Analysis
- max time kernel
141s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
27/11/2024, 04:12
General
- Target 2024-11-27_9e0f44f9fbedcb8050c0ae5706a870fc_cobalt-strike_cobaltstrike_poet-rat.exe
- Size 5.2MB
- Sample241127-essxkatjgr
- SHA256 084ea53e2d6bec3e979a62e178a593434fd232c48f8a8a3f643a58af693a2a22
Malware Config
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Cobaltstrike family
- Xmrig family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 45 IoCs
- Executes dropped EXE 21 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-27_9e0f44f9fbedcb8050c0ae5706a870fc_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-27_9e0f44f9fbedcb8050c0ae5706a870fc_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XDzMPGO.exeC:\Windows\System\XDzMPGO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LMfltId.exeC:\Windows\System\LMfltId.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HFughXR.exeC:\Windows\System\HFughXR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rQciwHn.exeC:\Windows\System\rQciwHn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rrVKjlE.exeC:\Windows\System\rrVKjlE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wCTiSdW.exeC:\Windows\System\wCTiSdW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jQhpjyV.exeC:\Windows\System\jQhpjyV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jzMwFYy.exeC:\Windows\System\jzMwFYy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YxcIsZa.exeC:\Windows\System\YxcIsZa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aFyllon.exeC:\Windows\System\aFyllon.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrkRVSM.exeC:\Windows\System\mrkRVSM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rmSIVcy.exeC:\Windows\System\rmSIVcy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PMRVUUo.exeC:\Windows\System\PMRVUUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HDAZXYR.exeC:\Windows\System\HDAZXYR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zdDXaKZ.exeC:\Windows\System\zdDXaKZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oMbwSon.exeC:\Windows\System\oMbwSon.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FykqefL.exeC:\Windows\System\FykqefL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SjIFnVe.exeC:\Windows\System\SjIFnVe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PNVhAwN.exeC:\Windows\System\PNVhAwN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VLiycpR.exeC:\Windows\System\VLiycpR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\weUzbLH.exeC:\Windows\System\weUzbLH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
FykqefL.exe
HDAZXYR.exe
HFughXR.exe
LMfltId.exe
PMRVUUo.exe
PNVhAwN.exe
SjIFnVe.exe
VLiycpR.exe
XDzMPGO.exe
YxcIsZa.exe
aFyllon.exe
jQhpjyV.exe
jzMwFYy.exe
mrkRVSM.exe
oMbwSon.exe
rQciwHn.exe
rmSIVcy.exe
rrVKjlE.exe
wCTiSdW.exe
weUzbLH.exe
zdDXaKZ.exe
memory/440-148-0x00007FF668170000-0x00007FF6684C1000-memory.dmp
memory/440-246-0x00007FF668170000-0x00007FF6684C1000-memory.dmp
memory/440-74-0x00007FF668170000-0x00007FF6684C1000-memory.dmp
memory/544-129-0x00007FF653BD0000-0x00007FF653F21000-memory.dmp
memory/544-228-0x00007FF653BD0000-0x00007FF653F21000-memory.dmp
memory/544-23-0x00007FF653BD0000-0x00007FF653F21000-memory.dmp
memory/672-95-0x00007FF77C3B0000-0x00007FF77C701000-memory.dmp
memory/672-253-0x00007FF77C3B0000-0x00007FF77C701000-memory.dmp
memory/672-154-0x00007FF77C3B0000-0x00007FF77C701000-memory.dmp
memory/1048-96-0x00007FF637410000-0x00007FF637761000-memory.dmp
memory/1048-241-0x00007FF637410000-0x00007FF637761000-memory.dmp
memory/1168-238-0x00007FF6E6750000-0x00007FF6E6AA1000-memory.dmp
memory/1168-135-0x00007FF6E6750000-0x00007FF6E6AA1000-memory.dmp
memory/1168-42-0x00007FF6E6750000-0x00007FF6E6AA1000-memory.dmp
memory/1432-232-0x00007FF7ECAB0000-0x00007FF7ECE01000-memory.dmp
memory/1432-39-0x00007FF7ECAB0000-0x00007FF7ECE01000-memory.dmp
memory/1432-134-0x00007FF7ECAB0000-0x00007FF7ECE01000-memory.dmp
memory/1892-230-0x00007FF7F3E40000-0x00007FF7F4191000-memory.dmp
memory/1892-132-0x00007FF7F3E40000-0x00007FF7F4191000-memory.dmp
memory/1892-33-0x00007FF7F3E40000-0x00007FF7F4191000-memory.dmp
memory/2368-264-0x00007FF67E240000-0x00007FF67E591000-memory.dmp
memory/2368-128-0x00007FF67E240000-0x00007FF67E591000-memory.dmp
memory/2496-62-0x00007FF66B360000-0x00007FF66B6B1000-memory.dmp
memory/2496-143-0x00007FF66B360000-0x00007FF66B6B1000-memory.dmp
memory/2496-237-0x00007FF66B360000-0x00007FF66B6B1000-memory.dmp
memory/2544-113-0x00007FF661F60000-0x00007FF6622B1000-memory.dmp
memory/2544-262-0x00007FF661F60000-0x00007FF6622B1000-memory.dmp
memory/2544-156-0x00007FF661F60000-0x00007FF6622B1000-memory.dmp
memory/2740-150-0x00007FF6F8C90000-0x00007FF6F8FE1000-memory.dmp
memory/2740-250-0x00007FF6F8C90000-0x00007FF6F8FE1000-memory.dmp
memory/2740-90-0x00007FF6F8C90000-0x00007FF6F8FE1000-memory.dmp
memory/2952-131-0x00007FF64DE60000-0x00007FF64E1B1000-memory.dmp
memory/2952-268-0x00007FF64DE60000-0x00007FF64E1B1000-memory.dmp
memory/3220-98-0x00007FF6F9670000-0x00007FF6F99C1000-memory.dmp
memory/3220-254-0x00007FF6F9670000-0x00007FF6F99C1000-memory.dmp
memory/3288-119-0x00007FF7B6B30000-0x00007FF7B6E81000-memory.dmp
memory/3288-212-0x00007FF7B6B30000-0x00007FF7B6E81000-memory.dmp
memory/3288-14-0x00007FF7B6B30000-0x00007FF7B6E81000-memory.dmp
memory/3356-45-0x00007FF72E400000-0x00007FF72E751000-memory.dmp
memory/3356-147-0x00007FF72E400000-0x00007FF72E751000-memory.dmp
memory/3356-234-0x00007FF72E400000-0x00007FF72E751000-memory.dmp
memory/3436-115-0x00007FF6351C0000-0x00007FF635511000-memory.dmp
memory/3436-8-0x00007FF6351C0000-0x00007FF635511000-memory.dmp
memory/3436-210-0x00007FF6351C0000-0x00007FF635511000-memory.dmp
memory/3660-248-0x00007FF747510000-0x00007FF747861000-memory.dmp
memory/3660-97-0x00007FF747510000-0x00007FF747861000-memory.dmp
memory/3800-244-0x00007FF740BB0000-0x00007FF740F01000-memory.dmp
memory/3800-80-0x00007FF740BB0000-0x00007FF740F01000-memory.dmp
memory/3800-146-0x00007FF740BB0000-0x00007FF740F01000-memory.dmp
memory/4028-133-0x00007FF7AEE20000-0x00007FF7AF171000-memory.dmp
memory/4028-1-0x000001B278010000-0x000001B278020000-memory.dmp
memory/4028-0-0x00007FF7AEE20000-0x00007FF7AF171000-memory.dmp
memory/4028-161-0x00007FF7AEE20000-0x00007FF7AF171000-memory.dmp
memory/4028-108-0x00007FF7AEE20000-0x00007FF7AF171000-memory.dmp
memory/4784-242-0x00007FF705570000-0x00007FF7058C1000-memory.dmp
memory/4784-51-0x00007FF705570000-0x00007FF7058C1000-memory.dmp
memory/4784-142-0x00007FF705570000-0x00007FF7058C1000-memory.dmp
memory/4856-260-0x00007FF6325A0000-0x00007FF6328F1000-memory.dmp
memory/4856-103-0x00007FF6325A0000-0x00007FF6328F1000-memory.dmp
memory/4856-155-0x00007FF6325A0000-0x00007FF6328F1000-memory.dmp
memory/4896-130-0x00007FF6AE030000-0x00007FF6AE381000-memory.dmp
memory/4896-267-0x00007FF6AE030000-0x00007FF6AE381000-memory.dmp