Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 01:51
General
-
Target
2024-09-20_e8b4e3ae2e7020ca9b29665295133450_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
e8b4e3ae2e7020ca9b29665295133450
-
SHA1
a48b772016a23dd854551b6c5be818dd5db251eb
-
SHA256
3c2c3819fc2a750460b1a145e2adbde3246237cbc4cffad3d1a7e3f1b7df1b07
-
SHA512
c334ed8dd0adaf633846531ae81284eabb47d786ff69ef40c933754fd816778e786cecd7765f78fae11b34310931ebedff17a54018eb2bd2be603722ab6d9b64
-
SSDEEP
98304:demTLkNdfE0pZ3s56utgpPFotBER/mQ32lUi:E+x56utgpPF8u/7i
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_e8b4e3ae2e7020ca9b29665295133450_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_e8b4e3ae2e7020ca9b29665295133450_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IEOmltJ.exeC:\Windows\System\IEOmltJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lEihewH.exeC:\Windows\System\lEihewH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QsQWKfZ.exeC:\Windows\System\QsQWKfZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DMoWbbI.exeC:\Windows\System\DMoWbbI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pclrwOB.exeC:\Windows\System\pclrwOB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OKAPdKe.exeC:\Windows\System\OKAPdKe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\atVrQLo.exeC:\Windows\System\atVrQLo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AdNGKAH.exeC:\Windows\System\AdNGKAH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\crEkUNP.exeC:\Windows\System\crEkUNP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OacywKD.exeC:\Windows\System\OacywKD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eYOvKXJ.exeC:\Windows\System\eYOvKXJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GLCDpZu.exeC:\Windows\System\GLCDpZu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SIwHjmF.exeC:\Windows\System\SIwHjmF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\umaOAIZ.exeC:\Windows\System\umaOAIZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iaZczrZ.exeC:\Windows\System\iaZczrZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KPfebrA.exeC:\Windows\System\KPfebrA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lsqpKju.exeC:\Windows\System\lsqpKju.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fmTCiyB.exeC:\Windows\System\fmTCiyB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qDBdqvJ.exeC:\Windows\System\qDBdqvJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NZurXTg.exeC:\Windows\System\NZurXTg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fUtXSCs.exeC:\Windows\System\fUtXSCs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5bac1dc132c8474cdaf594ec4fafa6339
SHA10ea88e0816e5df312d1218b0c56d9c217ab7fed1
SHA256ed6f9ddf888c7898297d8702db40e09fb8658500a0c0fe3072040902b21c7c38
SHA5123a1b43616b211bf27a0b8fdc3314184db4fa3e68df38b8d1ed871ee88f4d2e4953270c1b71f11ab55c24f0145b4ce8c1588d5bab5d999df7f10ded213d78d3aa
-
Filesize
5.9MB
MD59153ce0d382cb3b5e905e5a4feba3613
SHA162018ecb6abcb81d8de549d35c821d387f93f15b
SHA2567031518aef85af53da9024a21579e101419355cf835542d7844b88938d1baeee
SHA512c3551fd90cbdc10fa7db4e074fbf44443064c5dfdd29811a55660e1d0bbf41e880491407a71b83b6f1bbf01083654619c9a35223d1cc6a6d6251002d8defc75c
-
Filesize
5.9MB
MD5d2031ca77ab17d9b4b04b0cffb7bb7e6
SHA11eb9b94fb7f20bb1d70c90785edf8e43ca416b2e
SHA2564f5f2e4377ab3b318f3600db7cfc749989c7aea90e331121c02ed62340c3a98d
SHA512f76eed7b8e9baa51ed79a9e6b478c34a20426e6fcdc2f4e4eb5b6b5ef0a1c51541f08dce85e3cdec3286628e3af21d491b09d61bfd2905aa59b64efe250edb0e
-
Filesize
5.9MB
MD5806536610ccceb3531a6e37dfe9eefef
SHA171c606f8b1fdda8e30e31bef2e692e35fae7b03f
SHA2564f75d5acc579ad4b0d99f038d6a8676ea1c47707e91ba400ba80f481b62051d2
SHA51257f011841cbce485dfb978b1243a6ce151e599b64fc05efd0c9fca61b6b8366cacabf5d4da210cf64fd16ee1866efeec23005101964f76ea7a8172436822c7de
-
Filesize
5.9MB
MD5f04eaf8f84f5b5f0a7c658f15f06ce59
SHA11d44fde9562b42460f5b98c0bfeb99763ad42449
SHA2567d61baeb16b61ca9901842bdb038383f9c8273c660055b63ad538a378a9d59e1
SHA512868ab0bee4d11c285cb47d20cc370e6b7111f9aecbc3b5169d954fb831cf4a2765a20e0726681e92bd7bc97e10cc43bb1a5f9e4a41f0735fc67fd26c4f0cacef
-
Filesize
5.9MB
MD576d324f3bdb9ffa99935aea0457addfb
SHA15cfffc037047fa141ade1ed05b094c65dd757f1a
SHA256e31384b0dee717835beb0cc5d6db72860f1419ee06ee7b7e3f08d03c97d63d37
SHA51218b8b784da5024146ce379da3d95ecb44368b66edc2cb9bc8764c8369dcad3b4bd9de2617e729e061a868428b0a3773e8d2f6d59307345a45b96d8ff3f53823a
-
Filesize
5.9MB
MD596c4a1be5678b0de716ae57a1e195e23
SHA1e5242c9330ad21bf809cf81248d222701740f0f8
SHA25618c09d8a8f8a02f53480463e2c1d0e0ec4444d9d4d1b1b5d67ccfe88acfd83ea
SHA51287a4396eb01ee92492fa727141ada368b2cc8b22d6ac1568dc2695bb14bea7d3dff6c74d76e2ade88bc7ad097b2f175dfeb8a38f84797b9e79ed9a918b50ed56
-
Filesize
5.9MB
MD53e7da3ed4e33f04a8a87689309e29bbe
SHA1bc9c3d21493f4a91d6484155efc3df16616f69bf
SHA2564fec3d32e3d893aec2f9a424fb5660757fdf309bf409da7aae4de31f8fc2868a
SHA512f255c64ddd21e2faa96f4b6053d9fb1fe973928fe78bf1f8a7e4607d4ef1d9fd2fa0f9a45bd0a349032463e52162e1435e884c23723e5dd2e4d58b6bb79ba2c1
-
Filesize
5.9MB
MD54d11fc345dc07fdaa1dc540f91be7db6
SHA187b061736eeab7914c8bb0e9fd20c8d09e6edf33
SHA256dd9c02c19fc17e0f4a5ab782240908967a8914dc727e73552a9098e1cbe83f80
SHA512861e6095956a4977d74414520c903f383b21e400c30526775ef8ad6b21a99e28ab9c2be1fbfba5600a0d389e92e550a7f3714348df02f637309996ce64cadcc3
-
Filesize
5.9MB
MD54d297679ea9aa57695a6f7098d6084b1
SHA14c080a0eaf764f4f029b5a6045f2b9e2362c5331
SHA25677dcbbba00efeec519630ab93a2c54471e94edc24d685b9710d7e21380c631cb
SHA512ce3cdd812ba95a9151a25d83d638cdc9f59d8125cb00c2fe9d1bdf0940213c40f00f7c390f80a39bd4b23ba104742a0fae2b65711b0b7ede9c3cea9bcde11dbc
-
Filesize
5.9MB
MD5aba378ad760db499c5195912bba104fc
SHA1c37ab48c5eb09bc55eca11683ace42c65ba2217f
SHA25676a91cfbd30b192707958bdf689ad4c387f3689928460240c21c725024613846
SHA512e9f465da90b10b75747275ca38d1603c4590a4219279c607bda175efc4cb9b74f8316651d5ccb6eafed527afc2911a5a59e64c42599f633e9b46f3089a2de6b6
-
Filesize
5.9MB
MD5daa739f314b11ab6f02027ee5ab9e653
SHA1f30fec1da93f6dfba2150cd2c595672e1850f94e
SHA2562f1e473c0785538811b61216dbe97bec4296aaebb18b3c51d0d191d9a428ab76
SHA512368f80f0cae51b0fc17fe8b66fe21d70a800551d333de57c6963e80d2c02119fe4a4f6de2af89baf7a132965a592e09d0cda6cfbbb446786f6526b8224c87b91
-
Filesize
5.9MB
MD56c58cacd18f5233f3857fc2dbdbe0c3d
SHA18d863c0cee9f2f54ea5881ff3c1cc0893315fb63
SHA256051f082937110818f7e9455094641e6b0462a662eecd2c77d16a43676c418884
SHA512de1e0c80b2312b698ae78a04376e96dda9f28a4388868f497c99505cec962738d142121a371a66628d8d5f489747d56d17734efef0f22125f00580b48a39dccd
-
Filesize
5.9MB
MD5775702963b3eee5fcc39cd6c926c3918
SHA11b513a28f77543c05d5923518bda9f3d6dfd6b33
SHA25642f2742e0472ddb2f1e8111556acf06340357b9c33ec02d24b813c351a3901b9
SHA512d4360c3b2b215426ec6fce34b4a9e8d0cfa126dd41e20eb85b395dde3c80438c768eab40d8e0b593c8830d2002752e7c304b9e119e172ab5ceab3caa684ae9f7
-
Filesize
5.9MB
MD58bbe9b418cfb184c4c6db3d7eee66713
SHA1149b096cd9fe4e8d1894d1d4dd266f1cd39e0795
SHA256af32388c78d6639c9a17c5e8df3bc0830db32980251b4657ba9adaea1a820c68
SHA51249252283a75f25d7c98d1883709620cc6d471466a5da599b8c48ab7642f6a148fea1b6b0bbb997871bd99798008e1e14a1289745cbe58416cb6b92e2a291bff5
-
Filesize
5.9MB
MD5548f9f67abbc1f40b21641764b82089b
SHA194842339c164a3f73aa45380932fdfb6e1d4f535
SHA25610c8f360011679f978f4ac20118c86a6de70e72829bbc2592c99848b6ea2bf8c
SHA512eeeef020083f5b38f46cf0b4705af4d67594ecdcd380cb9d2ff1ace0d67611b5abf36aec17e0ada0a7a30ac899cd24664df3f54072274cfcf96fd2846ce4e8d6
-
Filesize
5.9MB
MD5803e6a48c49c79abe00c551798ec8145
SHA1d0ae74058f43fa9ec85d57aae2893910bd805e5e
SHA256e9d3a3424c16340fb9ecd727e7128f80434ffebd2aed7eb3ebabb1529b984840
SHA5122f0c149339be79b5446fd50fffd2d0319c44dcdf568328ffbb6b216cde8266eed1ed2f008deddc66c35eafd7230c351d6bc8de204625f0e50e1b10b0158b415b
-
Filesize
5.9MB
MD57e07d834cc1c56ea2b5a0acf3b07a294
SHA19cd2bd7d593b10dd1fbd242257b5dfc5d2181325
SHA256d1d326ac6a1505842fc4eeec0bc04ddd73a68fe0b975bb35bb71d19642da53c4
SHA512bba8b80fe235e2ff6a5d1b1bd029c942cc427d130679e3e2ca96969edb7603c1a018aac55de67c6115fa5fc672f75429e53cf4964b40fd2b316f9c3695a3939d
-
Filesize
5.9MB
MD5dd5a0d31f25aabe0e5a22353123e15a7
SHA182fb5c9a378514889493c9174c65cbaccddd5c5b
SHA25643dfadbacdf86ce9505cf7d9fab72997f7ebac74259c35f3e81963d20603ffb1
SHA5129ba1567259281012b155ac11cd9e5505e666bc114ea35a68d03e6f4821a71af157da22b1d3540698f5e4674c74fcc42536be046cf08ec929bbaa220cd0aa73c0
-
Filesize
5.9MB
MD5d75a654bf30bc413cfa4123162939af4
SHA13a178e17c747cd208e4386d5d74d99da9ffd498a
SHA256d40aa4447dd9f18366603808a06d3dc67c110723940d6e9bcb52846b5004b69b
SHA512f6092734534d5bc32037b7c43b31fbc2a2dd8fd688c0637ef983999e39b2afdae54f37200362b44001d9942aa950a0c1db6fd3d9b0ac80a09479b8efe35a0029
-
Filesize
5.9MB
MD55ee5bd6b2017c0f71a226ce471cf8249
SHA13d15941a630a134e6986c483d95a93586f9b255e
SHA25648d026afbf377abf7093eae80e4644e9e3b2558471fbaca3e134118c475dcf64
SHA512071a3f47f68a24b5cd132b1d99940847c1c213008f5df4b2e46cdeb0038e7331bb61e9265656c160a22cfd649209122e34c4854d8b3fa40c869d213ea6d2d9f9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB