Analysis
- max time kernel
144s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
27/10/2024, 04:16
General
- Target 2024-10-27_b3174365d3cd6400cc26c359ff162d45_cobalt-strike_cobaltstrike_poet-rat.exe
- Size 5.2MB
- Sample241027-ev9m4atdmb
- SHA256 1a8064cc79114d28d2801e572174b11a3840940c90c80a751f6a4a48ace2ae71
Malware Config
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Cobaltstrike family
- Xmrig family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 45 IoCs
- Executes dropped EXE 21 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-27_b3174365d3cd6400cc26c359ff162d45_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-27_b3174365d3cd6400cc26c359ff162d45_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IsMFzvI.exeC:\Windows\System\IsMFzvI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nCntXDE.exeC:\Windows\System\nCntXDE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zUagidr.exeC:\Windows\System\zUagidr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zhpEQMJ.exeC:\Windows\System\zhpEQMJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MeajEcg.exeC:\Windows\System\MeajEcg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nzjZItd.exeC:\Windows\System\nzjZItd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QAqFXfa.exeC:\Windows\System\QAqFXfa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HwAgBbA.exeC:\Windows\System\HwAgBbA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WiEbWyv.exeC:\Windows\System\WiEbWyv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZMpHsxl.exeC:\Windows\System\ZMpHsxl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oyJQNvc.exeC:\Windows\System\oyJQNvc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rniiYAm.exeC:\Windows\System\rniiYAm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aaaGjEk.exeC:\Windows\System\aaaGjEk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hrkosIb.exeC:\Windows\System\hrkosIb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rHykylg.exeC:\Windows\System\rHykylg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dMaTuPo.exeC:\Windows\System\dMaTuPo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\doXGefA.exeC:\Windows\System\doXGefA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ACvWtcI.exeC:\Windows\System\ACvWtcI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tKlJECW.exeC:\Windows\System\tKlJECW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GxdiEvl.exeC:\Windows\System\GxdiEvl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dAIUdSD.exeC:\Windows\System\dAIUdSD.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ACvWtcI.exe
GxdiEvl.exe
HwAgBbA.exe
IsMFzvI.exe
MeajEcg.exe
QAqFXfa.exe
WiEbWyv.exe
ZMpHsxl.exe
aaaGjEk.exe
dAIUdSD.exe
dMaTuPo.exe
doXGefA.exe
hrkosIb.exe
nCntXDE.exe
nzjZItd.exe
oyJQNvc.exe
rHykylg.exe
rniiYAm.exe
tKlJECW.exe
zUagidr.exe
zhpEQMJ.exe
memory/216-125-0x00007FF65EF60000-0x00007FF65F2B1000-memory.dmp
memory/216-220-0x00007FF65EF60000-0x00007FF65F2B1000-memory.dmp
memory/216-13-0x00007FF65EF60000-0x00007FF65F2B1000-memory.dmp
memory/396-255-0x00007FF602FC0000-0x00007FF603311000-memory.dmp
memory/396-117-0x00007FF602FC0000-0x00007FF603311000-memory.dmp
memory/444-124-0x00007FF7772A0000-0x00007FF7775F1000-memory.dmp
memory/444-156-0x00007FF7772A0000-0x00007FF7775F1000-memory.dmp
memory/444-266-0x00007FF7772A0000-0x00007FF7775F1000-memory.dmp
memory/1308-106-0x00007FF64E2E0000-0x00007FF64E631000-memory.dmp
memory/1308-261-0x00007FF64E2E0000-0x00007FF64E631000-memory.dmp
memory/1308-155-0x00007FF64E2E0000-0x00007FF64E631000-memory.dmp
memory/1556-102-0x00007FF736540000-0x00007FF736891000-memory.dmp
memory/1556-153-0x00007FF736540000-0x00007FF736891000-memory.dmp
memory/1556-257-0x00007FF736540000-0x00007FF736891000-memory.dmp
memory/1640-234-0x00007FF792BB0000-0x00007FF792F01000-memory.dmp
memory/1640-144-0x00007FF792BB0000-0x00007FF792F01000-memory.dmp
memory/1640-52-0x00007FF792BB0000-0x00007FF792F01000-memory.dmp
memory/1888-227-0x00007FF74BDD0000-0x00007FF74C121000-memory.dmp
memory/1888-72-0x00007FF74BDD0000-0x00007FF74C121000-memory.dmp
memory/2316-84-0x00007FF7B13A0000-0x00007FF7B16F1000-memory.dmp
memory/2316-251-0x00007FF7B13A0000-0x00007FF7B16F1000-memory.dmp
memory/2316-150-0x00007FF7B13A0000-0x00007FF7B16F1000-memory.dmp
memory/2492-76-0x00007FF6BC580000-0x00007FF6BC8D1000-memory.dmp
memory/2492-239-0x00007FF6BC580000-0x00007FF6BC8D1000-memory.dmp
memory/2644-81-0x00007FF71F000000-0x00007FF71F351000-memory.dmp
memory/2644-242-0x00007FF71F000000-0x00007FF71F351000-memory.dmp
memory/3068-53-0x00007FF7EEB20000-0x00007FF7EEE71000-memory.dmp
memory/3068-141-0x00007FF7EEB20000-0x00007FF7EEE71000-memory.dmp
memory/3068-233-0x00007FF7EEB20000-0x00007FF7EEE71000-memory.dmp
memory/3132-146-0x00007FF7DF8C0000-0x00007FF7DFC11000-memory.dmp
memory/3132-237-0x00007FF7DF8C0000-0x00007FF7DFC11000-memory.dmp
memory/3132-63-0x00007FF7DF8C0000-0x00007FF7DFC11000-memory.dmp
memory/3600-218-0x00007FF7A3EF0000-0x00007FF7A4241000-memory.dmp
memory/3600-6-0x00007FF7A3EF0000-0x00007FF7A4241000-memory.dmp
memory/3600-122-0x00007FF7A3EF0000-0x00007FF7A4241000-memory.dmp
memory/3640-44-0x00007FF601F40000-0x00007FF602291000-memory.dmp
memory/3640-143-0x00007FF601F40000-0x00007FF602291000-memory.dmp
memory/3640-228-0x00007FF601F40000-0x00007FF602291000-memory.dmp
memory/3740-131-0x00007FF78C1A0000-0x00007FF78C4F1000-memory.dmp
memory/3740-19-0x00007FF78C1A0000-0x00007FF78C4F1000-memory.dmp
memory/3740-222-0x00007FF78C1A0000-0x00007FF78C4F1000-memory.dmp
memory/3920-263-0x00007FF673F40000-0x00007FF674291000-memory.dmp
memory/3920-127-0x00007FF673F40000-0x00007FF674291000-memory.dmp
memory/3920-157-0x00007FF673F40000-0x00007FF674291000-memory.dmp
memory/4088-133-0x00007FF60DC40000-0x00007FF60DF91000-memory.dmp
memory/4088-0-0x00007FF60DC40000-0x00007FF60DF91000-memory.dmp
memory/4088-116-0x00007FF60DC40000-0x00007FF60DF91000-memory.dmp
memory/4088-158-0x00007FF60DC40000-0x00007FF60DF91000-memory.dmp
memory/4088-1-0x0000020F24FF0000-0x0000020F25000000-memory.dmp
memory/4252-259-0x00007FF67ABE0000-0x00007FF67AF31000-memory.dmp
memory/4252-120-0x00007FF67ABE0000-0x00007FF67AF31000-memory.dmp
memory/4272-224-0x00007FF6D88E0000-0x00007FF6D8C31000-memory.dmp
memory/4272-31-0x00007FF6D88E0000-0x00007FF6D8C31000-memory.dmp
memory/4272-132-0x00007FF6D88E0000-0x00007FF6D8C31000-memory.dmp
memory/4876-253-0x00007FF6FCBA0000-0x00007FF6FCEF1000-memory.dmp
memory/4876-94-0x00007FF6FCBA0000-0x00007FF6FCEF1000-memory.dmp
memory/4876-151-0x00007FF6FCBA0000-0x00007FF6FCEF1000-memory.dmp
memory/5024-241-0x00007FF69EF30000-0x00007FF69F281000-memory.dmp
memory/5024-83-0x00007FF69EF30000-0x00007FF69F281000-memory.dmp
memory/5040-75-0x00007FF6E0860000-0x00007FF6E0BB1000-memory.dmp
memory/5040-231-0x00007FF6E0860000-0x00007FF6E0BB1000-memory.dmp