Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03/02/2025, 02:53
General
-
Target
2025-02-03_ade2cd67edab9a308c63e248fbca03fd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ade2cd67edab9a308c63e248fbca03fd
-
SHA1
37cbf913acac8f4c7b2d8f38b35e80e4246f36e3
-
SHA256
1c40af683f483fd6c60769b4e7b1ed72599a1be1814d18066723bd7ed1539ed0
-
SHA512
e8abd3e0b2fad3adc944273e108fda4a29967fed4ae69cddff6cf09101db234c7f632333639cef01547089a03cb243de172c1b60207e81dbeeacf42c001ffdd4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibf56utgpPFotBER/mQ32lUt
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-02-03_ade2cd67edab9a308c63e248fbca03fd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-03_ade2cd67edab9a308c63e248fbca03fd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TmfmPAB.exeC:\Windows\System\TmfmPAB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ejCiRHs.exeC:\Windows\System\ejCiRHs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CSIfCoE.exeC:\Windows\System\CSIfCoE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AWbnpDB.exeC:\Windows\System\AWbnpDB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UgYqzay.exeC:\Windows\System\UgYqzay.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QEaNLsA.exeC:\Windows\System\QEaNLsA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qyIqEml.exeC:\Windows\System\qyIqEml.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UnuGnNW.exeC:\Windows\System\UnuGnNW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UtDqffP.exeC:\Windows\System\UtDqffP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TbXJgkc.exeC:\Windows\System\TbXJgkc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MQPoQjQ.exeC:\Windows\System\MQPoQjQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IGswjUT.exeC:\Windows\System\IGswjUT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gpsjnpI.exeC:\Windows\System\gpsjnpI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\obqHTCv.exeC:\Windows\System\obqHTCv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BQCPgTx.exeC:\Windows\System\BQCPgTx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FGrFZMh.exeC:\Windows\System\FGrFZMh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXiHHjK.exeC:\Windows\System\bXiHHjK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TZGlhVm.exeC:\Windows\System\TZGlhVm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SBHgWEb.exeC:\Windows\System\SBHgWEb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BJGzWOM.exeC:\Windows\System\BJGzWOM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WBLSeGr.exeC:\Windows\System\WBLSeGr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD528590e990f28bae506bc6125fb2bbec3
SHA18cb0e2398f0ee71a1518231232d3f23100e91882
SHA256d4e1c4a001236d4522ea1bfe7d211c93051dc561199515a0d5488485afc7a410
SHA5127a78f36bf883459d477c836864a87ac13cf5152742e341dbb3350676041b7202af6bd498645cd589f9ffa99b798c7c4da4cf456c323176a9bc56bdf2ca51dd6e
-
Filesize
5.2MB
MD547f9d6d7f51b5aa82ada12ba5f8aac73
SHA1f5aa8324b7910dedc49308824fbd430d76c682fb
SHA256546f0cecbd49f98be9fac8aa5da44d9f605aea48ec634c752340311f0ce7f110
SHA5127518e0ffaa284242f678d1e8cda4f23d7324676bb5b53261d1d09b9ce103ed95480974d649830853007b2d9563e50667bf1bfd0762c8f717610948d2a2e2711f
-
Filesize
5.2MB
MD5727750e107fd2c1dd1e732954cb35491
SHA19ed772fd50b90a49ed48e712eb09cb56bf8e1123
SHA2561c85e6dc83941d0aea3b655bfc005f7e0e4c45946a03e494f91b51a8e2126c59
SHA512799f82939a7f7595203a414f37778dde6ca85f74d5baa2094cc663a3a4dc0cbcd0fe05ac9156d09e888055190fa7420bdd399bdacd0ec66ae1cfcb9813c4e77d
-
Filesize
5.2MB
MD57e9a8fdb2b6ddc4410f66511013d133b
SHA1b8a41873b140b724c08a6ed323de83271acdeec3
SHA256e27f9792f95b45ab7c393afcdb93ed0e685d21d8f8786e65870ebcc06b8b79eb
SHA512d88da82f760ca6826d23adfcb63ef87beeabec86abc507258474aafe053c1f71de3c528ad46a395c349d6366ac0c8e18d3475f21afe2784b43569bc403df5348
-
Filesize
5.2MB
MD5bc2b435f70efa9579b4235c7b521e561
SHA11169b72736d98626b7c59b734f44648e91dddaa9
SHA25683f66a919908f0c7047d620227ce1406108ad799286fe459b537186d30304e5e
SHA512ba1a3f6399f8c47a19d1f015943e9031e766de0a41f56ae776983cb26f22e14ec280ecfa53a948c01d90aaf25d1b961b61844197746368ad30779393fc5b9303
-
Filesize
5.2MB
MD529770921bb55f2cf0de2a3251f4ca84f
SHA1f3d625b98c36e843f9fa4d91199361891f2e92ab
SHA256ea5d18664e4617a136e0744195a76bc08f91f4fbe407385a13576bc9546aeeb7
SHA512db674761c9c1187fedcb06a7851ef82ea8b26678a9ceb9bf32bf0df0b2238c16521d18e0b268667e29823ab9e57fce4fee0126ee0b6eac3c4c793813052b44d6
-
Filesize
5.2MB
MD5dec356f1d2997742ea8354e801ba8fed
SHA17ea69b12380c74b8a31f439241c4e1b2b9b0acea
SHA256848b454e444f133baa4548cd909b9a66d89054c2db669ad30494e0553db5377e
SHA5122e8d3da6f4d3964da5d3e9c4718e08a33c9aa02b3703d005e8da37b20f187e35b4f9664645778ed583aeeaccd0e02fd818415dff715cf941f66b047aeefa7b4e
-
Filesize
5.2MB
MD5fc210e01eb5bb5182703c44f5eedaaa1
SHA1218c2628fcfe07965d43d7fd90a0fd537a8b3152
SHA256149c20298cea0131a6b57091b6ecde44f73393cdb10ecc696ba913c5e5e8d3bd
SHA5126f82af864b089af7539aa2188905a851f10628bf81918148fe8067a211d92666f74e5acf1f1f8fe35e46cd59a911a32642141ee3d3a0d126804428a72b06523a
-
Filesize
5.2MB
MD5db20f510a3edb339ea24ea84b5ba3e1f
SHA1e1ebfdc7f938a64b8668d2a16e8e5a05a19255f7
SHA256f2c387d4324ae18cd77e13e00705e09f925b29cbd5bfcbc23b7222056f33aa53
SHA51234f40f6ca11baa941a41244655e57b4c8bcf8b14b186c099273eba731085e5d3646aaf0f54690765ccc4bc664a40236f6d968865676d61ada02c8591b7e5e9ea
-
Filesize
5.2MB
MD57fc2e209a2eb27dedd08f05e09803ad2
SHA1ce4391a227f5b3f51d8c6b9fe446bbf21eb223f0
SHA256857fac94857462d16c0cd96872588eeb98086e8e001b3cf5dde5dc156f6d73d1
SHA5121e8819aaa0bd43a231998a10c15fc9d8985fe7f1b63cb73973bfb06bfadf49acd8c72c5bf1463a01665c3c8aad2986ed51300425a68fb524bd0c4c4418ea67d2
-
Filesize
5.2MB
MD515768cad42373dd288dfa7d0f4af9ba2
SHA1d6da5ed8a154dd627122f6e1cbeab7b4cf33419a
SHA2569b5abacacbdc1e2a6c42f7e300fc341a0a6aee261ffe3055e0863c746829b2a0
SHA512ec7f8ca4ef6fef5e17e245f6e45b5bd6e6367a802eb6d588940e9850d4a517ee0cf317418fb5c5613d1cf30a4e644f371763f3eccec5acc2d6057deefac1b8a5
-
Filesize
5.2MB
MD5dba90910160d3c41b661b837b554865b
SHA1199a97581540f841862e2a9e314440812b4f46a5
SHA256ca4d012f044abe053ce94a7ab2f01a6828fd7b012ab92c598e7b9cc568810459
SHA512667f3c8b9e05e92c39baaed1e6f1f7a91a454b948789e8cab0194c07a424ae7fbfeef256b8f856ef6f651ba7d8ae2ae81cf131e7a18ab6d9767f1f0a1b1ca3e7
-
Filesize
5.2MB
MD56eed99aa7da6a3e5beae93a6451f4dd2
SHA18902c8cd4ce4bc7ae16050d52b4a83174f7615af
SHA256f1a2b3a80a497e20e761a33ac476152ffea9657206d8e46078eea5760de79a09
SHA512d65701abb0760284846505a36b57024ef007c6607220984ed4cf836f7e62aa88eafb4ce70860b312dcee7d79f8ec3e3aca722d1f2d5f3a7dd312c6933a1a7cb1
-
Filesize
5.2MB
MD5fe81e0ea9325f4315bfb0b952bdb9a99
SHA166ffe1c7260a41d9b58f7c2b7288b2d44467a092
SHA256b651a0145ed23e1e51511250502b61693786b72a192dc2790349932758ca6286
SHA512a1c7e46027205f2f7e8a4271ab704275079b52f3fa38fe5a931e809a1bebdc313cce959af6669a0ccc5676d5ff988866dd9a46804bcfec3cab177984cc60f191
-
Filesize
5.2MB
MD5f5054fa188e52303184a888ae4c7c5ac
SHA1f5a46d6fbe281325607057548d098ad06d5ca344
SHA256676e2746c93b9ec208a7387ee65514c098d32387fb76b7117c3dda4d3a26bf9a
SHA512989f13818372028a5062421f4be8f78648862a4588a60800eff34a61ce4d6f8757e4ced46a24255aaa2cdd96bf26aa950c6a4d61fcdccc9a0a214bf565258c7a
-
Filesize
5.2MB
MD56bcff3dc91d6ec3294a32279e6bb1702
SHA1fc6764536298a8d059a172c1b2bd20ba25082d6d
SHA2563ebbd9dd42703618677dbb888b19182b39ff78cbc5a15a6cc7978c73aa3b0920
SHA512b5c785911269804b26e7ae41a0818abda520b109e91af2d011beaa4b455271cc4ae541198447cbbec3302cca68a1efecfd3638c7ce26e0a7f4d7d69224a53da9
-
Filesize
5.2MB
MD5fbe0e6c6234a3e6011c6b82afabb89e5
SHA1b935e7de066cca1c2dca4ef9fe4f5fa4367299f5
SHA2564f1061d5ce4ee5fb41e23a127afc6075e96a268a1ab4f3d3a01fd6e98b00e30d
SHA512ac8bfec3fb738d0c990ea0c1495fe0319ced0388f8f61a7246672ba6ba900f652e52bb06844cc3ea33eb59a1be9c2caf47bf5a85eedb5b1a79482682d5b64ca1
-
Filesize
5.2MB
MD52a14c5e850e1381a98152cb03c5d0e3a
SHA14e2c60647d26bb6596eb4cc01b70c7a4c51935f7
SHA25647f56466c917d407c7dd4c0543a9afb48cbd8ea067c0009a27518d58450a0632
SHA512f84ab6dfd3b0f9fc5ec13ca60dfb141abbd0ee75f26a12d17efc6ca3cf1b1bd9b84fb4d97576db48271a3cd636c635ac024b7ee9b4b9cff3419937c3e2e30181
-
Filesize
5.2MB
MD5301fd818ff46c7ae9d169105bdc381f5
SHA199a67213d54c57fa0beafcfbb6d47c1fad84422d
SHA2568935af0fd391f03a42e873bcbec6e684307b092d705f03547e47eabbacdb37ef
SHA5125663d279a44375ce54c8c9401d9b5c5f12022b702195e912debbaf44915a8258ab752454e7342a21b890f05a97cc847e2da07b122a35837fb91cf07bf4d64e7f
-
Filesize
5.2MB
MD563baa240bc9b611b91ad297a235238ce
SHA15582ef425e9a6bad598ee6070a6e1e61e653b92b
SHA2565636af7e4c7d794ac3ba36405dad449f37cb8f872ae0002cb00167aaeb78127f
SHA5120bc9b5fb95541d94878909756b5ded68eb4f0fed5a7b51c68cf24fc5bfb9d52f5f8761cb3bc171bd37e3e894c893ceab89f7c1e5d77c6d564b8176bda0705b17
-
Filesize
5.2MB
MD50fba12a5a0cf2ac2b69b31e9b80ab8ad
SHA1bdddb83975b9adc717945ab333343111119020c2
SHA25621514e0a7652997a441c2c7f60f0816046db6e2767262e089e661327be4f9120
SHA512aaf49c9a4a7ecf3c8c864ae8ec951c38b1debbe54e84f26127a902561dc65e1e0230b12091a4eea023698af985ffd2831d649586679cfd78547efbcaf350d727
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB