Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31/12/2024, 01:02
General
-
Target
2024-12-31_be2c85d6efdfc4353a65b89ce48854f9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
be2c85d6efdfc4353a65b89ce48854f9
-
SHA1
97817c3cea696eceee04c58ac1be83f2e4827369
-
SHA256
19209576ba88a47dab03667291e7de50a9b9b498b45979685731b198f1e8b9ff
-
SHA512
39966ad0abae066586163b8982b4606341a86896ea7230e279e444a63de6bd2c5bfa1b2ac1a3ee8473af58924aaf08cc6fa49b5f956532b3b7ceadff41d75e19
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUD
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_be2c85d6efdfc4353a65b89ce48854f9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_be2c85d6efdfc4353a65b89ce48854f9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YCDTXsp.exeC:\Windows\System\YCDTXsp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rfEUicg.exeC:\Windows\System\rfEUicg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sSxGjrL.exeC:\Windows\System\sSxGjrL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UGrYSyD.exeC:\Windows\System\UGrYSyD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HmJIbjF.exeC:\Windows\System\HmJIbjF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iNJJoUu.exeC:\Windows\System\iNJJoUu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GILVYxX.exeC:\Windows\System\GILVYxX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kACelfN.exeC:\Windows\System\kACelfN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hZrqfOw.exeC:\Windows\System\hZrqfOw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hkSeDSY.exeC:\Windows\System\hkSeDSY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZmtDbUC.exeC:\Windows\System\ZmtDbUC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\slrYlSl.exeC:\Windows\System\slrYlSl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xfDwOWU.exeC:\Windows\System\xfDwOWU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IiSgjDv.exeC:\Windows\System\IiSgjDv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fjFkpnf.exeC:\Windows\System\fjFkpnf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KewzPcm.exeC:\Windows\System\KewzPcm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mBleemC.exeC:\Windows\System\mBleemC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hpuCdqA.exeC:\Windows\System\hpuCdqA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPmdCBC.exeC:\Windows\System\IPmdCBC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iHBrdml.exeC:\Windows\System\iHBrdml.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\knpFrDA.exeC:\Windows\System\knpFrDA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD508d1aeb7f0cdd16e76e945a8056cf371
SHA1ad38d8fd4c6b808437e904e7105bd8e2cf1bf635
SHA256607ad182ca4275436f96b8fa6fad6eba6201c509d6dd22cfb64b626b1745ac6f
SHA512d4432af7e34b1077c690134c80dbf3b3bdff968d2932a501f9889caa144ae57257467a70c626cb95f116325ad009e336e2a78af64b6f7e52bd11acfaf0526aab
-
Filesize
5.2MB
MD5e7e9c26335bcedfbc91412c3a9dc29b0
SHA1b36567ae9f8e20f0a418569b252592a4880a0ba5
SHA2560e5b5247d62bcbcdba67448067745a609030aa84ce859ae0b7f08945f7397ad0
SHA51288259a5d80db84ad2fe198d5f594509e4e860824cdba92684977e448e1ba4ef9673df0d8c0436e81f42e93c80217ca4943fdbba4fc832ea4f2697f3dd15e316c
-
Filesize
5.2MB
MD54c0b61a3fd9560d4976acd8091a307f9
SHA1b6d73462ff2c0224ff3f3812017b38333d6e43d1
SHA256c21b862ab4e1e2dd4f50f26eb7b538f41eb49d952a0c7ffdd2d0f035ab175af9
SHA5124896a8ec8b003ea0653b896a0063a6776b1977b158283adac2793c7dea60a58b0c2fb82aebdbaa14b568c4848ab16d73d1d849983b04f4a8a1446bfb66561484
-
Filesize
5.2MB
MD5d1db36ab46ead634ff34439e9d9af5d6
SHA1676ed16436fcf14dd7d7db1f2ca1cdad1a21f9af
SHA2567600e4f0cd73f3de37b228c716ae5ada7df24079298411868935b663bc6dfaf9
SHA51277f4453514038b5e8a3cf5243e8989b7a20c1816c69473dce39d9bd693c302e35b9b0499dbeba5531203c6dd6fdfa0d77f5ecded8259404a7025735fc1867e4f
-
Filesize
5.2MB
MD5d460a3d9f372564baf97625d217e8843
SHA10434f7e5f0122fe6d007fbca2514b4c42497a05f
SHA256a6b56f9db582c83a26b94c873db45448e575de5bee661d47ae73b0bd02a49854
SHA5127b40a5f234724fe4840e6ae4a4d3eb6a4b98bfce3bb0a526ba3537ae4d4a0c30a5f8111e775148f8f95522256b33efb769427b3e62b087cdbcbbb60970b21dbe
-
Filesize
5.2MB
MD532e9254284539b47dc43f08755fed4d7
SHA1533b7586909c1cf06be661a97d36725b64001e18
SHA256b7595574bcfac2b2f2322fc57a5b8616025d5f6ef114d28a7096935a5fe18f02
SHA51222f27e5a521215b96a91e5329dced2df6fa684db803ad2cdd1460bbc2fd185725ae4dd37e08e4e1325cbf8d3ee7611e62001ea4534017595401cab50123a538e
-
Filesize
5.2MB
MD55c813f6ce3e49701e815150ef35ffb4e
SHA1554a990c249dfbf4fb3a9caa82d349fdaf2d2684
SHA256258812c8c81bdc7d9c3a87ddfadd735a6654fc621f1d91a744bb91e298827a2e
SHA5125d75e32caa48b092ded5e7c2d02feb4dc3fff5d0931f343a74982092389dfd2b49f7929d45d2e55a4968dd33b6d7615487b56c6201bf3e8f99b2c2bda7a15df2
-
Filesize
5.2MB
MD57986e842048a629cde13c5ede2e13642
SHA1d1bad3e46eea5d01384ee9ff09b1aad432a9cc62
SHA25680694c014131acca2dc8cdd6523b0902312445cda22ca4113e0b6509d74bc041
SHA5128a1d7abf832bced1d3b734fa1cd0c6e8970976bd585e17d72e44662a8fa26b8740c3be7f96d41a4006c3e44ace23779b488b3fc730b67b104ce793e42b7f389a
-
Filesize
5.2MB
MD570571e7f15e877a4c33b61e45428be2c
SHA1b6190c953bb5ef881818840f804cdc7daa7ceac2
SHA25658ae841e51ac41f18a0457b05ff88fc549465f0e62e4cc2cb62cef0d20876a2b
SHA5120d44402959c9ea6d5472898d4c4f599c21a9e983abb631f549c112b116bf969eb5ba8c2036878fa7dc4dca52787b104b553fb2185997952bb8b39e5369743268
-
Filesize
5.2MB
MD567955b3c674b5661317eb2dd300f5ed4
SHA15f7ef27e7c8250072e4c85c4950457be18b1af44
SHA256343834b26bb02af183b50a2f1633d735fa69a64d36e43536bb40e51b94431c8a
SHA51209955c004b5d7c88af76711686d5540676424935a80c004a8011fdb416277cb1abc51c6e1ba702080683409901ca2fc9720ad32c6b381771916cb8a9aed00499
-
Filesize
5.2MB
MD53550a34e0f6da51960ca09393cf592cd
SHA1bb063012b22c00416a11beede1d389630f6a4d54
SHA2567e7a1c7880f6a90d3143506b2ccdc5f848f1809f61b7a672c0d6d7adc28a031b
SHA512739badcfc0b5e318f572c2d841e58ab779d2dad36d69d6f7a8e2ac46d62642958935acb148b433d3199758ab6e95d9bf002832848091d740f84de7294c6d860a
-
Filesize
5.2MB
MD5f53a02123b38d9cbd04edcec08c47b25
SHA197168967d285201747b048f21c4959899b28e045
SHA2567c5a20154ffa31bcd8a6ef47a4e7e97b27338f65f229e87f07debac05be00111
SHA512f4ee9f25130bc56b3021e8f80269ea394dd9261f427290ebe91dca0d819c733e9f8047ade879738a603c0f58531289ccad53927266187febbb216deefc3a0175
-
Filesize
5.2MB
MD5869611a285b2c1e5adade5b16657193d
SHA16e0bbcf9e171a05019dd0f31c30934a112933acb
SHA25692a9b1367f57a3462a448b42831d5b9bd1ca842130f68655b45b3a93cd8f524a
SHA5128a4e4ca6763861bb0989817b450d857b411f81659c3c92d9c8a074ed945dfa3a483bf1ab87d0ed00bf58c5d02c1bf3c2b4995f85ff81332a36acab5149989b5a
-
Filesize
5.2MB
MD52f94945bf94b9b561a9ed87d24d17e01
SHA185a083c82cd3712ad6afd0bb90ee6aaff7b989af
SHA25615e3f558f315fe234f0e2d2cb60edbb51534d2f95b624c816dd7909cd2735e36
SHA51233c9516a973d01e37cc6bb04066959e080a6d31fa85b56050443eb9a8d914bb902062d2f6a92892861f8cba5e19cee339d98917c4724a391ce9f2286564f1786
-
Filesize
5.2MB
MD5ee8d5aed29544e88abbfacdd4a25ce16
SHA1629b740f3aeb29635a29511eef28fa1019fa643d
SHA25605a405f4a9cf46eea48012f2ae98c4d93bb36297c99a4eff82501038a90ccbfe
SHA51249acd54fb48635268a5175613a7d8b3721ae1f0da57edeafef7f754f4abfd0bfba439bdc3c5ae7cb68672ea3172e27888c059c2c96305754ebb562b3ffeabe10
-
Filesize
5.2MB
MD5fb81b2c27e9e6fec545e8fc7a0e8e4ff
SHA1ff08b4dd2f3bcf0c57baea37d9664d7367202361
SHA2566f14d9905e39df2370dd04bdf5eb95290d584f34fe2f07ee81eda0e1bb6f63ee
SHA512a2b661d269dfa614c92c84e82b25595ec2487345900958e4f265381e09ab2b5ae5b168ac67a4ec325c623e773b410c833d295fdab48250d2c4d9cffd3f7f8d2d
-
Filesize
5.2MB
MD500828d5e2645fc21a0f1ed1d90bbb5cd
SHA1f4397c19424031c5b5c5a80c1d5e534c4101b547
SHA25621c52735fd53dc0a9a860a31ed56a9e5878808034094f056edd3d3f6e2d7ca9a
SHA5126658c445ef115278a2a827964e852c98ee4f6d36374eb46f3c7c00ef6f43e5a91435aacdf85abf511d506e2c9231ee228aa113eb4b0b68928c331959a9602022
-
Filesize
5.2MB
MD55e2f73abee2d4d806f641becd616b74c
SHA1c04e99ce4b293ee59b80b2dc9c4d20169a91d1f6
SHA256eefcc34e052dc22e7757dc803996089fe47962b26c3ebb92e58e2fe9ff019e99
SHA5128835e68e31c3f7485df7e1750040b1fe241a67c5c951c701c2bfe32e28d9cd27b8c146e2c39be30bead4fd1edbde0fca241fe7ed397f71eff2448f5dd5c3d114
-
Filesize
5.2MB
MD5b4aed22ad2b8b5e7db4a1ceed1dd9353
SHA122fa8564537f2ba3317cf01d96f334358d090cfd
SHA256bab7ae65d06bf7cc9f107173aaea24b5ee7abfa298090df21dd2b711b9c27a8a
SHA512e1c6cdeaefdbd74718cc76df17760be1de625537b62636b2a28dd75ec1c2d50503233e6e680fac3d63da6e9b31d91cb2a000fed47f7261c49784e82e54e5e17f
-
Filesize
5.2MB
MD5bbb469939bc223dc3a2cb2cbe2333f15
SHA16e2ff58b3ef810c49f5024b58082d86f2ad24c02
SHA256956735db8916aa2f124ef992b53490f18a565cc5d06a96d8f9cb505132802da3
SHA5121f38651013d0c5f27ef1c24d73d9f3c391cb2f96f5d10bb0b34536c001bb13ff7b86d523843fa4e1e0975906fb846da3bcca3cc5c455a6f1dbe6319d6911bc2d
-
Filesize
5.2MB
MD56e8ac4f26a6889e23cbc0066b394ca76
SHA11c9b9dee802602ae5c89c861d474a915fe9e928d
SHA256f28c610d3510db66fd5e97aad0832075bb3b3fc3388c01ff61a0d3e4e191befa
SHA512baf2a4490aaa62253ed68911d8e4b90153a5e4b91d06501f801d773dcae6675b479742f8158baea8080fb19f5d3eb1232853ec1533b2682ba02bd0fc9e4b7d39
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB