Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17-09-2024 07:30
General
-
Target
2024-09-17_3e05a842ddfcf9113ab0d1b2fdecc7c8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3e05a842ddfcf9113ab0d1b2fdecc7c8
-
SHA1
22b64c5520a1d286fe97e535291535aedea8ba98
-
SHA256
7e63146cf5cafd8edad8b1c3152ecbee0359f9143972a243b98ce60fb66a77d4
-
SHA512
4f3b4f1e66d3e42381d9662c35fcc45e8b08395434df9e10637bdaa749ec220d5ac8f94c4bb1b49987795b07566eb7a461f3f88e5bd4e1ca143388280107c204
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibf56utgpPFotBER/mQ32lUO
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_3e05a842ddfcf9113ab0d1b2fdecc7c8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_3e05a842ddfcf9113ab0d1b2fdecc7c8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CIXrWot.exeC:\Windows\System\CIXrWot.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cpwjQiS.exeC:\Windows\System\cpwjQiS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AzeVTgt.exeC:\Windows\System\AzeVTgt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TCPtwnd.exeC:\Windows\System\TCPtwnd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RuhFeRw.exeC:\Windows\System\RuhFeRw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nuoGaGx.exeC:\Windows\System\nuoGaGx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BmEPEce.exeC:\Windows\System\BmEPEce.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KUdiMhu.exeC:\Windows\System\KUdiMhu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bbrrnLK.exeC:\Windows\System\bbrrnLK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uxpiUes.exeC:\Windows\System\uxpiUes.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UsYrGuI.exeC:\Windows\System\UsYrGuI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LliCplK.exeC:\Windows\System\LliCplK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kDRGfYK.exeC:\Windows\System\kDRGfYK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yeclfga.exeC:\Windows\System\yeclfga.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VgpAvVr.exeC:\Windows\System\VgpAvVr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KxtRmsA.exeC:\Windows\System\KxtRmsA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OXWyuTq.exeC:\Windows\System\OXWyuTq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OuMFVnO.exeC:\Windows\System\OuMFVnO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hPZxDTf.exeC:\Windows\System\hPZxDTf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oBWfLCj.exeC:\Windows\System\oBWfLCj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PvkeBat.exeC:\Windows\System\PvkeBat.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58226900635a82aeeb4e737e00c04fe25
SHA127da6d4a5646afaee760d0c5ac1d3cd703015ff8
SHA256f90c3a572da1772ecf5d99293cc9c179ea32688f2581ba46ac084f0a3aff0ff7
SHA512e571c05b0a7f6030749d3f00a13122e26c17ca9489bf7d60d0bf3096250af2de37bfe6403b114f7725bd555add5a6884f74fcf6199f4c36fc9feceda1dcd6b57
-
Filesize
5.2MB
MD570f9de83e1eac733001475e08ab54ebc
SHA17fb19699fe91fcc86aa75f9e565b93d60b595145
SHA256031d7d700c325501f06ddcd9f5b3de13a44503993a730800cf5123cbab838d8f
SHA512080ae9e4673e7d22a9ae57fe58d24a6aac0e34af7e6cd301c53800c4058d6bb8d98ec4c41dae81bd61761a43ec8925bcf9d81f11fe1103cc38ad6824e731fdca
-
Filesize
5.2MB
MD5e49d3377b21bfb796f6a913282587a6a
SHA14dfe4397a3b371875e6c2d47ce46c18feb25ab52
SHA256bb6ef9bfce3f49c0eeb40de800f07854c33a30fd16ebb8639c3b746e77e31506
SHA5125a9aee0aa6e11f705d0376912236ee7e05af932466451f62b4639774f2f1e769230f3b53bda270040dce66e469fd9394642c62f7d88cc741d121801b3991033e
-
Filesize
5.2MB
MD5caf5ee00b8c1ebee31a9b7861b60de79
SHA16414b17fbc7622aa35ee4a2fa7c293396242825a
SHA256777d7194899c1c9b4c6b380c5afd7c3b85e683db2f8e2c97fff038c17ea57e1d
SHA512ceebea555cf00739ea3ae8023b959480cdcd53f3ddf85d05f9646a38d5f1d4b51c928644bd4910f26fc2ed21092226aefda17420c6fdbab2704a07e515069b38
-
Filesize
5.2MB
MD5317198b8f50a13be434f855d9bf223da
SHA10aaecbb67e3eaf897ddb8afa56a29487b5ba7967
SHA2569f06aa19da3d6e37598526d190e45ba9f3f4041bc6c85eca1cc06ed0d47c3761
SHA512f7a519645cc5426bc1cacf2fe9b524af92ac0bc329c2efb4cf9138fa986c7e143206ff7df544cc9abdbdc2f1b50448205dc300b1bd42db9b82f6d32e9a9d27e0
-
Filesize
5.2MB
MD5eb975d9179d1b7aeeed42e4f9ff6d5f8
SHA104d02bc321399b69cbb9da3a81a8cfd31427e926
SHA2566361cc086d1add27ce14baadf9a2e1220ec5a447db473014e11a0b0a3ce1ec9b
SHA5128ab08eb6a42cbcaeadf75198b8e3752b175f349c706a2550c7d8ed85369bfccd6e5547acddb35b2abbc7381b1b677ca1d041ac9a3b4f4cdbaedf582eab08b0f0
-
Filesize
5.2MB
MD5b232d3ae62245084abf3b6df6d1cbff2
SHA1a0d178888963a38c64b718d55ccf0fb0a6b55f77
SHA256006cfa24935994f321a1aff88a674f88b4018c8a125f6787ee62ee96d6b9e8a0
SHA512b76e36cfc4f95a921f22293549074b08379bb4d6dc9bd487d17f822207805a8e217ff7f74b0d60d176c2333d595230bfe7b93bf970e9fa0e2dad561b15e6c944
-
Filesize
5.2MB
MD52eb253e427c7fcc0c22d24dc4a756550
SHA1fc8829cb4e1a9f60c633d8ad9a6d24a879dea1d3
SHA25608bbda2c79b35abd205a8ecfc3a3a6e90b9a8bd73c271591face1040e68ece49
SHA51200b2a1dc9aa5b4bc2e10fba91fcdb92ff27cad6f8a010a7f4360234d355c3e198040febe176657c5ed028848dd3f449f138a34aa05369014cbcd0030550ad86d
-
Filesize
5.2MB
MD5791694a1694a9c4837870c7bd8c866eb
SHA1e37ae3b9bf5b1ab9e09ea0501e4bce1cf32e097b
SHA256f2ff1cd0dfd1d49a90ec05fb08c313f9f22627fd12e1645f3d986d9ed0cd77f7
SHA5127f2cf40930b763f694854ae10c6af1ec47d219fcb4497fe3838cd9ec2050835b73bef933f3380f4d9f9a6cd5765a31048438053a1c25fecfb300d1e8e8c6a68d
-
Filesize
5.2MB
MD57b632c86249a2483bb69a60b15e452bf
SHA1eee731eaae0d92781c972b86c245a9f69bbd236a
SHA2569842f470db4de172d216676ca6c1344f8c55b4982c941b5c6761511a366aecb6
SHA5124a33b27c7d92a979e47a0f76950dc2248a8280a071d678b0462649faaac43574b13844ec1b887a3757002f610a168b21ddb71a6ef4d381fb2e9227d6444821e1
-
Filesize
5.2MB
MD59b093583599e156648fdb1f27b492fbd
SHA1c23a1e66c8757a6f75501a02e7f7e2dcd2fdccfb
SHA256e1d5c74bc628e6722913b55fb646171c593e833ca0e7224f6fa8c8398c5459a7
SHA512808115a1bfc80534cb02ca99b7a83f490ef311426e7753c6faec6e4309cba76e586ac358effb42eeda0379b03ac46344ad9e5e21032ed8bddcb077567c38986c
-
Filesize
5.2MB
MD5c832d91718c7743a5394732716f40fd1
SHA1aaebb533d8875436ec07a95064c251fe7493d8c0
SHA256d0735bc47c22414263ada9f49f7cda0981c20d57fc9c44aeb948f396c662b246
SHA5122c0062de7d1d0a5cf97ecd57a120dc107bec11d630dd2d444659a2a03a5f55c7bd2a12229055c70aac77c6872c18064985095287502fb74a5c642e95e6826e1c
-
Filesize
5.2MB
MD5077d8986713c79def036f3e7514a73ba
SHA11f23bda04c6824978c83f5f13ea079cc605ce592
SHA256685b1b509aa174a17689bda070125e2c46c7d4c4249118a07cb3f7bcd436e005
SHA5121166ea354cc7407b117217fbe4b78806ed135a7d7bf259a34e44d2b140ca8810ab872a8cf2c93429f104e2f2701c0b36a77259a53315ab9e457614f433af5903
-
Filesize
5.2MB
MD51000603e6b75bcf72a7032ae0150cd0d
SHA12d73b08bfdab42d2d4f836cbd23e654058a5a4d3
SHA256332238b5557e4042e66c5b1448c7ae34838a676a3c5f95e9c04552113298a8b7
SHA512c02a76ebb288f850de558a8eb4c133cd52892d289b1e9c2048e8bbc95b77512a0c643fc98378598edd656006bc3b0b89a1f41b7b81c6176215970b7f4db64d27
-
Filesize
5.2MB
MD59acdc862bdd9eb5dec9757d0367335bd
SHA17c6870260d8917fd57fb93fa5f8124b085d6bb0b
SHA2564be1b6c78b6e0e74e6f73a193be854cd0fb8fc12dd11b566c645cd44c18d8232
SHA512fcbf46a559f0e2e95dcf44be3d73a1005beaf3aae0198b3a88d6a568f4fdc8a861e525b378b17d1930076c94d3b548d9a0568e51d8f1c965edef5e54dcb006af
-
Filesize
5.2MB
MD57e38590e16b8f4815437cf6f7a818c6d
SHA1a48374e880484f6e0567508e7b4366abcdaf018a
SHA256ac1fb57c2975628694da849d3170a68ddd3c3627ead5f1213d0e11a37050a0ea
SHA51290cedfbdb993b48e247312755c54d0452e12dcbf9057f184ea72d5e51fc72630978deb230e6198693cf59c7260352e287cfadd53e37a0e725c6d368ece3efaf6
-
Filesize
5.2MB
MD5c8d4f571b4334e009f4fcdac8635ef97
SHA1eb89e049a59d06be2b30147b202bc9f717d10efb
SHA25608014015a68187125068f7acd81ae15cc08b6072a06e396d4cc16d31fa69562e
SHA512afbe9d9c9523b2c9819e64054351eda13e428f271174986b4edaca1e1c49c3ef2ea4c547e1bd9981e999183049edb40715ddddc38e2241febb1df937e2bbc9de
-
Filesize
5.2MB
MD54c44bcdeb39dca86f56abe4357a95396
SHA1d23f4a66fb1e73e1592222ea142460fd772baa4a
SHA256d9c6725b33e99378d92031cc632a242fbd3552be36b35765ad4ef91470336bf3
SHA512e9ad12327a4ab566c029db1a2c9f297c6c3ed483f014443fb1367bab3a173cde3c9ec2ac6fa927989ec3e3ce36c15b49e3b9109f126a5708519cec5c6931d417
-
Filesize
5.2MB
MD539864119b3b55b35f18eb132b510c326
SHA1d545a01ae020a3ceb9d673596794c5ff1e8a9c04
SHA2564aaf5602c60f55c31a156de0d786838f5fc75f1d976fc6bb647ccc6994f7f5e0
SHA512daf00afb4763adc0f69777e78103f6da46d35d9c215948965244cc410275f29c4dab685f2ee45a7de22a55f4395614e100db3e38f855d0ea37c1cfcac5e200ca
-
Filesize
5.2MB
MD53d6bad8347497d85de48abb900e9bd17
SHA1063e75b1a795209a14eeb410c9d467799b962152
SHA2566635c4edc60af03324e7bf1cb9b7b81baf20b4991a4c9ddf7f526c0a87c5b1cc
SHA512c64e0b5afa96eb23c14e43a4ee3227ce1cf69d341ad252631bc762680cdfd5834934d361d348bd9e21ebbe8d9f34a754990ff7bc12f5b48fa8ee2ca81a0be2af
-
Filesize
5.2MB
MD5877fae101c601ec368d05387d0f681bb
SHA13b222d9c5eb35bff6678d04b3dff4266c9b6cb91
SHA256478ca30f92623d385b7daaed8b91315fa20e1e9fadb66b489e45d36c1556f021
SHA512168861486e5717c0b30d34f9c66295a661a050bcd0e871c7e3df22142dd6266128f1c9cd38bee37a9717a11f31a0403e70667c1813d363db2705583788003811
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB