Analysis
-
max time kernel
139s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
30-06-2024 06:25
General
-
Target
2024-06-30_1ba7dce749c70d4130881dd902ebd925_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
1ba7dce749c70d4130881dd902ebd925
-
SHA1
2af95dbec622e3312c8d3da8f17939ec00349f6f
-
SHA256
119c1b7241fdba86a110afc28592ca2f7a1dfdcb1bc9c2b1418ed3550f862ca7
-
SHA512
7af91a363a8d20d6cbd2a473cb5c16bbe11edc9af30a1b7e4f96f3efc3c0316ae2ee341d9bcdc649c49bb2f5b65f4ba0b7126f55ea3b1414b74db92fa2a04228
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:T+856utgpPF8u/7D
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_1ba7dce749c70d4130881dd902ebd925_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_1ba7dce749c70d4130881dd902ebd925_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HPdxQIq.exeC:\Windows\System\HPdxQIq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YDYaTQC.exeC:\Windows\System\YDYaTQC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iYgXUSO.exeC:\Windows\System\iYgXUSO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WfivsIk.exeC:\Windows\System\WfivsIk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RWERhRu.exeC:\Windows\System\RWERhRu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JqJxLbs.exeC:\Windows\System\JqJxLbs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AOLVHOb.exeC:\Windows\System\AOLVHOb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XnDJBfi.exeC:\Windows\System\XnDJBfi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hborWOG.exeC:\Windows\System\hborWOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eNHgrOb.exeC:\Windows\System\eNHgrOb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jTkPrkL.exeC:\Windows\System\jTkPrkL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iBenYJW.exeC:\Windows\System\iBenYJW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SYDWbat.exeC:\Windows\System\SYDWbat.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HURXHqJ.exeC:\Windows\System\HURXHqJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\guuGiBL.exeC:\Windows\System\guuGiBL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IFtwvIt.exeC:\Windows\System\IFtwvIt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TEULEdi.exeC:\Windows\System\TEULEdi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IDCdAwx.exeC:\Windows\System\IDCdAwx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cSPjuYN.exeC:\Windows\System\cSPjuYN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UUreilQ.exeC:\Windows\System\UUreilQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LRPLttJ.exeC:\Windows\System\LRPLttJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD56db07fa3e9ab559617e2fa5478f63628
SHA1a30004095e5e36dfb3b9bf53f0fa73da4e734ea7
SHA256e908889701341da90011d59dc7a334043bb2c4bac8b2fdf91ee8ffe977e218ca
SHA5123b49d5ecbbafab2d1f57f036e29b24bb097b5fd8767d6ce1c314cb055eeb86a110e4b9a533b6ba5261b1668fbd984f4df90041e137d7c89df87ff4a0c9c0b1a6
-
Filesize
5.9MB
MD545e89ebe30d4c173e5c701c7178f1d3f
SHA163ac85f7c97bd45229ab97a344d1dc44b78c8a2a
SHA2562141d02a05dab9acef9400f4c1854f8f29748412dd04805399a224ac1344bb80
SHA5128cb4056bb5f4df4601c182658101e92d86b55ef5aef155081c507012a2683e629e00360d4db7762a5bf09faa88e31f3d595d186b5f674df873a965000164e5a4
-
Filesize
5.9MB
MD53f7e3030a45ce98f823526a78cc39f6e
SHA11ec9bd7b79cc33385e155a3aca1325682e0ac843
SHA25620bb1f3358c29f2f018a06905957319c96942ccada2e54ddc2092d1021be4553
SHA512f93ecef1395e2ead6ec0ab65eb1246d6b8a366b7f53d23d6cac4a67c94e550103f2c6450c62bb2a55510b418db6e3d6a0f217b133074459322448a2d9be6f76c
-
Filesize
5.9MB
MD57ae21bc359e0d21442aa57ffa8856cfa
SHA1212c82e5bd32ee3a96621da60744db10a2e1eea9
SHA25681056ec53ef3f3689e0294ae0152b502a02360beeb78b6e276fbc318227ffb68
SHA51288045ee810276ba69001b10778fa78888b984b4b62a7ad35f5e26e3e27cfe9d2dee06f0ff139df9749776bff371546460a95ddf9f02fd9003395815983f3a7fe
-
Filesize
5.9MB
MD50cf6135982f0ee081c283e08ec6682f6
SHA1faa699fd2aa9b2125f261551d5fc933f1af056f8
SHA2562e6577f6930c5849d69002c6f4e4963b6b141e772c1ebc501267588536971869
SHA5120ba5cbb3f2cefda91537b75b9a09b8d3933a2449d3cda7fbf353e3dcd616b7c5d6e0d47cf7cda62dbc6f12ad44bc0041cb3326ad09c57ee2ca868fb99c6230f6
-
Filesize
5.9MB
MD5fb8f347dba8f423e5029c17a8ee76a26
SHA1094557b5f85c5bff5d73687e233d1a2bf3a9b213
SHA2565ac218dc28129c2f345b7f26558bfd12273a33221dbc5c62208567885ffec147
SHA512aea42f7a3364f97bcdba332840a9a567ea14f97c3caf6be7ed2deb6a8ed8bfba536b21c111b763b824cc1c7c0068068301c6782c4a92b953b53020f69e1928af
-
Filesize
5.9MB
MD522c6119a707dc68d5d2dbe4f270ed0ad
SHA1608223d4a5f683b1b97ecdf3bc7acb63113c90f1
SHA256dab2c8db80cafb94cdda43f0812e2919d0f7e9b496aa285ca2de7ea742fd61d0
SHA5120a739a7b9363200213e97bf70134c4ffc7aa280fea0aff81224c420ce9830b957a072cb66b7a5b18300bf8d0ed73030ca87cb8f278f4f7c045b42004635d5823
-
Filesize
5.9MB
MD5baa4073ccb294cc420364bed01d207bc
SHA13c1ceddd2051458c406f588099cfc5ddc8aa9da4
SHA2562f333e8bd0d569700f1c316420a3fb51bb8759646ee473f3304c53630efca89a
SHA512761dedc9fc0fcf7bb198ebe6cbd9a3048f68fcdab3d7d38ac83ebe43db04a27942317706be1fd80a2c96b56d3a443045e887f19a1bd91dcf0670a34bcce89c6e
-
Filesize
5.9MB
MD58f4f2e1c99b20c85fdbc5bbc50549c21
SHA1d64a13375f985f1f7236851c21d318c94b8b81f9
SHA256ecf462132961e85a0d7cdf7198b2f3c999a49aa34214064293e2573183586be1
SHA512973186a4131f26d3fb7e33e2f21f9d79733d5cc78c0d758c4ce7ee4a47f253780b24714e460bf4f4824c9f8efbdcfd6ee84a10dd4a1c195dee01aac4bd3c8a4d
-
Filesize
5.9MB
MD5a04c0940d08854895c73e4dc77190f7c
SHA1b15a5cbbbf94f7aa31fedae1b048f105ec239a97
SHA2567389cb326c1b6ae5f4ef0943a1af56315027ed0fed842de90e083163565b4751
SHA512f52a41b16ba254718cbdce26f12cbb7d92da3faad23daf9cb8c034632ac8df246f61db27c4b2d98056048a3ab13c46b00d840f4929cc89429b2437eb1708f341
-
Filesize
5.9MB
MD557312f2e41e81a7c754cecae2722c3c0
SHA15f028475e56aefb229ec9d819e7d71df3992d1d8
SHA2564a35b0fb4ea4bfa4847cb1f100d64cbee40fa6dde84bb776b7e19319161a793a
SHA512492e1d34d2e91f0093e71e7ce42d48ebf1284aab147354c6784eefe713240e331d09eff5205c687dc9de30572be98bd9eaf2ba6891b78ce1ab84a413acf9b6ba
-
Filesize
5.9MB
MD5472e34fe94f25e4a2a6d09dd4dff9505
SHA1fbdb44ed919182f7330ac79b413e27a8bf23e4c3
SHA256bec7299189e4c8517882069de5684303c96a3daee4b9f47d34d415f09e6d6150
SHA512daaf9fca38c7e49d678204e4a8fbaf499fb8a7d15be2b50aa16d5df9526bc9d280335014a27f4ce53d91a57473ecdbf1e6d6f2bde0eefdd27b0b8629466620f2
-
Filesize
5.9MB
MD5972bf7ae4ea1811350fc0375f25af417
SHA1db848bfa0c01c8ed4b11c599bcfa6975fd5a1236
SHA256ae2b813d3ecc9639d520f9fa0ce5ab33a659a27703c496dac34c90da46838f62
SHA512e45e39f35837da9db3c78d642974ef5564601a48edb41e4159c2941e418aec251c14d317b5cec3ba9bed939e71eb2de06cae44b6c0f076ff5620b01a9904c514
-
Filesize
5.9MB
MD5b2cf4c089cf2ea97da064a62b3ebb362
SHA1c407d2aff73988e5eecea7c9e32b3f0c797199c7
SHA2560acd3b8aa4b6a319266f51aa8ea512f6a834bff5b04d4221680e50062c6f6154
SHA5125337d374a29b32bc894d88a1c4867f08ead8e7d731d3cec1d57a1fa10d340ef41844b0e0b2c3d84312d6850514b2d31d704528891fd99bb75f3a9e46e49580f7
-
Filesize
5.9MB
MD559054eee0a95b8e0730b7b4d69b89860
SHA1baaf0d2957aa2bae76b959d941ea0c0ffd376fcf
SHA2564b8f45fe1d6fe330d55cec4b5b976ebcbb624b7e25865c61fc0005778198eaab
SHA51292a001b02bed8a27dae97eabba71b9cda93cf2e4f6bf37dc917f094dd1cae9e4d18dc290ad1bdf6f175f27727e86a02a94a299b8ed781190714d87b471d4c260
-
Filesize
5.9MB
MD5b9baeaf32b50026709d0cc1879c13077
SHA10611e0101b22fd949ec99b6d500fbc01e105675c
SHA256e06af2245fc91aecb6ca9bd020b7dc8c79553eb0eadfbe682e9edc5a121bb902
SHA512f8d730025b002c6fea92e379bc44be992308dfdb97a7bbeaf06bc35a83977413e5df4e8bd12b04478f3f82c73940e4cf346434c0424875a286979f173c9bcab5
-
Filesize
5.9MB
MD5875a9a60934456e7db70fe39579bf332
SHA1085b7169db7ddcba1325fbe1e8d0751df621865b
SHA256c70b52ec57a380f610de141963dccf92c9e15ed877575b664cac7c4c39bc57b5
SHA512e043577094723e479576990f57d80aef9ec429ba9a796bf29edc0dfe0fa1ab21559aa4df5e8ec4a6d79cf9a87b96a1132450a0f18afd66bdf9ec8920876c27c3
-
Filesize
5.9MB
MD5a5489c829896ef23da561e40e0cf685a
SHA1cd9fb85504b2e41df2f3e8fe2cc8ac4f41aa1438
SHA2560784ad65a21a292c60b0e66e12e1d983bcda2fd5b3e148364adf567967f81daf
SHA5129120cf13621b8b4f202a9d40aa036a91ffe0c26c3aa4f3aeb15aba6df0c5a79a58a7851f3ee917e769dd11beb74e61f4365d0934c146ebb4dfb41ae2ac2ce42d
-
Filesize
5.9MB
MD50a7b70d6bde015a9e446f91d529f95c5
SHA1a04b934b7c2ba6302205d6db2092d8e7f5545ef9
SHA256ae534581f41b32d70da6327b67b48a80c97c86056ca9130638cdbb09b08d2d5a
SHA512e878a5e7cf60395f4cfc2f8b7ab254980d6cf9cb835549e338c55aed20923d17900e77dbc8600c604ced7189db988059abf572535d0ad671f0f60b711485be69
-
Filesize
5.9MB
MD52e4e6251b86a0e561e6560acbf2fedac
SHA1dc6742aa39b0275a222f8b914037e3ab0bd95834
SHA256bcee55036dd6174edf22093be405d4d16a0e6f7d80521967de4b6bbe4e8ef30e
SHA512b8eb259a13e778f5eee50653e5d072e4c9e8a173684932d78d3d814373cdcbef6b94038da8b1ff2362f854166a986871b1f232770a4bc3d44b1d4e9227056f65
-
Filesize
5.9MB
MD5f2b4315405e9f956d9d5c2880381355a
SHA1c4555b86552a794c7c1570dc36d7b4cbcdaaf910
SHA25618441ea5d398a2cb645fdcc56aa8d40fd197524014d8cfab5d5d5e73897ef963
SHA512df3e35351343d5c0daad9f0a3e0966b944e0c3f647f6c50a74a24124461b83df98d84d4a0a3ed7a27dc93cf9b4abcd36872b5f2357baffc066307af8a8880c6f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB