Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
25/08/2024, 11:46
General
- Target 2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
- Size 5.2MB
- Sample240825-nxsl2avalj
- SHA256 b887dfb4d00ea232b7cfdd3c43bbfa584cdaca2994b7973085d3542c9d2926bb
Malware Config
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 45 IoCs
- Executes dropped EXE 21 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HqrePMa.exeC:\Windows\System\HqrePMa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vRxpjmD.exeC:\Windows\System\vRxpjmD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NXtETce.exeC:\Windows\System\NXtETce.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rhNrLeW.exeC:\Windows\System\rhNrLeW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nqyHgUi.exeC:\Windows\System\nqyHgUi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AWDYyjC.exeC:\Windows\System\AWDYyjC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GqXuXhZ.exeC:\Windows\System\GqXuXhZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QVBaQWR.exeC:\Windows\System\QVBaQWR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BxmgyeX.exeC:\Windows\System\BxmgyeX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cuvHnrd.exeC:\Windows\System\cuvHnrd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KhAtDbd.exeC:\Windows\System\KhAtDbd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZUEwSpt.exeC:\Windows\System\ZUEwSpt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HUhhXff.exeC:\Windows\System\HUhhXff.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SjuYTuO.exeC:\Windows\System\SjuYTuO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RYmnUqR.exeC:\Windows\System\RYmnUqR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mDCcFfB.exeC:\Windows\System\mDCcFfB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PyUHdMJ.exeC:\Windows\System\PyUHdMJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hpBxAQL.exeC:\Windows\System\hpBxAQL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ulwzBMl.exeC:\Windows\System\ulwzBMl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kctBFIa.exeC:\Windows\System\kctBFIa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bLUouQE.exeC:\Windows\System\bLUouQE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
AWDYyjC.exe
BxmgyeX.exe
GqXuXhZ.exe
HUhhXff.exe
HqrePMa.exe
KhAtDbd.exe
NXtETce.exe
PyUHdMJ.exe
QVBaQWR.exe
RYmnUqR.exe
SjuYTuO.exe
ZUEwSpt.exe
bLUouQE.exe
cuvHnrd.exe
hpBxAQL.exe
kctBFIa.exe
mDCcFfB.exe
nqyHgUi.exe
rhNrLeW.exe
ulwzBMl.exe
vRxpjmD.exe
memory/1240-132-0x00007FF761680000-0x00007FF7619D1000-memory.dmp
memory/1240-256-0x00007FF761680000-0x00007FF7619D1000-memory.dmp
memory/1428-32-0x00007FF7369C0000-0x00007FF736D11000-memory.dmp
memory/1428-133-0x00007FF7369C0000-0x00007FF736D11000-memory.dmp
memory/1428-223-0x00007FF7369C0000-0x00007FF736D11000-memory.dmp
memory/1448-43-0x00007FF7B15D0000-0x00007FF7B1921000-memory.dmp
memory/1448-139-0x00007FF7B15D0000-0x00007FF7B1921000-memory.dmp
memory/1448-225-0x00007FF7B15D0000-0x00007FF7B1921000-memory.dmp
memory/1884-69-0x00007FF70BC30000-0x00007FF70BF81000-memory.dmp
memory/1884-242-0x00007FF70BC30000-0x00007FF70BF81000-memory.dmp
memory/1908-144-0x00007FF676250000-0x00007FF6765A1000-memory.dmp
memory/1908-55-0x00007FF676250000-0x00007FF6765A1000-memory.dmp
memory/1908-238-0x00007FF676250000-0x00007FF6765A1000-memory.dmp
memory/2092-86-0x00007FF7433E0000-0x00007FF743731000-memory.dmp
memory/2092-23-0x00007FF7433E0000-0x00007FF743731000-memory.dmp
memory/2092-214-0x00007FF7433E0000-0x00007FF743731000-memory.dmp
memory/2256-254-0x00007FF6C2610000-0x00007FF6C2961000-memory.dmp
memory/2256-151-0x00007FF6C2610000-0x00007FF6C2961000-memory.dmp
memory/2256-94-0x00007FF6C2610000-0x00007FF6C2961000-memory.dmp
memory/2768-212-0x00007FF66CD50000-0x00007FF66D0A1000-memory.dmp
memory/2768-85-0x00007FF66CD50000-0x00007FF66D0A1000-memory.dmp
memory/2768-12-0x00007FF66CD50000-0x00007FF66D0A1000-memory.dmp
memory/3208-130-0x00007FF75FBE0000-0x00007FF75FF31000-memory.dmp
memory/3208-263-0x00007FF75FBE0000-0x00007FF75FF31000-memory.dmp
memory/3440-0-0x00007FF741C50000-0x00007FF741FA1000-memory.dmp
memory/3440-134-0x00007FF741C50000-0x00007FF741FA1000-memory.dmp
memory/3440-1-0x000001B36D0D0000-0x000001B36D0E0000-memory.dmp
memory/3440-59-0x00007FF741C50000-0x00007FF741FA1000-memory.dmp
memory/3440-159-0x00007FF741C50000-0x00007FF741FA1000-memory.dmp
memory/3464-266-0x00007FF74C670000-0x00007FF74C9C1000-memory.dmp
memory/3464-129-0x00007FF74C670000-0x00007FF74C9C1000-memory.dmp
memory/3556-103-0x00007FF6F78E0000-0x00007FF6F7C31000-memory.dmp
memory/3556-259-0x00007FF6F78E0000-0x00007FF6F7C31000-memory.dmp
memory/3556-153-0x00007FF6F78E0000-0x00007FF6F7C31000-memory.dmp
memory/3568-131-0x00007FF69DF80000-0x00007FF69E2D1000-memory.dmp
memory/3568-264-0x00007FF69DF80000-0x00007FF69E2D1000-memory.dmp
memory/3692-6-0x00007FF6584C0000-0x00007FF658811000-memory.dmp
memory/3692-210-0x00007FF6584C0000-0x00007FF658811000-memory.dmp
memory/3692-68-0x00007FF6584C0000-0x00007FF658811000-memory.dmp
memory/4016-128-0x00007FF61A4E0000-0x00007FF61A831000-memory.dmp
memory/4016-216-0x00007FF61A4E0000-0x00007FF61A831000-memory.dmp
memory/4016-24-0x00007FF61A4E0000-0x00007FF61A831000-memory.dmp
memory/4068-148-0x00007FF69BCD0000-0x00007FF69C021000-memory.dmp
memory/4068-74-0x00007FF69BCD0000-0x00007FF69C021000-memory.dmp
memory/4068-250-0x00007FF69BCD0000-0x00007FF69C021000-memory.dmp
memory/4084-253-0x00007FF667560000-0x00007FF6678B1000-memory.dmp
memory/4084-98-0x00007FF667560000-0x00007FF6678B1000-memory.dmp
memory/4084-150-0x00007FF667560000-0x00007FF6678B1000-memory.dmp
memory/4224-152-0x00007FF64FB50000-0x00007FF64FEA1000-memory.dmp
memory/4224-127-0x00007FF64FB50000-0x00007FF64FEA1000-memory.dmp
memory/4224-260-0x00007FF64FB50000-0x00007FF64FEA1000-memory.dmp
memory/4480-240-0x00007FF7C02A0000-0x00007FF7C05F1000-memory.dmp
memory/4480-47-0x00007FF7C02A0000-0x00007FF7C05F1000-memory.dmp
memory/4480-141-0x00007FF7C02A0000-0x00007FF7C05F1000-memory.dmp
memory/4512-49-0x00007FF790AB0000-0x00007FF790E01000-memory.dmp
memory/4512-244-0x00007FF790AB0000-0x00007FF790E01000-memory.dmp
memory/4512-154-0x00007FF790AB0000-0x00007FF790E01000-memory.dmp
memory/4564-248-0x00007FF625E30000-0x00007FF626181000-memory.dmp
memory/4564-89-0x00007FF625E30000-0x00007FF626181000-memory.dmp
memory/4928-73-0x00007FF63A970000-0x00007FF63ACC1000-memory.dmp
memory/4928-246-0x00007FF63A970000-0x00007FF63ACC1000-memory.dmp
memory/4928-147-0x00007FF63A970000-0x00007FF63ACC1000-memory.dmp