Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 15:42
General
-
Target
2024-09-20_e32e6111edbb32968583b1b59aa64fb2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e32e6111edbb32968583b1b59aa64fb2
-
SHA1
474e27971159b9b3db8e85b72c274bdb5bcb5e00
-
SHA256
ccba67d963a51395ebdf14219d79654dc29ef6fe3004ab88c25a14e8061f8afa
-
SHA512
dead3c392dac57ddc4a8e44093bc441a5c0a135778b32df9b3f1b5b73852a71207c7a6d18751b5411c3192fa2cce7cb484e95fecd58a10598639f159476b9e95
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_e32e6111edbb32968583b1b59aa64fb2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_e32e6111edbb32968583b1b59aa64fb2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RsyJpZR.exeC:\Windows\System\RsyJpZR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\esOdzUC.exeC:\Windows\System\esOdzUC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZrdgkRo.exeC:\Windows\System\ZrdgkRo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QNzWiZw.exeC:\Windows\System\QNzWiZw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CSNITNL.exeC:\Windows\System\CSNITNL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RwZoQGI.exeC:\Windows\System\RwZoQGI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zPnSgcX.exeC:\Windows\System\zPnSgcX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lFYjFuw.exeC:\Windows\System\lFYjFuw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OXxGEZC.exeC:\Windows\System\OXxGEZC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EXnPIOd.exeC:\Windows\System\EXnPIOd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CNBNCir.exeC:\Windows\System\CNBNCir.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jEpdmZF.exeC:\Windows\System\jEpdmZF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CFjXyJE.exeC:\Windows\System\CFjXyJE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xEVJewf.exeC:\Windows\System\xEVJewf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BqMlPdj.exeC:\Windows\System\BqMlPdj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eiufpHY.exeC:\Windows\System\eiufpHY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dxnFHfC.exeC:\Windows\System\dxnFHfC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aXALpDp.exeC:\Windows\System\aXALpDp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vBpluXM.exeC:\Windows\System\vBpluXM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yGYJhwg.exeC:\Windows\System\yGYJhwg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CeYbjpO.exeC:\Windows\System\CeYbjpO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57c9369ad6684c9583abd187ad83cd57c
SHA1fd31ea14b17813e15339a39ad09113539adc9146
SHA256829e0b26e2e1ae0f192c5199ee227580120692cbad3eeb10b4dc5060e5c3f3b9
SHA512b529ebec49d0eacf455f620eae5ed06df30cea3ad379ea277db57789ba0526ebc406a0b40769412bbe2db281e411b5225d1b8ad5e70d1832d2b63cbd096a0b5c
-
Filesize
5.2MB
MD512cb411a1a0e56c5d8d620243ce458fb
SHA17a83185973af8ab5689501831576bdeca5672be4
SHA25681f48db688bf9e205d2a98799fe114b3c3915364521ac8b5e0bf4d5cffb03a13
SHA5129be16d29eba03528a43882a2dd32c3673c0e3f55316407c89f85ae9ee5b4d1c97dfde01f52a09e833f588157d2ba9f1611905f34d329078d0edfed993bf96476
-
Filesize
5.2MB
MD5f2c79a83ee2e815ad30fff92fa24b4ef
SHA10625e8547439caba35dcb51f28c2785270ec38c0
SHA256d7a67804610efc8b168decf5f76f6150dc3f251261c26e52a7aa085b15992212
SHA5123d3ae263145cf003a0761babe938793cf964df95487050195c0fdb82ff4ac69dbedae17a0043c8b84c31d06831d9f6cd8e13b483af3f40ea13d58d65561fdd31
-
Filesize
5.2MB
MD534d7d1065540758066bc9c25a937f3d7
SHA1d3ff00200f1fed9bcd512d99fb1749dcdbf2173a
SHA256e0ba7a08071fe27fea094f2ec6453646af6091409f114f4c0d93e2969e7c7c0b
SHA5127a07b71f68b8a7bb539389f5f3c89a6bf22b709f48ef53e7da98c470a92c4f52c2a25ce091256f531ba14510abe6ac60dcbf128e2f8b0712070b334589f15bc9
-
Filesize
5.2MB
MD5bf24af7a9a08ca33005d57ed03c6a028
SHA1c4c28644278539826d53e90803e3a78fc7a8cce0
SHA256806a7d92d8185349354457704dab8dc18a4ba9abd9712be012bf7cf0de4e51fe
SHA5123593c99dffb5a072d5a07f880084e7214be7f4559c9e2b206048719101916da3cfe6b4a453d955d0e5cd6a5407505970428979a9845bb185b75eea4ca6bac9d0
-
Filesize
5.2MB
MD5c201636ef4d3125021865d04a6f4417b
SHA16841baf89f6db4e8cea8a4aa0ce8d936f3c94c0a
SHA2564d15a046876a737cb322b325a971f838c292fa921c02df937196d9cf8669eac7
SHA512ca0d0b31b699d142ee025374658a4a66a408e3d347288214bfa76da3064f262b10cbc5b55ab2241fd95fb20e42f85c779de47ddfc9893fa2f29ef3b3a616d5d4
-
Filesize
5.2MB
MD5f33ec56ae1f6f4632d82992092f9c454
SHA1bb4d03083ec5470a288911df59de411b31e892fb
SHA2564f19361a696f52b85cfd86b4d72a93f189f98e55a35f2f73c51518952fffdbf7
SHA5125d2a1c24d06c14e2e0dddfd3938486e9bf161da34760247e7598867705cac58cf494e555ed4fbbb549ac94196887eee506bc7ea1e005e2f7b28585023e4e8553
-
Filesize
5.2MB
MD573dde4609748092d892d765c5c4d1934
SHA1fe16a9b3e222474acd05fcb9c3acb90283e50c6d
SHA2569540052d5e9021c02f5d6357bca61103cc90c962ced50aa374e8871b4c9c9b9c
SHA512bc70ebbb826d6063ec301312be2fca40c282c8a5b234e9deceabdfbbbe43c1e22e2cff41236d73a3c7b5814869a648e11c293f3ac30c5de32f7479f8500c61a2
-
Filesize
5.2MB
MD55e11cf7049f8e97f80299a2fbe11bc8a
SHA1bb21064e2f3c88eac4e6f8db7770b5f11c6dc521
SHA256b3ac380540b05ab536c432982952d53ead894595ed22d0c53789613a7bac28f0
SHA5121b4206bcc22f5cd17c1433e5b713a81b38ad5ced7c06d0c5586a2444c23374bdc84fdb93e6fcdd03a1c2c60e41f353c361ddd7de1f3e0ffbbef43a8c6b63df72
-
Filesize
5.2MB
MD5501255ac7f38323266d05b878cabd0f3
SHA1abd933549a21cf566c4ed8c8cf6f5cf45c092716
SHA256619ab8e9c082c6f8f869872fec0d2a53de0edad08247872bfb5ed339ac8d9703
SHA5128796ed56785508a5cfcf124019dc35b1a8dd4424d51168c18d9ff731c9718b9663d12c356be2dbe81350a8fcc4b0cebd9cd6fe937af11ad505ed9db7cab72f64
-
Filesize
5.2MB
MD55f4f8c92874b3337ca3c95143b4981b6
SHA14f706cc4c509f27505ed514463cb8b272c4c631b
SHA2561fbe52cdd0039390a5606cfd81e87df59185ef826dfe779f013e5e50cb6eeac4
SHA51222298af15be0502c3b6d1b480da518346d8f9d5c9875b4581404a1ed6a8fd50f5dc9d27f8c2423885de22d36e32503b9b0087630ab979bcb44ded830ddaa444e
-
Filesize
5.2MB
MD531a61607f4ef742c679e7606d8c47347
SHA12ff262b1a46638faf5c1261b3c3eb51e93c1aef6
SHA256793a83d6e07e8fc28fa5cda82738c48a82a29f6c0c491ace906d99199346be17
SHA51257b7b52ede862ca103606d593d0ea201f0e128c0f3f4391df4cabed225bfa5d4707d721940a738df219c93d0b4ee30e4c4278668c0ddf4043b75b2559ac0a778
-
Filesize
5.2MB
MD5d7cfa69f7e5f37aa02daf80f265e2f6e
SHA13bc16d7da19d38be081486f8a00b6a4a8836b6f8
SHA256c281d4456a6872a706c9d0e80a4ac2da66352bddb522924cb48abbb119dca861
SHA512c291e6e381991958a85e25dcabce21192cc72186c8c581c3758638065faf948f8f68d10e71b7eca76f2b512c2395523139f360194bbcfec28326d877fdfdaa8f
-
Filesize
5.2MB
MD5290454b869b7f32ea8097b8c1fd1bc64
SHA1f6ccbefaff336cbd53f21f1c2ef2a82bc845c557
SHA2566f9127c873211ed4d4b07df091291a0b383c32f87af03a6e60d0224ef455b0eb
SHA51217543799a2cb0a7dba79886a0e7587f4a34b4cf37dda98fb3dc0f0b8cc03e31432c9a906dccfe3fd2fca792ae503d5900525a4d4d89f4faf9262c40d06d2c630
-
Filesize
5.2MB
MD521b458a90389d08d3bf11b69e31d6cbe
SHA158b1005737037cb18625f022db7e79bcdbbd1899
SHA256741b68a1304ba58eb153378dd9710f3498a34036a614cd10fa2801e3c2ae6013
SHA512883e8b5b8e43c32ad2e3d0bac819e4387068ebddf301aa7be2d1992f1cd012dba03f3fc5c6fca38fb86429a565f8b1d4e68c69208d47ad526dc73b2d74537d46
-
Filesize
5.2MB
MD5cfd9129fd469e1a2cabad72df06ea2e5
SHA1f20cedc6d1428ee35f041ea7cc3a1719ed28651c
SHA25641b62c5a8c7093b5744ea583d0dce4837baf2f7e85639dde38f37028018e8d0c
SHA51270f6e493252500eacc936a65560d837a56113db2719c3f5ec345a6bf3c9c659321b957f3e109fb19c068bbd3a96bcdb0deee39470bd102bf43371db1fb96186b
-
Filesize
5.2MB
MD5699509a46310ec51b6e41efdba804c35
SHA1620e12d0341647cd1975646721bcd3cbb9851681
SHA2569d93c6a97df94818100de5f628503373b8a7da894059fb3a23c07665e34d4695
SHA51220ffbc57dcb7f71adc91701c725693ac8c06804b2bf7eb19235fb446a12ce678393f054047a532cb525b5631f41353cada4159e5f672480b5263d6a25ea168ae
-
Filesize
5.2MB
MD561d6d0f7e67c76490382a6d1fb12f744
SHA130955cc32b866baff8c2d419801d6445d1594862
SHA256097bd0ad5bef331279c5c00d8fd35aed974423158dcb6b2afcb74cf1abd7e609
SHA51268c0092f076b786f37d9b2a9190f365540843475b4944a65423dcdad813c7faa053f4988b99fbfed3ecc38530f3166ba7d703a24cbdc150964608919e7e89c23
-
Filesize
5.2MB
MD5382f6b80471348f709b5d05fbf5ce69a
SHA11c3ccc6d00840ba9c869d7a93315a57f3817162b
SHA25628f79a440cbb49512fe9c262d08f76e7197beffbc47595222338a261c24cbc29
SHA51297cfe884c5437e8645eee7731f5a0390d4ce9903b7d63bce4180cac318f053b7ad4e2b43af1f36b4660201d358004a8efb4e81d6889fda586794a92a84e61e8e
-
Filesize
5.2MB
MD532b1d907a929bff553cf89c7f0d7d993
SHA1ea315325b54a83b90cde61c19b63ba7599acbd0f
SHA2560ef2e76f3ae2299dd34b5d3fda729b3f1f0803cfcecfb9c3c0d38cb511eff451
SHA5120229a5ff435f35b7570767f89285793f68d99fb4b7fd242f7fe7f290fe61bd514cdea3b581ffc83837beb7d66bfe86bae1fe3b5ed6d5f1e57f66bd28f4854a0d
-
Filesize
5.2MB
MD5f762693790086b8ab225042b74bea71f
SHA1ac3b5ff27330d9d73fdf2a38a53b6c814f20254a
SHA256be845c3915e305bbfec4a40492f30fd354827f439bf3aeff36769c0422611f01
SHA51261f5c1d75e71cfd1d01b44714ec21f7ff7caea99c99be75a1b19eb1336ad59ec240f914814cc55ee47fabe8054ff6756f0ad23c09a51b700294f7d5963185ca3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB