Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 09:32
Behavioral task
behavioral1
Sample
2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20240729-en
General
-
Target
2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
7afe1a0d6dd1daf9ed8813fea7f617c1
-
SHA1
59c09d8e2c1e6cfe7776a9fab3fc78e9d56ac7c7
-
SHA256
f63662c02c281cf3702245c163c3d0855a4bb8151d7225d42949eabd53b70a0d
-
SHA512
052c581669cbb34c7861745be6cfa0acf131c92bb5b7205b25908ccecd582851d6c2a01824df31704242c7df10a825d7f37c8832f9de74770c6ba981c51d440a
-
SSDEEP
98304:oemTLkNdfE0pZrx56utgpPFotBER/mQ32lUB:T+o56utgpPF8u/7B
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral2/files/0x0008000000023465-4.dat cobalt_reflective_dll behavioral2/files/0x000700000002346a-11.dat cobalt_reflective_dll behavioral2/files/0x0007000000023469-12.dat cobalt_reflective_dll behavioral2/files/0x000700000002346b-20.dat cobalt_reflective_dll behavioral2/files/0x000700000002346c-29.dat cobalt_reflective_dll behavioral2/files/0x0008000000023466-34.dat cobalt_reflective_dll behavioral2/files/0x000700000002346d-47.dat cobalt_reflective_dll behavioral2/files/0x0007000000023472-64.dat cobalt_reflective_dll behavioral2/files/0x0007000000023471-69.dat cobalt_reflective_dll behavioral2/files/0x0007000000023474-81.dat cobalt_reflective_dll behavioral2/files/0x0007000000023473-87.dat cobalt_reflective_dll behavioral2/files/0x0007000000023475-91.dat cobalt_reflective_dll behavioral2/files/0x0007000000023470-68.dat cobalt_reflective_dll behavioral2/files/0x000700000002346e-58.dat cobalt_reflective_dll behavioral2/files/0x000700000002346f-54.dat cobalt_reflective_dll behavioral2/files/0x0007000000023477-106.dat cobalt_reflective_dll behavioral2/files/0x0007000000023476-99.dat cobalt_reflective_dll behavioral2/files/0x000700000002347c-135.dat cobalt_reflective_dll behavioral2/files/0x000700000002347a-128.dat cobalt_reflective_dll behavioral2/files/0x000700000002347b-130.dat cobalt_reflective_dll behavioral2/files/0x0007000000023478-119.dat cobalt_reflective_dll -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral2/memory/4788-0-0x00007FF676920000-0x00007FF676C74000-memory.dmp xmrig behavioral2/memory/2872-9-0x00007FF602450000-0x00007FF6027A4000-memory.dmp xmrig behavioral2/files/0x0008000000023465-4.dat xmrig behavioral2/files/0x000700000002346a-11.dat xmrig behavioral2/files/0x0007000000023469-12.dat xmrig behavioral2/files/0x000700000002346b-20.dat xmrig behavioral2/memory/4160-16-0x00007FF69FF90000-0x00007FF6A02E4000-memory.dmp xmrig behavioral2/memory/64-24-0x00007FF691D40000-0x00007FF692094000-memory.dmp xmrig behavioral2/memory/1436-21-0x00007FF6344A0000-0x00007FF6347F4000-memory.dmp xmrig behavioral2/files/0x000700000002346c-29.dat xmrig behavioral2/files/0x0008000000023466-34.dat xmrig behavioral2/files/0x000700000002346d-47.dat xmrig behavioral2/memory/1404-51-0x00007FF60FFA0000-0x00007FF6102F4000-memory.dmp xmrig behavioral2/files/0x0007000000023472-64.dat xmrig behavioral2/files/0x0007000000023471-69.dat xmrig behavioral2/files/0x0007000000023474-81.dat xmrig behavioral2/files/0x0007000000023473-87.dat xmrig behavioral2/memory/3996-94-0x00007FF7FBC50000-0x00007FF7FBFA4000-memory.dmp xmrig behavioral2/memory/1996-93-0x00007FF74CDC0000-0x00007FF74D114000-memory.dmp xmrig behavioral2/files/0x0007000000023475-91.dat xmrig behavioral2/memory/1232-86-0x00007FF7E6E10000-0x00007FF7E7164000-memory.dmp xmrig behavioral2/memory/3424-85-0x00007FF76C030000-0x00007FF76C384000-memory.dmp xmrig behavioral2/memory/2648-79-0x00007FF7E9DF0000-0x00007FF7EA144000-memory.dmp xmrig behavioral2/memory/2872-72-0x00007FF602450000-0x00007FF6027A4000-memory.dmp xmrig behavioral2/memory/4788-67-0x00007FF676920000-0x00007FF676C74000-memory.dmp xmrig behavioral2/memory/1040-66-0x00007FF7BC3F0000-0x00007FF7BC744000-memory.dmp xmrig behavioral2/files/0x0007000000023470-68.dat xmrig behavioral2/memory/4732-63-0x00007FF6E1570000-0x00007FF6E18C4000-memory.dmp xmrig behavioral2/files/0x000700000002346e-58.dat xmrig behavioral2/files/0x000700000002346f-54.dat xmrig behavioral2/memory/1796-45-0x00007FF7B32B0000-0x00007FF7B3604000-memory.dmp xmrig behavioral2/memory/2672-36-0x00007FF794B90000-0x00007FF794EE4000-memory.dmp xmrig behavioral2/memory/5080-31-0x00007FF77B3C0000-0x00007FF77B714000-memory.dmp xmrig behavioral2/memory/4160-95-0x00007FF69FF90000-0x00007FF6A02E4000-memory.dmp xmrig behavioral2/memory/64-102-0x00007FF691D40000-0x00007FF692094000-memory.dmp xmrig behavioral2/memory/4620-107-0x00007FF67B130000-0x00007FF67B484000-memory.dmp xmrig behavioral2/files/0x0007000000023477-106.dat xmrig behavioral2/memory/3084-105-0x00007FF638520000-0x00007FF638874000-memory.dmp xmrig behavioral2/memory/1436-101-0x00007FF6344A0000-0x00007FF6347F4000-memory.dmp xmrig behavioral2/files/0x0007000000023476-99.dat xmrig behavioral2/memory/5080-112-0x00007FF77B3C0000-0x00007FF77B714000-memory.dmp xmrig behavioral2/memory/2672-114-0x00007FF794B90000-0x00007FF794EE4000-memory.dmp xmrig behavioral2/memory/4732-129-0x00007FF6E1570000-0x00007FF6E18C4000-memory.dmp xmrig behavioral2/memory/1040-133-0x00007FF7BC3F0000-0x00007FF7BC744000-memory.dmp xmrig behavioral2/memory/1960-138-0x00007FF73C570000-0x00007FF73C8C4000-memory.dmp xmrig behavioral2/memory/3440-137-0x00007FF639060000-0x00007FF6393B4000-memory.dmp xmrig behavioral2/files/0x000700000002347c-135.dat xmrig behavioral2/files/0x000700000002347a-128.dat xmrig behavioral2/files/0x000700000002347b-130.dat xmrig behavioral2/memory/2004-125-0x00007FF782820000-0x00007FF782B74000-memory.dmp xmrig behavioral2/memory/1404-124-0x00007FF60FFA0000-0x00007FF6102F4000-memory.dmp xmrig behavioral2/memory/3192-116-0x00007FF606670000-0x00007FF6069C4000-memory.dmp xmrig behavioral2/files/0x0007000000023478-119.dat xmrig behavioral2/memory/1796-115-0x00007FF7B32B0000-0x00007FF7B3604000-memory.dmp xmrig behavioral2/memory/1232-140-0x00007FF7E6E10000-0x00007FF7E7164000-memory.dmp xmrig behavioral2/memory/1996-141-0x00007FF74CDC0000-0x00007FF74D114000-memory.dmp xmrig behavioral2/memory/2648-139-0x00007FF7E9DF0000-0x00007FF7EA144000-memory.dmp xmrig behavioral2/memory/4620-142-0x00007FF67B130000-0x00007FF67B484000-memory.dmp xmrig behavioral2/memory/3192-143-0x00007FF606670000-0x00007FF6069C4000-memory.dmp xmrig behavioral2/memory/2004-144-0x00007FF782820000-0x00007FF782B74000-memory.dmp xmrig behavioral2/memory/3440-145-0x00007FF639060000-0x00007FF6393B4000-memory.dmp xmrig behavioral2/memory/2872-146-0x00007FF602450000-0x00007FF6027A4000-memory.dmp xmrig behavioral2/memory/4160-147-0x00007FF69FF90000-0x00007FF6A02E4000-memory.dmp xmrig behavioral2/memory/1436-148-0x00007FF6344A0000-0x00007FF6347F4000-memory.dmp xmrig -
Executes dropped EXE 21 IoCs
pid Process 2872 ERljoUL.exe 4160 AJMmLmI.exe 1436 qfxNHTT.exe 64 ARshnRw.exe 5080 ihKfdDj.exe 2672 QiDMTeV.exe 1796 vrkmpar.exe 1404 qywFOaV.exe 4732 ZcOHhuM.exe 2648 pmeCKCE.exe 1040 hPmymiy.exe 3424 seGxmei.exe 3996 IDAYKTV.exe 1232 TACzvNx.exe 1996 xYbjKLr.exe 3084 uXatdik.exe 4620 CRoCYyS.exe 3192 EPdHMIX.exe 2004 KrGPpAf.exe 3440 UrtdGRL.exe 1960 BxAYQUY.exe -
resource yara_rule behavioral2/memory/4788-0-0x00007FF676920000-0x00007FF676C74000-memory.dmp upx behavioral2/memory/2872-9-0x00007FF602450000-0x00007FF6027A4000-memory.dmp upx behavioral2/files/0x0008000000023465-4.dat upx behavioral2/files/0x000700000002346a-11.dat upx behavioral2/files/0x0007000000023469-12.dat upx behavioral2/files/0x000700000002346b-20.dat upx behavioral2/memory/4160-16-0x00007FF69FF90000-0x00007FF6A02E4000-memory.dmp upx behavioral2/memory/64-24-0x00007FF691D40000-0x00007FF692094000-memory.dmp upx behavioral2/memory/1436-21-0x00007FF6344A0000-0x00007FF6347F4000-memory.dmp upx behavioral2/files/0x000700000002346c-29.dat upx behavioral2/files/0x0008000000023466-34.dat upx behavioral2/files/0x000700000002346d-47.dat upx behavioral2/memory/1404-51-0x00007FF60FFA0000-0x00007FF6102F4000-memory.dmp upx behavioral2/files/0x0007000000023472-64.dat upx behavioral2/files/0x0007000000023471-69.dat upx behavioral2/files/0x0007000000023474-81.dat upx behavioral2/files/0x0007000000023473-87.dat upx behavioral2/memory/3996-94-0x00007FF7FBC50000-0x00007FF7FBFA4000-memory.dmp upx behavioral2/memory/1996-93-0x00007FF74CDC0000-0x00007FF74D114000-memory.dmp upx behavioral2/files/0x0007000000023475-91.dat upx behavioral2/memory/1232-86-0x00007FF7E6E10000-0x00007FF7E7164000-memory.dmp upx behavioral2/memory/3424-85-0x00007FF76C030000-0x00007FF76C384000-memory.dmp upx behavioral2/memory/2648-79-0x00007FF7E9DF0000-0x00007FF7EA144000-memory.dmp upx behavioral2/memory/2872-72-0x00007FF602450000-0x00007FF6027A4000-memory.dmp upx behavioral2/memory/4788-67-0x00007FF676920000-0x00007FF676C74000-memory.dmp upx behavioral2/memory/1040-66-0x00007FF7BC3F0000-0x00007FF7BC744000-memory.dmp upx behavioral2/files/0x0007000000023470-68.dat upx behavioral2/memory/4732-63-0x00007FF6E1570000-0x00007FF6E18C4000-memory.dmp upx behavioral2/files/0x000700000002346e-58.dat upx behavioral2/files/0x000700000002346f-54.dat upx behavioral2/memory/1796-45-0x00007FF7B32B0000-0x00007FF7B3604000-memory.dmp upx behavioral2/memory/2672-36-0x00007FF794B90000-0x00007FF794EE4000-memory.dmp upx behavioral2/memory/5080-31-0x00007FF77B3C0000-0x00007FF77B714000-memory.dmp upx behavioral2/memory/4160-95-0x00007FF69FF90000-0x00007FF6A02E4000-memory.dmp upx behavioral2/memory/64-102-0x00007FF691D40000-0x00007FF692094000-memory.dmp upx behavioral2/memory/4620-107-0x00007FF67B130000-0x00007FF67B484000-memory.dmp upx behavioral2/files/0x0007000000023477-106.dat upx behavioral2/memory/3084-105-0x00007FF638520000-0x00007FF638874000-memory.dmp upx behavioral2/memory/1436-101-0x00007FF6344A0000-0x00007FF6347F4000-memory.dmp upx behavioral2/files/0x0007000000023476-99.dat upx behavioral2/memory/5080-112-0x00007FF77B3C0000-0x00007FF77B714000-memory.dmp upx behavioral2/memory/2672-114-0x00007FF794B90000-0x00007FF794EE4000-memory.dmp upx behavioral2/memory/4732-129-0x00007FF6E1570000-0x00007FF6E18C4000-memory.dmp upx behavioral2/memory/1040-133-0x00007FF7BC3F0000-0x00007FF7BC744000-memory.dmp upx behavioral2/memory/1960-138-0x00007FF73C570000-0x00007FF73C8C4000-memory.dmp upx behavioral2/memory/3440-137-0x00007FF639060000-0x00007FF6393B4000-memory.dmp upx behavioral2/files/0x000700000002347c-135.dat upx behavioral2/files/0x000700000002347a-128.dat upx behavioral2/files/0x000700000002347b-130.dat upx behavioral2/memory/2004-125-0x00007FF782820000-0x00007FF782B74000-memory.dmp upx behavioral2/memory/1404-124-0x00007FF60FFA0000-0x00007FF6102F4000-memory.dmp upx behavioral2/memory/3192-116-0x00007FF606670000-0x00007FF6069C4000-memory.dmp upx behavioral2/files/0x0007000000023478-119.dat upx behavioral2/memory/1796-115-0x00007FF7B32B0000-0x00007FF7B3604000-memory.dmp upx behavioral2/memory/1232-140-0x00007FF7E6E10000-0x00007FF7E7164000-memory.dmp upx behavioral2/memory/1996-141-0x00007FF74CDC0000-0x00007FF74D114000-memory.dmp upx behavioral2/memory/2648-139-0x00007FF7E9DF0000-0x00007FF7EA144000-memory.dmp upx behavioral2/memory/4620-142-0x00007FF67B130000-0x00007FF67B484000-memory.dmp upx behavioral2/memory/3192-143-0x00007FF606670000-0x00007FF6069C4000-memory.dmp upx behavioral2/memory/2004-144-0x00007FF782820000-0x00007FF782B74000-memory.dmp upx behavioral2/memory/3440-145-0x00007FF639060000-0x00007FF6393B4000-memory.dmp upx behavioral2/memory/2872-146-0x00007FF602450000-0x00007FF6027A4000-memory.dmp upx behavioral2/memory/4160-147-0x00007FF69FF90000-0x00007FF6A02E4000-memory.dmp upx behavioral2/memory/1436-148-0x00007FF6344A0000-0x00007FF6347F4000-memory.dmp upx -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\System\pmeCKCE.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\TACzvNx.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\uXatdik.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\UrtdGRL.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\ERljoUL.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\AJMmLmI.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\ihKfdDj.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\seGxmei.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\xYbjKLr.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\BxAYQUY.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\CRoCYyS.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\KrGPpAf.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\qfxNHTT.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\ARshnRw.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\hPmymiy.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\ZcOHhuM.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\IDAYKTV.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\EPdHMIX.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\QiDMTeV.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\vrkmpar.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\qywFOaV.exe 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe Token: SeLockMemoryPrivilege 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4788 wrote to memory of 2872 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 83 PID 4788 wrote to memory of 2872 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 83 PID 4788 wrote to memory of 4160 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 84 PID 4788 wrote to memory of 4160 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 84 PID 4788 wrote to memory of 1436 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 85 PID 4788 wrote to memory of 1436 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 85 PID 4788 wrote to memory of 64 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 86 PID 4788 wrote to memory of 64 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 86 PID 4788 wrote to memory of 5080 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 87 PID 4788 wrote to memory of 5080 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 87 PID 4788 wrote to memory of 2672 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 88 PID 4788 wrote to memory of 2672 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 88 PID 4788 wrote to memory of 1796 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 89 PID 4788 wrote to memory of 1796 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 89 PID 4788 wrote to memory of 1404 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 90 PID 4788 wrote to memory of 1404 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 90 PID 4788 wrote to memory of 4732 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 91 PID 4788 wrote to memory of 4732 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 91 PID 4788 wrote to memory of 2648 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 92 PID 4788 wrote to memory of 2648 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 92 PID 4788 wrote to memory of 1040 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 93 PID 4788 wrote to memory of 1040 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 93 PID 4788 wrote to memory of 3424 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 94 PID 4788 wrote to memory of 3424 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 94 PID 4788 wrote to memory of 3996 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 95 PID 4788 wrote to memory of 3996 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 95 PID 4788 wrote to memory of 1232 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 96 PID 4788 wrote to memory of 1232 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 96 PID 4788 wrote to memory of 1996 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 97 PID 4788 wrote to memory of 1996 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 97 PID 4788 wrote to memory of 3084 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 98 PID 4788 wrote to memory of 3084 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 98 PID 4788 wrote to memory of 4620 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 99 PID 4788 wrote to memory of 4620 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 99 PID 4788 wrote to memory of 3192 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 100 PID 4788 wrote to memory of 3192 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 100 PID 4788 wrote to memory of 2004 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 101 PID 4788 wrote to memory of 2004 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 101 PID 4788 wrote to memory of 3440 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 102 PID 4788 wrote to memory of 3440 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 102 PID 4788 wrote to memory of 1960 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 103 PID 4788 wrote to memory of 1960 4788 2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\System\ERljoUL.exeC:\Windows\System\ERljoUL.exe2⤵
- Executes dropped EXE
PID:2872
-
-
C:\Windows\System\AJMmLmI.exeC:\Windows\System\AJMmLmI.exe2⤵
- Executes dropped EXE
PID:4160
-
-
C:\Windows\System\qfxNHTT.exeC:\Windows\System\qfxNHTT.exe2⤵
- Executes dropped EXE
PID:1436
-
-
C:\Windows\System\ARshnRw.exeC:\Windows\System\ARshnRw.exe2⤵
- Executes dropped EXE
PID:64
-
-
C:\Windows\System\ihKfdDj.exeC:\Windows\System\ihKfdDj.exe2⤵
- Executes dropped EXE
PID:5080
-
-
C:\Windows\System\QiDMTeV.exeC:\Windows\System\QiDMTeV.exe2⤵
- Executes dropped EXE
PID:2672
-
-
C:\Windows\System\vrkmpar.exeC:\Windows\System\vrkmpar.exe2⤵
- Executes dropped EXE
PID:1796
-
-
C:\Windows\System\qywFOaV.exeC:\Windows\System\qywFOaV.exe2⤵
- Executes dropped EXE
PID:1404
-
-
C:\Windows\System\ZcOHhuM.exeC:\Windows\System\ZcOHhuM.exe2⤵
- Executes dropped EXE
PID:4732
-
-
C:\Windows\System\pmeCKCE.exeC:\Windows\System\pmeCKCE.exe2⤵
- Executes dropped EXE
PID:2648
-
-
C:\Windows\System\hPmymiy.exeC:\Windows\System\hPmymiy.exe2⤵
- Executes dropped EXE
PID:1040
-
-
C:\Windows\System\seGxmei.exeC:\Windows\System\seGxmei.exe2⤵
- Executes dropped EXE
PID:3424
-
-
C:\Windows\System\IDAYKTV.exeC:\Windows\System\IDAYKTV.exe2⤵
- Executes dropped EXE
PID:3996
-
-
C:\Windows\System\TACzvNx.exeC:\Windows\System\TACzvNx.exe2⤵
- Executes dropped EXE
PID:1232
-
-
C:\Windows\System\xYbjKLr.exeC:\Windows\System\xYbjKLr.exe2⤵
- Executes dropped EXE
PID:1996
-
-
C:\Windows\System\uXatdik.exeC:\Windows\System\uXatdik.exe2⤵
- Executes dropped EXE
PID:3084
-
-
C:\Windows\System\CRoCYyS.exeC:\Windows\System\CRoCYyS.exe2⤵
- Executes dropped EXE
PID:4620
-
-
C:\Windows\System\EPdHMIX.exeC:\Windows\System\EPdHMIX.exe2⤵
- Executes dropped EXE
PID:3192
-
-
C:\Windows\System\KrGPpAf.exeC:\Windows\System\KrGPpAf.exe2⤵
- Executes dropped EXE
PID:2004
-
-
C:\Windows\System\UrtdGRL.exeC:\Windows\System\UrtdGRL.exe2⤵
- Executes dropped EXE
PID:3440
-
-
C:\Windows\System\BxAYQUY.exeC:\Windows\System\BxAYQUY.exe2⤵
- Executes dropped EXE
PID:1960
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD596239c037a08dcebc6bc6b96b7be8c98
SHA10bcd336afcc79806d8cd700d390323a11ba495ad
SHA2564b31fa55f9d9b58037836ed94bf7ce978f92487afa9beb122d2664605152a1e7
SHA51214368277ac37c331a0b96506fb8cb5642af62fc11694158bd7a12b14290085ab1b576ae23599818f025a0d466dbc79cbb2d092f07806fbf8ec9569efebf4b530
-
Filesize
5.9MB
MD583eb58ee61fae7431b41d498c26c0874
SHA1e6d1c3904d4c5445249b03014abd40f2edd70dc4
SHA256b4cf8715dedfab42622a1f7d0f45b9d29d38127f7def4abd3f0aea8f65b4f3bd
SHA512951da4c990d66154fbd8824a41435669def16542e5551b4433fd1959dab063a7355e1104bedeec1dd6259b168f9f309ca7a4eb81ae3888e6037792bc905827b8
-
Filesize
5.9MB
MD562cfa6c79fc5dd76a175c4c3c8e37552
SHA19ae7221ade1bcc105789601c6c2d4e0d8a466715
SHA256a96855e21014c6cf669b2e4f7639ac86a56333def138ad4fd5fc055a18895f1b
SHA512a200298c787175b58229d33f4364dd6adca7c54341cfc7163a18dbfb7913644226e8da52411da314aa796783e71365256efdd683ac608d63e4517a92f9bc2f15
-
Filesize
5.9MB
MD5896e604682816f866198032f59f837bf
SHA14a425124fc887a3b5533116cb319f45a31155f92
SHA25686e24f7935ed71b1dcee1cf40699fef75f6e33aae33069a0afc4999aaf4eeb2a
SHA51294fbddb5afe168ecbbb2464956e6e843cbf922474a5164e03d2a2c2f274fdd2ebd9975d85616ebdba04822c221cd5c0e90e57d51bfb2b2c893aed044dc044ff4
-
Filesize
5.9MB
MD5b13e6f6b1c6cf354c78f9d9c1329c27b
SHA1c3b54dfe90f2c18c6ad56f315bc6cc6b27a6d783
SHA256c95eb204e607e34bc6b0fec1d5e594057b9eaf7ade6f08787580192630d8351a
SHA51288e898b4cdf8a039d6eae2dc644a4022fb1611408688e9ae654b98880fcdc49bd3688ff23e73737f4c11aa6629ced8ad2cdd69bd3da6e1650bc7a735a141bbfe
-
Filesize
5.9MB
MD5df8e391a0fbdd01d2f59990c52f1ab51
SHA15e5cb872faba1e64c91b31db7529b9d55875c24f
SHA256d78f64b9adae8ea9740512892818bcf823413650e7bf4d99d64b7789800bc097
SHA51261868762ac8676eaae7fc82b9f099c55f90d7b5a950e142d6ce77cdb35aa9ca4889e30e78b947c0a7592b7ec1f7012047e7d7f0188b21ab8ee7ca9c1d3805e53
-
Filesize
5.9MB
MD5b25a5265269bd0b4b74b16de42ca054f
SHA16df44764ab62a267ac2c568e9a55a3760bfb9ffe
SHA25609fa7dfcdc4407451220ed8b9fb4f85e3d112242db20532e66792c53dc16a3de
SHA5120364dd4b6ddacd07ea854242fbcfd0e5a549609a1b35aad1390762e93da5f0454b81eebcfe718d3c3a11a397d2825c295db6ef3e79f8c7f581327f50584f2d1e
-
Filesize
5.9MB
MD551c762e28bb583589ff87530f0d5a0e8
SHA157cf87b0d6425a0ff473ad2758a722d80eddaa2f
SHA256e61e3eddc0e9b4c9fca2e1693c4183545fdc75bb858e01feed04382670b38e10
SHA51251fa08d0c7222bbfc35a9d5b4fdd833ef287d349ffc29d034f14a8333db409ba299096e0e8176ca1c86f8247cdb54a024c046dcda72bfcc2936ee80fe90631cc
-
Filesize
5.9MB
MD5ee6fbc1d016ce249900d245d59c3c0cc
SHA10625f9aaddefb613e274a20c9ed9ab9828f19bcf
SHA2560f63594e237c72257f7108d474ebb3d80a9c0bef08e7dd5f0edca7ea61a3b75c
SHA512a42601d8c3223e38ea262149288b19da3d2dec1185e1bb0f305a7f69a755cd15a0b68e924f5a8dafb702bc65a717208af8673a8ac9dcf4d03eba25f5c453df84
-
Filesize
5.9MB
MD502989f6953ddd853fbfebbab651af0e2
SHA1d02cfe08c0beced1673eac3c01c98dfaf2cad44a
SHA256f5b881c79e86cd7c2c98f03a46e416f9f2b1ae7f5be18de5986a8e2acf6d7dda
SHA512b251906fe78b1cd08c286be77c3ae60dd24b6b69a9ada32219bed5be5dc4715c997c9458cbf2aadcaf9b492b32138fb1666f690215d99e91fc8c6e5601ebc5fd
-
Filesize
5.9MB
MD52226691e5b312ebc9964521d9450caee
SHA1bbc27b846fb12907f63969addc5170949205a510
SHA2562584b88da987a707ef56e8e44834336d950741a12c9503619d502e2c68b40f89
SHA512e12cdf6d2eec6254ecedeff979a6bdcbcaf720dfd1da65b1580c9552a9261d749037a701e833aaa097f08bb3d61d8e14245fed624acf5c51eb13378c831b8433
-
Filesize
5.9MB
MD5d2321d6ad827f84c0e25a0355205c341
SHA1ea16b2f68cee8f5fcbcc42628a09e6e6e277f33b
SHA25661c2a5c13429ca91cd7aeccf234f4bfeee946774ca24bcebb5f0178fe91815e7
SHA51235432de8506a6cb3ea7403e2fd4f07306e04efd2bf88048b2ffb1ffcf3f8d0558368e208524d2b1ed1a5d03bf7de826acbb21776a359f293970460a61a5ca031
-
Filesize
5.9MB
MD57a8a406cea7d728fdbef1dc176210af4
SHA165a9d40e6c3d9ec1f201f854757d32ba1d6c072a
SHA2561fd90f29cb3891c8ae08017ca2c5a6cf7aad6d4f2a704cb2b42149c74b861398
SHA51261d4154db89b0da73914842fa82153cfd8f400c85c5a50e367bd5549c0e05b8f429b5a372ea92a802e507bec043138f338531cfa95f29616598df09d79b4d559
-
Filesize
5.9MB
MD57112e9db146f8597737feefd00a5cca5
SHA1f801d13c8eec2e389e4dd284ac897048bc133290
SHA25688c163d52f61c65852d7d6d09dc8b3bbf5a67ee5a7abdb7c7dd22bdc8e674d13
SHA51263e0558df208314177835d6320b95e6d023afcf1c4e07bdf951ac62d6de471e2f165bb54d8fb695e44bc889e74af4fcc04e4fd3cc5e5e4e77d6e9c22a9cdfa1a
-
Filesize
5.9MB
MD5c9c100f88c441d7c55ef2d99583dd93a
SHA1291f55ccb87a583ae03d92a56587f1dd46631096
SHA2562b4c602b6fd2ce19e9a15cd8a84a0bc4b3c6b8a0aaf0c44a4e8a83208f6720e2
SHA51268ad62ed955369b4bbc6245d2ecc4db1d7bccf2cc840d65bdaed1a6f1277fa436b7b41954e7a0be4caea41eda42abceafb0e896e6af6eb666d2e8b2c35514329
-
Filesize
5.9MB
MD55cd79630eaf5efbb761c3792ac8083d7
SHA149417db1f0063ee5b4c6bfa9fcbbec360c062f39
SHA2566f3575b3b7bec234a627317a48d643ac1fcf40a3c96889f972c880cf39a55cd9
SHA5127b12ba18a12f6f2eed3b51b011efa8c3c1ca2db97075eb91148c8214cb13a42d2bb5c06772fb32045d6bdea735792c4aa1678fc694f3fdf0cb974696b95b0edd
-
Filesize
5.9MB
MD50674639156f6f360f78f229d27ffb959
SHA1115427ffc97e4f17fa9c5a3a2484de30c9e8f13f
SHA256782166ed587084260148b39afb8806375f9a8c1f04ab7c0a666138cb3a903ff7
SHA5128d07348e13ba84e2c73140bbc1ffd5d132242dffffa4b5062f9b32d25110d799a31a7b31aef266c9691f7d5bce7f7bcd4e437c8e17db663987bfd1fab28962b1
-
Filesize
5.9MB
MD5bb5c37d288c14d46d5e1c36391edf134
SHA1c719f1b161101edab685da0e08908a5b335ff1fb
SHA256034d07f8c9f5640fa89ecb198f66618f32057d67e64a878b0ceb71621484e4af
SHA512f0cec7f5a8f9bf16db0c041e0cb254931319123266a3e5e4f95551704d9c485e07035ef35ad758d5530d3e4af535f0d1d3695e6514a49207ca723b027eb01d13
-
Filesize
5.9MB
MD550baaa22cda1d2c5fa4a763809864b88
SHA1ad33ba5e3bba14cfab717bd47c834116141b2120
SHA256eaf965c5bf162742b5f7f5c60119db2044f6f2e242d6bbfc1a0b89c50284b0f8
SHA5127938031a5af05623342150528a535f67212ab184380a4708062fdfd0b4e70f3e0381890a037ea46276a9ab9ed4b7930dbf803b6756fec58ee6849607e19a7963
-
Filesize
5.9MB
MD56358d03daf882b463af2c2bdebdba80b
SHA18c07bb0f100c08af08a7be56ebb55b24108d4471
SHA2569b5500872dde8bcf0407bd149ef5279945ac55de832c3827111fbf18ae736b56
SHA512ce7516a4ece1b152df3934325a53973c52e5cc7c1294659254fb1316ddf92e215ea8738bcbaf8a551010442ed1e5ab562d7461da42520b0bbf68ec9f37b0609c
-
Filesize
5.9MB
MD5807c7a9e6aa691482a8ee19fce008ff8
SHA15153a15937eec48e35cd64ead626d8e447859064
SHA2561fdbf31144803688b31fd068287af8e5f9ed67b4796f1b08987a23dd0575804e
SHA512fbda428ae02c506dcd00032eceeaf969872b4ff426d62d37670042fbae3ba7a7634644f2edfceb632d269ce6a6d64bdd909e39c93cd9b97187336f103ed3f847