Resubmissions
27-12-2024 19:59
241227-yqqtzayqcl 10Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-12-2024 19:59
General
-
Target
2024-12-27_8db1fe87523bc13fa033fba99d912cad_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8db1fe87523bc13fa033fba99d912cad
-
SHA1
7b9b4c2e9715e21ddc3ff121894ab7c47c2eb609
-
SHA256
fdc6a37cae9e9c9466694a182ddbfcec8198d91a29c8886f64e80a1d5655daae
-
SHA512
2aaea2009415bd075bf3a99bbfdf773e6a26646b1cc067f4dd70f191fcfecb904d58c8bd4bc7dd71423768bccca767218ff61e157fb7a7f0e18431ab846561fc
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lUV
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_8db1fe87523bc13fa033fba99d912cad_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_8db1fe87523bc13fa033fba99d912cad_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zwzijoI.exeC:\Windows\System\zwzijoI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CxVztDH.exeC:\Windows\System\CxVztDH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cyBlnOL.exeC:\Windows\System\cyBlnOL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jJAmUqO.exeC:\Windows\System\jJAmUqO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dUMXwro.exeC:\Windows\System\dUMXwro.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RWDlbhT.exeC:\Windows\System\RWDlbhT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fiLwLTD.exeC:\Windows\System\fiLwLTD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aYfUIXh.exeC:\Windows\System\aYfUIXh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VAlFURE.exeC:\Windows\System\VAlFURE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NOcYkGF.exeC:\Windows\System\NOcYkGF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KXIyoaq.exeC:\Windows\System\KXIyoaq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bPBqyGb.exeC:\Windows\System\bPBqyGb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RMDpVtd.exeC:\Windows\System\RMDpVtd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CIBMzel.exeC:\Windows\System\CIBMzel.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hRGLdMp.exeC:\Windows\System\hRGLdMp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LgGymnc.exeC:\Windows\System\LgGymnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SPrzsem.exeC:\Windows\System\SPrzsem.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pKEIkxs.exeC:\Windows\System\pKEIkxs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntOaFxt.exeC:\Windows\System\ntOaFxt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\inrvRro.exeC:\Windows\System\inrvRro.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EFcnXpq.exeC:\Windows\System\EFcnXpq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58096016f29c7fc2c70c2dc510ecead7a
SHA10c025a714f2e3266e0b17860a2c69fcc38e9064c
SHA25639b6a3b6852ab98db5c8ab8af916cc784114de8bc8b77e2c5da9da9dd98c3a8b
SHA51290e7d100f12ee2cb7e068c4e95c4667aa15f0a02faab7b70196f5adcbf21c7a1d93d2cdb98a8cde8be9c916a96248312dddea6576f91770a9be55b7d483f35dd
-
Filesize
5.2MB
MD59d2798f814063a2d927e4148ecfd10c4
SHA1d0212ff3ee24d66332d8cb4de0422423c95afaff
SHA256213cf25c604881fd1f69db522479f7a37ee6cee0eb8aa2b10c430fbfdc55ba69
SHA512182e5f068096afa4f64d282aa1119d37cc642009ba939ca19331c938db14f0bb7d6c6650dc94e30be03a8ce87313358fc4947405ece632bd2673843e5be6f92c
-
Filesize
5.2MB
MD5e55a710603214d42c8117ec63f5ebaa8
SHA16c0852328100f09239f27f2b816215bfd59eb111
SHA25602ce97f3ba2973887045ff7ed063372b39129b4f4954600a968a1abb67edbeca
SHA5120255e1b77b89944851f3696a2c661f250800ebf40f597693b7465b6a716d8e4d629cb2318bf3f73cc497a92c573bc79116454734928a62e477325bdf34271dcf
-
Filesize
5.2MB
MD5845c79dbe9985eeb1193893b66f10987
SHA14b786e9dbef5243cee0ebe7a5344f005fd504d11
SHA256ff575d279f74d7b3d567a496a9d1ca5e4dfad249ebae97dea259c51eaea911a3
SHA51298144b5f67795f198e9c8e1b91e9dc61a2f0249596f8075464a4691459afdb7983860be26e93140bffd5e50ee84f069f4300d7e8a5c17277819cf6aaffdec5ef
-
Filesize
5.2MB
MD5a4c7b302f1ba2b9146605f2727f75a8e
SHA1e7f79faba896e97f58162b4331fb82c7c971afb6
SHA256bde7fe2b4a479c15e0faae5cceb3824accc6ec40fff652326fd7994de702cf36
SHA5120575f292d34a41f14ad0100d27369d1be848244e83b56ce18ee2064b73571bcc0a26f82963f27938d750fd035bd7a2a06fbf8940c0fae61e5f2e15f22ef7983d
-
Filesize
5.2MB
MD5e80c9a5ab1048f8951f5ff8237e392eb
SHA16aa9b148f393e4911061774e122bdeac65904b95
SHA256b1462717f3211ebb5891cf2d746ab907d98f5710970c293f8f586196b337eb9e
SHA5128f811ddaf6a0a9a936a0f5cd87fc9203a645426cb186e9681565770b438c48e6d168d8f30f3ec6e76918490d0161ca3e0def2fb62cc3cdac955cd02b0778d850
-
Filesize
5.2MB
MD55c0af6522fb3349e414455f52ed24d4f
SHA1118a9db7ae63aedc2b113d44dddaafd9739f59c1
SHA256b5cf3d7480f74d2d80f3d0828d9cde99629bfe4e8ea7cc6193d1ef8cd357c275
SHA512dfe6e676c67e677bd59d2523375bda9cdbc451747d26cf071466cfc8a3696252c6e4829d08d20869097264ed606615ee8163b7afdefe9c74823309b2a2a5e729
-
Filesize
5.2MB
MD52974ae8df785c8a8347431a2306d6eb8
SHA1153efe6ccc63024fca6740911b0e2c315a3b54d8
SHA2567c6ff20f173c2b01cee7e7149135d1f23f3beec8952c465033091566b0f22229
SHA512453fd2837eb0b6bac7a48d77994fce181a941115ae4bd0877aa6a6b1256c32ac77615ec87f7519de78a9758bb5dfcbbd6f28104657189c349e1453b52d55ecf7
-
Filesize
5.2MB
MD5226fcfdecedd85aec22781e8356eedf5
SHA1c2bc3a80d2f91d77e9e42318b57993a76fb29f6b
SHA25661b2149ef1fd9deafe44bba5694a0f1336d4247be3a40834049cbea52bf38a4d
SHA51247db6758758dd10b1dca11544abbf9ecc6bb5af09bb24fee15eb21f72a5dc33aa01e563a9e9935a0052270516ccf92f53aac464be70427073c5bd16aebfc082d
-
Filesize
5.2MB
MD53c16762e7decbaa66b2b5b8300631806
SHA1b481706543c18caae41579c88ad22d05ffbb61b4
SHA256c941dfc069462a08fb3cb34ee97c138224623ace02db2807109975907ca8c4ad
SHA51263ccf16be29a5a0b0363c7b1adb4f54a653707c040291c858248013b60bc42e991e8c5f172a048080128b766bf68c8e837096da44f05280ff4038c6dd7c94193
-
Filesize
5.2MB
MD53d288445a37e9370eefaafb693f542b2
SHA1acbfd32918d7b280335acebe0fc3cc7f259c85a2
SHA256c7e5105bcdecbda9ac1b6ee8df5555bcbb8d520071f4556c53b0a683205067ee
SHA51272eed77f952836c1846df4a4a09fb00b57330ca75ad33615bdcd1a1177d067407f1dda8508b2b2601ef5630ed747307c9b43930bae1f4b53c877ec52322b018d
-
Filesize
5.2MB
MD55e0c59339f48ad81acafe874491845b6
SHA17edd0cb99a51c5322ce87ef82c3287fa77c9142f
SHA256f633d6bb98b1b408d344bd4ea2fad3d46340eb4c5446041b8b1bb3aac7e9b282
SHA512add9c1ffb1dc1db88b3c44e61a658b781a4102bd5381610d13015f833c2033fd449bef3abea759b0a5e39e5b99dfdaa6532d4c996f43e406a72e4cf7a1b72897
-
Filesize
5.2MB
MD5d2be06cead72eefe309e732a93d4e553
SHA156ac8a82565537f620d5f4003a6797b88fa46d0a
SHA25656ae73d63d9d4ff485094bf1c0ac67c09cae3a7f54979530770f1f94f04fceb9
SHA5120d3b4e5892b8d422d81b6145558ffc8e940b907cb535e71d311a440a3ffa75b67e33bb5ba628762b7d9b9f85c8b734fb79dfa55b88b3f84286ebbd20bd2932d4
-
Filesize
5.2MB
MD588cd0287094dfafde5eb41da5d4bd121
SHA1592224406b7cb91485e80cfab433f4d72fa1cdf2
SHA2563bbede95e25a813d5571abd1d4d6623b7f2c3ef1bac8407bcfe679d27866d4d3
SHA51261975c29466deec93dba32428e2a82beae7ba040b27ee11f14b2eb2b232adbd7e12ad983157e557cc7f7d6a1ccec6183ead4cae7cc83e1167738b1763752684c
-
Filesize
5.2MB
MD510df01c2eb6e9293602c74bcd746865f
SHA1535dda40f9e28c9a4e1e17548e0a958068f0c3d4
SHA256c97caac270f7d1f1481b7fbef49eab1446953b2f349bb6e53310ca328fd92101
SHA512b930911d340a0d26c5deff37448c391ff5446b9bf26e0b3a88c37c8ccc95bbc28645e508258d0881c0d4bfa535f002c39e4c74c125ee6f388523db2cab4d0d3d
-
Filesize
5.2MB
MD529c12ef6a8dd76ee038b75b98dff2444
SHA1c69f99f46a5c0a4710065beeea7de693f0f0ae81
SHA256de5b3cdddfb24ef04afcaf01e0b1f0e4c94193b32672ff099bbbb01f8484ce78
SHA512b7e454b608c91de9b6681c2fafcbcc3b718f4ba973465db10bd421eeedbf9731eb15b13541cfefbfc70e00d644b0150c737de5e2a3d38af61f23a2aae5e130eb
-
Filesize
5.2MB
MD5094cb53406f164783b39596657888fef
SHA151207d796ec4951b804b2ad55a4a90aea4d9510b
SHA256a4b4e1650b778baf99ce5fd60ecd82255b7c60ef0f55828fada52662c95a0cf3
SHA5122f2665e801a41ef875a3ec3dead734ea13ce44249a6c13d292cc0e86156b4524a481997df05f5b377947b65b3a05485565498b811b22a5a042bef531f028a1a3
-
Filesize
5.2MB
MD563ce5733046440172ceac6c8c80348b9
SHA1f2f43addbdaf00659f0f2f7b65fdd179904b46fd
SHA256df37204186122e1789a511aa7917b64e2d472c5ccdef4750cfb158ebbf067077
SHA51265dbf613bdbff00e8ecd3dc7e3141f488f5d4b3affaf9b8d3f651a48df46d81d1da1a379a9edfe178f0ac1c953d87259263faf2f6ffb9d1e1b2971f13e5d9023
-
Filesize
5.2MB
MD575069a7c3eda7d465ebc1341e43f6614
SHA1e7d014641f8363180da48fe0db3c2c6d6d5acbc6
SHA25670a9e252ce05811a3f896adbe95a4213428de2f6657bd5e323b9ef86d231044b
SHA5128b217aa1a8a4fa1e94468aaf8a9f965d177d4a9e3cb751acd0e06ae27578e87563b452e8a5f83898cc0458e9df35742a2e7902a85f84791bd3757f9958802429
-
Filesize
5.2MB
MD5623b8a8ae7201c8a8843b41dca424622
SHA185f3f44c12fe7fd2c2f1c10f7750f8c98c79a0d5
SHA2560ec78c16053b9ce7a7640268d2976464146cbe037e14d4ad536e8b8e4ead30ef
SHA51246d1ecca24fcd21c9d216e9561386b7ec05894e127689479be51b373e10409542d1ce22941a162f41dfeadf0477b0c9f43992cd4ec3a265de7e2320f45940f15
-
Filesize
5.2MB
MD5149ec2cbbf483450e89ef9fb07b6bee9
SHA1dfecaf72210fb96095a3f18fed53f8af6102e193
SHA2561cbc19efa0c03b6217ca913e25fbeded823134f8444712cbfb561415e14b6b52
SHA512cef8727f2193308bb1db629b521c0c0029978955f0cae4dbff6d2f268ecf37557b714671b595d3b9dba84b6f1afb67e8d3ea965252d904408d0bcf6700f691cc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB