Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
25/08/2024, 12:12
General
- Target 2024-08-25_d045adebce54b55b783c2bf616f6ad20_cobalt-strike_cobaltstrike_poet-rat.exe
- Size 5.2MB
- Sample240825-pc8cesvfnm
- SHA256 e6ea8c95a3cafebbd4066c0c901401bae7f9df558ffee9ce3e793e618d59bfd0
Malware Config
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 45 IoCs
- Executes dropped EXE 21 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_d045adebce54b55b783c2bf616f6ad20_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_d045adebce54b55b783c2bf616f6ad20_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\OCbuMIV.exeC:\Windows\System\OCbuMIV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WNBDHly.exeC:\Windows\System\WNBDHly.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZDziCyT.exeC:\Windows\System\ZDziCyT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DoYwONX.exeC:\Windows\System\DoYwONX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QbZzAXW.exeC:\Windows\System\QbZzAXW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oGrkyEA.exeC:\Windows\System\oGrkyEA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gDpyCmg.exeC:\Windows\System\gDpyCmg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RyRMVRk.exeC:\Windows\System\RyRMVRk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nhctCWQ.exeC:\Windows\System\nhctCWQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hSPXUKp.exeC:\Windows\System\hSPXUKp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XAGqPTQ.exeC:\Windows\System\XAGqPTQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SQmNvpz.exeC:\Windows\System\SQmNvpz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tBjklRK.exeC:\Windows\System\tBjklRK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YQAJRJo.exeC:\Windows\System\YQAJRJo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fmAIFHf.exeC:\Windows\System\fmAIFHf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yEdXprs.exeC:\Windows\System\yEdXprs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CFtFEHQ.exeC:\Windows\System\CFtFEHQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LnnwQpH.exeC:\Windows\System\LnnwQpH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zqeUJSG.exeC:\Windows\System\zqeUJSG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\unLlkCa.exeC:\Windows\System\unLlkCa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KcOrBLl.exeC:\Windows\System\KcOrBLl.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4188,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
CFtFEHQ.exe
DoYwONX.exe
KcOrBLl.exe
LnnwQpH.exe
OCbuMIV.exe
QbZzAXW.exe
RyRMVRk.exe
SQmNvpz.exe
WNBDHly.exe
XAGqPTQ.exe
YQAJRJo.exe
ZDziCyT.exe
fmAIFHf.exe
gDpyCmg.exe
hSPXUKp.exe
nhctCWQ.exe
oGrkyEA.exe
tBjklRK.exe
unLlkCa.exe
yEdXprs.exe
zqeUJSG.exe
memory/400-222-0x00007FF750420000-0x00007FF750771000-memory.dmp
memory/400-101-0x00007FF750420000-0x00007FF750771000-memory.dmp
memory/400-31-0x00007FF750420000-0x00007FF750771000-memory.dmp
memory/568-176-0x00007FF6D3610000-0x00007FF6D3961000-memory.dmp
memory/568-0-0x00007FF6D3610000-0x00007FF6D3961000-memory.dmp
memory/568-55-0x00007FF6D3610000-0x00007FF6D3961000-memory.dmp
memory/568-154-0x00007FF6D3610000-0x00007FF6D3961000-memory.dmp
memory/568-1-0x000001867E6F0000-0x000001867E700000-memory.dmp
memory/944-249-0x00007FF6D8A80000-0x00007FF6D8DD1000-memory.dmp
memory/944-95-0x00007FF6D8A80000-0x00007FF6D8DD1000-memory.dmp
memory/1104-158-0x00007FF76B4A0000-0x00007FF76B7F1000-memory.dmp
memory/1104-110-0x00007FF76B4A0000-0x00007FF76B7F1000-memory.dmp
memory/1104-260-0x00007FF76B4A0000-0x00007FF76B7F1000-memory.dmp
memory/1156-45-0x00007FF632F40000-0x00007FF633291000-memory.dmp
memory/1156-118-0x00007FF632F40000-0x00007FF633291000-memory.dmp
memory/1156-232-0x00007FF632F40000-0x00007FF633291000-memory.dmp
memory/1304-122-0x00007FF6F2B00000-0x00007FF6F2E51000-memory.dmp
memory/1304-46-0x00007FF6F2B00000-0x00007FF6F2E51000-memory.dmp
memory/1304-234-0x00007FF6F2B00000-0x00007FF6F2E51000-memory.dmp
memory/1740-75-0x00007FF78E4F0000-0x00007FF78E841000-memory.dmp
memory/1740-242-0x00007FF78E4F0000-0x00007FF78E841000-memory.dmp
memory/1740-151-0x00007FF78E4F0000-0x00007FF78E841000-memory.dmp
memory/1900-139-0x00007FF717BF0000-0x00007FF717F41000-memory.dmp
memory/1900-163-0x00007FF717BF0000-0x00007FF717F41000-memory.dmp
memory/1900-270-0x00007FF717BF0000-0x00007FF717F41000-memory.dmp
memory/1956-230-0x00007FF786D30000-0x00007FF787081000-memory.dmp
memory/1956-39-0x00007FF786D30000-0x00007FF787081000-memory.dmp
memory/1956-114-0x00007FF786D30000-0x00007FF787081000-memory.dmp
memory/1968-159-0x00007FF73F980000-0x00007FF73FCD1000-memory.dmp
memory/1968-262-0x00007FF73F980000-0x00007FF73FCD1000-memory.dmp
memory/1968-111-0x00007FF73F980000-0x00007FF73FCD1000-memory.dmp
memory/1972-80-0x00007FF78BA80000-0x00007FF78BDD1000-memory.dmp
memory/1972-217-0x00007FF78BA80000-0x00007FF78BDD1000-memory.dmp
memory/1972-22-0x00007FF78BA80000-0x00007FF78BDD1000-memory.dmp
memory/1980-264-0x00007FF6907B0000-0x00007FF690B01000-memory.dmp
memory/1980-121-0x00007FF6907B0000-0x00007FF690B01000-memory.dmp
memory/1980-160-0x00007FF6907B0000-0x00007FF690B01000-memory.dmp
memory/2568-219-0x00007FF617D80000-0x00007FF6180D1000-memory.dmp
memory/2568-24-0x00007FF617D80000-0x00007FF6180D1000-memory.dmp
memory/2568-89-0x00007FF617D80000-0x00007FF6180D1000-memory.dmp
memory/2868-64-0x00007FF7DE1F0000-0x00007FF7DE541000-memory.dmp
memory/2868-16-0x00007FF7DE1F0000-0x00007FF7DE541000-memory.dmp
memory/2868-215-0x00007FF7DE1F0000-0x00007FF7DE541000-memory.dmp
memory/2992-152-0x00007FF64BDA0000-0x00007FF64C0F1000-memory.dmp
memory/2992-251-0x00007FF64BDA0000-0x00007FF64C0F1000-memory.dmp
memory/2992-94-0x00007FF64BDA0000-0x00007FF64C0F1000-memory.dmp
memory/3212-62-0x00007FF7DA840000-0x00007FF7DAB91000-memory.dmp
memory/3212-237-0x00007FF7DA840000-0x00007FF7DAB91000-memory.dmp
memory/3212-138-0x00007FF7DA840000-0x00007FF7DAB91000-memory.dmp
memory/3448-162-0x00007FF601D20000-0x00007FF602071000-memory.dmp
memory/3448-130-0x00007FF601D20000-0x00007FF602071000-memory.dmp
memory/3448-268-0x00007FF601D20000-0x00007FF602071000-memory.dmp
memory/4180-61-0x00007FF610BA0000-0x00007FF610EF1000-memory.dmp
memory/4180-129-0x00007FF610BA0000-0x00007FF610EF1000-memory.dmp
memory/4180-239-0x00007FF610BA0000-0x00007FF610EF1000-memory.dmp
memory/4204-210-0x00007FF632610000-0x00007FF632961000-memory.dmp
memory/4204-63-0x00007FF632610000-0x00007FF632961000-memory.dmp
memory/4204-7-0x00007FF632610000-0x00007FF632961000-memory.dmp
memory/4676-153-0x00007FF654C20000-0x00007FF654F71000-memory.dmp
memory/4676-243-0x00007FF654C20000-0x00007FF654F71000-memory.dmp
memory/4676-65-0x00007FF654C20000-0x00007FF654F71000-memory.dmp
memory/4904-161-0x00007FF7AFE60000-0x00007FF7B01B1000-memory.dmp
memory/4904-119-0x00007FF7AFE60000-0x00007FF7B01B1000-memory.dmp
memory/4904-267-0x00007FF7AFE60000-0x00007FF7B01B1000-memory.dmp
memory/4940-259-0x00007FF66FC80000-0x00007FF66FFD1000-memory.dmp
memory/4940-102-0x00007FF66FC80000-0x00007FF66FFD1000-memory.dmp
memory/4940-157-0x00007FF66FC80000-0x00007FF66FFD1000-memory.dmp