Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
03/07/2024, 07:47
General
-
Target
2024-07-03_32749dea18a574efe9e6cb6825051e93_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
32749dea18a574efe9e6cb6825051e93
-
SHA1
d5f5344a2ddeecfd66e5c0fa005c8800ef785502
-
SHA256
17599344f8771ed8185b2ffc42c41a4a1867a7fa85db1aad55edf711880fafd1
-
SHA512
0879f5cefd71613718d30b8e9d7d7493e14128f0e7ca261e441e4a1991c01e445f3181efaa889223c335c1eaf36a5b0c657882e045a526fb1f330c6387477593
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 61 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_32749dea18a574efe9e6cb6825051e93_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_32749dea18a574efe9e6cb6825051e93_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\JGlbKXl.exeC:\Windows\System\JGlbKXl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SEtAehr.exeC:\Windows\System\SEtAehr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FkEaZRk.exeC:\Windows\System\FkEaZRk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FbaGfeq.exeC:\Windows\System\FbaGfeq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sLAyrxm.exeC:\Windows\System\sLAyrxm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lqMXJTx.exeC:\Windows\System\lqMXJTx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UFmkRHS.exeC:\Windows\System\UFmkRHS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WTTfiqr.exeC:\Windows\System\WTTfiqr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xJDIEzi.exeC:\Windows\System\xJDIEzi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QIxtqRk.exeC:\Windows\System\QIxtqRk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uxFdoeP.exeC:\Windows\System\uxFdoeP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FEOqamv.exeC:\Windows\System\FEOqamv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\llGdscV.exeC:\Windows\System\llGdscV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cKuFssQ.exeC:\Windows\System\cKuFssQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cptpjRH.exeC:\Windows\System\cptpjRH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vBYwIdK.exeC:\Windows\System\vBYwIdK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iIlfDgx.exeC:\Windows\System\iIlfDgx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lVVXTHf.exeC:\Windows\System\lVVXTHf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oPphNNU.exeC:\Windows\System\oPphNNU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LRhgltP.exeC:\Windows\System\LRhgltP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fZeyUnY.exeC:\Windows\System\fZeyUnY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c2b7d2e8ff47b85cea26ed11d4ff77bb
SHA1d3692e9999054b427829bfbf121ccb3c3a722da1
SHA2564d4c97f892232fe38d57196a869a48dc0da97815adcf7c50b857032a2d3337fe
SHA51249e81dea39eccf5ec792f85be2bab2b6ac6e593b62ef4177922ab4916cb69c91f92d40a3cd1425054bcfc74a65b6c9b60c9275a3869203cda2cc05fc5abd0053
-
Filesize
5.9MB
MD511b13570187087ed67c9a879e1ccc1a2
SHA141f6d162a39c876871e00800a244122735f0962f
SHA2561546be71d8992ad16b350eb7153d2cfdf1177e4e64e6dce980b9cfbfca1a86b4
SHA5125723cc7877a0502ff06066a1d88b7e4e0bfe300aaf468ad59a11b57bf623908c3db85df21f334b43b0bbb31b5fdc88a4882e9496e45d5ae1ddb141547b0155ce
-
Filesize
5.9MB
MD570e94cff6a0c205d13a69377e98d55a3
SHA13e61c047dbc6fd26a4a7b7c8b01b665de33b4ab4
SHA256ae1b4e1737eb42f1f9657c422f609c664ca4a8443eb895debf169306879fb0b2
SHA5128a6cbda35dd0cf8c409b1eb3238e2173b7e4519f8da56d68f860e6b3efe6c068b7f8dc5ec95f5bca3f4e829517b5fb24b069636443acc81540f5dab0021b2de6
-
Filesize
5.9MB
MD59c27e832c4095831321c3d476fbeb877
SHA1e84045e448b4eb5b3d596019c415d2187c517121
SHA256cdc73f7ac702efdad1146fbc15e8bb860f2d4419e240c7947e55a125cc85e3a9
SHA512cf97a23f9c447219360d0f98711d8bc35d6f46b4159ae36e3e6b606a4cc8f7d82e4dac95ccb8aa9ca0f5ed5ea644a439df28db8e3504c1fbca0e9b9ff9fabde5
-
Filesize
5.9MB
MD5240d2007046f286df471aa5877424881
SHA1555e63fd470f8e3a32bf3c30232bd68f110f281a
SHA2568d6de620ec4c3baffb4ae94e9d145d348435607237d2cbda1221bb151c5d3071
SHA5129f16c0bfa3a989304a043598e68ce985a2fe8bf5c99628138ab0538bc08060cb8e0c2e08db2bfa81fbe4b690d80bcda15abdb0cbadd2072612d68dda9a583d6e
-
Filesize
5.9MB
MD5552c093c54309f8f3efd01968c888ab4
SHA17e11c4121c8c9f55e211890c51992858dd5edb38
SHA2566333e4c1b95dd9a66299f1d74df2505b4e01ed195a8adf84042077c99a473125
SHA5127c94d4815b5f18d3814545f4d687e1df1c2429576524679c26deb3fba2cfb027bb2148365bbcc2d5b1be410dcdb899cff875a33934605ff1049b65c9d9714f87
-
Filesize
5.9MB
MD58638e477383877180c0ac212b21e2b01
SHA1cde7d7da9f7112bd96f8b50b78b9bf164ea4e468
SHA256dc250bb15faeb0064c95162d3f5249bf4432c847f5b85fbece4ec52e3b9e15ac
SHA51298b880be5457b558167719ca65119678f0150db589c199d7e4a2fc568ba0457c61a08549f881e3006f658d9470cfbbecdeccf6715a36855dea2ee5ab82aef5a3
-
Filesize
5.9MB
MD515d33e94149f5fbcba6ce73f0a58f532
SHA1d12f0bcb20e16f4a84579b6604dd10b53f58d2f9
SHA256c3d4c126d6fe88f0d35c707f61a5e75b6e476ef38d967902407090ac096b3762
SHA51208445a27ef77879a5454f6d16bf8396febb737fefb4c704024ff93a92a5141eac53b0cf37ab2798f3e4eff7607a50d5f5b190f42909518a47e5eb2b5915fedcd
-
Filesize
5.9MB
MD59a379a9b958c99f3e4c50192c7892648
SHA137ffb4f0cfc592349d0b792089fbabae8cdfc79c
SHA2567b0a0727c09613dcf712434adf496572ca52a5d8dedca09262f442f30c68d8e3
SHA512b4e75d6bd5a64f894444eae2046cc2b19d12e28c1041807a6e3db97d78388bfd467b706f09f072442932c26ce69261082de9526778c8796f22ac6001cad06147
-
Filesize
5.9MB
MD5822176c3b34047b34f7bda769e298408
SHA16a50e254f236185c459ae7c08eb3f725b580e67c
SHA25656c42f45b30cb6541a7bc46b5331a1fdce58a3b0abf0e9dbb5cc78713ee78b0a
SHA512e378a433b84f48f11e219622aa3d0ae067b5acb84582c59bcf6f2ac495249e94fe6f7c55e988baeb77b00a400f1ce1d9abdee3c918f85c50c04f5bead3603554
-
Filesize
5.9MB
MD5fb3a1db8ecd432ca56879107e911b64f
SHA1979dfe94f385308e2f3f3499af45ccd0c97e2676
SHA2562b99ec13276520d0e684ddc4e686191d214b3196170ec236e63b5fbc800e919c
SHA512ec724b7240cc41906314d9121891d9aed0e08529bd27ac806ff21b162eca659d67b2fa79731a3b05c75c06d05eda8b1d85c425add12aedd8d12757b7309c5477
-
Filesize
5.9MB
MD574b8864b94ef2cae08b5c9aff6c2954f
SHA1515f063a23470bcd37713eaa4f33f086ecee3add
SHA256b6fcd994211c01a3cd1720e00c0ff7b197c898e86ab117c7d143a2972fabf04b
SHA5122852cb0ddd4407ba6a81de74681e48b2cf297382ec3d8ccf29505ff492c23ceaf9f1745f2614197e9fb1b324039d4e645ec16e5a7903ae8a241f7b7eff2afd16
-
Filesize
5.9MB
MD577de065318351a612c823ce160b1887d
SHA1c42e6fbc5875e8fbfa5108d7cc3bfd7aa88721c0
SHA256fbde890bfa7612f2bc4828713ac30cf6689df6ed2c1fa973ca285ffa269238b3
SHA5120ad457bd703bef9bb29b049038f55124b8a501a40b5df5d936bf3bffc5bacb886e04b1a6bd20eb11733a66e96f70632da7a9fe4588e3297a22acd95fccde8ea1
-
Filesize
5.9MB
MD5d2a13dc8d6848a6e2e0f1b9cf3b873c1
SHA1797e60e6c8ebdcf9e571195fe902553d49356bde
SHA256cffecc5a937341ca8b751ebdd3f1f99d2f33ecd7dbfe9225e8759e92fdc978f0
SHA5120520d35fc90b1bb91ead2196dd2141089391ddd15c98c0d8493ea6c6248f319500ca365cc4b24a4ae9734d007429bd93a20f709672bb70ef50faaa55c6cec04d
-
Filesize
5.9MB
MD56ebd1fd7d658f893ac9d27a2f681f06e
SHA1f56f3cc66d807d25a0a2e936aaf163387902ff18
SHA256d8ad2c0983f1f861ffce1a020435daa4b4f88bed66a13a2c804bc2f30e096eed
SHA512a06547e3317048e25c70f68f3d1ac1e3a839a3024c70ce38eff049cda72287e03b86f22ce3c8c41d957e6a0b2f838306692e50900610b4cf45754545ddf7c7e5
-
Filesize
5.9MB
MD50bb08bee3807b41d4b4dab1e351f1f20
SHA18d2c3bb675afe8c22c8090967a5afcc71ba46570
SHA256720235c88a1fef116ba62ca83b78ff56bba3df602da7dfc7eb4cb6fdc89953fa
SHA5122d3bee90b5fe13518519d50267190eb2b4262d0896971cfcf9462d615ceb8cd62bfdb0e0d7ba587351469482edae213330c9492da02b03d5eb3fad7a0263d480
-
Filesize
5.9MB
MD5e0eaee666f68e7a4ad6c48731d740716
SHA11f511238b45481f6a421eba055fe688563af8b6d
SHA25609d010bbe877ddf4a630018d9f703f511cba10e47bd6d8b3abff5316e2103967
SHA5121631c5e0604451e711313a86203edd324d2eb7928c80ef9829b12c84e42841dba3998ddb5b5676a393257cca4e23c2f73571c43511132bff6d6385ad5b251ded
-
Filesize
5.9MB
MD5bb905346b4531ccf2cb7955c1c278933
SHA1f1f1da73e8bf3e66c104630d42ea8e91a165d136
SHA256ba4377653ede5ce0cbb294778f511d4911a4ad711e3083b8565af587d324e2f2
SHA512e48f81cb91c0f386d2a8425454f0c3bf8d7f315c1a1b8705a69b8540deda3e63aa3bac6ecb7efdb7a2f731328b423d198269dc686b3c57e79e3d7a7378ce9aa2
-
Filesize
5.9MB
MD57c36ecd8e438b3bf40027a72acd94f7e
SHA1bfbcff1905145cdcb772cd17d43b8ab30ca4c120
SHA2568acd884c513a9c9e0446e5586e3ac16f7c4348366cb5a2e318dcf438fe447e8a
SHA51213979be1c416da858f5b53091380c55b8c4561e7cf4449f08bb1bfb909bbc37ecb9e607d478c3a4f14e7b1fb120d0795328d2fde02c8a766d3800f664e2d167e
-
Filesize
5.9MB
MD5df7df01a3f4a719934abfbbb160cc258
SHA1af0de227d80dfbdd3eb6f95cb561b04e84da717c
SHA2565ae423e1c9de423d781a49ea6d1cc98f91afa07786b05c045d64b8ad3ee56845
SHA5122e7286f7398a138494c3a75692e2a90bded0b9c7ff1e0567d093064c4dc94f6dd584a2ecc5dd92c3bc74c7762f0b2d6adf732f3db006587e0048f0ac2813776a
-
Filesize
5.9MB
MD55dbd6446f31a93eea0ff356a89d9cd6c
SHA110957a7f48547a43adab912ecfc0630f35d11d38
SHA2566f266f8d9ba4d914c041152ce0f499ff0a198ca6b11f55ff50086cc2f9a67e79
SHA51279f259f1bdcfb0004fd1ccd96aff070b14714ebf0a5aec395e63706129cc17552cbff21b011270fd9d4eb6e2f372004d330494159e23408e0163e1c42b1fa845
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB