Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
03/02/2025, 02:03
General
-
Target
2025-02-03_01d2d9592258c7018b77f91d05eec946_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
01d2d9592258c7018b77f91d05eec946
-
SHA1
86ed62d47f6eebfd35745a3c02e9e70e02005318
-
SHA256
1ffdc01ad3a5f413c2a3cdf2f08431dbe30ef60052d49dcf866b19b127ec529e
-
SHA512
f146f611887a740bae3d2d90a35ccedb644d7624601c8ab59ee0e7ef93607c69cd719d75018151560273fd1f7d9581c872953124f6e6c617a2ab82fff4b12a64
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lUm
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-02-03_01d2d9592258c7018b77f91d05eec946_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-03_01d2d9592258c7018b77f91d05eec946_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oFqxGvF.exeC:\Windows\System\oFqxGvF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dIZrSFG.exeC:\Windows\System\dIZrSFG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TwBgLoC.exeC:\Windows\System\TwBgLoC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mtNFiuE.exeC:\Windows\System\mtNFiuE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fXugRWZ.exeC:\Windows\System\fXugRWZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VQJpeqo.exeC:\Windows\System\VQJpeqo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rKuboyd.exeC:\Windows\System\rKuboyd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VhbuiwS.exeC:\Windows\System\VhbuiwS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DzwkLkj.exeC:\Windows\System\DzwkLkj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lkBngOG.exeC:\Windows\System\lkBngOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fHGiFpY.exeC:\Windows\System\fHGiFpY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fvySKUc.exeC:\Windows\System\fvySKUc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jsEYGYI.exeC:\Windows\System\jsEYGYI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rVKXkfL.exeC:\Windows\System\rVKXkfL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrykZQW.exeC:\Windows\System\mrykZQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oiCnOTB.exeC:\Windows\System\oiCnOTB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WyrUjpw.exeC:\Windows\System\WyrUjpw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\antoEKu.exeC:\Windows\System\antoEKu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XwxZeCX.exeC:\Windows\System\XwxZeCX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SxJudrp.exeC:\Windows\System\SxJudrp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OzjalNo.exeC:\Windows\System\OzjalNo.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD572c48023d984f785724900fb98b19fa9
SHA16492a95a9d2ff2d3667912a70cf070b1698aa810
SHA256dead1dc2e5752abe7246d71cbf2247b49f462fe6e4587dc0a701870967e3c3bc
SHA5122c095693751fa9ea1b068ad85e7de1a4601fcd8e074c3c39de8bca9745a29a11d61724e0e278d6fba0d533152a5c9c62b8e20fafa2554e316ffd737a5ef668a2
-
Filesize
5.2MB
MD5c40bf655179109a5d20dcf6137363dda
SHA1888013b0a09dcbe9f6661821b4b334b0af0fc3fd
SHA2566f9f50afea068e6748b15f471ae41d5ab17f98ab8d27f1cf88ce442475d6480a
SHA5124712dab09b631fcc2bc55544ebb225ffd1c22b63fd932055f7cee0b542bd832cb7bde9bbfb1c9609db0b963445f7238a72f3630efb52d85051e7398d92b43fef
-
Filesize
5.2MB
MD50634b44f78935b400909325aeeac8831
SHA1298fd60229e2dd3513e3f03c6b7e63c827995e4c
SHA25634fef210e5d8af1e9d01f984be2cf867e03854807c544ad0c48bf2a67b1b2a56
SHA512d961102f91a49759c1bfd7fad4ba3b52d4f27aa8faa4899d49780b296276adfa6355c532a25750584a4fa5a61a38cc792b87ee81013d61ab5ecfa9ca575680f5
-
Filesize
5.2MB
MD547f674430fd7c9e34d0bc228b8dea8c4
SHA1cfba46f1ae3f05a8a756dd1d5f159a18394fe0c9
SHA2568f830835aca615935c0ce97422330cc1261574111a076d0f92e9466c74e9449d
SHA5125b0afe57ce0827875a9eef0ae07a3b763d7e995ddb38cdc08b80b917557d24f523c978d1528e2eecf076e58898be7df48e40434666c67caf1c154609c89a9b20
-
Filesize
5.2MB
MD51b174594eaba4a8844ccc14dcdb4f061
SHA1450324d3bc02cd858a83c12edd2b4bd6c4d4ebb2
SHA25678d41db0f273ac623347a503926a51ad20510a3478cef62afec7d6b64fd3fe30
SHA5123d3e396a9e094f32a320bb783c5f8026c557d35059ec2a131201aab6bb513a8f94fbcb6c4be6896b7f407366570e34fb0e368371f9a753bdb6a5adbddfde3b81
-
Filesize
5.2MB
MD59012dbf4f57fd9164107611da8f35a0c
SHA19c3a1766b7bff15423b82be728b486fc7182e11a
SHA256bfbda17edb7a8eabcb881e1bde94541eb2598dcbfaf5d4e0610f7caea13ecbff
SHA5122321536ddf6a095b3ac243997a28b02962a59a5072c846e9896362703658c17adf13c6da0fc8c390be5395d19a4d719cdc42b3879bf511270860d1c001ee472f
-
Filesize
5.2MB
MD5aa7daf3ca16c56622790494f6ba843d5
SHA15f3bdde0eb5c0ce7022f0ff45f0c5fc76a9ac4d1
SHA256675c8efcb0b227d17956408e3ce3e7b74aea0220455d3a856a0da0490bec2504
SHA5123b8838600750a7e4f5bbf63a55b7b39ebec08b76a483a26e2c79f6855d7720f9f568c03d5888d1edf57c4cde28c69d0a8f7b54aa4bc2f4afe6f8b387a584cbd6
-
Filesize
5.2MB
MD56610e5aa3446078a3501be6d875a083f
SHA1f42cbd9427d737b951cbe01793792b4a4fad087a
SHA2562d3779d6c05577ba32733ac5ca3bef73b1511e645c46a9ca789acd4ecff389eb
SHA5123f1740a70703606e82db1d04565c3ceac045443bf21b9d6bf283207aab71b7adaf5926f98179ed683a4244bd2c4620e10d1da22b4e9b62c73aae18b45fe15aa3
-
Filesize
5.2MB
MD567f56800b8cba4e8ab58817cc11bc5df
SHA14607801e648609a2383b02594ee35939f9d552ed
SHA2565d97533e625676ac995bb6d7202cd4b8e8f19018ccf83afc59d6a0b2c4996b3c
SHA5123260a6ce9e791f4cc5ad798fd88550a899faf1fbdb32b5160472811cedd498a30107941a2e32afbd7ff1c391802dfdd2fe0276aa756853f23734fb201b4bf3c3
-
Filesize
5.2MB
MD5e4e17a60a549e132fc3e561cdd40297c
SHA10fce6f7ef16def7396cbfeaf1ce85bc8a2c8f664
SHA256128da6003ae1b137531019c61652821c9c2ce6916044357d969f7246f46a9d9f
SHA512c76a01acb4cdf4c1106d3ce84ce2d3f93d657da31ac2230fde6a526f51fa1cc2215171de429f091ea2d2ebac48dd9fafc1245a10122ae5f0fc80a8f7460b34ee
-
Filesize
5.2MB
MD5e50630f01332321419d6c8b9001f4ce7
SHA1943588bf21f128f7c8626b55549805841e1e1204
SHA256557e98523193b6b9a0352d93b91f1069eedc314da9d087af97b9cba1cadee5a4
SHA51220ab29cc759aefe74d656e81817b3aed62b56c7a7006c360309dbbc3bac444d16462dc4fc54ca1b4d863f0b2e4a9fc9ead49ac42f6d99f5f3d697a3ad4e8e5fb
-
Filesize
5.2MB
MD51bfc113b090669e6427a19ee18cf802d
SHA18ed4dd6ea821c3b065cdcd349556f5a84e53b1b8
SHA256afb3d1c12023f88a45132904e25e62c8a1a48733570f659b3400171e2725eb5d
SHA51217630e2e1a36a006990494c08385245ed6959c5b1908edf1f69785605da72e5112248a93184a94d6c0ef1eb3203d184fe644797ecebccc83eec6e8a67c02759c
-
Filesize
5.2MB
MD591ff84dfc176d42a272e685ebc211a76
SHA18487fcf8e64ff455b4c2beb8f8e8a17ab698b54e
SHA256482deffc244c7e940be4f99d844d73c035538c71a7e95a8c565a4d27654a815f
SHA5122e32389b6ea385b60a31d1e198ca65a836ad68566aa2c27b28f2e1817c70f9ae09650f55d7e5ffeaeafa7d8f604dccec38ebece219e1a039e723472ad6d2a7cc
-
Filesize
5.2MB
MD534d59ec8666b98f0cc43928156209025
SHA1a16981f4266a157db9bf732c649f1387e8d7aa0c
SHA25623600ed244d874b9472ec6798756609d56103cad0e15105642f4317a02bbb774
SHA512724db32239f2d77f2d604a9d8c9aa1fe03d7dd17cf72c065478228cef8cb9ba9d1901c12e7456eff758425272bad0b5e504c5054eba9f338566169c816217e9d
-
Filesize
5.2MB
MD58916a3081a74dea1852b04617cf7cc68
SHA1099af084af79bf53b1da58e87671ebec58493c2e
SHA25642909ca2c0b6ade5e270fdb0e4744d74864c061f764b589d177773a22ceacf58
SHA51239ed0c053798447cceed88fc32e4e8a6eaedad42697ece51c5917ea3d819238469dd1ea03ca8033c39ad6a0eb34e174e7ef383b123a2853cbf7ed91f7102fd09
-
Filesize
5.2MB
MD5464dbd3bddacd8a361be8fc541a04be8
SHA18c2829a47213adfa9bb895d77dab2fb088d9ab1e
SHA256c2bea5a054f7c7742e598b366c31bd113a564bcc49979ed6979ef630197c040f
SHA51267940fe9de1323e9803f2e0eac2de09278349dfe55a5e1bbd1af4b892bb94ba63fac8113c8cdf43635eb7360fa1f9321428506c09b096be9430b2eead0e11bb3
-
Filesize
5.2MB
MD508bcc6200573ae68846f001cf2133e31
SHA1c4509449462cb88e5d51e966c2a04e81d345dce3
SHA256ac14b56fd3123a621296d37daa28adfa0e4227473fc7ebdae78dbc213d6e5f5c
SHA5124ec9c34421295646f78595fe97a906c4b7aad2a42878b34d801aaf746c118a2f93185239dae839afe4a1dc8e33676853b4e1f3c6405e8a1f454af929b7f9aef7
-
Filesize
5.2MB
MD56f758f419c7a40d5b829a5f9d18f0a40
SHA17ab3f0819c947145962d8a2231ba3354888c3ed7
SHA256518d8b00928a4aacbe832f0bc01118463d25e759af3cfc2d7af8704165975f74
SHA512e5801ad03fd7a11e2a61a238cb687d2908e1ea62604b50349f43ed614ab596dd8440003161b91636b091fd0f63a988ffe1f26d017c158fef47007c868ca7d3da
-
Filesize
5.2MB
MD55a3c981b66b000707d8c99069fa527d8
SHA166291157e78ffbf5c9184f4db13c22c466042523
SHA256b74d2c9cb09f08785e2b9e1bf900fca0e2521bfb367ed52d25344d5dd5c676ea
SHA512e7e18480750857e98847eb99fee9588cff8b94facfc5d319d0839656c087da4ccd75be0b4f37f67242d9e1042152df99465901caf774ce0b1c64b3341315db3f
-
Filesize
5.2MB
MD582d21ff58b999a05393fe1dafb5bae6e
SHA1f702e679e75197b58f93daced86d363c8476e851
SHA25685a43085fda5fb2ecf715252c72efbc887b141aa0f3932f20f7b720cfefbb22e
SHA5121cd37fb0d781c016f65e02d915d9ecaf9ff58e07cc0a5f872efa912b607fc6aaef9c0de2fd2d7bb19119b08e62223d31e8d6bfa39df5dc2eb6ea12fac451d1b8
-
Filesize
5.2MB
MD55bbfa88bf4430fc3c9f3811901a63b1f
SHA1e03bc6487438f005cc290f49ec4c7540275e06e5
SHA2563220af28e191909bc6727cf62c90f3e88fe93934f18dffa433c70ee85990faad
SHA51273fc62e39e152cf62f2bd268d7a711b9b3370e5bdd1f55668a87cc542caef94567a93fbf4c195912a4849593854230bd388414ea9094e1d83e485d2eaafbb950
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB