Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 11:12
Behavioral task
behavioral1
Sample
202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe
Resource
win7-20240704-en
General
-
Target
202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe
-
Size
5.2MB
-
MD5
2f0d6cef399a874555144a83a5a846b4
-
SHA1
839e82afc307b14454287bb9d6711a88a335abdb
-
SHA256
05e88cf91ef01b2cc9ea30084816e34d33081319188faab8bf8ac09ee00a697e
-
SHA512
3576cbfa84c4fcb8172bbc2810397fcc6911967448afd13e661ceba226b7263d3701c0fc59fdb10638ccfd05e18a68b28a77fd0ffbc08834d7a4fa82ae8151ec
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUO
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x0007000000012117-6.dat cobalt_reflective_dll behavioral1/files/0x0008000000015d22-14.dat cobalt_reflective_dll behavioral1/files/0x0008000000015d10-8.dat cobalt_reflective_dll behavioral1/files/0x0008000000015d39-16.dat cobalt_reflective_dll behavioral1/files/0x0007000000015d71-23.dat cobalt_reflective_dll behavioral1/files/0x0007000000015d79-26.dat cobalt_reflective_dll behavioral1/files/0x0007000000015d81-31.dat cobalt_reflective_dll behavioral1/files/0x0009000000015f19-35.dat cobalt_reflective_dll behavioral1/files/0x0007000000016ccd-38.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d20-46.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d30-50.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d49-62.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d89-82.dat cobalt_reflective_dll behavioral1/files/0x0006000000016dde-86.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d6d-78.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d66-74.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d62-70.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d5d-66.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d41-58.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d39-54.dat cobalt_reflective_dll behavioral1/files/0x0006000000016ceb-42.dat cobalt_reflective_dll -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
XMRig Miner payload 43 IoCs
resource yara_rule behavioral1/memory/1904-111-0x000000013FC90000-0x000000013FFE1000-memory.dmp xmrig behavioral1/memory/764-109-0x000000013FC90000-0x000000013FFE1000-memory.dmp xmrig behavioral1/memory/2308-108-0x000000013FFC0000-0x0000000140311000-memory.dmp xmrig behavioral1/memory/1896-112-0x000000013FEE0000-0x0000000140231000-memory.dmp xmrig behavioral1/memory/948-114-0x000000013F550000-0x000000013F8A1000-memory.dmp xmrig behavioral1/memory/2824-115-0x000000013FB70000-0x000000013FEC1000-memory.dmp xmrig behavioral1/memory/2896-117-0x000000013F600000-0x000000013F951000-memory.dmp xmrig behavioral1/memory/2648-127-0x000000013F4A0000-0x000000013F7F1000-memory.dmp xmrig behavioral1/memory/2144-126-0x000000013F4A0000-0x000000013F7F1000-memory.dmp xmrig behavioral1/memory/444-125-0x000000013F540000-0x000000013F891000-memory.dmp xmrig behavioral1/memory/2144-124-0x000000013F540000-0x000000013F891000-memory.dmp xmrig behavioral1/memory/3068-123-0x000000013F230000-0x000000013F581000-memory.dmp xmrig behavioral1/memory/2144-122-0x000000013F230000-0x000000013F581000-memory.dmp xmrig behavioral1/memory/1912-119-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2144-118-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2640-121-0x000000013F1F0000-0x000000013F541000-memory.dmp xmrig behavioral1/memory/2144-129-0x000000013F870000-0x000000013FBC1000-memory.dmp xmrig behavioral1/memory/2136-130-0x000000013F300000-0x000000013F651000-memory.dmp xmrig behavioral1/memory/2736-128-0x000000013FD70000-0x00000001400C1000-memory.dmp xmrig behavioral1/memory/2144-131-0x000000013FE00000-0x0000000140151000-memory.dmp xmrig behavioral1/memory/2628-151-0x000000013F6D0000-0x000000013FA21000-memory.dmp xmrig behavioral1/memory/2496-150-0x000000013FA50000-0x000000013FDA1000-memory.dmp xmrig behavioral1/memory/2728-149-0x000000013FD90000-0x00000001400E1000-memory.dmp xmrig behavioral1/memory/2644-148-0x000000013FF20000-0x0000000140271000-memory.dmp xmrig behavioral1/memory/700-147-0x000000013F760000-0x000000013FAB1000-memory.dmp xmrig behavioral1/memory/2588-146-0x000000013F870000-0x000000013FBC1000-memory.dmp xmrig behavioral1/memory/2456-152-0x000000013F660000-0x000000013F9B1000-memory.dmp xmrig behavioral1/memory/2144-153-0x000000013FE00000-0x0000000140151000-memory.dmp xmrig behavioral1/memory/2144-154-0x000000013FE00000-0x0000000140151000-memory.dmp xmrig behavioral1/memory/2136-221-0x000000013F300000-0x000000013F651000-memory.dmp xmrig behavioral1/memory/2308-223-0x000000013FFC0000-0x0000000140311000-memory.dmp xmrig behavioral1/memory/1896-226-0x000000013FEE0000-0x0000000140231000-memory.dmp xmrig behavioral1/memory/2824-227-0x000000013FB70000-0x000000013FEC1000-memory.dmp xmrig behavioral1/memory/3068-231-0x000000013F230000-0x000000013F581000-memory.dmp xmrig behavioral1/memory/1912-229-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2648-234-0x000000013F4A0000-0x000000013F7F1000-memory.dmp xmrig behavioral1/memory/1904-241-0x000000013FC90000-0x000000013FFE1000-memory.dmp xmrig behavioral1/memory/948-245-0x000000013F550000-0x000000013F8A1000-memory.dmp xmrig behavioral1/memory/2736-250-0x000000013FD70000-0x00000001400C1000-memory.dmp xmrig behavioral1/memory/444-248-0x000000013F540000-0x000000013F891000-memory.dmp xmrig behavioral1/memory/2896-244-0x000000013F600000-0x000000013F951000-memory.dmp xmrig behavioral1/memory/764-239-0x000000013FC90000-0x000000013FFE1000-memory.dmp xmrig behavioral1/memory/2640-254-0x000000013F1F0000-0x000000013F541000-memory.dmp xmrig -
Executes dropped EXE 21 IoCs
pid Process 2136 qRcvlOh.exe 2308 faCKfNB.exe 764 ZqZtNdu.exe 1904 wfJuoOT.exe 1896 EZELVzH.exe 948 eYcJNDU.exe 2824 fVHQrAY.exe 2896 mwHAGvS.exe 1912 NBrOoXI.exe 2640 VUdApfO.exe 3068 RJdBcfH.exe 444 jUsrRFV.exe 2648 RrfpSWw.exe 2736 agHBeII.exe 2588 dFHSxYZ.exe 700 LcconfZ.exe 2644 rhmDXbn.exe 2728 LFOLdsZ.exe 2496 vEbdQgE.exe 2628 pjhjlFT.exe 2456 EkzbKnC.exe -
Loads dropped DLL 21 IoCs
pid Process 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe -
resource yara_rule behavioral1/memory/2144-0-0x000000013FE00000-0x0000000140151000-memory.dmp upx behavioral1/files/0x0007000000012117-6.dat upx behavioral1/files/0x0008000000015d22-14.dat upx behavioral1/files/0x0008000000015d10-8.dat upx behavioral1/files/0x0008000000015d39-16.dat upx behavioral1/files/0x0007000000015d71-23.dat upx behavioral1/files/0x0007000000015d79-26.dat upx behavioral1/files/0x0007000000015d81-31.dat upx behavioral1/files/0x0009000000015f19-35.dat upx behavioral1/files/0x0007000000016ccd-38.dat upx behavioral1/files/0x0006000000016d20-46.dat upx behavioral1/files/0x0006000000016d30-50.dat upx behavioral1/files/0x0006000000016d49-62.dat upx behavioral1/files/0x0006000000016d89-82.dat upx behavioral1/files/0x0006000000016dde-86.dat upx behavioral1/files/0x0006000000016d6d-78.dat upx behavioral1/files/0x0006000000016d66-74.dat upx behavioral1/files/0x0006000000016d62-70.dat upx behavioral1/files/0x0006000000016d5d-66.dat upx behavioral1/files/0x0006000000016d41-58.dat upx behavioral1/files/0x0006000000016d39-54.dat upx behavioral1/files/0x0006000000016ceb-42.dat upx behavioral1/memory/1904-111-0x000000013FC90000-0x000000013FFE1000-memory.dmp upx behavioral1/memory/764-109-0x000000013FC90000-0x000000013FFE1000-memory.dmp upx behavioral1/memory/2308-108-0x000000013FFC0000-0x0000000140311000-memory.dmp upx behavioral1/memory/1896-112-0x000000013FEE0000-0x0000000140231000-memory.dmp upx behavioral1/memory/948-114-0x000000013F550000-0x000000013F8A1000-memory.dmp upx behavioral1/memory/2824-115-0x000000013FB70000-0x000000013FEC1000-memory.dmp upx behavioral1/memory/2896-117-0x000000013F600000-0x000000013F951000-memory.dmp upx behavioral1/memory/2648-127-0x000000013F4A0000-0x000000013F7F1000-memory.dmp upx behavioral1/memory/444-125-0x000000013F540000-0x000000013F891000-memory.dmp upx behavioral1/memory/3068-123-0x000000013F230000-0x000000013F581000-memory.dmp upx behavioral1/memory/1912-119-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2640-121-0x000000013F1F0000-0x000000013F541000-memory.dmp upx behavioral1/memory/2136-130-0x000000013F300000-0x000000013F651000-memory.dmp upx behavioral1/memory/2736-128-0x000000013FD70000-0x00000001400C1000-memory.dmp upx behavioral1/memory/2144-131-0x000000013FE00000-0x0000000140151000-memory.dmp upx behavioral1/memory/2628-151-0x000000013F6D0000-0x000000013FA21000-memory.dmp upx behavioral1/memory/2496-150-0x000000013FA50000-0x000000013FDA1000-memory.dmp upx behavioral1/memory/2728-149-0x000000013FD90000-0x00000001400E1000-memory.dmp upx behavioral1/memory/2644-148-0x000000013FF20000-0x0000000140271000-memory.dmp upx behavioral1/memory/700-147-0x000000013F760000-0x000000013FAB1000-memory.dmp upx behavioral1/memory/2588-146-0x000000013F870000-0x000000013FBC1000-memory.dmp upx behavioral1/memory/2456-152-0x000000013F660000-0x000000013F9B1000-memory.dmp upx behavioral1/memory/2144-153-0x000000013FE00000-0x0000000140151000-memory.dmp upx behavioral1/memory/2144-154-0x000000013FE00000-0x0000000140151000-memory.dmp upx behavioral1/memory/2136-221-0x000000013F300000-0x000000013F651000-memory.dmp upx behavioral1/memory/2308-223-0x000000013FFC0000-0x0000000140311000-memory.dmp upx behavioral1/memory/1896-226-0x000000013FEE0000-0x0000000140231000-memory.dmp upx behavioral1/memory/2824-227-0x000000013FB70000-0x000000013FEC1000-memory.dmp upx behavioral1/memory/3068-231-0x000000013F230000-0x000000013F581000-memory.dmp upx behavioral1/memory/1912-229-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2648-234-0x000000013F4A0000-0x000000013F7F1000-memory.dmp upx behavioral1/memory/1904-241-0x000000013FC90000-0x000000013FFE1000-memory.dmp upx behavioral1/memory/948-245-0x000000013F550000-0x000000013F8A1000-memory.dmp upx behavioral1/memory/2736-250-0x000000013FD70000-0x00000001400C1000-memory.dmp upx behavioral1/memory/444-248-0x000000013F540000-0x000000013F891000-memory.dmp upx behavioral1/memory/2896-244-0x000000013F600000-0x000000013F951000-memory.dmp upx behavioral1/memory/764-239-0x000000013FC90000-0x000000013FFE1000-memory.dmp upx behavioral1/memory/2640-254-0x000000013F1F0000-0x000000013F541000-memory.dmp upx -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\System\RrfpSWw.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\pjhjlFT.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\qRcvlOh.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\ZqZtNdu.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\fVHQrAY.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\VUdApfO.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\jUsrRFV.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\EkzbKnC.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\wfJuoOT.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\mwHAGvS.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\NBrOoXI.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\dFHSxYZ.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\LFOLdsZ.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\faCKfNB.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\eYcJNDU.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\RJdBcfH.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\EZELVzH.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\agHBeII.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\LcconfZ.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\rhmDXbn.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\vEbdQgE.exe 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe Token: SeLockMemoryPrivilege 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2144 wrote to memory of 2136 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 29 PID 2144 wrote to memory of 2136 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 29 PID 2144 wrote to memory of 2136 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 29 PID 2144 wrote to memory of 764 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 30 PID 2144 wrote to memory of 764 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 30 PID 2144 wrote to memory of 764 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 30 PID 2144 wrote to memory of 2308 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 31 PID 2144 wrote to memory of 2308 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 31 PID 2144 wrote to memory of 2308 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 31 PID 2144 wrote to memory of 1904 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 32 PID 2144 wrote to memory of 1904 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 32 PID 2144 wrote to memory of 1904 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 32 PID 2144 wrote to memory of 1896 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 33 PID 2144 wrote to memory of 1896 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 33 PID 2144 wrote to memory of 1896 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 33 PID 2144 wrote to memory of 948 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 34 PID 2144 wrote to memory of 948 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 34 PID 2144 wrote to memory of 948 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 34 PID 2144 wrote to memory of 2824 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 35 PID 2144 wrote to memory of 2824 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 35 PID 2144 wrote to memory of 2824 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 35 PID 2144 wrote to memory of 2896 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 36 PID 2144 wrote to memory of 2896 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 36 PID 2144 wrote to memory of 2896 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 36 PID 2144 wrote to memory of 1912 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 37 PID 2144 wrote to memory of 1912 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 37 PID 2144 wrote to memory of 1912 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 37 PID 2144 wrote to memory of 2640 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 38 PID 2144 wrote to memory of 2640 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 38 PID 2144 wrote to memory of 2640 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 38 PID 2144 wrote to memory of 3068 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 39 PID 2144 wrote to memory of 3068 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 39 PID 2144 wrote to memory of 3068 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 39 PID 2144 wrote to memory of 444 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 40 PID 2144 wrote to memory of 444 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 40 PID 2144 wrote to memory of 444 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 40 PID 2144 wrote to memory of 2648 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 41 PID 2144 wrote to memory of 2648 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 41 PID 2144 wrote to memory of 2648 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 41 PID 2144 wrote to memory of 2736 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 42 PID 2144 wrote to memory of 2736 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 42 PID 2144 wrote to memory of 2736 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 42 PID 2144 wrote to memory of 2588 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 43 PID 2144 wrote to memory of 2588 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 43 PID 2144 wrote to memory of 2588 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 43 PID 2144 wrote to memory of 700 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 44 PID 2144 wrote to memory of 700 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 44 PID 2144 wrote to memory of 700 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 44 PID 2144 wrote to memory of 2644 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 45 PID 2144 wrote to memory of 2644 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 45 PID 2144 wrote to memory of 2644 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 45 PID 2144 wrote to memory of 2728 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 46 PID 2144 wrote to memory of 2728 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 46 PID 2144 wrote to memory of 2728 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 46 PID 2144 wrote to memory of 2496 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 47 PID 2144 wrote to memory of 2496 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 47 PID 2144 wrote to memory of 2496 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 47 PID 2144 wrote to memory of 2628 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 48 PID 2144 wrote to memory of 2628 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 48 PID 2144 wrote to memory of 2628 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 48 PID 2144 wrote to memory of 2456 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 49 PID 2144 wrote to memory of 2456 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 49 PID 2144 wrote to memory of 2456 2144 202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe"C:\Users\Admin\AppData\Local\Temp\202408232f0d6cef399a874555144a83a5a846b4cobaltstrikecobaltstrikepoetrat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\System\qRcvlOh.exeC:\Windows\System\qRcvlOh.exe2⤵
- Executes dropped EXE
PID:2136
-
-
C:\Windows\System\ZqZtNdu.exeC:\Windows\System\ZqZtNdu.exe2⤵
- Executes dropped EXE
PID:764
-
-
C:\Windows\System\faCKfNB.exeC:\Windows\System\faCKfNB.exe2⤵
- Executes dropped EXE
PID:2308
-
-
C:\Windows\System\wfJuoOT.exeC:\Windows\System\wfJuoOT.exe2⤵
- Executes dropped EXE
PID:1904
-
-
C:\Windows\System\EZELVzH.exeC:\Windows\System\EZELVzH.exe2⤵
- Executes dropped EXE
PID:1896
-
-
C:\Windows\System\eYcJNDU.exeC:\Windows\System\eYcJNDU.exe2⤵
- Executes dropped EXE
PID:948
-
-
C:\Windows\System\fVHQrAY.exeC:\Windows\System\fVHQrAY.exe2⤵
- Executes dropped EXE
PID:2824
-
-
C:\Windows\System\mwHAGvS.exeC:\Windows\System\mwHAGvS.exe2⤵
- Executes dropped EXE
PID:2896
-
-
C:\Windows\System\NBrOoXI.exeC:\Windows\System\NBrOoXI.exe2⤵
- Executes dropped EXE
PID:1912
-
-
C:\Windows\System\VUdApfO.exeC:\Windows\System\VUdApfO.exe2⤵
- Executes dropped EXE
PID:2640
-
-
C:\Windows\System\RJdBcfH.exeC:\Windows\System\RJdBcfH.exe2⤵
- Executes dropped EXE
PID:3068
-
-
C:\Windows\System\jUsrRFV.exeC:\Windows\System\jUsrRFV.exe2⤵
- Executes dropped EXE
PID:444
-
-
C:\Windows\System\RrfpSWw.exeC:\Windows\System\RrfpSWw.exe2⤵
- Executes dropped EXE
PID:2648
-
-
C:\Windows\System\agHBeII.exeC:\Windows\System\agHBeII.exe2⤵
- Executes dropped EXE
PID:2736
-
-
C:\Windows\System\dFHSxYZ.exeC:\Windows\System\dFHSxYZ.exe2⤵
- Executes dropped EXE
PID:2588
-
-
C:\Windows\System\LcconfZ.exeC:\Windows\System\LcconfZ.exe2⤵
- Executes dropped EXE
PID:700
-
-
C:\Windows\System\rhmDXbn.exeC:\Windows\System\rhmDXbn.exe2⤵
- Executes dropped EXE
PID:2644
-
-
C:\Windows\System\LFOLdsZ.exeC:\Windows\System\LFOLdsZ.exe2⤵
- Executes dropped EXE
PID:2728
-
-
C:\Windows\System\vEbdQgE.exeC:\Windows\System\vEbdQgE.exe2⤵
- Executes dropped EXE
PID:2496
-
-
C:\Windows\System\pjhjlFT.exeC:\Windows\System\pjhjlFT.exe2⤵
- Executes dropped EXE
PID:2628
-
-
C:\Windows\System\EkzbKnC.exeC:\Windows\System\EkzbKnC.exe2⤵
- Executes dropped EXE
PID:2456
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56610a7974a2170ab554b7120b6f3f1f5
SHA1efb09b7ec11617c5151ac1bdd82bd3f66b0b5bd3
SHA256c8b6fd77bf571991317c7eff0a3631d12d4f8cbbfa8a77779c24b81aa2f9cb98
SHA512cf60b541679c572a10bcc4057ee28e49f796f80e701bdbe12d665329cf006bbbffdae09013019ac0f7bd5d686ab30acd827dce2df6096a95c6d2acabd1c34ae9
-
Filesize
5.2MB
MD5f495a2b306e0fa0f4f88dc88526dc46b
SHA1c6712fff22760cad1be27ffa18d92be738927235
SHA256a54a8c43d5925f4f184e9f9d8c7927ff9daa78edf7e842c4f8be76faaa237995
SHA512f749660547b39aabe2fc6d54a0698ab05f189924d22f036f13e8f7648cbff9c98e64ea4c3bd68947596242e9c9306a4d32ee8710b04384d989f1d90b2c49684b
-
Filesize
5.2MB
MD58d70422d53754c2ccd7f8b5a4e3e109d
SHA13bed0cb64dcc73eaa1dca9796e0d5f8ab3c05eb9
SHA2568ba7d5fcb8ec631c99e38291d2add39ee8f5d39e8eae12d4822d6fe47eb545c4
SHA51225a5b6cd5d062e25838054132e5f39a46becef7b3a0d7fc6a328d84cec5819faad99eedc34d6eb7a931509acbe34a9479573d86c34a1df7b2df00c40fdb5a438
-
Filesize
5.2MB
MD54aa87052f0a113b0502ed574f930c754
SHA187ce37a768b480153ef143195e836ee67b58c574
SHA256d73012a03aed0229348721b9080389672b0fdd8f8b8a1e18afdbe3cf5ea2fe0f
SHA5124be1ed52e06ffdbd76ca5c3b47ea933d029b4f152e41480d0c1f8f3dfe4ce4a9e8e70ca9cbd67703abcb3036185e56fd802f8effe0c07689c9afd9b954cc066a
-
Filesize
5.2MB
MD5957b40ad89bb939be6d88b02c6e883e0
SHA12cbbe7e61a4d6e8f95c27bf111e0dc28f219583f
SHA25612f73913e3b59a5c3cb7c9d3af39e698cb32c669ea6668ba060d9f12ad37025f
SHA5128e9c04659ab324159f347219a5c514164a8d85858418cec5f10e9f89e41a9e25453444fe8fb987ed315a75ea221fb5576cabe853cf6ff0b2cf46b28d67fe3725
-
Filesize
5.2MB
MD524d5662646ec9487ed156dd9f0fe8ebd
SHA12a44030125528588ea26e97898976a482b226aa7
SHA25669c258e9bb426f95efa819cb4697eb54af0fc43bcdcd73c94e03c29ca09ce855
SHA51284c146d8efeedc709e0bb25641c7797f37ea5820802cef4c17cadfd7c585b348beb9d87ce0ef4102c1ce1118b9d222a6d4e7d5e0942aa8780a480551f5130227
-
Filesize
5.2MB
MD545142fa3cd3ed172d2b1a054270d1013
SHA1d5f956760305b001434560b07ffdcc549b9bedb1
SHA256462c9eb4bdda0d528f132f078e784222258c1778abb56aa9ac0c124f176c225c
SHA512899f7ad31d52dc88f1ee8e698e69fb0402e7a8fb79c768dcda4a97c5094e1dc5c970c585013c6a7c1b6b99424f6a6d2cddc454d5817541c025b6923b10d2d03e
-
Filesize
5.2MB
MD5637b2bfa972da5f4f7645576e994df19
SHA15923db7b2f4fe58280d01599d083ad9e5031310e
SHA2566b73c4535cc97507f707b20b12062ccd3c248663e13fe829d62b8076b60cf7b2
SHA5128a640f7f5953647af8729bc5ab55768aa4bf95482c652cecf0aa3218cd8593986425da35639b154d6ca5c886cf4bfb40b7021e0ccf584778ab319b916d83cef2
-
Filesize
5.2MB
MD5228c02546014ca89f99cd75bd6c16b79
SHA124acd143bdef933c23d148be642a8e55737bedd4
SHA256a1ec2ebda7775aad5bda79151b15a45a304ae3877e2739f185b61eea953f5551
SHA5125ae58b57a76652b9f8bcf4e7fa383a166db6558df92d94e2b1fec04da08e8bff0b8b064ed96ad2eebda5781c21b5265c98f76733c5c9f4179748edecd5de8342
-
Filesize
5.2MB
MD58da3fa0ec15aa3e6989853cf4d0c0dbc
SHA102c5fefa5d63f576158c2cf6879d07388d287bf1
SHA25625d35d2713d5d805ab9a352944efe55e5b6e5e406b597af7f597392a820ae4ca
SHA512172d8e6221509a8eb5439820e244facddec0556f30beb4aa6eeb696334c7370794cd72337442a0eaff270df48341577d057bfb311822360485ce71d555df380e
-
Filesize
5.2MB
MD58b7825b258dfa20835b1aec0c585f3a1
SHA11d622b19c160793ed1f04c9c9c978599f9b56c6e
SHA256d2c7a0b8caa40bd20b4241ead6cff31c68c42920780474f050eee866d28b161a
SHA512362eac5f53ef268aa594a23f6abd0718e04a5df393e866e523eadd41b4b0333ef98099a93b9034165bf7d5e90b2ffd076265361012aa19df0120581c93daa002
-
Filesize
5.2MB
MD52e0ea186691da6872a8c1754801dc009
SHA1f21f99bb28de91dd1d2aaf17517e07967853e447
SHA2564104dca3d8d3cbaedb580ab1c0912eea21573c6f28f7d1828ab30f47927aebea
SHA512477f1f7c37cc7d4d3cc68b7ce5282bd8f3cfb1a4dd35b2c8e30c32987610f582a278ddfbe9ebd19d09573bde1ba44afae4fa8408e1a444bc8f51906b9cf9122b
-
Filesize
5.2MB
MD5e789f31373e378ac4d883b3b0ffed549
SHA1c15ed9b1f47138825d1ccac7350d859e457d82d9
SHA25661ed2603e721bec4f1370270af41a595275300f620676a333d551192099549d7
SHA5124458cbdf23090b05aa364feb4fea8ea7ec97a160a37766bd2ee6b63e6e546eb5e367a3e0421ec0712bc4b18a3d0a8187ea50e843e8c118bc3ffe65c4435b0e02
-
Filesize
5.2MB
MD553e580710a5857c66c177657bd393490
SHA14d2d1c46b18035abd661e860f9fccc1a07191b04
SHA256a559741e9cbb11ea072f37e04624295334bff6167ea1008a4d8a17d7cd0dfd7d
SHA512f0fdf23a3220e66528c45e1af95c2fddcc81cc01c5e6bbfc7b2d462f4a7031bdc0628e821fed3c43d43cb1fca4ab2801aa1c6c26569bba0bdb053f22914b76d8
-
Filesize
5.2MB
MD5dd91ea852192274dcf5b2d0da68ed6db
SHA13bfada6b3ce8f9121d74109a0f7068e1c39ce6bb
SHA256c947d002449c6fd68ba826fd34e7f538276cd0c5546d042cc892db1d19d3d990
SHA51209c7db03d3903fe8c57f11ae5f26a5927d009b2bd02a519bced535d77b397defa9c135f2024e9299837923ad8a53194d93c04ae843af787892042a3a0d56679f
-
Filesize
5.2MB
MD54e5a180f169bad1f982d5535ede3b90f
SHA17dc35b343fd8b9707baae53477ab50f11ce74227
SHA2563e9df799074e231a3ae3632711b9152869ccdb75c63912d67670e254d0f40775
SHA51209e95abec7abe12fd1f44d03b18b8049b512bce44648a2d2abed4012b6809e40fb569c2dc020c008b3fcbecfd03b94252b4584494cbe2d9ea8d49f7f39189630
-
Filesize
5.2MB
MD5affa4a0f6da4b419c49d702310620865
SHA1ac913eb9a83086bac81cd58a4a89fe1cb92ba7d1
SHA2565ae5fb4db7759f47a5bb166170a73b2cbca1183ec2f6b604d10c4d7b3e6a70fe
SHA512e00d8914d6b4ead49199be18d73ed5f8191871ca8fdd4576945047c472d504350c199d45f4c0ff71966d1c84ddd6ed8da8bca00c4a115c64d900c941a4b02039
-
Filesize
5.2MB
MD58a525caa8a1ddc34a8c6b8928b7a28ee
SHA1c009a8e89249ceecede00e0aebf071a054971d1c
SHA256d6806882b7bcceb17172afa3be43f5b250a40b11d9ea6d630e406b23283a730e
SHA512beaaf58729086e724e2c9b00b28dd79d205c626b541513a0cd01bddd835912f02f52ca02d0c52e1a3d7c8eff2017b149ef7cd2ab48e0d09e531148f0c733282b
-
Filesize
5.2MB
MD525b03db83a4bc9629d6b7d6809b19245
SHA1b2bb59f8d2ef6204df96cd1b3cae1451c2ac9ea6
SHA2560dffead736e5df4ab259a14279aba8b0d043854cfb1c587a4201fa7058288239
SHA512b9ee8c3ec955f7ca0d0ed1e7b7db7b9b8fedb89cc8d7bbf43f4ae26944d030d3ca472cedb620d6c2c23fd019920cd4e6a6e92365251cdba74ec70bd3a61b43b4
-
Filesize
5.2MB
MD513809fc281cf17fcde4e65bd5453a845
SHA1e65a53e9b4c65f2e22ee542d34b52a50ed909527
SHA25623f22b09a69cb3d559338295749707b2058f4e70cab791307d856c106c84f7ba
SHA5123b039bfcf8fb4d514a0d458540491d173b073c0d2c31a73c165316d1967cc68a67d9e819e1aea12c833eb874da449c33c364c93a6e5f23ddbfa74e293e47a017
-
Filesize
5.2MB
MD5668e9e9e21ac45e813ed18369d802dd4
SHA13606e1f443b76311f7abd0526f7a3a94ac5116f0
SHA256b259ee4b4735dbb36a64d165b7264eb9fe13185101bf5ad39c5121fdb4091d3f
SHA512ac742660752975f47426a3e1c5e5536094873badf90e949e2989af5be76ba689bfc9366e6b2cd629041e125c1fced5347de793e836777550710dd6d9c8e68862