Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
02/11/2024, 19:55
General
- Target 2024-11-02_33c74c08cbc58d9608aeec855a04cbcd_cobalt-strike_cobaltstrike_poet-rat.exe
- Size 5.2MB
- Sample241102-ynec6atele
- SHA256 22d7797f726bcbc4a03010aa7aabd6346b761aa12b2019e7a647ea021ea49293
Malware Config
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Cobaltstrike family
- Xmrig family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 45 IoCs
- Executes dropped EXE 21 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-02_33c74c08cbc58d9608aeec855a04cbcd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-02_33c74c08cbc58d9608aeec855a04cbcd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hLBonKO.exeC:\Windows\System\hLBonKO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VlinjwA.exeC:\Windows\System\VlinjwA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GcBKOrB.exeC:\Windows\System\GcBKOrB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GPnBIHr.exeC:\Windows\System\GPnBIHr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JQVfYZP.exeC:\Windows\System\JQVfYZP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\plHdppD.exeC:\Windows\System\plHdppD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wOfEpkn.exeC:\Windows\System\wOfEpkn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hqfQtoe.exeC:\Windows\System\hqfQtoe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\obAFaUl.exeC:\Windows\System\obAFaUl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wvSFLcP.exeC:\Windows\System\wvSFLcP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\idJotYF.exeC:\Windows\System\idJotYF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ObfSCiC.exeC:\Windows\System\ObfSCiC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JhtbIkv.exeC:\Windows\System\JhtbIkv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CYsDeYs.exeC:\Windows\System\CYsDeYs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ddnnUMI.exeC:\Windows\System\ddnnUMI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DXnmbGf.exeC:\Windows\System\DXnmbGf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TKETTaO.exeC:\Windows\System\TKETTaO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CVuerpl.exeC:\Windows\System\CVuerpl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vXZgooB.exeC:\Windows\System\vXZgooB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CbCtrUH.exeC:\Windows\System\CbCtrUH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rRMQBaQ.exeC:\Windows\System\rRMQBaQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
CVuerpl.exe
CYsDeYs.exe
CbCtrUH.exe
DXnmbGf.exe
GPnBIHr.exe
GcBKOrB.exe
JQVfYZP.exe
JhtbIkv.exe
ObfSCiC.exe
TKETTaO.exe
VlinjwA.exe
ddnnUMI.exe
hLBonKO.exe
hqfQtoe.exe
idJotYF.exe
obAFaUl.exe
plHdppD.exe
rRMQBaQ.exe
vXZgooB.exe
wOfEpkn.exe
wvSFLcP.exe
memory/456-249-0x00007FF7A7DB0000-0x00007FF7A8101000-memory.dmp
memory/456-134-0x00007FF7A7DB0000-0x00007FF7A8101000-memory.dmp
memory/1396-130-0x00007FF73FB30000-0x00007FF73FE81000-memory.dmp
memory/1396-238-0x00007FF73FB30000-0x00007FF73FE81000-memory.dmp
memory/1400-250-0x00007FF713500000-0x00007FF713851000-memory.dmp
memory/1400-135-0x00007FF713500000-0x00007FF713851000-memory.dmp
memory/1568-253-0x00007FF7F2130000-0x00007FF7F2481000-memory.dmp
memory/1568-140-0x00007FF7F2130000-0x00007FF7F2481000-memory.dmp
memory/1836-122-0x00007FF6A7910000-0x00007FF6A7C61000-memory.dmp
memory/1836-229-0x00007FF6A7910000-0x00007FF6A7C61000-memory.dmp
memory/2032-116-0x00007FF6AD170000-0x00007FF6AD4C1000-memory.dmp
memory/2032-38-0x00007FF6AD170000-0x00007FF6AD4C1000-memory.dmp
memory/2032-207-0x00007FF6AD170000-0x00007FF6AD4C1000-memory.dmp
memory/2100-200-0x00007FF650480000-0x00007FF6507D1000-memory.dmp
memory/2100-12-0x00007FF650480000-0x00007FF6507D1000-memory.dmp
memory/2100-114-0x00007FF650480000-0x00007FF6507D1000-memory.dmp
memory/2432-245-0x00007FF6DD590000-0x00007FF6DD8E1000-memory.dmp
memory/2432-131-0x00007FF6DD590000-0x00007FF6DD8E1000-memory.dmp
memory/2840-113-0x00007FF73A6E0000-0x00007FF73AA31000-memory.dmp
memory/2840-198-0x00007FF73A6E0000-0x00007FF73AA31000-memory.dmp
memory/2840-8-0x00007FF73A6E0000-0x00007FF73AA31000-memory.dmp
memory/2868-256-0x00007FF6FFF50000-0x00007FF7002A1000-memory.dmp
memory/2868-137-0x00007FF6FFF50000-0x00007FF7002A1000-memory.dmp
memory/3368-133-0x00007FF69AEE0000-0x00007FF69B231000-memory.dmp
memory/3368-246-0x00007FF69AEE0000-0x00007FF69B231000-memory.dmp
memory/3452-225-0x00007FF637D40000-0x00007FF638091000-memory.dmp
memory/3452-119-0x00007FF637D40000-0x00007FF638091000-memory.dmp
memory/3788-117-0x00007FF6392C0000-0x00007FF639611000-memory.dmp
memory/3788-209-0x00007FF6392C0000-0x00007FF639611000-memory.dmp
memory/3840-128-0x00007FF66D540000-0x00007FF66D891000-memory.dmp
memory/3840-237-0x00007FF66D540000-0x00007FF66D891000-memory.dmp
memory/4200-121-0x00007FF784890000-0x00007FF784BE1000-memory.dmp
memory/4200-226-0x00007FF784890000-0x00007FF784BE1000-memory.dmp
memory/4388-23-0x00007FF686BD0000-0x00007FF686F21000-memory.dmp
memory/4388-115-0x00007FF686BD0000-0x00007FF686F21000-memory.dmp
memory/4388-205-0x00007FF686BD0000-0x00007FF686F21000-memory.dmp
memory/4524-232-0x00007FF746950000-0x00007FF746CA1000-memory.dmp
memory/4524-126-0x00007FF746950000-0x00007FF746CA1000-memory.dmp
memory/4584-111-0x00007FF63AF20000-0x00007FF63B271000-memory.dmp
memory/4584-221-0x00007FF63AF20000-0x00007FF63B271000-memory.dmp
memory/4644-138-0x00007FF745E20000-0x00007FF746171000-memory.dmp
memory/4644-255-0x00007FF745E20000-0x00007FF746171000-memory.dmp
memory/4656-0-0x00007FF6471D0000-0x00007FF647521000-memory.dmp
memory/4656-112-0x00007FF6471D0000-0x00007FF647521000-memory.dmp
memory/4656-148-0x00007FF6471D0000-0x00007FF647521000-memory.dmp
memory/4656-149-0x00007FF6471D0000-0x00007FF647521000-memory.dmp
memory/4656-1-0x000002894A4B0000-0x000002894A4C0000-memory.dmp
memory/4788-234-0x00007FF707EC0000-0x00007FF708211000-memory.dmp
memory/4788-127-0x00007FF707EC0000-0x00007FF708211000-memory.dmp
memory/5116-230-0x00007FF79F1B0000-0x00007FF79F501000-memory.dmp
memory/5116-124-0x00007FF79F1B0000-0x00007FF79F501000-memory.dmp