Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/09/2024, 10:52
Behavioral task
behavioral1
Sample
2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20240708-en
General
-
Target
2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
3906479d6009f30b05e81ecb3569c02b
-
SHA1
c44ee5f2618cde1831bc173b59daffcbfdc277f9
-
SHA256
9be8b62085a4070a54db7507f884fdb6be2bc8acc373a0fa281e14e1c8a31a77
-
SHA512
2d99e9dbf2d001322db0441c271fa02cfeda53ec34d2ff4bc92e2c025b57f06bc72ddaae8bc895ccbc376376c469cfaac81fd63d79dbbcebc255f21c1cc3afac
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:T+856utgpPF8u/7o
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral2/files/0x00090000000233ae-4.dat cobalt_reflective_dll behavioral2/files/0x000700000002340e-10.dat cobalt_reflective_dll behavioral2/files/0x000700000002340f-11.dat cobalt_reflective_dll behavioral2/files/0x0007000000023410-22.dat cobalt_reflective_dll behavioral2/files/0x0007000000023411-28.dat cobalt_reflective_dll behavioral2/files/0x000b000000023401-35.dat cobalt_reflective_dll behavioral2/files/0x0007000000023412-40.dat cobalt_reflective_dll behavioral2/files/0x0007000000023413-46.dat cobalt_reflective_dll behavioral2/files/0x0007000000023415-59.dat cobalt_reflective_dll behavioral2/files/0x0007000000023416-67.dat cobalt_reflective_dll behavioral2/files/0x0007000000023417-73.dat cobalt_reflective_dll behavioral2/files/0x0007000000023414-54.dat cobalt_reflective_dll behavioral2/files/0x0007000000023418-82.dat cobalt_reflective_dll behavioral2/files/0x0007000000023419-89.dat cobalt_reflective_dll behavioral2/files/0x000700000002341a-96.dat cobalt_reflective_dll behavioral2/files/0x000700000002341c-104.dat cobalt_reflective_dll behavioral2/files/0x000700000002341f-127.dat cobalt_reflective_dll behavioral2/files/0x0007000000023420-136.dat cobalt_reflective_dll behavioral2/files/0x000700000002341e-124.dat cobalt_reflective_dll behavioral2/files/0x000700000002341d-121.dat cobalt_reflective_dll behavioral2/files/0x000700000002341b-109.dat cobalt_reflective_dll -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral2/memory/3160-0-0x00007FF72B9B0000-0x00007FF72BD04000-memory.dmp xmrig behavioral2/files/0x00090000000233ae-4.dat xmrig behavioral2/memory/2476-8-0x00007FF69A920000-0x00007FF69AC74000-memory.dmp xmrig behavioral2/files/0x000700000002340e-10.dat xmrig behavioral2/files/0x000700000002340f-11.dat xmrig behavioral2/memory/4544-23-0x00007FF786060000-0x00007FF7863B4000-memory.dmp xmrig behavioral2/memory/3000-24-0x00007FF78B640000-0x00007FF78B994000-memory.dmp xmrig behavioral2/files/0x0007000000023410-22.dat xmrig behavioral2/memory/3596-20-0x00007FF647A40000-0x00007FF647D94000-memory.dmp xmrig behavioral2/files/0x0007000000023411-28.dat xmrig behavioral2/memory/4284-30-0x00007FF714120000-0x00007FF714474000-memory.dmp xmrig behavioral2/files/0x000b000000023401-35.dat xmrig behavioral2/memory/940-38-0x00007FF764890000-0x00007FF764BE4000-memory.dmp xmrig behavioral2/files/0x0007000000023412-40.dat xmrig behavioral2/memory/2488-44-0x00007FF6FCA50000-0x00007FF6FCDA4000-memory.dmp xmrig behavioral2/files/0x0007000000023413-46.dat xmrig behavioral2/files/0x0007000000023415-59.dat xmrig behavioral2/memory/4980-65-0x00007FF656710000-0x00007FF656A64000-memory.dmp xmrig behavioral2/files/0x0007000000023416-67.dat xmrig behavioral2/files/0x0007000000023417-73.dat xmrig behavioral2/memory/5052-74-0x00007FF6617F0000-0x00007FF661B44000-memory.dmp xmrig behavioral2/memory/4148-72-0x00007FF7EE620000-0x00007FF7EE974000-memory.dmp xmrig behavioral2/memory/4544-71-0x00007FF786060000-0x00007FF7863B4000-memory.dmp xmrig behavioral2/memory/3596-62-0x00007FF647A40000-0x00007FF647D94000-memory.dmp xmrig behavioral2/memory/2476-61-0x00007FF69A920000-0x00007FF69AC74000-memory.dmp xmrig behavioral2/memory/692-60-0x00007FF6FF320000-0x00007FF6FF674000-memory.dmp xmrig behavioral2/memory/3160-56-0x00007FF72B9B0000-0x00007FF72BD04000-memory.dmp xmrig behavioral2/files/0x0007000000023414-54.dat xmrig behavioral2/memory/2104-52-0x00007FF6AC110000-0x00007FF6AC464000-memory.dmp xmrig behavioral2/memory/3000-79-0x00007FF78B640000-0x00007FF78B994000-memory.dmp xmrig behavioral2/files/0x0007000000023418-82.dat xmrig behavioral2/files/0x0007000000023419-89.dat xmrig behavioral2/memory/2064-94-0x00007FF6C0E90000-0x00007FF6C11E4000-memory.dmp xmrig behavioral2/files/0x000700000002341a-96.dat xmrig behavioral2/memory/3116-98-0x00007FF693970000-0x00007FF693CC4000-memory.dmp xmrig behavioral2/files/0x000700000002341c-104.dat xmrig behavioral2/memory/4036-106-0x00007FF6D2300000-0x00007FF6D2654000-memory.dmp xmrig behavioral2/memory/1912-119-0x00007FF797690000-0x00007FF7979E4000-memory.dmp xmrig behavioral2/files/0x000700000002341f-127.dat xmrig behavioral2/memory/740-135-0x00007FF708930000-0x00007FF708C84000-memory.dmp xmrig behavioral2/files/0x0007000000023420-136.dat xmrig behavioral2/memory/5052-132-0x00007FF6617F0000-0x00007FF661B44000-memory.dmp xmrig behavioral2/memory/4192-131-0x00007FF7F8650000-0x00007FF7F89A4000-memory.dmp xmrig behavioral2/memory/4148-129-0x00007FF7EE620000-0x00007FF7EE974000-memory.dmp xmrig behavioral2/memory/4980-126-0x00007FF656710000-0x00007FF656A64000-memory.dmp xmrig behavioral2/files/0x000700000002341e-124.dat xmrig behavioral2/files/0x000700000002341d-121.dat xmrig behavioral2/memory/4224-118-0x00007FF7E33D0000-0x00007FF7E3724000-memory.dmp xmrig behavioral2/memory/4484-110-0x00007FF74DF00000-0x00007FF74E254000-memory.dmp xmrig behavioral2/files/0x000700000002341b-109.dat xmrig behavioral2/memory/2104-105-0x00007FF6AC110000-0x00007FF6AC464000-memory.dmp xmrig behavioral2/memory/4456-85-0x00007FF79C320000-0x00007FF79C674000-memory.dmp xmrig behavioral2/memory/4284-83-0x00007FF714120000-0x00007FF714474000-memory.dmp xmrig behavioral2/memory/4456-138-0x00007FF79C320000-0x00007FF79C674000-memory.dmp xmrig behavioral2/memory/2064-139-0x00007FF6C0E90000-0x00007FF6C11E4000-memory.dmp xmrig behavioral2/memory/4036-140-0x00007FF6D2300000-0x00007FF6D2654000-memory.dmp xmrig behavioral2/memory/4484-141-0x00007FF74DF00000-0x00007FF74E254000-memory.dmp xmrig behavioral2/memory/4224-142-0x00007FF7E33D0000-0x00007FF7E3724000-memory.dmp xmrig behavioral2/memory/1912-143-0x00007FF797690000-0x00007FF7979E4000-memory.dmp xmrig behavioral2/memory/4192-144-0x00007FF7F8650000-0x00007FF7F89A4000-memory.dmp xmrig behavioral2/memory/740-145-0x00007FF708930000-0x00007FF708C84000-memory.dmp xmrig behavioral2/memory/2476-146-0x00007FF69A920000-0x00007FF69AC74000-memory.dmp xmrig behavioral2/memory/3596-147-0x00007FF647A40000-0x00007FF647D94000-memory.dmp xmrig behavioral2/memory/4544-148-0x00007FF786060000-0x00007FF7863B4000-memory.dmp xmrig -
Executes dropped EXE 21 IoCs
pid Process 2476 rdBrsgg.exe 3596 tveXXzZ.exe 4544 UmOLydy.exe 3000 rYuAQMx.exe 4284 peGALeh.exe 940 exAeyFo.exe 2488 wqKEzyO.exe 2104 ZnKdbsq.exe 692 AAlkcFq.exe 4980 EIwPLFB.exe 4148 bshKZsq.exe 5052 QyiiUJq.exe 4456 SfWITYd.exe 2064 vaZvAae.exe 3116 glONpBB.exe 4036 sbBUQeD.exe 4484 yLfvMmF.exe 4224 ttstGyH.exe 1912 PfcRAxL.exe 4192 YQgUTEq.exe 740 LakLfVJ.exe -
resource yara_rule behavioral2/memory/3160-0-0x00007FF72B9B0000-0x00007FF72BD04000-memory.dmp upx behavioral2/files/0x00090000000233ae-4.dat upx behavioral2/memory/2476-8-0x00007FF69A920000-0x00007FF69AC74000-memory.dmp upx behavioral2/files/0x000700000002340e-10.dat upx behavioral2/files/0x000700000002340f-11.dat upx behavioral2/memory/4544-23-0x00007FF786060000-0x00007FF7863B4000-memory.dmp upx behavioral2/memory/3000-24-0x00007FF78B640000-0x00007FF78B994000-memory.dmp upx behavioral2/files/0x0007000000023410-22.dat upx behavioral2/memory/3596-20-0x00007FF647A40000-0x00007FF647D94000-memory.dmp upx behavioral2/files/0x0007000000023411-28.dat upx behavioral2/memory/4284-30-0x00007FF714120000-0x00007FF714474000-memory.dmp upx behavioral2/files/0x000b000000023401-35.dat upx behavioral2/memory/940-38-0x00007FF764890000-0x00007FF764BE4000-memory.dmp upx behavioral2/files/0x0007000000023412-40.dat upx behavioral2/memory/2488-44-0x00007FF6FCA50000-0x00007FF6FCDA4000-memory.dmp upx behavioral2/files/0x0007000000023413-46.dat upx behavioral2/files/0x0007000000023415-59.dat upx behavioral2/memory/4980-65-0x00007FF656710000-0x00007FF656A64000-memory.dmp upx behavioral2/files/0x0007000000023416-67.dat upx behavioral2/files/0x0007000000023417-73.dat upx behavioral2/memory/5052-74-0x00007FF6617F0000-0x00007FF661B44000-memory.dmp upx behavioral2/memory/4148-72-0x00007FF7EE620000-0x00007FF7EE974000-memory.dmp upx behavioral2/memory/4544-71-0x00007FF786060000-0x00007FF7863B4000-memory.dmp upx behavioral2/memory/3596-62-0x00007FF647A40000-0x00007FF647D94000-memory.dmp upx behavioral2/memory/2476-61-0x00007FF69A920000-0x00007FF69AC74000-memory.dmp upx behavioral2/memory/692-60-0x00007FF6FF320000-0x00007FF6FF674000-memory.dmp upx behavioral2/memory/3160-56-0x00007FF72B9B0000-0x00007FF72BD04000-memory.dmp upx behavioral2/files/0x0007000000023414-54.dat upx behavioral2/memory/2104-52-0x00007FF6AC110000-0x00007FF6AC464000-memory.dmp upx behavioral2/memory/3000-79-0x00007FF78B640000-0x00007FF78B994000-memory.dmp upx behavioral2/files/0x0007000000023418-82.dat upx behavioral2/files/0x0007000000023419-89.dat upx behavioral2/memory/2064-94-0x00007FF6C0E90000-0x00007FF6C11E4000-memory.dmp upx behavioral2/files/0x000700000002341a-96.dat upx behavioral2/memory/3116-98-0x00007FF693970000-0x00007FF693CC4000-memory.dmp upx behavioral2/files/0x000700000002341c-104.dat upx behavioral2/memory/4036-106-0x00007FF6D2300000-0x00007FF6D2654000-memory.dmp upx behavioral2/memory/1912-119-0x00007FF797690000-0x00007FF7979E4000-memory.dmp upx behavioral2/files/0x000700000002341f-127.dat upx behavioral2/memory/740-135-0x00007FF708930000-0x00007FF708C84000-memory.dmp upx behavioral2/files/0x0007000000023420-136.dat upx behavioral2/memory/5052-132-0x00007FF6617F0000-0x00007FF661B44000-memory.dmp upx behavioral2/memory/4192-131-0x00007FF7F8650000-0x00007FF7F89A4000-memory.dmp upx behavioral2/memory/4148-129-0x00007FF7EE620000-0x00007FF7EE974000-memory.dmp upx behavioral2/memory/4980-126-0x00007FF656710000-0x00007FF656A64000-memory.dmp upx behavioral2/files/0x000700000002341e-124.dat upx behavioral2/files/0x000700000002341d-121.dat upx behavioral2/memory/4224-118-0x00007FF7E33D0000-0x00007FF7E3724000-memory.dmp upx behavioral2/memory/4484-110-0x00007FF74DF00000-0x00007FF74E254000-memory.dmp upx behavioral2/files/0x000700000002341b-109.dat upx behavioral2/memory/2104-105-0x00007FF6AC110000-0x00007FF6AC464000-memory.dmp upx behavioral2/memory/4456-85-0x00007FF79C320000-0x00007FF79C674000-memory.dmp upx behavioral2/memory/4284-83-0x00007FF714120000-0x00007FF714474000-memory.dmp upx behavioral2/memory/4456-138-0x00007FF79C320000-0x00007FF79C674000-memory.dmp upx behavioral2/memory/2064-139-0x00007FF6C0E90000-0x00007FF6C11E4000-memory.dmp upx behavioral2/memory/4036-140-0x00007FF6D2300000-0x00007FF6D2654000-memory.dmp upx behavioral2/memory/4484-141-0x00007FF74DF00000-0x00007FF74E254000-memory.dmp upx behavioral2/memory/4224-142-0x00007FF7E33D0000-0x00007FF7E3724000-memory.dmp upx behavioral2/memory/1912-143-0x00007FF797690000-0x00007FF7979E4000-memory.dmp upx behavioral2/memory/4192-144-0x00007FF7F8650000-0x00007FF7F89A4000-memory.dmp upx behavioral2/memory/740-145-0x00007FF708930000-0x00007FF708C84000-memory.dmp upx behavioral2/memory/2476-146-0x00007FF69A920000-0x00007FF69AC74000-memory.dmp upx behavioral2/memory/3596-147-0x00007FF647A40000-0x00007FF647D94000-memory.dmp upx behavioral2/memory/4544-148-0x00007FF786060000-0x00007FF7863B4000-memory.dmp upx -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\System\glONpBB.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\sbBUQeD.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\rdBrsgg.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\tveXXzZ.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\UmOLydy.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\rYuAQMx.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\wqKEzyO.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\SfWITYd.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\yLfvMmF.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\LakLfVJ.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\exAeyFo.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\ZnKdbsq.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\AAlkcFq.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\QyiiUJq.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\vaZvAae.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\PfcRAxL.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\peGALeh.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\EIwPLFB.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\bshKZsq.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\ttstGyH.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\YQgUTEq.exe 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe Token: SeLockMemoryPrivilege 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 3160 wrote to memory of 2476 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 83 PID 3160 wrote to memory of 2476 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 83 PID 3160 wrote to memory of 3596 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 84 PID 3160 wrote to memory of 3596 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 84 PID 3160 wrote to memory of 4544 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 85 PID 3160 wrote to memory of 4544 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 85 PID 3160 wrote to memory of 3000 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 86 PID 3160 wrote to memory of 3000 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 86 PID 3160 wrote to memory of 4284 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 87 PID 3160 wrote to memory of 4284 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 87 PID 3160 wrote to memory of 940 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 88 PID 3160 wrote to memory of 940 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 88 PID 3160 wrote to memory of 2488 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 89 PID 3160 wrote to memory of 2488 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 89 PID 3160 wrote to memory of 2104 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 90 PID 3160 wrote to memory of 2104 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 90 PID 3160 wrote to memory of 692 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 91 PID 3160 wrote to memory of 692 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 91 PID 3160 wrote to memory of 4980 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 92 PID 3160 wrote to memory of 4980 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 92 PID 3160 wrote to memory of 4148 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 93 PID 3160 wrote to memory of 4148 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 93 PID 3160 wrote to memory of 5052 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 94 PID 3160 wrote to memory of 5052 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 94 PID 3160 wrote to memory of 4456 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 95 PID 3160 wrote to memory of 4456 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 95 PID 3160 wrote to memory of 2064 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 96 PID 3160 wrote to memory of 2064 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 96 PID 3160 wrote to memory of 3116 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 97 PID 3160 wrote to memory of 3116 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 97 PID 3160 wrote to memory of 4036 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 98 PID 3160 wrote to memory of 4036 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 98 PID 3160 wrote to memory of 4484 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 99 PID 3160 wrote to memory of 4484 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 99 PID 3160 wrote to memory of 4224 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 100 PID 3160 wrote to memory of 4224 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 100 PID 3160 wrote to memory of 1912 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 101 PID 3160 wrote to memory of 1912 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 101 PID 3160 wrote to memory of 4192 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 102 PID 3160 wrote to memory of 4192 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 102 PID 3160 wrote to memory of 740 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 103 PID 3160 wrote to memory of 740 3160 2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\System\rdBrsgg.exeC:\Windows\System\rdBrsgg.exe2⤵
- Executes dropped EXE
PID:2476
-
-
C:\Windows\System\tveXXzZ.exeC:\Windows\System\tveXXzZ.exe2⤵
- Executes dropped EXE
PID:3596
-
-
C:\Windows\System\UmOLydy.exeC:\Windows\System\UmOLydy.exe2⤵
- Executes dropped EXE
PID:4544
-
-
C:\Windows\System\rYuAQMx.exeC:\Windows\System\rYuAQMx.exe2⤵
- Executes dropped EXE
PID:3000
-
-
C:\Windows\System\peGALeh.exeC:\Windows\System\peGALeh.exe2⤵
- Executes dropped EXE
PID:4284
-
-
C:\Windows\System\exAeyFo.exeC:\Windows\System\exAeyFo.exe2⤵
- Executes dropped EXE
PID:940
-
-
C:\Windows\System\wqKEzyO.exeC:\Windows\System\wqKEzyO.exe2⤵
- Executes dropped EXE
PID:2488
-
-
C:\Windows\System\ZnKdbsq.exeC:\Windows\System\ZnKdbsq.exe2⤵
- Executes dropped EXE
PID:2104
-
-
C:\Windows\System\AAlkcFq.exeC:\Windows\System\AAlkcFq.exe2⤵
- Executes dropped EXE
PID:692
-
-
C:\Windows\System\EIwPLFB.exeC:\Windows\System\EIwPLFB.exe2⤵
- Executes dropped EXE
PID:4980
-
-
C:\Windows\System\bshKZsq.exeC:\Windows\System\bshKZsq.exe2⤵
- Executes dropped EXE
PID:4148
-
-
C:\Windows\System\QyiiUJq.exeC:\Windows\System\QyiiUJq.exe2⤵
- Executes dropped EXE
PID:5052
-
-
C:\Windows\System\SfWITYd.exeC:\Windows\System\SfWITYd.exe2⤵
- Executes dropped EXE
PID:4456
-
-
C:\Windows\System\vaZvAae.exeC:\Windows\System\vaZvAae.exe2⤵
- Executes dropped EXE
PID:2064
-
-
C:\Windows\System\glONpBB.exeC:\Windows\System\glONpBB.exe2⤵
- Executes dropped EXE
PID:3116
-
-
C:\Windows\System\sbBUQeD.exeC:\Windows\System\sbBUQeD.exe2⤵
- Executes dropped EXE
PID:4036
-
-
C:\Windows\System\yLfvMmF.exeC:\Windows\System\yLfvMmF.exe2⤵
- Executes dropped EXE
PID:4484
-
-
C:\Windows\System\ttstGyH.exeC:\Windows\System\ttstGyH.exe2⤵
- Executes dropped EXE
PID:4224
-
-
C:\Windows\System\PfcRAxL.exeC:\Windows\System\PfcRAxL.exe2⤵
- Executes dropped EXE
PID:1912
-
-
C:\Windows\System\YQgUTEq.exeC:\Windows\System\YQgUTEq.exe2⤵
- Executes dropped EXE
PID:4192
-
-
C:\Windows\System\LakLfVJ.exeC:\Windows\System\LakLfVJ.exe2⤵
- Executes dropped EXE
PID:740
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD563ffaab42de1499931bdff9a339bfde0
SHA13db1728926f6eec24d31f5666a491454453d3c35
SHA256858708ac1d03c9f9696d00f1ebb3c3dbe9a6806538b349771db25788b14e0cc2
SHA512c3eb429959c7ac277d0585a2ccb0533f9276e61a155643343624184740b377c55f2f2cb6d50cfcf61d37a515f4c978b6c7b207e625bb14f678df4182dd0204c4
-
Filesize
5.9MB
MD5f17981111eb31c8fa1e54717307fbcbf
SHA1e7da0808bb3a61303abaa39728d5fcc5378dafff
SHA2568854854000eba116249ff715136bb2876bf3bdf74c3d7df2fd2374c5716d46b0
SHA512115429c5c2236a63cd381a60bb71ed6cac77e76c62e92076ea01ad1016e9972500953f01a8511bd978c2bf2b46a2f5341c54a281bfac8c3dd715109409e08e56
-
Filesize
5.9MB
MD5960a571f022fb02dad9c73ecc66e9d20
SHA1ce91cf83b527e115e49361c716d42360b3aa53ef
SHA2566748a85cfc5425bc65e092b01686865008b7752d277793418c21ae5bcf71658c
SHA5124fac40a5001015b37d628c5f6227a76bf9b20f87b302f926aa5be7c3b695fc247d081316555f19edde42c0643556bdab59c1d83d741081eeadd8c1b8461fd9ff
-
Filesize
5.9MB
MD5e1966c4aae61f64ca058273bb165d9a5
SHA1f9da8167aaceea2e9dc1333263183490f28ba180
SHA256a6fe9a69752d9f564be8f426235e230149f42bb44f442bebd6f5bf7ec1cf65f2
SHA5124e3217fcdab5179854d8c38b48035c53b2415d691bfdf22609430a35cca2a5de0d41672c94f1fd7cd99e80fb17692b90155130b05411ba0f578a59630a728c72
-
Filesize
5.9MB
MD506d41e6c65f64fac2c455aa87d507d30
SHA1736a5fdf9b2d9d09055e31ab2621d8ccf0d87cd1
SHA2567c1653690da6045ce92538b660951d6972d1766c088d6bfcef634a65e121b091
SHA51243a9c3cc9a3d7a88b158f71c28f4b4c94b0eed764f734adc311cdd6fb08d4aedfe8c06349cd09b2bae184f4524e974ed6c05fd918a1d9d206f7a36659b050643
-
Filesize
5.9MB
MD5cd721e0525ff7fdc95e22d5f25e06bd2
SHA131a8cd9512802bced6a2a13260cb39d703583397
SHA2560f9283d6372b3b4f59ea497ee23b114c9326a928f91442e373b104d4370b3149
SHA512bee38051d2c73d7f6badf884cbef55f324158bb2a4af23e8b445c5fda3aecbe12439f011c3c3626bd743ffd829f3880f308be810ddd5102865688023188ade4a
-
Filesize
5.9MB
MD51579c6c94b616b2e071de6499bea9a12
SHA186ff28008f372a903da888563de199328fff73f2
SHA25640a8b49e70664ee650f0e69c20f6a698766e36b6d4be247f4038c47a28c82a4d
SHA5129d9eb0e78945e475e8c9934c403dad4d6ce7a5ee105c009dfd0f29dcc9cd000378f789d7b4bb8f985090939fb3c81d9b4fd191bc1798764b50ce17a9ca719c96
-
Filesize
5.9MB
MD50409235c15c1acfa647dd1753fe0564c
SHA1ee6593a615004cfaff7824464256eade253ff034
SHA2567d4b68f80cc106c02c1c3ee72256da6f80cee523e3b6a5bb0094d6dc0ae82ebd
SHA512d2f875da5204e53767b9c1fcaa396f65554935388c8e2ed7d11025cc8d544ef5ba2c7ce365f0771eadd1ae14b41ff0585b95caa8993e5321cebfc86764c1b8ae
-
Filesize
5.9MB
MD5d61daadf09d8303d8af9eb2dcbe4431a
SHA11454d60dd692f26300eb487ed67bcdfb87c4afae
SHA2566e1d1d3558af1da34cccda00db7f50839b247662d5cc3910cfa491aae42c4273
SHA5124d0b4b8047ac7e0b23c75e7df018ed325cc16d4d1e0a32c66cac971463d986342705c6eb272931938e49e1fbb683ad114a20f8163c753d19cc9db4c3085bda94
-
Filesize
5.9MB
MD5c197342d9aa6395fe0423c27676df88e
SHA1f03af92cf5fbfe48921dcec9268d4f647d2e64be
SHA25645625eb5311ff9703d6befedf0a7ed307ceaa80dc6a29b69e23206cb5c64b071
SHA512905d74510a6db25a75abb6103661be7ebcdef6c478255b88a42121b588b6c942b7e916566c77d2b8d1a2d4351e0ea8a2e1bf4a193e57b9b78d04d4cbf448beb0
-
Filesize
5.9MB
MD59495ae27073532b3742ce032eaccc94c
SHA13a72fcf243ced8c6583c236e909f4281f5b7bdda
SHA256b78756cbe7541deb05b1f5d93d9301361a997dad5dda100bb2e20a72db565046
SHA51214a88ff7c4014810f84c76f1c866282518a34131a213dc8e47e877bf78992bf3337afa7ec391c80eb4a86f0719dfca3d55fb239e0e77aaa90c86323520572c82
-
Filesize
5.9MB
MD532d7de3f572854a1bbcd1b1c7bb17405
SHA1ac8c5ddde64378bc06a9852dfbf367d9ab622a17
SHA25644627906b1b6bd5715e106ebfc3ab34f2cd7e0224fa65a661a6dccf8e7ce4f0a
SHA5129263f075606aa960facb282bf4eba3374a2ec1664546f9a402c9d6ca7e976e69f9ea5ba1ed6bcedf2a79b95065844529c217d003777fd17428005d87d9704ad1
-
Filesize
5.9MB
MD5cfac48c27fbe9a763dfd296c1f172d23
SHA163b4ae252bf281d57a70ce71a8f47c040766e2ed
SHA25614e8d88db9b180e21737f71e72967fb4cc0dae51488e5f975c222f3d2bd00fac
SHA5124672bc67a33b66e15af30bf7721e42eeb703ecf27fbbfd45b372ad1130196d171c86ed9f6d402c85657eeb1cd3d34ab6c6b65b77c6692dfba4fb7057a952a2eb
-
Filesize
5.9MB
MD5962f0eb39dc43b7053e83c5a160d7260
SHA1e418023fd0f876f3608e692308ef2f76cf01d320
SHA256170a928cf5040efeb51cd5aa21eac887b54d86b93bf6314526336ed64c87281b
SHA51203d2873f3d768711fd4de9b6c9c55a3aa44edd055accbd07e3d63641af4c6ba2f569656046177bc3a4ea16a6a33db3d8b6b6e82d07b19afa316d35474765de07
-
Filesize
5.9MB
MD53c535043715ecc14a53239203e00a551
SHA1118daa3b81022f947827f72632a4130e1effb0bb
SHA2560398a31c00b529a376c9c9215ffda0c66f456858a2fe9c4ad85e0bd5e15e1ae2
SHA512e8c32f961b9430473cf3e37239eaa0b663dff3dea658600eb52e35ea038076162bbaac94578440151bbbc041f6493cef4fc31ac9afeb2bfb50e5b65757203094
-
Filesize
5.9MB
MD595897696cc65d394d79d5767fb9d4166
SHA18e3354409a37d998be88a45199751ddffa8d9ea2
SHA2567343519c5cd7ceef2447ebc502bbba9d887f4c9d9d735fd74387ef138be4a0b0
SHA512d8caa5fae4c888f450cec2a0b9f8b299564245ec6c57ac1580cb2b10877ec933a30e80d63fdb6d345b4ef3d7e69dd171a9cb93d2abbc3476c72c3625ed4268fe
-
Filesize
5.9MB
MD5445cb630c426a540671a0de6045f37e6
SHA14b14fb35062d36aad2024529f63971f1cb281f3f
SHA256976bfc3c6b39fd7e1ad99a83a4180064fc6d2bf82c39471a0e587d4eb9501d1c
SHA512253b0c96e93ef0b7ccd9a08efda5133c2cb2c68c5788d71921a20a4768f5a538e826db1abd2e4694688f973a9c086d59d512da5a75d9feb9dee464003e9dc58f
-
Filesize
5.9MB
MD58e51d9e754ce9ef86aee2e6938d3061e
SHA185d57b51c4a5e0319c8a3c079c09354450a779c2
SHA2563f4207650a1e8504282a255d76e3f5b9df2a22243d44b5a33cec4e8080a1064d
SHA5125cc217fcd89d91abfdf807262a017cd6af739264d444bdb2d9a4a85cd3929749540e78e38d85e7d78dad7ba465fee64de0e030328e4212a1214d6a9230f1acea
-
Filesize
5.9MB
MD53cb9b8591515582b2ee440c57cffbfc7
SHA1061fa621aec5fd8b7a28b5022e7b1326b892a1ed
SHA256b8925cc692a5912457435d3c229050fe55cfa0631f0c3cd0d1872e247cf1e948
SHA51250aa4b7f530928092caaf3eaa2dd18b455c0ceb61ba61195c9897863199fea0246a41b4d7fa8a0905a93d51d43771df7e014d779dac25b1a03de057074d97d92
-
Filesize
5.9MB
MD5442a0965104a2c1981ef4f9623109a94
SHA1e0cb248ee1ff46453555c57d0d09a97bdca81731
SHA256bbab66215496de260c446d865e389cdfa82ca7980411227b4c7afdb0db3133c9
SHA51269dfa40b32f3ad612e17305be2134d65404b9b4a253a5aafa9e9154c68504cba9d086ae87407f8074313387844a63ac0dbb62c5d7aff0e41cec4e032ebb94538
-
Filesize
5.9MB
MD5adeeb84f771ddc8ce44ad89a1e22c43e
SHA102f2b118eae6e663e7030705d1edda9ea51d0c75
SHA256518903fdd72f667eba9e02a3f7f779170afc564e59e03733e84a05ca7fdb30ba
SHA512eba06f581530f1b132a2507a0544741a0ea932b1174e5cf6e3390b3b122e2b2e013f3c0e83cb6b6f162dbf9e7ee050346837be66870cc2d9f4342009a942a226