Analysis
- max time kernel
140s - max time network
150s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
- submitted
25/08/2024, 12:12
General
- Target 2024-08-25_d045adebce54b55b783c2bf616f6ad20_cobalt-strike_cobaltstrike_poet-rat.exe
- Size 5.2MB
- Sample240825-pc8cesvfnm
- SHA256 e6ea8c95a3cafebbd4066c0c901401bae7f9df558ffee9ce3e793e618d59bfd0
Malware Config
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 42 IoCs
- Executes dropped EXE 21 IoCs
- Loads dropped DLL 21 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_d045adebce54b55b783c2bf616f6ad20_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_d045adebce54b55b783c2bf616f6ad20_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HhfcbHk.exeC:\Windows\System\HhfcbHk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pvODDSU.exeC:\Windows\System\pvODDSU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PboYbcN.exeC:\Windows\System\PboYbcN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ugIbYKr.exeC:\Windows\System\ugIbYKr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jRfJJQY.exeC:\Windows\System\jRfJJQY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jfiJOxb.exeC:\Windows\System\jfiJOxb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MpulSPW.exeC:\Windows\System\MpulSPW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fcuMbFl.exeC:\Windows\System\fcuMbFl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rVtHpeM.exeC:\Windows\System\rVtHpeM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BRpGJBk.exeC:\Windows\System\BRpGJBk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XUmAhla.exeC:\Windows\System\XUmAhla.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aQuojhi.exeC:\Windows\System\aQuojhi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\htvMxGm.exeC:\Windows\System\htvMxGm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UyhIFHD.exeC:\Windows\System\UyhIFHD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\himVHmT.exeC:\Windows\System\himVHmT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fBIPSgu.exeC:\Windows\System\fBIPSgu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VDZnFRx.exeC:\Windows\System\VDZnFRx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IulozAv.exeC:\Windows\System\IulozAv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dieuchY.exeC:\Windows\System\dieuchY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XLwdzKY.exeC:\Windows\System\XLwdzKY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\npGFupw.exeC:\Windows\System\npGFupw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
BRpGJBk.exe
HhfcbHk.exe
IulozAv.exe
MpulSPW.exe
PboYbcN.exe
VDZnFRx.exe
XLwdzKY.exe
XUmAhla.exe
aQuojhi.exe
dieuchY.exe
fBIPSgu.exe
fcuMbFl.exe
himVHmT.exe
htvMxGm.exe
jRfJJQY.exe
npGFupw.exe
pvODDSU.exe
rVtHpeM.exe
ugIbYKr.exe
UyhIFHD.exe
jfiJOxb.exe
memory/476-163-0x000000013FD80000-0x00000001400D1000-memory.dmp
memory/660-97-0x000000013F070000-0x000000013F3C1000-memory.dmp
memory/660-249-0x000000013F070000-0x000000013F3C1000-memory.dmp
memory/880-160-0x000000013F240000-0x000000013F591000-memory.dmp
memory/892-158-0x000000013FC90000-0x000000013FFE1000-memory.dmp
memory/1084-165-0x000000013FF40000-0x0000000140291000-memory.dmp
memory/1268-164-0x000000013F680000-0x000000013F9D1000-memory.dmp
memory/1484-56-0x0000000002380000-0x00000000026D1000-memory.dmp
memory/1484-39-0x000000013F360000-0x000000013F6B1000-memory.dmp
memory/1484-1-0x00000000000F0000-0x0000000000100000-memory.dmp
memory/1484-98-0x0000000002380000-0x00000000026D1000-memory.dmp
memory/1484-96-0x000000013F070000-0x000000013F3C1000-memory.dmp
memory/1484-79-0x000000013F840000-0x000000013FB91000-memory.dmp
memory/1484-166-0x000000013FD10000-0x0000000140061000-memory.dmp
memory/1484-64-0x000000013FD10000-0x0000000140061000-memory.dmp
memory/1484-69-0x0000000002380000-0x00000000026D1000-memory.dmp
memory/1484-125-0x0000000002380000-0x00000000026D1000-memory.dmp
memory/1484-144-0x000000013FD10000-0x0000000140061000-memory.dmp
memory/1484-62-0x000000013F3D0000-0x000000013F721000-memory.dmp
memory/1484-143-0x0000000002380000-0x00000000026D1000-memory.dmp
memory/1484-0-0x000000013FD10000-0x0000000140061000-memory.dmp
memory/1484-142-0x000000013F070000-0x000000013F3C1000-memory.dmp
memory/1484-141-0x000000013F840000-0x000000013FB91000-memory.dmp
memory/1484-32-0x000000013F220000-0x000000013F571000-memory.dmp
memory/1484-101-0x0000000002380000-0x00000000026D1000-memory.dmp
memory/1484-100-0x0000000002380000-0x00000000026D1000-memory.dmp
memory/1484-43-0x000000013F180000-0x000000013F4D1000-memory.dmp
memory/1484-42-0x0000000002380000-0x00000000026D1000-memory.dmp
memory/1484-41-0x000000013F860000-0x000000013FBB1000-memory.dmp
memory/1484-38-0x000000013F8D0000-0x000000013FC21000-memory.dmp
memory/1700-226-0x000000013F650000-0x000000013F9A1000-memory.dmp
memory/1700-20-0x000000013F650000-0x000000013F9A1000-memory.dmp
memory/1700-71-0x000000013F650000-0x000000013F9A1000-memory.dmp
memory/1728-99-0x000000013FC30000-0x000000013FF81000-memory.dmp
memory/1728-250-0x000000013FC30000-0x000000013FF81000-memory.dmp
memory/2052-239-0x000000013FB30000-0x000000013FE81000-memory.dmp
memory/2052-57-0x000000013FB30000-0x000000013FE81000-memory.dmp
memory/2092-49-0x000000013F360000-0x000000013F6B1000-memory.dmp
memory/2092-95-0x000000013F360000-0x000000013F6B1000-memory.dmp
memory/2092-240-0x000000013F360000-0x000000013F6B1000-memory.dmp
memory/2256-44-0x000000013FE40000-0x0000000140191000-memory.dmp
memory/2256-234-0x000000013FE40000-0x0000000140191000-memory.dmp
memory/2308-48-0x000000013F8D0000-0x000000013FC21000-memory.dmp
memory/2308-236-0x000000013F8D0000-0x000000013FC21000-memory.dmp
memory/2328-27-0x000000013F860000-0x000000013FBB1000-memory.dmp
memory/2328-230-0x000000013F860000-0x000000013FBB1000-memory.dmp
memory/2356-161-0x000000013F850000-0x000000013FBA1000-memory.dmp
memory/2484-33-0x000000013F220000-0x000000013F571000-memory.dmp
memory/2484-228-0x000000013F220000-0x000000013F571000-memory.dmp
memory/2636-246-0x000000013F840000-0x000000013FB91000-memory.dmp
memory/2636-80-0x000000013F840000-0x000000013FB91000-memory.dmp
memory/2644-162-0x000000013F600000-0x000000013F951000-memory.dmp
memory/2652-126-0x000000013FBF0000-0x000000013FF41000-memory.dmp
memory/2652-259-0x000000013FBF0000-0x000000013FF41000-memory.dmp
memory/2732-232-0x000000013F180000-0x000000013F4D1000-memory.dmp
memory/2732-40-0x000000013F180000-0x000000013F4D1000-memory.dmp
memory/2756-70-0x000000013FA80000-0x000000013FDD1000-memory.dmp
memory/2756-244-0x000000013FA80000-0x000000013FDD1000-memory.dmp
memory/2756-140-0x000000013FA80000-0x000000013FDD1000-memory.dmp
memory/2900-242-0x000000013F3D0000-0x000000013F721000-memory.dmp
memory/2900-139-0x000000013F3D0000-0x000000013F721000-memory.dmp
memory/2900-63-0x000000013F3D0000-0x000000013F721000-memory.dmp