Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 01:02
General
-
Target
2024-12-31_befbfd2feb53d51e9b769e906bde1f90_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
befbfd2feb53d51e9b769e906bde1f90
-
SHA1
733c0c3b3e85d8e4709b778ecf758ec45727a75e
-
SHA256
21470d3aeb8879e0587b3993317b6fb3dd79a636ec54bc5846b5dc95558b2d98
-
SHA512
8171a9d6ab33e4c990d3a89ccf8835609cd2b991d771e4d873958a19bcbed50a08a317f5d9f234e799e8b34c371312fe8392e83cff83bad34b4b325a8d2d9b82
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_befbfd2feb53d51e9b769e906bde1f90_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_befbfd2feb53d51e9b769e906bde1f90_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IdTlsNV.exeC:\Windows\System\IdTlsNV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FbmfpfD.exeC:\Windows\System\FbmfpfD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\egvTZvY.exeC:\Windows\System\egvTZvY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZGCIvxx.exeC:\Windows\System\ZGCIvxx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GfsLPMl.exeC:\Windows\System\GfsLPMl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hQCAGMc.exeC:\Windows\System\hQCAGMc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xSPGtCk.exeC:\Windows\System\xSPGtCk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rOIVNvw.exeC:\Windows\System\rOIVNvw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oGloxQt.exeC:\Windows\System\oGloxQt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hgUFRbQ.exeC:\Windows\System\hgUFRbQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rPiMAyO.exeC:\Windows\System\rPiMAyO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CbfFkvn.exeC:\Windows\System\CbfFkvn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iZbSwwg.exeC:\Windows\System\iZbSwwg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LykdPYT.exeC:\Windows\System\LykdPYT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GMPbPFU.exeC:\Windows\System\GMPbPFU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\amcufyo.exeC:\Windows\System\amcufyo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EYFZJdu.exeC:\Windows\System\EYFZJdu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xTpJVgK.exeC:\Windows\System\xTpJVgK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TDCAqSJ.exeC:\Windows\System\TDCAqSJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mUmIjJY.exeC:\Windows\System\mUmIjJY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RlMaXsy.exeC:\Windows\System\RlMaXsy.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5eb861e616136e0191c4d01003d7caef1
SHA1a8a8d92667b84941e44f02f0fde77e67873b27b8
SHA256e24473c06e5b397e478e494edc0260b9638c734aab026ee484921eb2ff597098
SHA5124f83f010b6dd0fc3890bf8e2929e6e1c8e2e502501d27bb7914c485b5d5435637dcff23321c41dcba296ce8d9bbca3d99924f602e5be8c840239b372d2c9e727
-
Filesize
5.2MB
MD5d4e1ab17b600302de6b55faf5d8565ec
SHA16760ece783ba6827577f8a973720bea188efa52a
SHA2563ff236979e61822b9382df15ff543b255f936bbf07c74a408a52d17f62a469cf
SHA512598b921af476965daf254f65066143784b1b6508befa36eca0d4cc8060de0814bd6ecbb97642c765bfe547ad5557d4f348a5ed857354e78091ae8ab30287276a
-
Filesize
5.2MB
MD52537771766282d9735a0e6085c44ac56
SHA1751d4340464f8d7f5a8a25ab1dfea14aa5c9bd53
SHA2560102bc5f56b247705d63d8d9fcd70383d715045012a446707600b26253741efd
SHA5123de706c9cd2f4758d1e7ba48ecd60dddb92e0295d2f408bd200ecf92c0efaa4386e4e1938d474388a26621b3a362ddb197d9121b4c267c2ed5e301b883acb52e
-
Filesize
5.2MB
MD500128a609bdf2899b39a37450009eefb
SHA151b5f35cf2c7f56f4f78f3109d7b5da3be9d4f58
SHA256e4f6807f66a2f36dabcb99b194f08c33d82def72ad2e4f711249cce2039bb337
SHA512ac17bd59393b5bbd5f309aa490f5f26ec040987bde1722aaaf07ba4b7d3fea9341b5eea8a8a5b84a37280d056a5d75244b15b60b52787291d992acf459a0e7b5
-
Filesize
5.2MB
MD5a21f8ab4c72caf80bcab7898228cf330
SHA123222657410c55bf960ab3e626e2c90890900529
SHA25612233105b381e6b1296ec65ce973a8ec263281d1b59e52a63f35b20fcbc91847
SHA51263267a105d70c4e1b62e4c13e05aa8d90c1cd3de78d9f285a36c0928a915e9dff0a0b06a7794b41f28d42c4c32e1e6eba41248a004f1773a6a1d4543b10e9616
-
Filesize
5.2MB
MD598142b0746ffa5dae4937f74a22fd1bb
SHA113647ee1b3e6c106744c299a9aee4aa50b81964f
SHA256f932b59f2891046872f2994ec309236ae95a239d4ad534f5290941b3e301c4cb
SHA5122ab84cf6f3e5b96620b9ed508805a4bc1928d720f2a7dd0efea28bca014f2bdac698485d1865c8eee1ff2434b23d96fc4f854ca24e3335fa92d474ffebfa0cc2
-
Filesize
5.2MB
MD57d0accb62c82c346994886823d84c11e
SHA15ad1980fe195b7919e7ce37e09f0ce875536d45a
SHA25634b93059f988d60557ffa7378e6b0bd5d2a2f2e9bce16989c3e93289b915df92
SHA512d15749d8e29d8999fd19568c800563803013af6795fc6d31ff1fc35f1720a0565dc5c5d8acea50f2daffd92ecc8971af5eb8eb07c970e50ed5ab1d490143b93a
-
Filesize
5.2MB
MD5d556a1602e1e2c18e0d51dbefb0703ea
SHA12de3db65d112ae84540ba06d823e247a9521f56d
SHA2568d849ad3b7588fb1490663f1e9ffadec3e0470a7cd9d508231447b40a78e2267
SHA51244a08efdf7f75722cfbadc17e5f7860ac299c0887affad197e932de078763dd8457433cfdee4f19e208d122e72a161db821c6b110528231c12a7d1b07b078ce1
-
Filesize
5.2MB
MD54c4692cf97e79ed23cd1d3dbbcb39ec6
SHA13faaab5826c364d5e942e65705bb799485a55947
SHA25617487c7d1a51eb9d315808cac84ac4a04fb9bfdbec7ca3f495a6eef03f0b646b
SHA512cf571613a67ef2446276e6d1534b1e719ec4913227e16ae053c8b0c1f87c28ad60f2eec7b677e9396c888739b41aef5704fd592da1b045d98ac48859d3b10a10
-
Filesize
5.2MB
MD51985d8460ae951165175918c64ba3274
SHA1510b0d3b7632a8799648f221cd0aaeb0ae6f162f
SHA25615475290b0e492c3c9a66c706afe4b72adf78e0f55e95a60280ebbfce16b9d40
SHA512f85c3032ac124022221d484316d88ca962b2d6b19f17bb25d59669a05e4be1e38e955f88b3eadf4483961cb509b5e7b1b6033afdee28fa901ff4b885a48fb4fd
-
Filesize
5.2MB
MD5a384389075aa967913f2248831c1fed9
SHA1e2f752eff69e4204894022ccbcfb96a9fe725fb3
SHA2563ffa61a5a47dff12da156d2003c38c44b76f77ce238830fb42fd3e97ae07938f
SHA51299bd8f99aa20aa169535c39e3af9a5d3b66b2a2c590f90e2e09d77317313479e373a411cd8a6033c5c074f532456c708d4ba281c5513637cf00ee910973548e0
-
Filesize
5.2MB
MD5a26e298d03e5dd089fc306df5bd9d132
SHA127e0cee4f58e734c758d7bf726bc317ff146f49b
SHA2568a4ea12e43d772e1227ffb37751d0d25e25cccef734234eb4127b642893d99e1
SHA512b7fa794875822246ec57fd0dbbfd13af22ac74937bf87cc86ad3cbd7f80da7865a261b332f4bfa2f67e5d4696df7bbb1d0dd276194baadb795d473a044566029
-
Filesize
5.2MB
MD5389cbd5467b1684f7d87f80a676a3945
SHA1bb4d52239de290d87e8682084c968e0c05cc664c
SHA25647ca4535da8b413df98ff1898306f3bd35cb3d08df0631ef20ddf89c343353f6
SHA5123d4c538d470741cc0ea28fd18f48ea6ac422cacc61d6b78927a22f47ac2545271772b8a11dccd2e67a4f8459e951523e94cf5567e27d4846caa39245a3e0ae60
-
Filesize
5.2MB
MD5d8f4828dd62feb28981aa2ab91dc898d
SHA187de857300c675d084cd7c629fd6ebe4dd02ab6c
SHA25621ddad11d68482cf7a6aeca7fffb126cf0f1bce74886ba7ec87edc6237c325bf
SHA512cde02f1ef954ccb97ec1e238895e934267eab548ae59d234e743ee2bdecde87f57aee7719f858c4d6c713cd990400f5f826889eaf59818e46b686facdfa161d1
-
Filesize
5.2MB
MD5422e31517989048d786874635cd070a8
SHA197652002ae3b3b9199d2cebd0eab089ad693507f
SHA256e5b65f6a5a92fd3a513e655cdf9377015f17cd1d24f9f0d6365c1db794a7a9ea
SHA5128fa992133aeebc4dcf0c1aa0e1ec59f92794f3ac5a0c015eaf15d41373d70e3e9f14085ca41bc66d0413454498bb7764e7aeeccfd3a8b94cca73a00a2065a774
-
Filesize
5.2MB
MD565d5d0b07c51a5671013e324d6ca57f2
SHA15b100601953b93d5daaf38df2c60aad7639d611e
SHA256159e156688271b9b6a751d7bae98584ec621cba57d4f73d8044ee5c8c8f32010
SHA512849ee6d1666c06235181ec6778684ee13f28639d02c1b627f48111de696b6ba72fc7939a3d2e588a13361259c7d359ed129a74499632074d69a048716923e92f
-
Filesize
5.2MB
MD52b5341f8f6fd8650bd132c3427272e31
SHA1ffaca1409af5db0e2640e3819deeb71f5891e4a8
SHA256b7d18c554fb61f0d77b94cfb185a327c02eec208f859695e14c394ca1ad5f4b8
SHA512fb446875fc1abe4b1123baece3e0475d2d6dfe026ca30d6749396f10aae57683952d1038c8efd9d33f609686b3e3177432a6787a094b604377a335c0c2236077
-
Filesize
5.2MB
MD5beb591bd3a2b491b96f7d7d3cfcfde2f
SHA12122c446025d129751906858bf22313d61ceb032
SHA2565c6da13d7c7de7926457347178330a90e969f3e7f519d41927a1440491e55373
SHA5127b4c7c90b71e24c4a24432fded8064402591c32717fd426e79b445d46c9d43eaf9c5e1e5f770796784f98d511f03d9008c035da6a570a06ff4d7373eafec4c4c
-
Filesize
5.2MB
MD50a15097157c302994a6a34dd23bbe5d3
SHA178a3afea15be01f7d82d0b658bbcb25f53694d4e
SHA2566c0ebe8df2c0ccd57f211c329ac6e2505a02821b3394492fa86874c2c4c9bac9
SHA51293395c734500010d233266ae13cab2ddf00135f345e1c69168bd7607a454f7e654aa00a0faf6262a770031659e787f7289e225d678d390e372cf081c1add8abe
-
Filesize
5.2MB
MD5bfc530955f2c17f3d2b786e6c9abf611
SHA13393a735b3ab7bf07ce79b0f9620026577bdb835
SHA2569577754562c9b6eaae7f204cf4eb91a4ea3aa916e9cfe197fb9dbf0b4e161987
SHA51232dbe39bd9655c93c4be0d2d7f121458727dcf56b6a1fc025fce8497851fc492f1f8850fbdd4190939d8cae652933dbd88595797a629eaa5d01f0d6e9f91291b
-
Filesize
5.2MB
MD5f2ff0dd0d8f4b004c59c4234f127e74c
SHA171829c6a92cd9740f5269f2f00fb30309ceb02d1
SHA2560fa2337e0067b3529f0437330da38267bc41417b83eb718d72b85f0bedee7f9b
SHA5126eebaf4b2099460ffa1c0e0eba2238fb565d29479d03f4c6c7b920b020a93752e7a84f3d52a0a4556c1b0a7ba46a0088c393f74db86870aa93bc5525a48e2016
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB