Resubmissions
11/12/2024, 15:32
241211-sylmbsylgv 1011/12/2024, 15:31
241211-sx6acasrap 1011/12/2024, 15:26
241211-st9tcsykcw 10Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11/12/2024, 15:31
General
-
Target
2024-12-11_16c8042089bee10d20ea354a5d69649f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
16c8042089bee10d20ea354a5d69649f
-
SHA1
6e74bb92f586e2ee82bd35b6a7ff72ae05a3b69a
-
SHA256
1d31de0dc459115553638a449998de44b31f95317caef59b173380438a593de4
-
SHA512
e721bc69dc2054eb55ce6da95cf0f476dc2e60a9399f6fb8d166a9e822d8a0b823213e956e991bae357da9354954fb236828faaa6ffbbee71bc3637b3bfe2829
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUy:E+b56utgpPF8u/7y
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 58 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-11_16c8042089bee10d20ea354a5d69649f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-11_16c8042089bee10d20ea354a5d69649f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\EIBsgTL.exeC:\Windows\System\EIBsgTL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\soDmrsy.exeC:\Windows\System\soDmrsy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QwckNba.exeC:\Windows\System\QwckNba.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ckRUwNV.exeC:\Windows\System\ckRUwNV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EMLSXdq.exeC:\Windows\System\EMLSXdq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PcArqja.exeC:\Windows\System\PcArqja.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DrdevCj.exeC:\Windows\System\DrdevCj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntEoKmg.exeC:\Windows\System\ntEoKmg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cmoNtji.exeC:\Windows\System\cmoNtji.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cIkusGz.exeC:\Windows\System\cIkusGz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IqdXspo.exeC:\Windows\System\IqdXspo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\askaJnk.exeC:\Windows\System\askaJnk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TGhfNEO.exeC:\Windows\System\TGhfNEO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pYXiTUi.exeC:\Windows\System\pYXiTUi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rLapybp.exeC:\Windows\System\rLapybp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FmqsCwb.exeC:\Windows\System\FmqsCwb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\chHsJok.exeC:\Windows\System\chHsJok.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ehbWihd.exeC:\Windows\System\ehbWihd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VCvCGOH.exeC:\Windows\System\VCvCGOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FmbLxen.exeC:\Windows\System\FmbLxen.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TIKphUM.exeC:\Windows\System\TIKphUM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5d777cc977a8c04ec035c9f5f3153ba4b
SHA1b86c6a99260f67fffab7f0ade63d38325712efe1
SHA25605672aae4de0495595e8ae8689938a24888a5c00d237af5370732f355a9667da
SHA512e81825b9857fa8d3e2f5398355e21e31294c01b077b4a114314da366cc6794324d1b3cf7fd3d0b5111073e7844cbc188e72a55e7b6d87eeeba4a24a674b9384a
-
Filesize
5.9MB
MD5dd12eaada8d07aafe3d99a23bad4eea3
SHA17aef2b9119bd33eb97fb35a9236734e3254edc8f
SHA2561253f11ec5544d65a3c358c1c13f08e7f3f769bb988dacf49e5ce5a164cb0ff0
SHA512ed69f364df795e4cebfca2bbad3a9ed57bfa7917f6192d2dc74df37a9afab98ac6da5c99a95f90049a4e01be2c0ebd39893f71cdedc8e83c515589f7e456eadf
-
Filesize
5.9MB
MD5365a6d27d3eec686ed33811bc129e6ae
SHA11ada28ad952d161b037a239741632ef2a62b88e9
SHA256ae428246c813fe0d00d50423a35c776ec712365d915679f5d192935537da4739
SHA512e0f284cf468b3c639d5a9152c0594c13830fd31950e901d78a3d11af0cde5676837d417026f62b7210b30b24e52fa75274b968e3eeca498962a9a5f0e98e5b21
-
Filesize
5.9MB
MD5ab983616a527e9a08fcd1bea7be8f5d9
SHA1a99ea6e99d7ae07e9bc83aafb141c9f0b5a463b5
SHA256ef4b9be98550b3c742cc816c40f60186c6db593b7e60cb0e234af62f35b11e0c
SHA512765bfa1f783732315c2a423d17316a64dbb562f39b44652f9df8716e73cebf8db217371eb2b792ee3d8c399a49d312b12924a58f0a877a724d6c25f16151df97
-
Filesize
5.9MB
MD56e557e48f5a2f38fd85821145826e5b6
SHA1dae194b54fbad04905ad313af755478b14777e87
SHA256355250793a18d4e5c79227142fb97a923d6853606b22b003780fde455d3a34f2
SHA51288b1060ecb85ee2be1b1a5ec2b9bc2e94e4e6656ebd42d7e133a9eddf2ea44efd77884317417fe248c3cc622ee9b8d086286d342ec38548c291b291b8802daba
-
Filesize
5.9MB
MD532f5fd0f703e18d83e15c369a62593a8
SHA19005933d6bafbe7c22513b5a255e147094759760
SHA2563d17152dc0c412c2fd7c8c324ea6c46eb815628ec6b522dbc7ea806e834a2c37
SHA512e6f0e937bce8474ce765e229a736ae48ef6c5abaf954db5d4884b55fc3e1e4feae1bd4f503b49d9ffff8774ed4265f2b900ebabda91e0d0d3c75f3e7cd10c3be
-
Filesize
5.9MB
MD55c3634243946964af89e423c5baf90eb
SHA17310bc04042e9b03479db4a607c291dddbbdce08
SHA2567cc4543a32f1ae9c6d08b3c9779e5831a0f8c0872d65d424d1c985f65e1193b7
SHA512f17031a8bda27a2eae3226e6d20f7caee1196cc3768624ac004bee9b37133297ad00fd378eceb247581b1584c93830f85c41b131866de64e51e9023ce18445bd
-
Filesize
5.9MB
MD51656d15268a2a0ab666ec9060236afb7
SHA102d83affe02993303206eba31cca98c85e0aaedf
SHA2567c5a669d762a0d6407db2cfa3d2b53dfde8ee6aa612baa80e5a9534c9f1ac526
SHA512352548df5320aba1f5bae766be16f4e8abfcc1f1baa945a7af3ca854abf5124dc37eea944bca807ec67389fde18714d43aef7b6b4d854d5df7b21910055010c5
-
Filesize
5.9MB
MD5310f9fdbb834802ed95126b743e37e49
SHA1f7566dddf346867ccaf09b9e2b3f873123710bdb
SHA25619f3a2af679070271ce0088e47b9746149783b88f54fdabb17c887f05ef75523
SHA51244b80f733c82b3d91ed19bcf3bac3d88d4c88e5b9f7249fdb83c72f6a872000c4948581c2f7e151e3bc51970bfd6a9dceb7c98976286d48763880b73134999cf
-
Filesize
5.9MB
MD5cc55803884dbcbcee3ff752240e94607
SHA1e08e0afa5fd5da013a410db3c9946613d2aaa54e
SHA2565125ccd05b8f888603f03f3a0c8b4e0f6eb74f580ac644ce07cd7d496d7f6545
SHA5122375f78620ecc904ad6f86bd11f616b5a01e1df35fc55c60a9123a37fefacd9db5219a9c957000ec0435881543fbdb0d4c4a05657d9c8579baf078a90939a95c
-
Filesize
5.9MB
MD54e1d5defb9c2e773a7562251bb893108
SHA128aed56d8615a54277c5f7e433cb008680fe1ed8
SHA256efac436073f45e30593b691e6580f05811b80ee639a5ecef9c55cdc6e69d573e
SHA512f981471de12d182f067f87adca4e55791def8bcee6ae9d195c4c5c7881467825f27bf98a8687a2758a249f3b2d81316be43236cdc4abff2cbf4ad9a257431afd
-
Filesize
5.9MB
MD534d00c773f948aa07ad8fb3f14a37b06
SHA1a7067ed9b5a1610e0d898550227e4fe5175594c2
SHA25636ded9d0250340b377286d4a2fe4afb5a4210ad6611d3393f62f788603fc8dd2
SHA5128252f379ac7a61d17631d403ae6e384f693c3086a8458af669ba515f559d8c733dc236e0145fdd62951028b77caf2d73f862aab41b2a662b99d6741eb28eeb7f
-
Filesize
5.9MB
MD55bdf890f6b051791ca3f2434464d0860
SHA1a105c40959913af813a026a7515496ad1c406cd1
SHA2566b89844dc68a26d37ba2740b57b1ecb37a9551330a2ababea2d48f2748e848d5
SHA51230ed069b617d3399862d11c12fcbf1913f700b7722e02b0a10627ad4e8dbfbcb1964a2f02ec39311bfdac89e12ac567d7a086ea92aa685953486aaf9d8eed879
-
Filesize
5.9MB
MD5ab973ff22aabfa1b7c8d084219e38306
SHA15af1de8a887791ee1974eb7092ee6fc38021629c
SHA256f7c4fa384ff6cb21decff2153e7d5bc7432b9b878a26360f7df6055e7bafa976
SHA512fb722a7d6606d89ff6b22a1f5c1367205116617b519bd14ee890349de61aaf500403aff294ba59f225fa20aca6f15890021b736898f2c93efc9049786d2508e2
-
Filesize
5.9MB
MD5049a2636542385327c0c3ef51e24da6b
SHA1913d9067f1c25b514f29e5cddd931e2db89f4e3d
SHA2564b02982a3a6c53f8c7e3018c3500d960ff013f158dac333907607ec18f715e56
SHA512d3ca48bc488dec44e9575cb40eb97104b403d9bc967cdd7eb2afbe4c7b6004f4f2cdc822ec98a8a711b31208c0b037df3494f27c1dc1905ea0a78bdc2658a92a
-
Filesize
5.9MB
MD500bdfae2d7ce321bdd6482f9f7e807a9
SHA151b040b0146867f06274175e77f25b1c4129b2c7
SHA256afcecf9b0156a45cecf6b71de80e58314aad648345a33403c68ea70c56bec643
SHA512207258d0128d82cf69b4bf666ba059636aa9e04bd5dc6c8e54574fbe954f2c79c7d4cab3abe1412838d00767ca17a6a075949373a3fd0b4ddf1f6ae980c74af9
-
Filesize
5.9MB
MD5f7db9cd639aafca5e3e30c79ed2bb6ab
SHA1b16e8e0ffe37f40d178975144d0f21d3444e5772
SHA256c775b20de80c9fd332963d2b2905d593b9d2afd8c24cac7327788dfb79bda287
SHA5123ae6b6f5f0a0a29012831da85a4ef455497e9abb3c21121998c70c1043591c1c21e028f4b8790e71f473d0156f334e571655c42ca130b603954b742ed9cb75d2
-
Filesize
5.9MB
MD55b98237fcea7a69d65f2d93246d2805d
SHA1ec5ab316c9cadf6ea4029355d199a8829d948bc3
SHA256b2c6aa2521707590a87d8f4c26255e01ded88311849e757ff9aa53f76f88e81f
SHA51231ed4b541ec9dace5f200b1c83aec6cf65f4b406aae46b958f4946889934c8e4a5c084827f990155744a47a80f8c2e8964ccf21ef4e218b0c06f35f50cf0bb53
-
Filesize
5.9MB
MD5be761fd7ff6d54fc6f485294ec6c3bc0
SHA1ad54bd45b24148b40fe69c6d2fb19abfff65a68e
SHA256cfb59507f40806e492e24f8ba71fd261403899590e5926e8d8b8636a21e43266
SHA51231cd5b08bff34e55d6db0ced727b518e14111bc7c7a5caa5c661a6c6cbb990eb1444d25b7ef4c95e0eadcbc4437d656e7cf1c6675f8bfd4b20e4f4dcef1cdebe
-
Filesize
5.9MB
MD517f361a838f8b00e0cfe3be6afd5ca53
SHA1590e9326ee27a3e86be884c01899f402ef6d81eb
SHA25651424424d9acc101e0bf113a26779ede882fa08664538d5a14ed9803d1babcff
SHA5127129e052479d23da194f16100145fbc4023165e9198d2f240ffaf6e1da89b36ea64b6a3bbd4bc9ff8611f6e82c0e62130ec689985970a7070d809f789ec6d451
-
Filesize
5.9MB
MD5bb80327684bb93fff4682a8d704279a8
SHA12d530629f9dcf5958b4cd36f0c625d9b9fb27723
SHA256c87f66280ca1d58557c48845629eebcdd107e26b6eb11c0e256b64a9614462f6
SHA512db0a639e3ad686fa64fe3107a7a67619bd5fe71b6f4e76835991f99676265c22fde3d3ea088d3e241746cd9e4298df91584927f00b5e14904924cb4e0c51e8ef
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB