Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
03/02/2025, 02:13
General
-
Target
2025-02-03_9a679e8a5512d759a664c8a5d64ab3fd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9a679e8a5512d759a664c8a5d64ab3fd
-
SHA1
783a739b879262c3488cd2a14423df2e8ac060cd
-
SHA256
eb7da0be13fa6c26acbff0e16ca7cce516b6afa4e00ede7d1305368c10540d68
-
SHA512
ce4e5ef89c6b93d848550f7e83577e33bbe563152353e8b7f7c5a3a855f893f8d5c0ba86235050b83d44df1ea6ba276f36c6141a1acde09b7935e3c67794c946
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUB
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-02-03_9a679e8a5512d759a664c8a5d64ab3fd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-03_9a679e8a5512d759a664c8a5d64ab3fd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oDyBzjS.exeC:\Windows\System\oDyBzjS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yisjIsZ.exeC:\Windows\System\yisjIsZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nihmLUl.exeC:\Windows\System\nihmLUl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HyRNSAH.exeC:\Windows\System\HyRNSAH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wUwpJJm.exeC:\Windows\System\wUwpJJm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WwdJALQ.exeC:\Windows\System\WwdJALQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EhSEaEy.exeC:\Windows\System\EhSEaEy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YwVfqMt.exeC:\Windows\System\YwVfqMt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kGXkJbU.exeC:\Windows\System\kGXkJbU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lrfJPHW.exeC:\Windows\System\lrfJPHW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tEZaPNk.exeC:\Windows\System\tEZaPNk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lnyjQLr.exeC:\Windows\System\lnyjQLr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QioZGGp.exeC:\Windows\System\QioZGGp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yQthXNN.exeC:\Windows\System\yQthXNN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\koXJHPH.exeC:\Windows\System\koXJHPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FTwiPqe.exeC:\Windows\System\FTwiPqe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfcpVil.exeC:\Windows\System\kfcpVil.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cogOqJM.exeC:\Windows\System\cogOqJM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PotCrEf.exeC:\Windows\System\PotCrEf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LSwwjQj.exeC:\Windows\System\LSwwjQj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\klxZQtZ.exeC:\Windows\System\klxZQtZ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5921969e60de2aa293f9f942bf62e480f
SHA14952bd67287d49610d09b57bd00c208c762d2438
SHA256fceebfb89640c0215c9184494b8cfb821854de30b327e5262f5dbf599e9271fc
SHA512c4aef49199be5d26191c46f6639316bbda7011b0c954e7f18459b33f9b421fa1c9fba2b1f61d8782795e53ccd0623e000676122d77f6bf1a68fd25472ea4127f
-
Filesize
5.2MB
MD5e2f69bec0f6c68f0eb359ef0738422ab
SHA115bb8be027f584f8611c49d11f00411a8828a06e
SHA25673c44315353a0217f0473cda7f02fd1b0a14f29b579fe0d394a86a3816a1ea0e
SHA51226efcd7571b407749c523edb15057af4016dbad6c2c9e2d89073cd7a2727b7757cfde50f8da745314a2097167e0fb86da9d4ae66e7677a425989426088fcbd39
-
Filesize
5.2MB
MD548640a9f27091f70c63a7ee44687507d
SHA10a3dd5190b47cb3d4c9a893eb9131b9d4f8b4254
SHA25607a121ecbfc902ea778e98b98e573c418f0fe128cf7272a37d46114c6f20437c
SHA512c7525e65794006f20bdc1ea9da5a773d351aad53f76bd99935bdf02ac2eb571cc783a22818243c741183bd3e37af352b8eba2e072415433d90d52a3f453f713d
-
Filesize
5.2MB
MD50a1b59c3be2bda9a9872a9ce2d0b5e10
SHA1b9550d5b346fd8f147703e8596c40c4571477eeb
SHA256d33f05fb2b6259fa470e94d19afdfba3710e7351b9ba8adee91f17c24042e0b6
SHA512db50f404c54ffc7c44aafe13faaae978763da46d6e03900d4860fde55915f537e610ba306d5e7f88442b5e6cfb40a938a5889473e475bd135dec08a53124a260
-
Filesize
5.2MB
MD59cf7710075b7b175c954df77daf7a87d
SHA166190fdd18f5b6f250e194b4b94c9621fcd34f68
SHA256ba516b6c3be4261eb26be6c47001826ca5566a31015cfe300261f52f7e206806
SHA512e70d861fbdea606c537139fdacb98c55f7ffaad2270115bef4e92aa438f666d845c1b025392d5c7ccb42e86d4bb38cd7ac8aca304a01e93f6d91201cb1bef317
-
Filesize
5.2MB
MD5ccd5978172f6750bb076b585a6be5c15
SHA1758ffacc3ffc7b0b076c9d163f6cb8f494d81a71
SHA25628008e34c97c0fa8dc716c9a691a03730a3067ed52690730cf8680b7b62f7f9c
SHA512bac4df75e505ce800c852faee2176657cb84923d54896bf0a2c14e5ea2267cf9f3e7afb824a729fbb4236bac6d8cb13153f91bc06149147bd9895f0130ad3a6e
-
Filesize
5.2MB
MD5982467e9251ef41472a08875d3df33f2
SHA168f1d68bc83664f229f576263a086e4602142dff
SHA2563be36178f6cd6397f7d22437432edec547e47a22f82711fb15908e405d43c5f4
SHA51240fc08b237a9e4dbae09a2beb7fa00f2724f6136100c6f16aeeac060d0955a5793fbd685a5e300fa56143367c4ecc9047eddbcd40d9f8852b5ea8b074a879e9b
-
Filesize
5.2MB
MD5f27c36378e9c75a15f430cb19d07c4ea
SHA1d0cb8a69aefd3f8ec199c0a04b36f62d5fbde73e
SHA25629d737cc26d8a1a32dbf5264f8530437b51ad231232a73963368ce0aa0c7c48e
SHA512889b131ef4841940120bd5a51f8a33103e9aee55ba4aa073e7793e8860c966d5de2eb075024672b860601c2c399e70d00c52538920a863d4412b773136c6a1f9
-
Filesize
5.2MB
MD5d7236ca5ea4587d064a04ac0bea7b41e
SHA1c7c0a62a285b4a0cd184b7f9c2131f729459e94a
SHA2566c3d650162830af7bdf72cda1afe205d31317c38b10b23fd439447742af35abc
SHA512a7a0ad0bec9fe7bc830a641745485d5722e144c0e2874e3fd1d980b774560cbf33db60b29166e1e452cc4a437ee55f06a09a040c32036f70c493d907584027f4
-
Filesize
5.2MB
MD5415f692e96a4f264a8d6cc1656aec5ed
SHA1b4a511cde991384c65110e9892929a9c819a7196
SHA256e48199d2ef169dfb9332685af483cbe81ece469096c7ef064e3e8f61e1e6ff2e
SHA5129722f42e108ad9ecfe15aac0f36bbe458c242144ae51580b5765eb780d37e98139ce7ec8f46eedfe639f91489fc2399c7ccae8a442b45edb7f448b8ef4d990c4
-
Filesize
5.2MB
MD5d02b91308136b7be46743ac94458b5ee
SHA1387bf7f334e328d02a72a4b06f3c2c0c817ed847
SHA256e809f6a7fee26ffa580454d61bbf89aeb302dac55957065f8bd60e656f246695
SHA51255ad1b9e8ed5a8d4f63746017ce7eca7e4d5911efb400916148407053eb9b75a01dd46415fc1563aad87f7984084687c8a39bdee99e50ad4dd4cdb8cc7ede569
-
Filesize
5.2MB
MD556a24ed67593cbf8e261abb293c6772d
SHA193a549ea28c800a5c8d6d7c56075d0baa1e6687f
SHA256378f3a75d2cdb711e453ddcccae8db14d820b60d02b7813f532b3ead251340e1
SHA512a2824594d265ab4cd351987fbd633e347dc68c3b71e55bbdfcb830b22a01b9fd9c7adb88580ea0adbf582737671dcf394be539a6376625bd28f5b4631fa2b4e3
-
Filesize
5.2MB
MD5bf1a5f3fe631823d926fba112a29c810
SHA1752239cc1ebf59d341f46e2916f89572131d9171
SHA2566e746e647ae9d7b807fbc70f2494268d9d6523a30a8f53b8690fdbed5a2a90da
SHA5121d56291e43471c206595d6b0191d49517efb5187962706d526ca7be93bc096bb3dc424e973c67d09651782662009c9b00b6fb01d94d50b977609ed49ca2d52dd
-
Filesize
5.2MB
MD55afd9902945bce2a2c4575c4dd7755f5
SHA1497712831fcbb77c329b28e000bbb280a140162d
SHA256795fed49dcda5d1cf7d52ac831f6860bd83303d6da7cef8775ec7beb6ad2c57e
SHA5123b25edb32c9fe4730c36486624554290d3c2e4f02c808d584bca1bce2e5a009c4775f2998fefa7e7c476cc3658234287ed50141ceecdc3f147b8893bd6ec2eb8
-
Filesize
5.2MB
MD5a44b7fd0e39c1a3ed7af1faca37bbe84
SHA1340081fa3f1978d2491ff898d6db5d518e38eb1c
SHA256a1dff14f6f8fe48627e52a06d57a764cdbbb23f6cc74ab10c31510f22cbec1ca
SHA512697ff9c6de2008c68f5a3ac1b6fd2d3d20a3f93e4ec786b5d4a95117421524c18fc785924446f5fb75a3c5ed653061358657df1dc1ca972aa69d68bfd11c13a8
-
Filesize
5.2MB
MD540e9448e08ab1c0cd7842aae59acd979
SHA1af84740c884278800304682404984ec623a0952e
SHA2568ba202cce0f6d7a196ce50aeb8082b79559bc9c4f6bea3d77263435a2cffa30d
SHA512d60fa8989daf2e3ddb6771b49cf5002c18d4b223d306af5163e15ef8aff88d0f19c21ea8a071909f896a040f6b266236b4759747af0c684e6431a28012573163
-
Filesize
5.2MB
MD5f27bc7cba48610e0cc4fdc93ad555759
SHA1704e122f6ce598a086957bddd34b6d62c154a9b1
SHA256e568faf16c8b6fc685d3daddb63bbc05e53c306a2bacc5d7ae2e31c79503fd15
SHA512238e063da05de460286eca8e03d444eb8da41748ff55cfd94455e12ae046e0b6fbe2925a88c8181f354bb7b7c42d5b1e6788f66ce0ae33d4ea2adf0306a2516c
-
Filesize
5.2MB
MD523eea30ef500879db1ba697bc0e84109
SHA1466dfeadc5ac8b634502968b88c8a8fea3d7f808
SHA2566cdfc25316a0af209e8d6b6761416fb777dea38c118fa0c3ebe5687b781cc00c
SHA51232cf35d606808c39836ebe9c468d5584f6843af21d7dadeddcfd63041241f7fd4ac301374fba8b51fc3675e02a757bda6d6feac02ca4dd62dee94b67ce9b1a28
-
Filesize
5.2MB
MD52b139f1fb14b35a86b9b9fd9970d7120
SHA1c6f1feef138e3f9e23834adde0c3e9320f978fc7
SHA256eb1d336bed640d7f118d78af436b5ae161a1c7133258ef94b2d8fe8984a3b7a5
SHA512f0f7782c89d54e14a0c8172d6a74bc1ed4818ede22a0ca0172dcf0f235014d7c931d986f53dfa0fba039d2ce1e1298c1cb30a9bd4940ec36b972073f378e508c
-
Filesize
5.2MB
MD565cfb35612487d6285f5ee8f6ce2582f
SHA1492f3ea262e959a929388861fdfca65613705626
SHA256376fae90cb3de9715fa9cc01e6b282210700891e9477c57301035434f8ddc439
SHA512e44046685e6b2bd525bfad726379367622145696f9ff2f640611ecd1cdcdc3a2592c90b658605469dfc54175bb1ce28bf4275c642d5772b81c0b11f961cf7ad8
-
Filesize
5.2MB
MD5259d537fd11489739605e03c528abcbb
SHA1ac4625322707176f5c5c15110846d14d2ee57b56
SHA2567d58124ca9d49355f2884131fe594bf15f139daceea9e2287e5415eacb2aaee1
SHA5126e010dd962536b3aa51d9bf8fdad2cd2f1b35d5c74139ff1fc98bad92cb78a900eb499257f590cbc777da8583689cbdb6f6e27dafa44cd9e8c6d30b25b69751a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB