Resubmissions
11-12-2024 15:32
241211-sylmbsylgv 1011-12-2024 15:31
241211-sx6acasrap 1011-12-2024 15:26
241211-st9tcsykcw 10Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
11-12-2024 15:26
General
-
Target
2024-12-11_16c8042089bee10d20ea354a5d69649f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
16c8042089bee10d20ea354a5d69649f
-
SHA1
6e74bb92f586e2ee82bd35b6a7ff72ae05a3b69a
-
SHA256
1d31de0dc459115553638a449998de44b31f95317caef59b173380438a593de4
-
SHA512
e721bc69dc2054eb55ce6da95cf0f476dc2e60a9399f6fb8d166a9e822d8a0b823213e956e991bae357da9354954fb236828faaa6ffbbee71bc3637b3bfe2829
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUy:E+b56utgpPF8u/7y
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-11_16c8042089bee10d20ea354a5d69649f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-11_16c8042089bee10d20ea354a5d69649f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QJUzULK.exeC:\Windows\System\QJUzULK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xfwxmzA.exeC:\Windows\System\xfwxmzA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUMAGgt.exeC:\Windows\System\pUMAGgt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SVhqERS.exeC:\Windows\System\SVhqERS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UCCklnp.exeC:\Windows\System\UCCklnp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iSCQOmM.exeC:\Windows\System\iSCQOmM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UARfKry.exeC:\Windows\System\UARfKry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LnylFEo.exeC:\Windows\System\LnylFEo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BLpSBhQ.exeC:\Windows\System\BLpSBhQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pNXNhMM.exeC:\Windows\System\pNXNhMM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tPIKmMA.exeC:\Windows\System\tPIKmMA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jXKCZLx.exeC:\Windows\System\jXKCZLx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IbkNsOd.exeC:\Windows\System\IbkNsOd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OdgqOnJ.exeC:\Windows\System\OdgqOnJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FVXYOos.exeC:\Windows\System\FVXYOos.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TYExTrj.exeC:\Windows\System\TYExTrj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BSsREZv.exeC:\Windows\System\BSsREZv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eEAgPgy.exeC:\Windows\System\eEAgPgy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ccpgSVw.exeC:\Windows\System\ccpgSVw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dhxzTAu.exeC:\Windows\System\dhxzTAu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OaNuEAS.exeC:\Windows\System\OaNuEAS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5042c73a04d88705a6e784f87ab1d4b35
SHA12cc4eacc23ebe9957e39de093600d0a44d6c079f
SHA25627f11a4ba71de0ef979783abb7f2d60ce93cf3d9139592a4004ac0ff7416c7db
SHA512a56276ee42bfd0e1147e2c0b248e60022229d7411faff210b98a61e3494f0978eb1fc880ac8d69cff6ec3ac602f04c1bbfe01c032a581620c3bfb4f0be036c60
-
Filesize
5.9MB
MD5f0aaacfe7ac93b5a11bf5b21823f53a1
SHA112583a631de2612baa2a109758af114770eb02e6
SHA2566464d4278eb1223a4b43cdb71c9e40c061df42ea5f2568dc4a25a97d9aed4fe0
SHA51298b5bcdf06d5bef41a4f40383c31e825d2d9d0decdda0ee2bae7cad377bca65a8134e54b7fb5f4df7f0b670e98241d38ae881e4e0a4670151a9863f1a402b976
-
Filesize
5.9MB
MD5e3c32de07c0f7da9e929697bc43c69f4
SHA15acfd2900d454e7b7756ac6a2879babc01c052e3
SHA2566fca510698589540ee5423cc22220fa23829848939a43813c9dad737be043291
SHA5120e9f5e5c2dee7c35676286cc612e0c0f11960eadde71cc472c54f9230136575aacb9a0258500fbaa3e68fc140a124c96fb66e6797173bdac9eb069e1c9248870
-
Filesize
5.9MB
MD5513a223c9559bd70836abeabaf7c16ab
SHA1e01b88d569ea21ae577176fd6ffd7080384a80d6
SHA25693e44081d23265ecf44a7e58c69ad4523d58d57462d29c7b9eb700fe9a3b8944
SHA51203bc27c76b180d984aa4ce900c5655981df754149b3a7adfd4faf05ff7027ed9ff28b7b25e9505a90b899dde9f4c7700162a09d02c7cd9affce473bf220fd863
-
Filesize
5.9MB
MD58b446ea81a4ddb706ebb606f9e40973b
SHA12430c0f4afa410d911adf22f498d10d607579640
SHA2565f0ade9cbe483d81d7f6b88549a667d090031125f12f0cd6786bcca81285a31f
SHA51228b109d9b14b11eac6c78e4cf1434bc3178bb2b0b4547019b1e8b384faf44272fe9d5f542765ec4782455c86d2b3b6d492772da0830d9efbb53a318d956203d9
-
Filesize
5.9MB
MD516691cb7d2b175958a1c10bfc2eaf3e4
SHA1768f0a75ff40ccfa309cce928cb32fc954638fda
SHA2563492e5a8e541020ba4cc9229bf87c333ad8969e10982b1af2a22e764fe40f79b
SHA5121d7fcb9fb9c471ba4d1d2d1a644ff00e741045aafb511a29fbb5a8afcb7ef942734564a5fefc1941072608a0fa97a5de2e33dacbf848af49bacd58416b0d99e8
-
Filesize
5.9MB
MD50e9851321a5849c5e32d87152dc00e69
SHA153c7a8a62d0d0b66dfaeb6ebe15bdd508c95769c
SHA25636dcc3c2ec133d014e73c85eb2a929c0b5222f67c7911965aea1f1c59ac0df9e
SHA512d65da3c2fe515c03a2b81dd7695f5ad27348e9244cc72756906d966744852d078f39b39b13dc3deb5a0987c422d450cf98a7621be15c5f572542195455a038b4
-
Filesize
5.9MB
MD57b36e3f949b09393e1d3cf693bca5bfa
SHA150401887dbfd5d02c368261d3c18484fdb20e4b6
SHA2565a1e5ac4555d079a16b86f5f782b9213f5479cb269fa65ce708af4eb84652087
SHA5124ce2d1431e59a890a3c967e0b60e99cdf0a466f4dfcfeb3ef22ca2a910ec52941ed06c8980edfe0e72391bf818ea553612b302d9f1e29bd3d8e0571404c5a7f5
-
Filesize
5.9MB
MD5a4a7ea67606ee29ff2953e8e54cce779
SHA15d09ac80207710d00fcafafefffd2faae96397f9
SHA25611fd890b0aab495297b72f6c8fd4a4bbdf4d4e41745627076608be3555b5cb36
SHA512bdc6eecf548f50ae7484f83b900a283f791eeaae9ac36a5ee74b8c360a7d155ef10ceb7b223bbef2c538868bce61d6e5298fb17e8cbcffa7be710c9944cddf35
-
Filesize
5.9MB
MD5d8f7e94679dd2329c7c15dcb288ace29
SHA194c9716bb8ef992c2423599ea2fb228bde5f099d
SHA2562ad5e1ad05f792fa208fa3481421441b087388dc0dfd37d641adac6ce16d0356
SHA5120049c8457808c08382be60093bf6ce92f9bd64fa82bb9de6da125a0de03be06752fc9b7e765d67efca12b01828caf862240c3da928cd50330d9b17d48f030cc9
-
Filesize
5.9MB
MD578f8c6401ebd6e25db3a99da6d7ce443
SHA1a210c471360fc6b7f24c1389f837036225f4310e
SHA2569ed3568dfa9af29d4dc6ee1e877f54cd330c6917f5ec0dd6e8a853338024b634
SHA512db39174ad0cb88a89c4502e3b71ca5e78fb22640de7ac9e5df7c10516f8e76664ddc65daa5b06e247bb589ad90d9e78f1581d9d49aec61dbc7b9ddec44f600ce
-
Filesize
5.9MB
MD55a9c46507c3fa6feb927db0c9d22ca50
SHA16865117e7685ce7f601babb896c1d4db7521ca69
SHA256e7457d353a0631c9a9608e1375a62a927bd3706e98424a2d0c8f3ffa695c11b0
SHA512f9ea0b59ac2b02f76674bacd0b39b6342b8dfb219af025bca8f0819ace5f982250f98a79755999aef641e84b7ac75ca2edc03247420ab717d102bc1819e16d66
-
Filesize
5.9MB
MD5ef9c284314196c65ba7291f894f0aaee
SHA1b13cfdf1818a488ba8b7015a2b8c40327909f358
SHA256b0858492dcf4fcb863f7d2a37ced7a73a287d3394ed6f05840c98ddcbe6bdc77
SHA51288b5504450866076d9108ebfd28a881c722feac7f81ed85ede90ec23129faafddb7b23f74357fae57edafbc3f1387032a82a06de92751818f2c1b7d920054973
-
Filesize
5.9MB
MD5fbbf3df6c1a282380ecfba64b7e7de4f
SHA1b13cd334d90750c97c777b1e3cfbeeef913eb331
SHA256f60e5a97bed3b15f014cf10f0dc7b0b268bdb5308e8e7bfe908606437c700180
SHA512e9106d08a6b854088b6378b5ef9af8c803c00174777a52d1c40042e4752f07f9650a6b2df52c2811f936304c13e0320ae7811ffa0622933e51b095ae650cc2d9
-
Filesize
5.9MB
MD5a7f13f17d01894ea5327625901b09c64
SHA101a429a2da8135a1861edeeeda9dab711e7e8095
SHA256458f3fa97c25bdb2a0147713abf71c6194d24509bbb9d04affb220a1ada33d76
SHA512251553162b16770cef176ca44b4d385e044ddc054913958888dc727c76b9fc1368e303e25cb7b80d8a04234d773bf597e68a094cd8add2cec0fc14d63e3f5724
-
Filesize
5.9MB
MD564b13efdedc21fe4493f7f01b640e5c0
SHA131177d6d8b8fbd338e6be775fbb5d97227a89e10
SHA256a6dd8f7f34078de0b5a39291a9dc3bae15da00f76e5b92af5554d3270d052b69
SHA5129b86fe38e577d4facfb70aab44c8c74737503764187c210f8b58228100397271e97eb44e4b19636fcc434eeef620d110599c17cced1a66240157261bdff70e2c
-
Filesize
5.9MB
MD528f65346087c68fe813eb224b028c0a7
SHA12af5760954f9eaef1607b93b53571337a7a64e00
SHA256340690b15f837644f08e8289a28576b02cc2a3d0afed75c126e6c143b946cbe1
SHA512205f41ff6e0e1653d26d2ddea936f7d036a2dc1943e3b85adf6c5ed0372b22f51bb38df3d25056f787f0eae2ed4c65bdb2da7fc01e0f6e120f59c5bbed9c4f07
-
Filesize
5.9MB
MD5f7797bac6a9c8b1e00325fc2fda9a9de
SHA1114bb29785943b1c01225df423b8ebbd5aff301b
SHA2567c9d7777ccccbe296fffc1be91944cbaaaea9e1bbb8cf1ded96a3d55874e5c4e
SHA512f5ed4ef9f65c356c26aebd452b229865e80fcdeccbeb8d55111abdbcb1c590554cce260978cced1938ac335672a8c1631e71dbde4eac649a08c561b9a3697ffa
-
Filesize
5.9MB
MD5bed0087118747e532d7d77c74d7cca78
SHA13534b0b0ca64198f09ecae89192231878c67fabc
SHA256594762e440d1a98c77c664fedc8dbf42ba2fe5082c3f443786112623e5fd5fdf
SHA5125ffafd7c6b9775f905e642bccba2e2f613bcdc9fd0da350416434e35a85e3612100f15015f98299e7d1c5127f8ad5e27b51c0be75230166e052f8fbe3e753b45
-
Filesize
5.9MB
MD5d428fd044115dbfe8424fc583e081f20
SHA1416ca057aa2bb68296cc626cc7d283686c8c00c5
SHA2565278f64157348cbc3aa48956aa58779011b9529c45f4134cb61f9f9fde003552
SHA5126edf655cdf3f524d912af5c7c5b2d97b0021c7b7929f643290af318efe1ff5af59c7ff4a4710a0742fe6ce7e61e7b7203fee1c7f737d71d5660f61ec2cef3dc1
-
Filesize
5.9MB
MD58a0dcbf08aa95e126c8ac7cd7d65532d
SHA13d937374eb96e2e2f4589eb1f4afd08eb27bf6ae
SHA25628e8209dc62179124bc57c6d42058a07c2319fb48c87ba847f967c6239381245
SHA5128a0f38f02717ead6eef50747628f8167a15cb592bbb43d0c101558e735238c997d73585b8de209cf25df1adde415acafc6378970cdd7a12d521fbcf65eb80da7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB