Resubmissions
11-12-2024 15:32
241211-sylmbsylgv 1011-12-2024 15:31
241211-sx6acasrap 1011-12-2024 15:26
241211-st9tcsykcw 10Analysis
-
max time kernel
52s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
11-12-2024 15:32
General
-
Target
2024-12-11_16c8042089bee10d20ea354a5d69649f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
16c8042089bee10d20ea354a5d69649f
-
SHA1
6e74bb92f586e2ee82bd35b6a7ff72ae05a3b69a
-
SHA256
1d31de0dc459115553638a449998de44b31f95317caef59b173380438a593de4
-
SHA512
e721bc69dc2054eb55ce6da95cf0f476dc2e60a9399f6fb8d166a9e822d8a0b823213e956e991bae357da9354954fb236828faaa6ffbbee71bc3637b3bfe2829
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUy:E+b56utgpPF8u/7y
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 51 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 48 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-11_16c8042089bee10d20ea354a5d69649f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-11_16c8042089bee10d20ea354a5d69649f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lGyejOH.exeC:\Windows\System\lGyejOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mtsxEMh.exeC:\Windows\System\mtsxEMh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\URrSdVc.exeC:\Windows\System\URrSdVc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HsruEdV.exeC:\Windows\System\HsruEdV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vWxaqZb.exeC:\Windows\System\vWxaqZb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LFPuuBn.exeC:\Windows\System\LFPuuBn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kYkgZSv.exeC:\Windows\System\kYkgZSv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\czYjpAt.exeC:\Windows\System\czYjpAt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pjqogKl.exeC:\Windows\System\pjqogKl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QcVFxTP.exeC:\Windows\System\QcVFxTP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DPmPXXE.exeC:\Windows\System\DPmPXXE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kIUZdjL.exeC:\Windows\System\kIUZdjL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xsoxTQg.exeC:\Windows\System\xsoxTQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PcittRk.exeC:\Windows\System\PcittRk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TPzidmB.exeC:\Windows\System\TPzidmB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EOqcKjS.exeC:\Windows\System\EOqcKjS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eEVDSKx.exeC:\Windows\System\eEVDSKx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xQAVSzh.exeC:\Windows\System\xQAVSzh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uHLMEEo.exeC:\Windows\System\uHLMEEo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CPfyOFW.exeC:\Windows\System\CPfyOFW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oMamOGu.exeC:\Windows\System\oMamOGu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD537d82e3d456d6f787faf1b0a9df8b5f9
SHA1a63ebabc1fa6744e7ef23b7b8a2dc24e7b420474
SHA256e04d98e3236ae8382f8aec46474126edc1df75c8a6ec762876345d12f0e9ecea
SHA512b78d5cf31de86ac9c35860236e04f4cd2c71e62030466ea19afc3bd3308df933c3ad96b2234d9b3fb7ce6399f1c62f34b0fb16cbed738ae0fe74a0fadd669d3a
-
Filesize
5.9MB
MD5c81fcb2e51ffe356c34d5fe0ef14b84c
SHA1ce521ed170ad0e8276ec554d0074f2a42140e1b1
SHA25679ceb68e5f1623a1e84fe28987306d6d2262e3d3131dd48501b647cb831a981a
SHA512e3f4ffe8e16427b13b4f6c28d2588d72fb424ecd8e58b61b21586b1d5fed8130bf131ff5a585bec2de0b369c975aa2046311e1d88117be4d895262d7117d9048
-
Filesize
5.9MB
MD561e818bf7fad3f71e546fd49450715ac
SHA144922ed02120ceb0861126d8a423ffdb213691c1
SHA2565641782e65bd8784fedf26e4263d93005c5bc9aecbd604fa4b56580add017a12
SHA5126e68a0d71c64019144c482a5dad67b0f30635a75d7d858ebb077f34980873b0b6633aad52b4b5c90c02ca2d5c179b366b8a80780d96d86ca89ab3a96db11c85d
-
Filesize
5.9MB
MD5ed34ca5ac780942f810c3ab8dff68d9b
SHA102bc0b530c5a3d62f7bcca343593c29b27cd1b51
SHA2568227d6a9121463420e8c22e1e8e508e55f6d664ec526870037ccca094e248904
SHA51266974bf20cabe12abec0794728b1d68286e5c73c1f492dfd8d6753ed8ce18349d779cff8c30fe5ee482ce37de6ec1f7f37eb40daad82dce487f52dde12ed3936
-
Filesize
5.9MB
MD5db8b4ec3601ef036c04a3ba999ad6f2d
SHA11b3020624f593aa0e6ed9e2ea0437aaa1b21f074
SHA256f0d5f822d7fb9989db38caf0271641741011bfcd34e49924921ce125373e63bb
SHA512659ef83bfbd87e52a9def06d1dca9865747a1749c489c046650b563f54427cc502203ef4337865284f3ff8ec2602f209f017fb07d68d846440074b522620218f
-
Filesize
5.9MB
MD54de3f950875f51bd7aa33e9e62b4bb95
SHA123201c2e8977d352d57c7f528271e2e1fa9fffb3
SHA256d3716e10c979e394f5116c0f9885a2a9d8f7101bc0a3dfe4f5f8b74addefcba0
SHA512673c70bddf905fd636937a34d46eed74dade9018e9a14af20c131797df0ee3354bd0e9681a56bc3940f143ddea44e18c9d74b6f5faacb1da29b0055163aa7b9d
-
Filesize
5.9MB
MD5b64443f5047da2b78c5d7161161fbdfd
SHA106aaf8d1401c3fc4cc545c30c0c5c0652e193d49
SHA2560bca97cfd850708aff56e6dd0e414c10e6f00d976548e204a31b6fea399b39cc
SHA51234f57349fe2a58cb8a7b10f99d6bb30c2e9c38d141c6e90a3edf7e7a7a3de6935bf8e13fad828b5d31b95bb63c99a27b6a21379502e1c6c12e68f62d09f66806
-
Filesize
5.9MB
MD556660bd4be53af6ccde856358099b959
SHA102566d96b92e9ef1d9674898526195dcc6377f6b
SHA25633152b3b1a37110e020724a53579ef220abadd489d777f4767683e7e9ff0f347
SHA512031824e024af1b4db2744e1bf6197bdc7af1f40b265024088cb90c984a944385b2504eb4c4fdf47e456c6defdf770e5ddb97216da83ca3b962140dbd81cfcaa2
-
Filesize
5.9MB
MD54067a320613bfc9158f6c2eebd9da5c1
SHA1cb8584939efffef4178ee9b85444298a605d9397
SHA2566a2c05cb45ee7b1410eddae0ffaaa5ab8d2a09c82b89be7267536fb360b964cf
SHA5123f51a071fef3a71d9f0555d42208098f53c390376e87aaa1be6f9b09fad0a9f468878009b3f75dd8a7e090715d216be9926aa0417e89ca013f9f7909560481cd
-
Filesize
5.9MB
MD5b17af77f39ebd36860808ea871ac75a3
SHA1a6b121bb3b10810d07c671793ea628e5357e1bb9
SHA256a30d3388843244d40ad0f0be1e8daba025896730b5be9eab802c8fbe2eef6e34
SHA512502040aeb6cd2125535bb8f5158ef233934d95ad66369a3b36077edbf6f1bb09b433e326fa3ab912912fbbb3aad62bb9daa624994b7099271ec138075c09b4ca
-
Filesize
5.9MB
MD5f4604390701973c322f0a72f53ff8a81
SHA1e3515948207147948b9b88cfa20e5aba55dc3c6b
SHA2564cf0e321b0a2902666dd424681972e7ec74ef48840d3f1d0205c5f04899b43ca
SHA51247ae11957f74e263c14928cf3a09761d0bda70f612bbd3842861708cbc9198b565953ff1351f4c29281c966194504adcb2682f4222d29feede4377fbf9541e58
-
Filesize
5.9MB
MD55d07712e361c8026e66ef2e31518d40e
SHA135d572bdc1d4faaab6b290e82410f325b4438a69
SHA256a7f647367ffce0a7a10f388721a0994f4b15641cef8805e165c578d963b4a2cb
SHA5126bd7fc3e48fb8e0bbf500e50f35167c17389d99be8e56760bb48351f84c0d037e2d87ab5bb39fc4db64b626074ce46ca99d51d8c4d1c275d38a20b02bf14f9fc
-
Filesize
5.9MB
MD5a35a9b1e4e930e9ebbb8666e35282da5
SHA19a2418711da1d5fc3ed39b2b840b29b227a16963
SHA256b4885dc4da37de3c801e6701879bba6c92cdddc148a46c9d064fc01d8b735e2e
SHA512f8828c06dfb427a9a68071e8d9b75d89118909ff0738d187e31cf4468c1097591ea9f86802e0725b24bf621ae7af21e2a311d78b3b743462051a678de79f9767
-
Filesize
5.9MB
MD5a38a4bcd4913603b4d13b6a90a529d40
SHA141d18de27dd724684d8576572d6943083e607ba0
SHA2561104242d5403d2bd91d8f7445e1a68cd7ddfeaa8099f779707866aaf4206898b
SHA5120a5c71258abb3642d51bde0fb47c41f50d34198c6fee024e0ade7a246188781516b44619769af7b57ce4fb7d7202c5062b1a2916562203585d0593fe4afc39b0
-
Filesize
5.9MB
MD5404caba5a40dafed8d8c9785846661ea
SHA112a61aadeae3e57697c7b20b2aebb806f3f2530c
SHA25698e2f987b4e28cf929297ec4f587f982c110a9bb9ca735112000e540e85d5169
SHA512967b9987ef19b86cf1b099fa07b15b23320fe6d6e0f6a71bbd7182f56e7fe3e27242dcf74cec66ee8a4232786dd8c2653428b03bb2439a52c9800c5e7135225b
-
Filesize
5.9MB
MD563be574ddf2f5a90babffadab2b99b41
SHA16e7e2e97cbd64ee1c0c2beb3872f3b9f57c83dea
SHA2566b683de1742c16baddea5deea2dcb6c269b7cdd037e96c082e208b642caa72a1
SHA512da7e21103a5a34cbfe3396d893e69ad6c56aa5179e015afc09752a0df91679390a799b6f40b7f4422c73329cc2da0a63d020455ec65b06b0667e536e4c7f5ef9
-
Filesize
5.9MB
MD5209cd03c836155223ed13aa871254c48
SHA116f2b4182485165ea01f168d3f356f97e2e547a0
SHA2567a062a90671c1c8f89a5e63066d8553a8f28740576482d76fe0e48cd5b76e358
SHA5123effd88bdbadcad2bac60a85e94db258bc3abef437af1b45e7533006830b9cc8558dd4e18046bebebf3eeca45145680fc99ddd5cda731743f59b2abab478c643
-
Filesize
5.9MB
MD5c8ad2fc07d570254962fd57a68add614
SHA1dd228ac1047477ca2001049b876712bf96c3a875
SHA2560e7f9b5301d6c172d40e113e970429bdab71b4af4e7913a838ebc6443bab8cd1
SHA512cde4c74d762fd5d27ba5a0c39dcc39b4ff1c2ebf7ecfe8a3ab84b1a7fca78510a37e0b775a1c348faea82c85b049e728c85c011d32f1cfa5471b915e82981581
-
Filesize
5.9MB
MD518d0d79cffeae32e4c5536b822c6848c
SHA11f1d4e0251ca4594f7519a957d0d747a99fedc7c
SHA256cc389d40095ab95f5fed27e3a28334cd9b0d8e72ea70f6261c00a71f2ce8dda1
SHA512698c56ac169cc6ba98b34ea2ae853e3aff2297f04febed20365d789af607b6978f3c49be854b00b3b6f7f6d665efad48b7e3bd91a76760e1a70027be46965bb4
-
Filesize
5.9MB
MD5bc57f5d6bbfd2165c4332b13b587e4b3
SHA1209ed17680000a0e577b3c7b922976445f16ec10
SHA25626533f9d4d3ac5d29f4c0c7840ff2c97ec3ac11a76ca89e30ea56231db5297f0
SHA51207991715270679f2b32aba18c2dce4230702ec041df296fea3102031c092b1a995d901fc7f16f0f6c0befd8992b4e44fdca06e93bab9fc7f9561ad00dfc01321
-
Filesize
5.9MB
MD5753326ec4353ba306d3fcaba472313ff
SHA18e06d5bc9a31175696bff4536677e268505c8781
SHA2562eb48f3a5a595395f5ff8b6f3cd2a46545de1c9fb3798f44821152116203b79f
SHA5122f729dad01aac05b2749b20681d4895fa0b015ca44c6838efab16a5d900253dff629d90fdb6979da0bf692388ea58549bd03160669837538602e44381ec52a07
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB