cabb98a2
SHA51254f460e8f6fd0d7aebd1a073d1513c2c14f46676d3f603c7483d40949c18404ec0f23496e3ffa03ca626b46c0ae16dbbda62696b8c3ed1accddaf3d3f83945e1
-
Filesize
5.9MB
MD587908157a4aa2f6b07d06c54d68253e7
SHA1f910d5900b4c3bfc452be6a4c73041ced08c0324
SHA256dbb0896527972c839dd48ead24e52a60028ad19e468c110a7621a821501ebc41
SHA5123c8d9b5ddc824678c8eaacf62011fe72650642f67212a443d387db0d98836637c7473635ce2db41f96015b0e89334fd6c6c685937bfcc8ab1c77f9f7d9cb3e00
-
Filesize
5.9MB
MD55cbb8e7697200891547725a47119f03f
SHA1378fececbaaeb5c497d385024ebf3c98b92749d0
SHA256af1a8920b7f0f1a7e2a99b8ea2b9d06b0669e5a6a82ff9dabe4d96c2e0d245d8
SHA512a2b9400488312535b7d8057248f8ff7be7835d559e7f303993f6c2d54372f1cd0e77cd6c81c56a50b58e37118c6ca79a1f3c4399dad52824e2d5aa9864905d12
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB