Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
25/07/2024, 14:30
General
- Target 2024-07-25_c6d1eb5adf7b467d5374c5449a8fcc1e_cobalt-strike_cobaltstrike_poet-rat.exe
- Size 5.2MB
- Sample240725-rt5c7swgnf
- SHA256 f59604c97274a841e03acc35a13aa434bd91424ac5e364c970a9811ca1de6e41
Malware Config
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 45 IoCs
- Executes dropped EXE 21 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-25_c6d1eb5adf7b467d5374c5449a8fcc1e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-25_c6d1eb5adf7b467d5374c5449a8fcc1e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VZbVsIw.exeC:\Windows\System\VZbVsIw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bUunsMj.exeC:\Windows\System\bUunsMj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OfNundj.exeC:\Windows\System\OfNundj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KrsGtRM.exeC:\Windows\System\KrsGtRM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uhucuqc.exeC:\Windows\System\uhucuqc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iVFdAeG.exeC:\Windows\System\iVFdAeG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dapYpZP.exeC:\Windows\System\dapYpZP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UqwCtWl.exeC:\Windows\System\UqwCtWl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eLaTxaC.exeC:\Windows\System\eLaTxaC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hvPqdTU.exeC:\Windows\System\hvPqdTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\demQJHS.exeC:\Windows\System\demQJHS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PxRraET.exeC:\Windows\System\PxRraET.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zPimMLb.exeC:\Windows\System\zPimMLb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IAZwfCC.exeC:\Windows\System\IAZwfCC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JDxsELx.exeC:\Windows\System\JDxsELx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrdKNlc.exeC:\Windows\System\OrdKNlc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XdQVoEG.exeC:\Windows\System\XdQVoEG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mIVsqLx.exeC:\Windows\System\mIVsqLx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mHfjkrd.exeC:\Windows\System\mHfjkrd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PyXxZLr.exeC:\Windows\System\PyXxZLr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IaeMywc.exeC:\Windows\System\IaeMywc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
IAZwfCC.exe
IaeMywc.exe
JDxsELx.exe
KrsGtRM.exe
OfNundj.exe
OrdKNlc.exe
PxRraET.exe
PyXxZLr.exe
UqwCtWl.exe
VZbVsIw.exe
XdQVoEG.exe
bUunsMj.exe
dapYpZP.exe
demQJHS.exe
eLaTxaC.exe
hvPqdTU.exe
iVFdAeG.exe
mHfjkrd.exe
mIVsqLx.exe
uhucuqc.exe
zPimMLb.exe
memory/60-81-0x00007FF6EC570000-0x00007FF6EC8C1000-memory.dmp
memory/60-14-0x00007FF6EC570000-0x00007FF6EC8C1000-memory.dmp
memory/60-205-0x00007FF6EC570000-0x00007FF6EC8C1000-memory.dmp
memory/960-40-0x00007FF719B00000-0x00007FF719E51000-memory.dmp
memory/960-106-0x00007FF719B00000-0x00007FF719E51000-memory.dmp
memory/960-215-0x00007FF719B00000-0x00007FF719E51000-memory.dmp
memory/1052-127-0x00007FF738720000-0x00007FF738A71000-memory.dmp
memory/1052-224-0x00007FF738720000-0x00007FF738A71000-memory.dmp
memory/1052-52-0x00007FF738720000-0x00007FF738A71000-memory.dmp
memory/1120-119-0x00007FF6FF740000-0x00007FF6FFA91000-memory.dmp
memory/1120-243-0x00007FF6FF740000-0x00007FF6FFA91000-memory.dmp
memory/1120-154-0x00007FF6FF740000-0x00007FF6FFA91000-memory.dmp
memory/1236-230-0x00007FF648A60000-0x00007FF648DB1000-memory.dmp
memory/1236-84-0x00007FF648A60000-0x00007FF648DB1000-memory.dmp
memory/1412-151-0x00007FF6B4A40000-0x00007FF6B4D91000-memory.dmp
memory/1412-238-0x00007FF6B4A40000-0x00007FF6B4D91000-memory.dmp
memory/1412-95-0x00007FF6B4A40000-0x00007FF6B4D91000-memory.dmp
memory/1420-133-0x00007FF724480000-0x00007FF7247D1000-memory.dmp
memory/1420-157-0x00007FF724480000-0x00007FF7247D1000-memory.dmp
memory/1420-247-0x00007FF724480000-0x00007FF7247D1000-memory.dmp
memory/1672-203-0x00007FF761320000-0x00007FF761671000-memory.dmp
memory/1672-8-0x00007FF761320000-0x00007FF761671000-memory.dmp
memory/1988-153-0x00007FF6F1B20000-0x00007FF6F1E71000-memory.dmp
memory/1988-241-0x00007FF6F1B20000-0x00007FF6F1E71000-memory.dmp
memory/1988-113-0x00007FF6F1B20000-0x00007FF6F1E71000-memory.dmp
memory/2176-0-0x00007FF75A860000-0x00007FF75ABB1000-memory.dmp
memory/2176-1-0x000001EC67060000-0x000001EC67070000-memory.dmp
memory/2176-69-0x00007FF75A860000-0x00007FF75ABB1000-memory.dmp
memory/2176-158-0x00007FF75A860000-0x00007FF75ABB1000-memory.dmp
memory/2176-135-0x00007FF75A860000-0x00007FF75ABB1000-memory.dmp
memory/2356-22-0x00007FF650030000-0x00007FF650381000-memory.dmp
memory/2356-207-0x00007FF650030000-0x00007FF650381000-memory.dmp
memory/2704-222-0x00007FF7ABE00000-0x00007FF7AC151000-memory.dmp
memory/2704-51-0x00007FF7ABE00000-0x00007FF7AC151000-memory.dmp
memory/2704-109-0x00007FF7ABE00000-0x00007FF7AC151000-memory.dmp
memory/2736-147-0x00007FF7E7AB0000-0x00007FF7E7E01000-memory.dmp
memory/2736-226-0x00007FF7E7AB0000-0x00007FF7E7E01000-memory.dmp
memory/2736-60-0x00007FF7E7AB0000-0x00007FF7E7E01000-memory.dmp
memory/2792-76-0x00007FF64A560000-0x00007FF64A8B1000-memory.dmp
memory/2792-228-0x00007FF64A560000-0x00007FF64A8B1000-memory.dmp
memory/3252-49-0x00007FF72AB80000-0x00007FF72AED1000-memory.dmp
memory/3252-211-0x00007FF72AB80000-0x00007FF72AED1000-memory.dmp
memory/3592-245-0x00007FF66A160000-0x00007FF66A4B1000-memory.dmp
memory/3592-155-0x00007FF66A160000-0x00007FF66A4B1000-memory.dmp
memory/3592-120-0x00007FF66A160000-0x00007FF66A4B1000-memory.dmp
memory/4164-129-0x00007FF7EDCE0000-0x00007FF7EE031000-memory.dmp
memory/4164-249-0x00007FF7EDCE0000-0x00007FF7EE031000-memory.dmp
memory/4164-156-0x00007FF7EDCE0000-0x00007FF7EE031000-memory.dmp
memory/4204-209-0x00007FF7F4670000-0x00007FF7F49C1000-memory.dmp
memory/4204-94-0x00007FF7F4670000-0x00007FF7F49C1000-memory.dmp
memory/4204-31-0x00007FF7F4670000-0x00007FF7F49C1000-memory.dmp
memory/4628-232-0x00007FF648690000-0x00007FF6489E1000-memory.dmp
memory/4628-85-0x00007FF648690000-0x00007FF6489E1000-memory.dmp
memory/4848-91-0x00007FF639210000-0x00007FF639561000-memory.dmp
memory/4848-234-0x00007FF639210000-0x00007FF639561000-memory.dmp
memory/5016-152-0x00007FF6A5D30000-0x00007FF6A6081000-memory.dmp
memory/5016-236-0x00007FF6A5D30000-0x00007FF6A6081000-memory.dmp
memory/5016-99-0x00007FF6A5D30000-0x00007FF6A6081000-memory.dmp
memory/5104-35-0x00007FF6F23C0000-0x00007FF6F2711000-memory.dmp
memory/5104-213-0x00007FF6F23C0000-0x00007FF6F2711000-memory.dmp
memory/5104-98-0x00007FF6F23C0000-0x00007FF6F2711000-memory.dmp