Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/09/2024, 22:52
General
-
Target
2024-09-08_e04e1aebe7aef971419c036102265631_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
e04e1aebe7aef971419c036102265631
-
SHA1
7cb5bcda75b27af669a4693ad10f49ab75b71b96
-
SHA256
04560f2d8c431dbd77d2448a2aa22cfc8462a6da134771188617cb774eb88dbd
-
SHA512
33ffcb4daa09cb0c9c742a9cbf1c40cfec5e183b0d919863a2402c464c724db3a9a2c9bddfc2456eae6a189dd64ed227527a93326c71f104677b924e21608b2e
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:T+856utgpPF8u/7N
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 54 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_e04e1aebe7aef971419c036102265631_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_e04e1aebe7aef971419c036102265631_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jycxqOs.exeC:\Windows\System\jycxqOs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SjzWtWX.exeC:\Windows\System\SjzWtWX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AppGvuZ.exeC:\Windows\System\AppGvuZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cWGrsTz.exeC:\Windows\System\cWGrsTz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cpKylVe.exeC:\Windows\System\cpKylVe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NjvVlRl.exeC:\Windows\System\NjvVlRl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EyLuWuZ.exeC:\Windows\System\EyLuWuZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eyjpbqV.exeC:\Windows\System\eyjpbqV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oOXtCsp.exeC:\Windows\System\oOXtCsp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MyyGdqs.exeC:\Windows\System\MyyGdqs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EvwemRW.exeC:\Windows\System\EvwemRW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\itSiDwg.exeC:\Windows\System\itSiDwg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SiRonBu.exeC:\Windows\System\SiRonBu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JwcONvw.exeC:\Windows\System\JwcONvw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UDzrrUc.exeC:\Windows\System\UDzrrUc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HqzxYpV.exeC:\Windows\System\HqzxYpV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MPZFEnP.exeC:\Windows\System\MPZFEnP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AXiZeKB.exeC:\Windows\System\AXiZeKB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bRINqJN.exeC:\Windows\System\bRINqJN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lryCUuz.exeC:\Windows\System\lryCUuz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cPjbeOF.exeC:\Windows\System\cPjbeOF.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD542ec0a6ed78944bb7055336bec76a792
SHA109269486a0e309379963f9e214f187c806ea950c
SHA256f6616fa1b0daa34e2762bf7789df476de918f19ee53e760e920fd812447fcf2e
SHA512891c0c9f25d1bd3ff4422bc853b7bcfca89047ff816be0e35a02041df08efa505216e626dff66f014b33b9d6cf0b2ef3676b54ad306e6dbe24c2b0d2b1d9e926
-
Filesize
5.9MB
MD5e25a4c196647b8faeeac952997cf5240
SHA1cf145126f9a044c1498de54cb24b64814dc512ec
SHA256aeca6e9cc796b3ee2d2136d4ac71da1cc06b25a574725559f3326444644f363b
SHA51217a7165c46b9ab408b3465af4ef6d562402588ce8a1278199f517d495e5d93f36733adf8f234785635cd9671526c5fb436855f0fef5d4bef275d5fdabf75ab05
-
Filesize
5.9MB
MD5e2be7a1552993fccb20b9c789064c2fa
SHA15383ac2386550505133e14a564db80ecb598811f
SHA256026a8a4e88d02f72ad11888168eb3a68981bfefab54badabd934abf79e2e7193
SHA51275df30b930f4cdeb55596110d499781b121ce5716b60c4ce2417c2da758a63d099bf5483fc93ec505f6c4cdbd19616aea3b31803e0f0e88c601477845cd3e0bd
-
Filesize
5.9MB
MD52e193f2a0b296a444582dbc5b9a4d022
SHA17620d86ca2ebab70b7cbfb13b53c5891c5181bd5
SHA256034ae5e68269b416b7e3bb82fcdb34081c25067451ca8ec8afd6941144916d50
SHA512730ca283e036365327b32c9820ff7f11bf735ad55c101be7585dd960ee7190d0eb26c2dc6e4a1e1d0ebb65a3ad93f19f6972572ea105b2fad45dcb03ef2944b5
-
Filesize
5.9MB
MD558dd38c51a796242f921e9f46226b4a2
SHA1164d203f3b33bfec5accf2f7222146854bed51f8
SHA25613adf79a090213b7350c692584d2cf2db1c6834ebf6a4629826356b223b7e477
SHA51206ea6b69eb2c48cb2f326bdd2896d391302ba508d64430cd5273c91378776cbf6fde731452a55bdad37e8bd51c3d393a9cbb1880a6752ae068261f7b965ac7cb
-
Filesize
5.9MB
MD5aa4a1f272b04a7aeb1f7fb3fbac38519
SHA180a3c8fbc13dffe1b577f025a25eae44d0945ce4
SHA256615926d0b57dedba81f8fa01819882cb4613a259879723f3a8e9ba5a2585d234
SHA512f86eb24ae6f4f490a850425af5f73eef2da699c368ac7594b279dd2952efdad5b4e109b89ac087571a39407a4b103f79ffa5f6b20b7e448763b289d5422449d9
-
Filesize
5.9MB
MD538e1004ab1bee869a23f42a1570dc118
SHA1b33261c4d7ac53be50440b14eb7fe90893a8239c
SHA2560bcdb6cf5bd50d37bbf298c9732e11e659c71db62cb7140be56333b21fa13e88
SHA5125c98d153b65de2d99cd51b010dfa83462310fc2f248462424e3f9b6f0248280fd7f3b1e79fc3b2fd2069afef2c9424f21be969e28833b836926261f9ec9b47b5
-
Filesize
5.9MB
MD5c512a692a2bf7cad9ddc34e64576f9e2
SHA165dc94e3cc6d1bb0cbc75be92a1944b9a6e5bd2c
SHA256d7f5e8af53059fe5e74473078e9c5e157f4a130a0c10934f1e4de65e1a7f11e4
SHA5124debff5ebad689ddf60862ffb0aa95c965916adc63c049ebee74f290674366cec27bce256352ce983176ff7160a97794c23fa3ac4cfbb260164fb7a8dd564838
-
Filesize
5.9MB
MD503a427857ddda3622ef499142125496c
SHA1e09c44f58826911312119a7103864d2f0558d908
SHA2564be6a15bb4a3fb036df24064ae0363365f061025c21c2708a3787f0fcfcf6de6
SHA512dde0ed4cafd68317e4644e58e84e0e4b9388f7468de6f5809ee952fe1c1ee2186d23fac0fbaa7773140facb7ba25f2c448fe216087943e5baa703921366192c3
-
Filesize
5.9MB
MD54c6381343781a732e5af8b878a9cf1be
SHA11277006838e08ded35d89b8be97dcda752a24c58
SHA25638dcb649cd384ee54ebfd99375c2eb491c19ec16ffab66a95bf4e864380cf787
SHA5126a718bac9cb50fc657c12bd52bcad6937e70007e956de0502c028fb5bd5c6c5a88a61c80c19e5b45855281d648fc48434434ad985b73cdd8a4d8669fa09f3696
-
Filesize
5.9MB
MD547df02bf971f008dee495ab5b52940da
SHA1a70c83c5b99fa0ba6d2064a30063cc3b7d21071e
SHA256904af5fe036db31f91d6c1387e629ed3f83c858e0a2dba18ec64b77273a2b72e
SHA51249762ce01e1dd0bee3a4fb9a9a51485b4912740508ee0458003caa88ce62162a05b8bd55673fe70c891652d917d9a2bade4a12202efe45ee5a7d639eb164ffb0
-
Filesize
5.9MB
MD561a0e1ef8e2b232536f5c0cfbed01861
SHA16decaa58f474be012878f35742e789c671cd8a03
SHA256d6ecd3830ac4345245d5a293387d1a5e6064257cac4644a02335b965ff17fb6f
SHA51262b2fdd0c6ef5cf2d28718bc56ec02ec65303474e1626793e83e45e4fe4cbdb353ea84a0b34722d8d86d1cb5d999ebd42bbf28199e6c423ea6af4f0513ccbec9
-
Filesize
5.9MB
MD51b01bf30b5038b437869a7128c84c7fc
SHA10706c649bffcbdb0fc6e30087f3aebc42788388a
SHA25687205cbd28f58c8289935d16ca14bca8d21fe1cb8af41dd7741c8d159737b6dc
SHA5126b15889da23cab6c8eb6c5e01f57ae4fa42a58241e0e5044feca7415486b9589d60506a89ccd7fe7009bc6114bf76939b4a45d1ab3a38c4a0ec46abdd10a8867
-
Filesize
5.9MB
MD5e13405669ebd46d0ad9ba50744858f56
SHA1045e63cc7a84477f1075da1bcccb06e94a8d1cae
SHA2569a576272325f5b5c96795afced3b21dd630168c3a2fe87bca4ca170cb8fc1c40
SHA51226436b41afdf19fa0104f4470f8cbe1d480e55c21389409fb73c35d5323c0b4a8993fc62c6e9d7799ad299480a9acae78007e44bf6f619d9bddc8665ff0c2369
-
Filesize
5.9MB
MD5f9ac0406bacb739c3ed725ec1e894be0
SHA1a641876f5a97e9e6afc86bd987ffda115b2e7012
SHA256a979740b8d8dea38960747c76609b503ba751f5fb09e818a46d6cb0b02dedb82
SHA512e95404bffecfeb132e1edd48d80f7a42fbf0a3af3e5c78cdc3648e0bf85a906a53934b3d2d374c6e28c51e81dd36980e4e67bfe3de94ee72f1d03fdd3ae0bdc3
-
Filesize
5.9MB
MD57824e4a870943e6a3fe0f1ebff8df63f
SHA1fc6bd766d13ce485b7eaca5c9fa99a54fb6f290c
SHA2563f53233257c6323aef0537479e07c74f5614ee0c115d59288bbafe86ce16b818
SHA5124dff57eb1d2b8af89461f9a4770dc4cc5a7d4c05ee5ffaff1a1cf076142f298fd542df93d229065a3c23f9829cbb9b7e61fbee4e8f323f2c778222048f6d78cf
-
Filesize
5.9MB
MD58ef04fb67d9e1b7fabc879271d1e5ef9
SHA1ebbf6e3851b5d53c4aab40504e09952881c83341
SHA256f3e9a6f27feb3fd2a94129361c468d2bb36e91af493e86ee166b3848c7d812ae
SHA5128507cf2f83817ef1f18801e58baef115f15e08d73ad426d47c116a7f4ff8b6349aa2124da0377d5cad2f73b97de1461c4682c59eef69efbba316a8a1874315bb
-
Filesize
5.9MB
MD5aaaace15d0ecc9f1748e7f84a9f05fa6
SHA1fe3677f28bfbfd408381d7c34342f17d843ff434
SHA2560e67f0afda5aea51ba6115555b8cf36725158b364609871562a7a0e0608af527
SHA51248080d0ce7061688b50476a1d89b5f9c048920772d73b1a9303cfc60c9d55a19c91d224290ce80eeb54626b1ef7a5e637717c4a8bc09951e09f81201a5df1759
-
Filesize
5.9MB
MD514d68cb1b0c9a655516cba868c299c68
SHA11f5a78940ae4c66b4a544c4921a4be9c6f02bac8
SHA2562d7f02c1a012f493cdec158b6283d0d968e06a88d7f040678755d00f68eac6bc
SHA51284febd25a67084a98507c6e1fcfd8b1a2e71909ac71a64a322a5fbf9df17565f31ed034f7206c98054af67587cf26104785cbd537003b2f3decfd738815a1bfd
-
Filesize
5.9MB
MD51fbeb06f4e62418414bd825b347dd772
SHA14bd0ecd3d197651a2fad43a29bc3adca95f6f706
SHA256d7600a27b0224a6d7e26f4ece5ab1038bc8f186aa40492fe2bc9c45a98635f5f
SHA5126c2e2ea8b3bdcf40f946ce4685c507719ed6f0dcef56a1dc532a29f68f3bbc8633b9e98aeb569f5dc1aa8b4457577b9316e8f549e80ed8b54a89ceaae0607c39
-
Filesize
5.9MB
MD5625d01a820a509b6f27748bdccdf1df6
SHA1d0b9a0066cfb5674010e522617a2950c04e87aac
SHA2562972a9ee5170ddd302cd3aae6b240b526214d59e473dbd45a7046f91dff8d56c
SHA512bca1be5bb8bcb2d604c2b85c8f772026b7bd574b04964f3f6264a3d625a7fb348896c4f96e9a50202a47e5b8eac4f08e1ba91b94ce441111e11ac113f3596f69
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB