Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
31-12-2024 01:02
General
-
Target
2024-12-31_befbfd2feb53d51e9b769e906bde1f90_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
befbfd2feb53d51e9b769e906bde1f90
-
SHA1
733c0c3b3e85d8e4709b778ecf758ec45727a75e
-
SHA256
21470d3aeb8879e0587b3993317b6fb3dd79a636ec54bc5846b5dc95558b2d98
-
SHA512
8171a9d6ab33e4c990d3a89ccf8835609cd2b991d771e4d873958a19bcbed50a08a317f5d9f234e799e8b34c371312fe8392e83cff83bad34b4b325a8d2d9b82
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_befbfd2feb53d51e9b769e906bde1f90_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_befbfd2feb53d51e9b769e906bde1f90_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oieptRW.exeC:\Windows\System\oieptRW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CRZPbsR.exeC:\Windows\System\CRZPbsR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tlQhicx.exeC:\Windows\System\tlQhicx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IzYhZfP.exeC:\Windows\System\IzYhZfP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NJSprrB.exeC:\Windows\System\NJSprrB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LnbVSaz.exeC:\Windows\System\LnbVSaz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ycgFxcx.exeC:\Windows\System\ycgFxcx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bHklXJH.exeC:\Windows\System\bHklXJH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rMUkEwx.exeC:\Windows\System\rMUkEwx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yUcqOCy.exeC:\Windows\System\yUcqOCy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FgyrKss.exeC:\Windows\System\FgyrKss.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LiFbkNf.exeC:\Windows\System\LiFbkNf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EbSzQGw.exeC:\Windows\System\EbSzQGw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yCuAXBN.exeC:\Windows\System\yCuAXBN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UzSyUlk.exeC:\Windows\System\UzSyUlk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QcJOXCo.exeC:\Windows\System\QcJOXCo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QEGGRxH.exeC:\Windows\System\QEGGRxH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GhcuQDM.exeC:\Windows\System\GhcuQDM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\whJcXCC.exeC:\Windows\System\whJcXCC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HurlUXD.exeC:\Windows\System\HurlUXD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AYZItml.exeC:\Windows\System\AYZItml.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5fcc4e1bebca2933fa6c76aa2ac3032fa
SHA1b09bb7f8f9a2a3259ed4690210d9f3f308bc4f84
SHA256f3f762fb73d7f6d5ec6212121e2bcbb1f23c902e9c92a65e1404372c82ff553e
SHA512e185235734f44bf1941fcf7f91da1d576db000c897b9fb9e6683f376bf97fde008baf1bf1a5e9b36b5738f68ae6fa6966958a7d7eee2f0eda3ddcfebefd6a1db
-
Filesize
5.2MB
MD5e6796241577532683b169ee9bb770955
SHA10a60763cae9a5eb3f4508f2f6bf9550bf6aa941c
SHA256eca7c19dc7f6e99f88a3423d14e4aa9b76bff7dca21fbe4e26247762fcc5de71
SHA512cdb5c716b388cae061d37c3958b6559410e8184daa964cd9913ffd3c3f713c9b2a2840f57abcb83ee1120d2c1341fee5cdb7502e2d00b1b05432c776b51f4559
-
Filesize
5.2MB
MD5be787519fc9242ab565ea2746af3fa14
SHA1b8aa546594995672c4c5746a4b1fb35dedf4b0ad
SHA256a85c678cdd03aa047e98ba7bac857bb272b03e5ff34b5b3e25abb131ef7105b6
SHA5128cff0280233c689acc023fe295dbf7b85df87907863c04595365b4b7c21d817d6b8001c44a1bcb00de24c531dace80dbe29ad2cf345e4c0ce614ccd7fc44e265
-
Filesize
5.2MB
MD5793eaad1c102ee9e9cd34604e466815a
SHA13c1bbbad246111b3806bd9f5b502bf0771174049
SHA25647e52c4b7868349117e2407904874e9f571eae5b87782397850f3a3638139f6e
SHA51273205d1c0919a94efa98045b18c5f37bec2351c2facdf8a84c6d9912290adf24f8576a575336735e0282ada3fbfe7ff9092c69ee5f68fe47c9345ef61c77367f
-
Filesize
5.2MB
MD5427cccbb1d1edc25e9b3e89156072ba0
SHA19ac5baf9c6c7d3d3609abe98582e96f455f8a727
SHA2569e0851673b6571a87612250adefa0d28268d7b789f78287a6deb660c0583ed58
SHA5128f1c492b40ce22aa6c57dc9cfc05fc47a7807d0acd852a682487cdce1260d1c22b9f232b4f24f75bd1fe73179acb457ed1427f9e8dd0fc318080d1d3192af200
-
Filesize
5.2MB
MD515dab53ae9504c73b619b2e4db4077eb
SHA1f549b925d1861baeffac9d7835a3294acf98731a
SHA25606cce2a3994a99d95ddbceb40296fbc8096cdeae2a65a4b7c86fea196128afe6
SHA512f016de4b848095ae40b70418300a8820c12eda62fdb92b201de133760a308d273aa763f267d36c7d467491e2a8f442bb879ca3d56ba5f5fd7fe04c339c9cbfa5
-
Filesize
5.2MB
MD539a36a15d8b57584588027f87337404e
SHA1b7ba3618bc521d9648ccdd8b26557a7f6c974ea9
SHA256f33797ed9ea4846afa50734a4af06bb492b26466e1e450ff65e19ce990ad9dfc
SHA512fecd118f8b98ffd190743d57bcd921b38a39835befe2661ccd6b0b87f7338fa18fe35dd0eeb8d205d2184557394c870d0060f6fc9f661e2391084e1c377cb9ac
-
Filesize
5.2MB
MD58e1279820aaff5c3fc7f0b2ad902d41b
SHA1a34b96b4ca9a3092464998679493fdb5ebdde956
SHA256637db9c8183202fcf7dfe2c2dbac731212edd6614713947fc63e43f5346c54e4
SHA512ec99785506148a8da92afeb4c71bf99e240d87d3e11570766c1f5d9f12be049b66b093ef699c13ceb76e22c7d9dceb462d0c3ee3ca2d55673eb140e5d93e710c
-
Filesize
5.2MB
MD570ed5c61c353808dc72b84d562f9a78c
SHA1fd0ddd675f7a56051781183833f38894e3cb95a8
SHA256798a6e4697f39fcd946c2914dcf1b65baf40783ef5d3f4e6c2a338c8cb61c6ce
SHA512cba0e5a6748d4449a93facbb82d2c87f17a4c92bd4d576c2d3a283cd46ff6d957a92c811dc696461f6121a4ead7e626d22095f07a20aa57e0377e91698710739
-
Filesize
5.2MB
MD513c5f070308216705ba586b116e108ca
SHA12c9b9f8617363ac91a69c7d81f1e27d556e1b146
SHA25696debb428578504399a756dcf6ce166a0bcc580d7f158769a084e376ea8a9e60
SHA512ddf24c4636ad8d5d41c994d6a23b1e5a32b6d8315114e1b64da80bcbfbba461b6b63b86e59dbb74671e6c828afea8bd741cf91ac622fc4b0321e2e04d3872a9e
-
Filesize
5.2MB
MD5ccad9b291355f50c96d61a2efa33ac3a
SHA1aa1e5a16b9e2a1c09af69f16fbbf92bc7342e842
SHA25620cf505f315d5a2e97df3d1e3ca9c8dccd73095ac489658b26b4bf28e50c4d71
SHA51209a1d042910bbb970c48c9417e22bdb5c3bba8f9c886caf6acf4a9aed098bf6f7f5b565041ec6af7bde70d059ad6d67d2777d60f56a51472dda0acba8894f0b7
-
Filesize
5.2MB
MD5112467b4a46e6cc8e30bc83dda118eb9
SHA17d994d7a45698843b1b09a7c851472e08112584d
SHA25607867952e3e83b5c74dbe4f380a438e6f855d9c3ca3baae64fbdca8ba8b297f4
SHA512ad707f9c3066b158f755443ec42686f8479a76d36c1c03bd62bc898babe0fd1a5e2ff093a1dc54a444f31671b67f21d26cd6824d2886af2d8dd66a04f90da8be
-
Filesize
5.2MB
MD56f44ca1149d72b25a2deb138e255aa6e
SHA1016f1db780b0b23e43f48d44a8500d74a7714fa8
SHA25685fc722288fd9babb5adc0e2600da464a226e62ce262f030d6b19b21e2856fe7
SHA5120b84902657bbeed9cb36cc21a77a72b8a68519245320a775b550ec5798bc10d0e27c3a7b83c27981f3cc8d459cba0a7a4190c933c1e4544fb41d8d0ddf66763a
-
Filesize
5.2MB
MD5b07f499b7b29e0313ec5b42fcf80024e
SHA132f1c64c0cdfc9f9cbdb7eda309b29967d1814e5
SHA25676e1c9de4613d4b0c3ddf45dd3a48f106e683abc4c9cc6e7224863bf982af1b4
SHA51211f7fecc96ce7f85d16e6f4b8c6f49d27ceaf03ee18e47a2391f83c59c1c4c53c8b9191081edf82d6c876d0827cf1c0f2f019ca0864c6f0a9e71509dd9de0bb9
-
Filesize
5.2MB
MD551453d769ca0a8854f2962acd5478e61
SHA18f046f7fbd2a2bb5205ab5fe9e867d0d3b00da8b
SHA25642341ae5623f567b16ac602d906888b3b2782a7bdc2ace9883f3669e0292264d
SHA51243422fbba8786a2f4e2db483110efe2dfe0cef3bc8d71fa77f6899a8a299cd4c2acd8f14c018598ed693c65ede29d1ef81911652ac7720d6762f2ebdd9871195
-
Filesize
5.2MB
MD5f06c39c14d5afd9fb4ac75fc77a254fb
SHA164e3077be98ad86a30eb8d8809c3b15e7c03ad67
SHA256c47d4f25d07b4943145cdd7d44548aa7d038460d13c165a6cd1fd27c66f9b746
SHA512e7b355ac476b096a9b32da351a2a1f4f4809a1632fed04ce3a1aabea70198cb0b91822a73b399e08f83cdefa8572cb67021cd894f1ee530bfc63ea03d6acd553
-
Filesize
5.2MB
MD5c4032fb35fa955bfffcc5ef65f7591a1
SHA16b126d1b82835264825e9984bdf54b1aba20308d
SHA256ec18345bf289822483e623aef976f71643072f08a682771b88912d7d347a5a1b
SHA512f43d9ce6016445184ff1589b7854ce03c919e8e1cf79f771e7cfba61de8c07a918287de73c81e520e3ff4e32fa16f7b48c3605cd0af6ba94ebfe812d724cdbfb
-
Filesize
5.2MB
MD5c4a35488cb59b1a7054b6bfd986decc7
SHA1a8105ef676e96ac417b976e03f43243bd11d59d9
SHA25665e5bf01f686d03e55fa589418aaa25cc554b9f3bf3655c73967dbae2d8ec2a7
SHA512084ba93560ab29ee9369ce43c424b30ef80609502fc2360acbb3130ff8e4c3ed67c2a1896a03cb72e26a8e5ba19281375a671754fe8c53cd9b0e8453a545f5de
-
Filesize
5.2MB
MD5a017e7d8c31287dcec28ecb6b5fa79f7
SHA1c97f6e8bd46af207b67196718cad69d1914f684f
SHA256a76a1cf453ea591d7427ee264af432b8872cb235f9c45375b1263a974d37e857
SHA512a4b02d1de2c4235fa3ff4681c3f63a20cc8f344561cda716e613508f8f70e2cde4d821a15efd2c4cb3b688c6f98d59e622f537f2d81288e11a61f4e4c93f6067
-
Filesize
5.2MB
MD545268c08461681890102563be1193eca
SHA14da89344b276a3d51043cd14d4cafdcedd54fd7c
SHA256826a8199f4256de7584c72bfb595eddb290679d968ec97d668c5a72f353e7437
SHA512eab0368495a4fcff6dd36c36319b611c84948489551a65f9b7d2dd8ac9a86aee652715da9627a3f9ea954de1d2b7b27b8b1e977edc056840be87990708d14a14
-
Filesize
5.2MB
MD5f49639f4497fcb057fcc80244cc2c894
SHA142a4434a4bec45e662d5f17fd3bd46145a69e3fe
SHA25635e7fd7cb9a8b21fe3d80cf39246b7f31748128aa48847c1dd4d3ca52a8eaed8
SHA512383adf9c2fe71065cb89ebed52acc971802362406f5ef4db58dcd935483e4d8debddf3b1e80a39ba9f6a13d263b31e2984c7322bbef2c312505203b3c1eb5cfd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB