Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
30/06/2024, 06:25 UTC
General
-
Target
2024-06-30_1ba7dce749c70d4130881dd902ebd925_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
1ba7dce749c70d4130881dd902ebd925
-
SHA1
2af95dbec622e3312c8d3da8f17939ec00349f6f
-
SHA256
119c1b7241fdba86a110afc28592ca2f7a1dfdcb1bc9c2b1418ed3550f862ca7
-
SHA512
7af91a363a8d20d6cbd2a473cb5c16bbe11edc9af30a1b7e4f96f3efc3c0316ae2ee341d9bcdc649c49bb2f5b65f4ba0b7126f55ea3b1414b74db92fa2a04228
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:T+856utgpPF8u/7D
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 59 IoCs
-
XMRig Miner payload 61 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_1ba7dce749c70d4130881dd902ebd925_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_1ba7dce749c70d4130881dd902ebd925_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\EnJKxix.exeC:\Windows\System\EnJKxix.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DUfaQoF.exeC:\Windows\System\DUfaQoF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zgxsDIL.exeC:\Windows\System\zgxsDIL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wXxlXgy.exeC:\Windows\System\wXxlXgy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BnHWMks.exeC:\Windows\System\BnHWMks.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zheKxuf.exeC:\Windows\System\zheKxuf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qeOlPZS.exeC:\Windows\System\qeOlPZS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EgRNEdN.exeC:\Windows\System\EgRNEdN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nzxUqoE.exeC:\Windows\System\nzxUqoE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SeqXiKG.exeC:\Windows\System\SeqXiKG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NHErExQ.exeC:\Windows\System\NHErExQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qbiwsbf.exeC:\Windows\System\qbiwsbf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LQfCHNH.exeC:\Windows\System\LQfCHNH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ePMtBLu.exeC:\Windows\System\ePMtBLu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pWJInmj.exeC:\Windows\System\pWJInmj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qhEsgZq.exeC:\Windows\System\qhEsgZq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CvOciID.exeC:\Windows\System\CvOciID.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CGXdsfs.exeC:\Windows\System\CGXdsfs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rtXXEFw.exeC:\Windows\System\rtXXEFw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FbJAthL.exeC:\Windows\System\FbJAthL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AYHomis.exeC:\Windows\System\AYHomis.exe2⤵
- Executes dropped EXE
-
Network
- No results found
-
3.120.209.58:8080 -
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD56974f527f1a443944b74c8580a78b857
SHA1bfe0b3c7c0e156c77e956d904db1b373069227d2
SHA256fbfa8e8fda5a69e5317af50f0dda180b1aecfb77f68591c6b6e15d6bc1574ef6
SHA5122444a0ff6645463cfbfea74ced1e5bb4bf247926eb955b7f679bf9a3c27638fd1106023d7cc023d299ff8604d7d107942c5eea89e7a7e4cf2d3d1b0a256b2bee
-
Filesize
5.9MB
MD5c0fc71b9cdd98d464bd4411dccdfc4f2
SHA166a332464c83ed6f573126b8a058bd69a1bab860
SHA2569b0ad2699b70a96de35bdc4b266099fd5946b2a0cae175d91abcb1aa5c3efaa6
SHA51226ae4a86b29b00faa51e58299531fa1ea7b238787d0df89e076ce3a39854df62f8f5d68efa8cdfceabb03f4f5a4eb0f7367a0980407080095e5a12be3837e9ec
-
Filesize
5.9MB
MD534da6baad1ecdfeff495a110739f4a59
SHA191e58d38b90f6e7ab7b5b3a43cdd4d85fe078278
SHA256e54033124f1832b52a0c4dcd4639b0cf5660c5acef8f1d130c5d60b9872c6ef5
SHA512ae300468a2bec3eede0d2b897aa6bbcf36015f7624451fbde88ace6071f79d404d60b790f25ca16f29d3c49153dadf38be10f513b6df4b69f3a83712a0695f41
-
Filesize
5.9MB
MD5cce6d2e0fc459296a540ddce3f391376
SHA18ee347a85f56541155c372f2323097b49fd8d643
SHA256ddb5481a12b6219f9c8b08afab73aaf74c58de402d25be45e8b9a193f7a3249b
SHA512e8f6c10ef09b239dcab91d3627f78d02d254c7bea679b6964b30c70666b03ca3ea9f6bc2f76283aab8d70d6e4722dfe4e42433e95fff12db0b86753636dc98d6
-
Filesize
5.9MB
MD5e44c4a527ebdbb9332eaf30d0785b11c
SHA1b2042017ab7adc7eb32d7026618c4ddef555a85b
SHA256c4bd008aabda3a1884a5717d4791968ab8dc76e130ed5d4e243d56243705c836
SHA51271f9188888dd455e459e9b64261911f7f409dbc41b42159cda55c180b96cd09517cf50a1ad0fc8211de5e1c255136b53501a5e8c554c9c438f01276151484383
-
Filesize
5.9MB
MD59ae06d8e509710b36973f4d438f9813d
SHA175d7c20953fe63052c4734cdaeb341d1e4c0bd5c
SHA2562e99822d6a5957502a80da1ec5bbf09504b085c4bf6acab1d1b247bcec1f4ce5
SHA5124fa83e21b69d69a1a5f364f6448de8fedbd04c5fe753e3d05ebaba260f76fab5ee6eff4c88323a13c0ac1be500f145ee2bf0a5dca470b464e2409640e6c0c1b5
-
Filesize
5.9MB
MD5ec6fe6625d5faccaf95bd8f3f3c1f7bd
SHA18c350e946fa7158191f75d1562600bc3a5f96991
SHA256c4170735894d336d44cf180d19d4ea1a338a1bbdb77e1ae2ed9627b3c1154492
SHA5125b422701bd5a8d989758e7bd114cca7a40add0524f8085f18441eadbb9b22f32608a9425bc1dc8ddd621ac3c72948f7210d6226fa37742b8676b9c9398dd4e3c
-
Filesize
5.9MB
MD594662d90e4dac4401410b80718a86d79
SHA1656b590e4100db9d6252fbdb545553f99368d114
SHA256639cbcd5bbd2bf680d3f2e2db8b5c41a943a72f687ecbaeba26bf51feac9087a
SHA512c0914a222535b38f97e821e5920ff8a8d4a88550d1eca1e555c7f16d5605f1d421434c93e850f05205e81f5acc19c53ed4bb94e10441566d1282e22fc9ccaed4
-
Filesize
5.9MB
MD58ca405eea7f605219d0d93538bafb4d7
SHA1a10c292d26ffe79460ac79246d77ea3477489fd4
SHA256d45b50e262faac1d13807367b73d37820ec0c6f659b3df7cc221b2c4e3abeba4
SHA512e46cb5da56ea09f2deeb53ed8a6e3cffad21eddd7c85595b7dee83e9dcdd35ae4ab36e17224533578dd6607f85629f21f1bf99c57ed80dc88ac29d51a45e19f3
-
Filesize
5.9MB
MD51f44215431da252ff1115a9add14a5c5
SHA1bd4dfbe86366f940011be66e5f78738755bb3b80
SHA2569b9976b31e01b3a8560bc0a51d3588b21b72c48d8cc7abe5178e221d421f9c4f
SHA51284f5a365cb6f35cbc2e8c332108077e4320e5165011d72ed9a5231561a5dd1592a3564e0419618c42fac3846e67ae0c603e7b4aa7d6871bf476c00bb53a33d35
-
Filesize
5.9MB
MD5a4c0f8e13f62e83d274fc17491589d50
SHA13f920d4cbb71966196ae48cc8124e6b1a329ca96
SHA256085978fc5926d98e20aa85c73c70c5205686225602e1e2d75767caf065893575
SHA5122c475db6a3cc6393bb9a8084b440ba6ffcd98801fc62b5e81ce2d7d104b4b3b53c4c4d91e491990892e69ef073b80ed0a220089c09b669c9e2f92907a166007d
-
Filesize
5.9MB
MD5ae2d92465b93cad022e5a50660bc1f3f
SHA1ff960413f3c72505cb59074b73030c2381d6d75e
SHA256cc90c83a47aec4e7945fe5dddee03d530fb97cb04a42a7d05057212ff584c7f4
SHA512f91a3795db8196a2782ac613b03af675721e21360574cf731ea3a445aa35cae29e6db16d71e9b67a7c2ba9eb3b2a857bd543c840f46f67316a2253394ebea26f
-
Filesize
5.9MB
MD5e79ce538f99bd91a94373498133f8687
SHA133e41388dc97610d2fae9164706a0584905470c7
SHA256b9fa13f9020a760049b90edf2a1150be6b3fb9884cbcd18987feae5bfc8614c3
SHA51205d464193a07b0511ed2c092ad245a0ea7f60879995863609686e54313f5089c4e2bf9016b437cbf4de959ba86f554692e0afc39c8fa838e5ebb32a6654d6b3d
-
Filesize
5.9MB
MD51023d0582600fd9f49065a129812e124
SHA1a751e2e22bcac49a6dbb1c67f45102aab29f0d5f
SHA256c232bac6c66e889bbb92bf14c2f7a682e84c20966a091f9c225d131a78d91747
SHA512fc0dfe266ac037b72b5c6faa392efe66b938a0e41e9da607b7befd132772d8eece3ac38b6750669141183182eb69c69387d4c9b667103427850ec3248b7f9120
-
Filesize
5.9MB
MD5714d90c534e37dccb83be8a7c3d898a5
SHA175916d3387e0643270beaa4fa2ea045760d029e1
SHA2560d37f8654c0685cc8f8b09512ea87e07aa6c788da67b188a9fc87f0ce96aa1d0
SHA512b4ae6b00b8e385c2b0145a70986585ba33630da054666d58e85154d279f2f06e2e75e01f70b547a2d6a9538e8b967ae9507969931ff7d51e0f22dd40ce538b36
-
Filesize
5.9MB
MD5bf7c8c36a6e89378602a0bd12037ac51
SHA1ed1b503befbb42657cd87d421f2652c3d75d7670
SHA256a21bc73b21d8653ab59f1028f6b5dec4ec7640c8189808de155901a1d145af86
SHA5120fd7693b2fba79416b5dbb0453dd4cb3126a107e0bfb14fe7dc24a46a04c5e4ec3a44cecf8fc3289592eec2000e63a62a65d0eb3da9a2f3c25b53b823022051e
-
Filesize
5.9MB
MD56e184170dae4649cc037d5117ac9250f
SHA1847a883f5ad41b6bdb80e1bfeca3fa1214511229
SHA256732c0d90b3fc03fb0483b996521853e1804257ae7c1b79f1b09dd971c8fa21bb
SHA5129d5e1c03ada9117766e7b7da389885fb20618b6e2c227b3b4f9e9e10e278fd941084b47d06c6d294791ebd627475bf12a094e2900c6854f06c92461feb92f961
-
Filesize
5.9MB
MD592e1ea5d8365c7561a1ca26f9ee530d8
SHA1ff4e584a5d1a62acadaa8dfc9182b0a380dc649f
SHA256fa7ab4b53caaa2e33afe024dd076b9ac2fcc4a080460d571d1ddb8f074d867d1
SHA512f8944116fbcb6057ee0c349b712c108944db0b6c126af18af5d1cde86465dbdaace100503b9ba1b2a5cbf70d190a68665e7d5801694898b641dfb22cd237d775
-
Filesize
5.9MB
MD5aff14f9d56afda56fb136da6b4a1d6a1
SHA12698d1552d69b9e1af5222a6f921c75ea1ddd74b
SHA256fa14b2a71859fa2c85b1d06654278df191cb0ef49ab2a407dca993f2957fa61b
SHA5127a3abccb6f306c51aa141b8d26c53caf10465cb911402e8bb4757006f2423a1017ddab85eeda54dcbaaa165c983fbe298ff0a47fb805cf3cb9b454f8cba2fff2
-
Filesize
5.9MB
MD5087fabedd6db7118509f066b1f128965
SHA1e4deb2c159b5e43463b9938e989af509502d3b8e
SHA256004dd8aac01f6f5392212dc6fcb2e86b441a6aa0cb48bb769e388d11252ba078
SHA5127e324b11f763f7c19061b27222f1f29b8a77b08abc46c8e33c28dc30abd70e344677007748cf8299a6de9c9244f16325b880b3c0e8df618a574a566c1428e118
-
Filesize
5.9MB
MD5f4d75e05519643df2f4618c9ea19480e
SHA1227d63b85a39c7c271923558958f04094bdc7da2
SHA256fcc2f909a1bcb1b4f5cac3567a50835a67f811958a2fbcaeb37ef902d5fc3596
SHA51286c9cb8a9c3b46c0cf489a486d4213e0bd7f2a9b169341958e3e73536a6b2f784ab833448166c3ae2708becc8454838ac9d68b6c4076a06715f86450bb151273
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB