Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03/02/2025, 02:36
General
-
Target
2025-02-03_2f509ff3116bb36b6ba79034cb752c15_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2f509ff3116bb36b6ba79034cb752c15
-
SHA1
f9d44e62339f09edacd8d15a0b0ec3d156445132
-
SHA256
999caf7cf88b42e07cf4d1e64c2fb8c65c833bec888a6c8c7112b40e64033095
-
SHA512
af7f5f492c24dbd048d0a1f6c83caa3c7764e1697682ded32e7b50709d3dca73d6ec2c9d1cc8ba4c43b7b0224e3327c536bb7695c8d70b00a4b17863444ef191
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUZ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-02-03_2f509ff3116bb36b6ba79034cb752c15_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-03_2f509ff3116bb36b6ba79034cb752c15_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DajFDdo.exeC:\Windows\System\DajFDdo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RaOoXCa.exeC:\Windows\System\RaOoXCa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZOJtrQm.exeC:\Windows\System\ZOJtrQm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AWDJxgv.exeC:\Windows\System\AWDJxgv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xxgZKaH.exeC:\Windows\System\xxgZKaH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FleiIYf.exeC:\Windows\System\FleiIYf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UefkXEn.exeC:\Windows\System\UefkXEn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tPMzyQc.exeC:\Windows\System\tPMzyQc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cKlAuwG.exeC:\Windows\System\cKlAuwG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EkoLHVu.exeC:\Windows\System\EkoLHVu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RibPHGR.exeC:\Windows\System\RibPHGR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hGDgzIA.exeC:\Windows\System\hGDgzIA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FmKRZFu.exeC:\Windows\System\FmKRZFu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PuWPrKl.exeC:\Windows\System\PuWPrKl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NLVppjv.exeC:\Windows\System\NLVppjv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SKwzQza.exeC:\Windows\System\SKwzQza.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mFybOBU.exeC:\Windows\System\mFybOBU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WgIBfvI.exeC:\Windows\System\WgIBfvI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UaXgDlH.exeC:\Windows\System\UaXgDlH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JbDcCZi.exeC:\Windows\System\JbDcCZi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qnOisQe.exeC:\Windows\System\qnOisQe.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55348949bfd18e3157d883a173a7411c7
SHA1a09db07468dffb8501d532eb17333e6f29c4c123
SHA256592c474fd475993b4b7dd9642fa0c3417236b2bb14decfdd03ade344270251f7
SHA512a9a3178f445bb9c15841641fa02f181fb68cc0599e579263ea028527c0f953d96ae8f0737693a324afc5637f7b6631210ae3f3796a34e480926ab3b7f74e28bc
-
Filesize
5.2MB
MD5ba1af55186631d6459b1de72ca8f625a
SHA126e7863d3f695283de56e792b160b77a6c4033b1
SHA2562b4c1d4d33e3cb00ebb87129b1b1353482072c1cef024c726068a33a548b19a6
SHA512feff5b5b01520439369df61c5c2fb05d09cb955f30b3293e6127ed7931bab8b3ddda2bb7c826d53a1960349ed96b29ceb5c58ea4eec2b23186c1a0dde425c96a
-
Filesize
5.2MB
MD583cc203bef475423775d1b7d97faec76
SHA18641744b9911ef781a9f609e75b38e22932ace57
SHA2565bed26c307c94a43ed4136ad122977f9423728ad1add976abddfa2e57a616a72
SHA5127c459c2e96cb2080c345553b65696be5a7e79d972dc6f33fd484906aec39a2b84ccf21c5f1aebaed98c4ed90cc9d00ff86b141c440360b3ff49a5777a804f40b
-
Filesize
5.2MB
MD588232cb418704d2e7fb9c8fc1e5c22b7
SHA1914049af63d334e07a8e4c914dedab3f0ec8eb47
SHA256832c85c692b0d06568c99886fde4f6938ce1e3038d40940de21e744058bc1ff7
SHA512ead4bf302addcc6286d9ed0b0509ab4ae6086048f41e367a2bd5a5e38882c0b04f63daadaf0b4513a6b074cbe51f70d687ea28741a5149ddcb5d50fda65e5068
-
Filesize
5.2MB
MD5652c1654ab35c59af85e46b1a7b7a805
SHA12842be0d05e259091badb606bd1d7c3adca611fa
SHA256577c9322df98ae130de54bc0bd787b8c978cf4d26c1d7b6b876b26e2ff5a5959
SHA512ae36d4780f93437453d092ccfb5ee2ac98f3910946a880b075dfe0ebe762d7c9418c0c49175fe90c3319e6ab06ac6ff9a9a4955206a2d68bea468a4ca824a147
-
Filesize
5.2MB
MD5828bcdf182e501cba9fcb088f10d981b
SHA105de4164783e3d50501e3ff8c5c93c626426436d
SHA256d2d763c486ffad7690425ea96496a62ac4e3e81de8e78c0f2b1adfbc2483a6fb
SHA5127e41426b44f6adc2b86d3edf3bdc4e3382d7deef891d73f7c86b893a8cc38ce551adf109ec79ba93dd8eff817895a1e6d4853cd97142eadb1cc004de0c7b0065
-
Filesize
5.2MB
MD59cf58c0880103b76e1028dfa9eb3e871
SHA1fdb91dc098213b5b9112fc8ac72efe609e52414e
SHA256041f85b56797d9035ed6cd00b0ab31e2ee91983e3cfd2be763afad6198a195c5
SHA5129b1c8cce855f6a5dcb0e5459a0dc89359eb6fbc3ff9563268656cc9ec393a627205074e878483322322bff6f79b8f4bbfdeefd49a0355718829b7d260d9d4700
-
Filesize
5.2MB
MD5e06a1d7b2282a925e1ca77e9b62d7d80
SHA17bec426378a99d638507219aba75427baf589282
SHA256901c116889ef7ffa60acfee02ac3d2be18b8bc7d6a0d4377c5bdd59d36d6d6d2
SHA5125c8ba1d12c3ee98afb713560d7ff5f4e1a380aeae6d65acc102f5deb26eeb15a4fcc3ea5e79e5e157f2b1a30e6e59100551c970ec0571b23925c4862ca164c52
-
Filesize
5.2MB
MD5cbcd8b185e9f5b08541103241040983a
SHA1f0a245cb52aeaa05e1e8ad7c19ae783cedc13e6a
SHA256b0cb254caf9ae985d0d955fa9de4877f45b77db9db30213701e6029a59fe5167
SHA5129ca9950972534b85490b3c6240775edd568cac6d61730ed830ce0bdf33f75374597714a7a158410486ee58805457ef82fb63ebf070fb358a41a26d39443aadb4
-
Filesize
5.2MB
MD521c79d1c19908b2fd601540f79d7b153
SHA194662a07f798be4884ced8918393f13a93691158
SHA2560e2b86cee8e6dc34a6878b03efdaf7d5a4f751b72c67b2454ef59813ffac027f
SHA512ecd06d2bbf2570c3b6fcdefe6aaee08a86d5372349019119cf75ea7dde46a41f737b2653dedc03457238c1843546164adc098b782cdec3f5b573b02cf99c4ef1
-
Filesize
5.2MB
MD570e2b0bff92adb20f8ddfe4dd73c358f
SHA1029820c641d716f033d97690a37d4ac437cf916a
SHA25633697ee0480c8d2ec6545dbb8eb9b04d14e4433b00b7afce892af5ffd81fd67a
SHA512ca49ce1d4ff149ae6abfa5f83bb7eb993ddd7d9d7e4d87a83bb493b881045ac690a7e813024bd4a7e9685a0b2fb191f3453f2d8dfc7574b1f7582bfcf31dd09e
-
Filesize
5.2MB
MD51a4cd22f72060efdaea337dfdffaa06e
SHA1a80bec2edfe21c98c14501b1eb7e952bdc74ce77
SHA256dbc6c373c3d5b79ec3dd71b16213aabe0d79466c9f77af1ba46b31c5b77923c3
SHA512cd64a24b21175048ff2afba09f8fa3ce3be461c43c94781c3092eb696060fa3b801ab06698338a16eac6ed98fb75b77295e480ecb10b740a4e273ffd62738485
-
Filesize
5.2MB
MD544fbf93b530c44f87ee092445448655b
SHA120a1070df03edf25d4b9e2470bee2ff76df09a26
SHA256f684d2a239b0ea503e2543d2a78d34ab1e424f1e2dce5adbc34476c76eb76252
SHA512646813ea18fdd814ce0bc9aced77825b9bbbf6fa29f89e20f8807081a8bf27d6bc7f6bf30d3acd2380a7cf41358c88e0a29c47b93a6e71ea2b62f702a95acd27
-
Filesize
5.2MB
MD5ecc25141ba187889b125f8f73739d048
SHA15f2ed015ddb785ce05b80c46b66ea1f29501ee8a
SHA256a1b7c7d9a333b6ed26eed24ec1c73321f862e2dfaf55ef786eec92c93aa00bfc
SHA5123ef73063a597051a39f5ff706d45c8c0de6294020afb639ff6414c0c26b7d85dad405030add93a509cf53c92ed2c7dc22cd9787cbde67f7ee1e6ab42d95e0ccf
-
Filesize
5.2MB
MD580384b7fdf8336d0f7e71e59e957ff77
SHA17a1a443cec98851798364fe6d31cb91d74f0e5c7
SHA2569aa9af37b7d80eb0857ad5cfe8070ae025fc438eb46e8b4f8740f5769d0c3e71
SHA5128163b751bdabfa7c7c948b6578e3ff760e8fe06432a1607e1b8c108b0e6b28c43250641ca124937cbb4fd075a6593444ccbff54d25314925e241976a1596aece
-
Filesize
5.2MB
MD5e9650327536800241204abbd49198135
SHA1249c6c0d2494a657d6481c183284bc19d68e8bef
SHA256927633bfbfffab7e163d2482f0f14b845a0d8ea2a8a76c28ec3e53f22e7f8695
SHA512b1691c8c0c5f9b65346dd631f8fe03e7a5932322bf0bbd4784532b234e61e35fde83f01a3a273dcb34772d26f53078cb509b69861233b0edad6f88c328c2b8bd
-
Filesize
5.2MB
MD5d0bfe4b1961d5d37dff90525e413c293
SHA17510a9117f8c9104337aa72ca0a21e2f8a9f20e0
SHA25621cf7f1e712a5797c4098405f3bd92e7cf3f9b5754795d53031ecee5fd2f9f54
SHA512b85b555332b0019d7c3e74874bc34607074d7cbf212c15cce327e856c148727817c7123e434d75a4d3dab355e4012013b16d5e0282e143a0e7df49c424d2d425
-
Filesize
5.2MB
MD510753a7a30125ba80565645bbe9b2f4c
SHA1600e288d4ff45b513648f294e2936b1a9495e234
SHA256e543d6caa3d53d214f770f4495baf1c7934027446b1fdcaab41d1de43f196349
SHA512bab7982306509a7be37948474388d142ff6cd9a2488a590516e63ee89a955181ba2b56c808e8edd82795d52981d15fa5b6986330c0219474ea38e3bb1aa1f73d
-
Filesize
5.2MB
MD56487fcef17a2f6f018aea09e8148a34f
SHA18d76499390b169f5feb68f96aa8ad9971ad9738f
SHA25651cce307b5422404e3f908bfe48880571126a387c91be8211df38160c0cc1338
SHA51269b8b81d9a6991d1e689d4b9cb6dacc293c2acee8a6aebbfcc6c9f910d26f684005cd9c4bed14a7fccf20e48d5a4d953ab27e1be246b517f7518535ae1abb557
-
Filesize
5.2MB
MD5690ea0be178fa6b52917136f5bc31314
SHA15d899e57a18e73fa875b672ce666f6d4d5504bf8
SHA256dc543bac2cffa335446a67e7bdd3e259bc745bec5137e99f3506865bcf982a87
SHA512bb11324d7125e16c5831fa8218254aed7d880dafb5c615c2527607cae160228b8f8f074b2fbf8ecb2cc6d51cae72e2854193fab4916178a583d76a80b9184e31
-
Filesize
5.2MB
MD53c60c62d9141f1483215560a1fe0dac2
SHA1a8fc138e30d73a88f1a30c4c0ee2e1d8a4f8c6ef
SHA25697ea0d50177899e5b9cddb37e9cc8ccf18a105fa5611b4c82398d68ca9350df1
SHA5124cc0257906891e0edb1013a627d4f0ecf86b39c7cf7805a4f70e08561727a56d7e98163b7215a525f094b2c2035313474df4c281c34b8bac3eaaa3632d5844a4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB