Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 18:55
Behavioral task
behavioral1
Sample
2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20240903-en
General
-
Target
2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
313868a1a130554e4f091f298496ea56
-
SHA1
879979388ab9415176380b98e1e0370b10e39556
-
SHA256
d2650632c3364598ca0cb43c7ddf2cfbeff3c8efc8dffe09eaf211c55fb56d39
-
SHA512
a8859e5457397d536ed2e3493f89f48ce09fb281fe02e99f4dbb2f2be7b7acca9b457ce1a59061765579339f95707448404904847a516929c9e385a6487bfaa0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lUS
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral2/files/0x000a000000023c05-6.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c9e-11.dat cobalt_reflective_dll behavioral2/files/0x0007000000023ca1-25.dat cobalt_reflective_dll behavioral2/files/0x0007000000023ca0-27.dat cobalt_reflective_dll behavioral2/files/0x0007000000023ca3-36.dat cobalt_reflective_dll behavioral2/files/0x0007000000023ca4-43.dat cobalt_reflective_dll behavioral2/files/0x0007000000023ca5-47.dat cobalt_reflective_dll behavioral2/files/0x0007000000023ca6-61.dat cobalt_reflective_dll behavioral2/files/0x0007000000023ca7-69.dat cobalt_reflective_dll behavioral2/files/0x0007000000023caa-83.dat cobalt_reflective_dll behavioral2/files/0x0008000000023c9b-87.dat cobalt_reflective_dll behavioral2/files/0x0007000000023cab-99.dat cobalt_reflective_dll behavioral2/files/0x0007000000023ca9-93.dat cobalt_reflective_dll behavioral2/files/0x0007000000023ca8-77.dat cobalt_reflective_dll behavioral2/files/0x0007000000023ca2-40.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c9f-22.dat cobalt_reflective_dll behavioral2/files/0x0007000000023cac-104.dat cobalt_reflective_dll behavioral2/files/0x0007000000023caf-124.dat cobalt_reflective_dll behavioral2/files/0x0007000000023cb0-131.dat cobalt_reflective_dll behavioral2/files/0x0007000000023cad-127.dat cobalt_reflective_dll behavioral2/files/0x0007000000023cae-118.dat cobalt_reflective_dll -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
XMRig Miner payload 45 IoCs
resource yara_rule behavioral2/memory/4696-53-0x00007FF6E7FA0000-0x00007FF6E82F1000-memory.dmp xmrig behavioral2/memory/3464-91-0x00007FF783230000-0x00007FF783581000-memory.dmp xmrig behavioral2/memory/1176-86-0x00007FF7B0CF0000-0x00007FF7B1041000-memory.dmp xmrig behavioral2/memory/4704-44-0x00007FF7716C0000-0x00007FF771A11000-memory.dmp xmrig behavioral2/memory/3288-105-0x00007FF611910000-0x00007FF611C61000-memory.dmp xmrig behavioral2/memory/2544-117-0x00007FF6CA830000-0x00007FF6CAB81000-memory.dmp xmrig behavioral2/memory/2412-123-0x00007FF693850000-0x00007FF693BA1000-memory.dmp xmrig behavioral2/memory/3136-110-0x00007FF6F3540000-0x00007FF6F3891000-memory.dmp xmrig behavioral2/memory/3540-108-0x00007FF70E1D0000-0x00007FF70E521000-memory.dmp xmrig behavioral2/memory/1800-103-0x00007FF77DEC0000-0x00007FF77E211000-memory.dmp xmrig behavioral2/memory/1636-135-0x00007FF6E8000000-0x00007FF6E8351000-memory.dmp xmrig behavioral2/memory/988-136-0x00007FF78BBF0000-0x00007FF78BF41000-memory.dmp xmrig behavioral2/memory/700-134-0x00007FF752810000-0x00007FF752B61000-memory.dmp xmrig behavioral2/memory/2892-138-0x00007FF70D760000-0x00007FF70DAB1000-memory.dmp xmrig behavioral2/memory/408-137-0x00007FF688DA0000-0x00007FF6890F1000-memory.dmp xmrig behavioral2/memory/3256-139-0x00007FF7818E0000-0x00007FF781C31000-memory.dmp xmrig behavioral2/memory/752-140-0x00007FF7823E0000-0x00007FF782731000-memory.dmp xmrig behavioral2/memory/1176-141-0x00007FF7B0CF0000-0x00007FF7B1041000-memory.dmp xmrig behavioral2/memory/2972-149-0x00007FF766C90000-0x00007FF766FE1000-memory.dmp xmrig behavioral2/memory/1404-160-0x00007FF72B6E0000-0x00007FF72BA31000-memory.dmp xmrig behavioral2/memory/4076-159-0x00007FF795CA0000-0x00007FF795FF1000-memory.dmp xmrig behavioral2/memory/4052-164-0x00007FF75B6A0000-0x00007FF75B9F1000-memory.dmp xmrig behavioral2/memory/672-163-0x00007FF6A3240000-0x00007FF6A3591000-memory.dmp xmrig behavioral2/memory/1176-167-0x00007FF7B0CF0000-0x00007FF7B1041000-memory.dmp xmrig behavioral2/memory/3464-223-0x00007FF783230000-0x00007FF783581000-memory.dmp xmrig behavioral2/memory/1800-225-0x00007FF77DEC0000-0x00007FF77E211000-memory.dmp xmrig behavioral2/memory/3288-227-0x00007FF611910000-0x00007FF611C61000-memory.dmp xmrig behavioral2/memory/3540-229-0x00007FF70E1D0000-0x00007FF70E521000-memory.dmp xmrig behavioral2/memory/4704-231-0x00007FF7716C0000-0x00007FF771A11000-memory.dmp xmrig behavioral2/memory/3136-233-0x00007FF6F3540000-0x00007FF6F3891000-memory.dmp xmrig behavioral2/memory/2544-235-0x00007FF6CA830000-0x00007FF6CAB81000-memory.dmp xmrig behavioral2/memory/4696-237-0x00007FF6E7FA0000-0x00007FF6E82F1000-memory.dmp xmrig behavioral2/memory/700-246-0x00007FF752810000-0x00007FF752B61000-memory.dmp xmrig behavioral2/memory/408-248-0x00007FF688DA0000-0x00007FF6890F1000-memory.dmp xmrig behavioral2/memory/1636-250-0x00007FF6E8000000-0x00007FF6E8351000-memory.dmp xmrig behavioral2/memory/2892-252-0x00007FF70D760000-0x00007FF70DAB1000-memory.dmp xmrig behavioral2/memory/3256-254-0x00007FF7818E0000-0x00007FF781C31000-memory.dmp xmrig behavioral2/memory/2972-256-0x00007FF766C90000-0x00007FF766FE1000-memory.dmp xmrig behavioral2/memory/752-258-0x00007FF7823E0000-0x00007FF782731000-memory.dmp xmrig behavioral2/memory/1404-260-0x00007FF72B6E0000-0x00007FF72BA31000-memory.dmp xmrig behavioral2/memory/4076-266-0x00007FF795CA0000-0x00007FF795FF1000-memory.dmp xmrig behavioral2/memory/2412-268-0x00007FF693850000-0x00007FF693BA1000-memory.dmp xmrig behavioral2/memory/4052-272-0x00007FF75B6A0000-0x00007FF75B9F1000-memory.dmp xmrig behavioral2/memory/988-274-0x00007FF78BBF0000-0x00007FF78BF41000-memory.dmp xmrig behavioral2/memory/672-270-0x00007FF6A3240000-0x00007FF6A3591000-memory.dmp xmrig -
Executes dropped EXE 21 IoCs
pid Process 3464 MhmloYw.exe 1800 wIdOxAs.exe 3288 FSBbwJV.exe 3540 EiIiIjt.exe 4704 jCIZXVl.exe 3136 HpduKtk.exe 2544 qToPRSM.exe 4696 spTIJkL.exe 700 AHlNUym.exe 408 XSMnqKK.exe 1636 AYWHMbr.exe 2892 XXwmySd.exe 3256 iUrHWVI.exe 2972 YdNLDTA.exe 752 fRzaAST.exe 1404 FHurzSR.exe 4076 bQXgsry.exe 672 DNiJjXn.exe 2412 ZGeXfbQ.exe 4052 DNczDAh.exe 988 VEQFwIk.exe -
resource yara_rule behavioral2/memory/1176-0-0x00007FF7B0CF0000-0x00007FF7B1041000-memory.dmp upx behavioral2/files/0x000a000000023c05-6.dat upx behavioral2/memory/3464-8-0x00007FF783230000-0x00007FF783581000-memory.dmp upx behavioral2/files/0x0007000000023c9e-11.dat upx behavioral2/memory/1800-12-0x00007FF77DEC0000-0x00007FF77E211000-memory.dmp upx behavioral2/files/0x0007000000023ca1-25.dat upx behavioral2/files/0x0007000000023ca0-27.dat upx behavioral2/files/0x0007000000023ca3-36.dat upx behavioral2/files/0x0007000000023ca4-43.dat upx behavioral2/memory/2544-52-0x00007FF6CA830000-0x00007FF6CAB81000-memory.dmp upx behavioral2/memory/4696-53-0x00007FF6E7FA0000-0x00007FF6E82F1000-memory.dmp upx behavioral2/memory/700-54-0x00007FF752810000-0x00007FF752B61000-memory.dmp upx behavioral2/files/0x0007000000023ca5-47.dat upx behavioral2/files/0x0007000000023ca6-61.dat upx behavioral2/files/0x0007000000023ca7-69.dat upx behavioral2/memory/1636-71-0x00007FF6E8000000-0x00007FF6E8351000-memory.dmp upx behavioral2/files/0x0007000000023caa-83.dat upx behavioral2/files/0x0008000000023c9b-87.dat upx behavioral2/files/0x0007000000023cab-99.dat upx behavioral2/memory/1404-98-0x00007FF72B6E0000-0x00007FF72BA31000-memory.dmp upx behavioral2/files/0x0007000000023ca9-93.dat upx behavioral2/memory/2972-92-0x00007FF766C90000-0x00007FF766FE1000-memory.dmp upx behavioral2/memory/3464-91-0x00007FF783230000-0x00007FF783581000-memory.dmp upx behavioral2/memory/1176-86-0x00007FF7B0CF0000-0x00007FF7B1041000-memory.dmp upx behavioral2/memory/752-85-0x00007FF7823E0000-0x00007FF782731000-memory.dmp upx behavioral2/memory/3256-84-0x00007FF7818E0000-0x00007FF781C31000-memory.dmp upx behavioral2/memory/2892-79-0x00007FF70D760000-0x00007FF70DAB1000-memory.dmp upx behavioral2/files/0x0007000000023ca8-77.dat upx behavioral2/memory/408-65-0x00007FF688DA0000-0x00007FF6890F1000-memory.dmp upx behavioral2/memory/4704-44-0x00007FF7716C0000-0x00007FF771A11000-memory.dmp upx behavioral2/files/0x0007000000023ca2-40.dat upx behavioral2/memory/3136-37-0x00007FF6F3540000-0x00007FF6F3891000-memory.dmp upx behavioral2/memory/3540-33-0x00007FF70E1D0000-0x00007FF70E521000-memory.dmp upx behavioral2/memory/3288-21-0x00007FF611910000-0x00007FF611C61000-memory.dmp upx behavioral2/files/0x0007000000023c9f-22.dat upx behavioral2/files/0x0007000000023cac-104.dat upx behavioral2/memory/3288-105-0x00007FF611910000-0x00007FF611C61000-memory.dmp upx behavioral2/memory/4076-111-0x00007FF795CA0000-0x00007FF795FF1000-memory.dmp upx behavioral2/memory/2544-117-0x00007FF6CA830000-0x00007FF6CAB81000-memory.dmp upx behavioral2/memory/672-120-0x00007FF6A3240000-0x00007FF6A3591000-memory.dmp upx behavioral2/files/0x0007000000023caf-124.dat upx behavioral2/files/0x0007000000023cb0-131.dat upx behavioral2/files/0x0007000000023cad-127.dat upx behavioral2/memory/2412-123-0x00007FF693850000-0x00007FF693BA1000-memory.dmp upx behavioral2/files/0x0007000000023cae-118.dat upx behavioral2/memory/3136-110-0x00007FF6F3540000-0x00007FF6F3891000-memory.dmp upx behavioral2/memory/3540-108-0x00007FF70E1D0000-0x00007FF70E521000-memory.dmp upx behavioral2/memory/1800-103-0x00007FF77DEC0000-0x00007FF77E211000-memory.dmp upx behavioral2/memory/4052-133-0x00007FF75B6A0000-0x00007FF75B9F1000-memory.dmp upx behavioral2/memory/1636-135-0x00007FF6E8000000-0x00007FF6E8351000-memory.dmp upx behavioral2/memory/988-136-0x00007FF78BBF0000-0x00007FF78BF41000-memory.dmp upx behavioral2/memory/700-134-0x00007FF752810000-0x00007FF752B61000-memory.dmp upx behavioral2/memory/2892-138-0x00007FF70D760000-0x00007FF70DAB1000-memory.dmp upx behavioral2/memory/408-137-0x00007FF688DA0000-0x00007FF6890F1000-memory.dmp upx behavioral2/memory/3256-139-0x00007FF7818E0000-0x00007FF781C31000-memory.dmp upx behavioral2/memory/752-140-0x00007FF7823E0000-0x00007FF782731000-memory.dmp upx behavioral2/memory/1176-141-0x00007FF7B0CF0000-0x00007FF7B1041000-memory.dmp upx behavioral2/memory/2972-149-0x00007FF766C90000-0x00007FF766FE1000-memory.dmp upx behavioral2/memory/1404-160-0x00007FF72B6E0000-0x00007FF72BA31000-memory.dmp upx behavioral2/memory/4076-159-0x00007FF795CA0000-0x00007FF795FF1000-memory.dmp upx behavioral2/memory/4052-164-0x00007FF75B6A0000-0x00007FF75B9F1000-memory.dmp upx behavioral2/memory/672-163-0x00007FF6A3240000-0x00007FF6A3591000-memory.dmp upx behavioral2/memory/1176-167-0x00007FF7B0CF0000-0x00007FF7B1041000-memory.dmp upx behavioral2/memory/3464-223-0x00007FF783230000-0x00007FF783581000-memory.dmp upx -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\System\wIdOxAs.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\jCIZXVl.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\XSMnqKK.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\YdNLDTA.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\DNiJjXn.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\ZGeXfbQ.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\VEQFwIk.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\MhmloYw.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\HpduKtk.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\spTIJkL.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\XXwmySd.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\fRzaAST.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\FHurzSR.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\FSBbwJV.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\EiIiIjt.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\bQXgsry.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\DNczDAh.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\qToPRSM.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\AHlNUym.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\AYWHMbr.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\iUrHWVI.exe 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe Token: SeLockMemoryPrivilege 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1176 wrote to memory of 3464 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 83 PID 1176 wrote to memory of 3464 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 83 PID 1176 wrote to memory of 1800 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 84 PID 1176 wrote to memory of 1800 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 84 PID 1176 wrote to memory of 3288 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 85 PID 1176 wrote to memory of 3288 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 85 PID 1176 wrote to memory of 3540 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 86 PID 1176 wrote to memory of 3540 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 86 PID 1176 wrote to memory of 4704 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 87 PID 1176 wrote to memory of 4704 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 87 PID 1176 wrote to memory of 3136 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 88 PID 1176 wrote to memory of 3136 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 88 PID 1176 wrote to memory of 2544 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 89 PID 1176 wrote to memory of 2544 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 89 PID 1176 wrote to memory of 4696 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 90 PID 1176 wrote to memory of 4696 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 90 PID 1176 wrote to memory of 700 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 91 PID 1176 wrote to memory of 700 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 91 PID 1176 wrote to memory of 408 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 92 PID 1176 wrote to memory of 408 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 92 PID 1176 wrote to memory of 1636 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 93 PID 1176 wrote to memory of 1636 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 93 PID 1176 wrote to memory of 2892 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 94 PID 1176 wrote to memory of 2892 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 94 PID 1176 wrote to memory of 3256 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 95 PID 1176 wrote to memory of 3256 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 95 PID 1176 wrote to memory of 2972 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 96 PID 1176 wrote to memory of 2972 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 96 PID 1176 wrote to memory of 752 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 97 PID 1176 wrote to memory of 752 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 97 PID 1176 wrote to memory of 1404 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 98 PID 1176 wrote to memory of 1404 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 98 PID 1176 wrote to memory of 4076 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 99 PID 1176 wrote to memory of 4076 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 99 PID 1176 wrote to memory of 672 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 100 PID 1176 wrote to memory of 672 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 100 PID 1176 wrote to memory of 2412 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 101 PID 1176 wrote to memory of 2412 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 101 PID 1176 wrote to memory of 4052 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 102 PID 1176 wrote to memory of 4052 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 102 PID 1176 wrote to memory of 988 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 103 PID 1176 wrote to memory of 988 1176 2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25_313868a1a130554e4f091f298496ea56_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\System\MhmloYw.exeC:\Windows\System\MhmloYw.exe2⤵
- Executes dropped EXE
PID:3464
-
-
C:\Windows\System\wIdOxAs.exeC:\Windows\System\wIdOxAs.exe2⤵
- Executes dropped EXE
PID:1800
-
-
C:\Windows\System\FSBbwJV.exeC:\Windows\System\FSBbwJV.exe2⤵
- Executes dropped EXE
PID:3288
-
-
C:\Windows\System\EiIiIjt.exeC:\Windows\System\EiIiIjt.exe2⤵
- Executes dropped EXE
PID:3540
-
-
C:\Windows\System\jCIZXVl.exeC:\Windows\System\jCIZXVl.exe2⤵
- Executes dropped EXE
PID:4704
-
-
C:\Windows\System\HpduKtk.exeC:\Windows\System\HpduKtk.exe2⤵
- Executes dropped EXE
PID:3136
-
-
C:\Windows\System\qToPRSM.exeC:\Windows\System\qToPRSM.exe2⤵
- Executes dropped EXE
PID:2544
-
-
C:\Windows\System\spTIJkL.exeC:\Windows\System\spTIJkL.exe2⤵
- Executes dropped EXE
PID:4696
-
-
C:\Windows\System\AHlNUym.exeC:\Windows\System\AHlNUym.exe2⤵
- Executes dropped EXE
PID:700
-
-
C:\Windows\System\XSMnqKK.exeC:\Windows\System\XSMnqKK.exe2⤵
- Executes dropped EXE
PID:408
-
-
C:\Windows\System\AYWHMbr.exeC:\Windows\System\AYWHMbr.exe2⤵
- Executes dropped EXE
PID:1636
-
-
C:\Windows\System\XXwmySd.exeC:\Windows\System\XXwmySd.exe2⤵
- Executes dropped EXE
PID:2892
-
-
C:\Windows\System\iUrHWVI.exeC:\Windows\System\iUrHWVI.exe2⤵
- Executes dropped EXE
PID:3256
-
-
C:\Windows\System\YdNLDTA.exeC:\Windows\System\YdNLDTA.exe2⤵
- Executes dropped EXE
PID:2972
-
-
C:\Windows\System\fRzaAST.exeC:\Windows\System\fRzaAST.exe2⤵
- Executes dropped EXE
PID:752
-
-
C:\Windows\System\FHurzSR.exeC:\Windows\System\FHurzSR.exe2⤵
- Executes dropped EXE
PID:1404
-
-
C:\Windows\System\bQXgsry.exeC:\Windows\System\bQXgsry.exe2⤵
- Executes dropped EXE
PID:4076
-
-
C:\Windows\System\DNiJjXn.exeC:\Windows\System\DNiJjXn.exe2⤵
- Executes dropped EXE
PID:672
-
-
C:\Windows\System\ZGeXfbQ.exeC:\Windows\System\ZGeXfbQ.exe2⤵
- Executes dropped EXE
PID:2412
-
-
C:\Windows\System\DNczDAh.exeC:\Windows\System\DNczDAh.exe2⤵
- Executes dropped EXE
PID:4052
-
-
C:\Windows\System\VEQFwIk.exeC:\Windows\System\VEQFwIk.exe2⤵
- Executes dropped EXE
PID:988
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54b15699126fff7c8874804fd11512acb
SHA1ebdc31dbc41b4f0732b0dc7783a469dc727b7685
SHA25655a1579a263332abf96a0f5eed500f6676c8090cf8cfeb3f97677cd6420c60a3
SHA5121523285f4823edec25a4feb952a92039d7af970896c6aa6e8db72d36f5ca4514a425e2a47d9ec09e8dd0a83c92c3eae1344e04957b21b6366dd616aa7d20bd54
-
Filesize
5.2MB
MD5cdb90d6588065c274af21cf4eb1c0dcc
SHA1e72c90d75476266970da1db919eef6760185c5f0
SHA256189886ccbe1d9e790f7ec62fd4081be5dffd5216cdcb450c87b06289986c26a8
SHA512e874aec516887a652a0cb7d062b5d196fde1b80f63fb1520fec8b354fac877b0e974d58e5799d752485d72861284f6dd92fa8ca0c5219b515574edc5286e49ab
-
Filesize
5.2MB
MD5c76d75786193703443115bdae96cf828
SHA13b254d46cffa66d1f9c2569a23b0987d44ef07fc
SHA256b1452e1babb1cc3d55513520f1ed39fccdfa983b950055af8888acf98365d408
SHA5121d92ec6c7db16b0f910ed4839a82d692b7e17721aada5a622afd1218fdf40bbc5eea6daa8b8854149abdce54634e7ba2040d15184ce58da6c01705a97324345d
-
Filesize
5.2MB
MD555f5068fd1b06777c55245010fe43e8d
SHA17c300c834b358a9fad835f1bcbae376cf792b6df
SHA256bf546321e2e7d469384baf94060f7bde62dc68dd2571d9b0539e533173387edb
SHA512ba71517b9c1201316309621e5ab39cfb7430b6b0231d0a0872acc2a25b43b7386ee7e5f2caa7ce89113fd370e48f48134b4aa97b1569419f98f312acc976eb22
-
Filesize
5.2MB
MD51770a75717f2844e97af6ff794d01165
SHA1258ea5e298af90c23cb635034c8963a05926d18e
SHA256a5b0769e84ce583b960e8d6eddb3892705c58096c18c8b64778cbc27c41849d7
SHA51262fa57e4c6f33e0536febda4f12ebbbbfca941bef50ebad88877ff13a8ad6306fe10c45710219d6fe562ad98a2ceefb282c81b1c8c44e82829d3f7d37e51f593
-
Filesize
5.2MB
MD597e8edc512e387559afd27d2d36e984f
SHA13f18fd240fdfe9afc1585a4295ead8869dba75a3
SHA25622829939089590e7ec7cb9169e14bf01e03a2d0fa42a953032232fd9920bfbcf
SHA51204183098e11fd4434a17505b46d6cce41f49d1edc49b874634099b5ba7b611e2a32cc1611b99df8381425bc8fa17bd6433ba5fd8cfb708461b41a6e240c9b76d
-
Filesize
5.2MB
MD5ae1989d25567a351ad5f2382722990f4
SHA19112f062380a278dcaaa2c7e57ccca3058a23e3d
SHA25620ded110321a78b15687da8f019b8173b0c9514a7bc8f6c3df187a2167ec3a8a
SHA512713764787eac5b1180cd8e6727ee0c376c640364153b028c1a1d605194ff5cd77e47782e45f8a4dfd4c3b7cf0feaaa31e44a1999f7eacfdf9239802d28c61d8b
-
Filesize
5.2MB
MD5806bcff7af45f4ab1e834080a536092b
SHA1bc08e8cda1850557ccd758b9f6f2c4e82869ff2f
SHA256311a7f4ed6fd178f1111584b922f96b1a3b278f43e101e01048e6e211ed591d2
SHA512ae8d0f21bc2e40d55f4aec4e234fad63eb8625b426770c1975581900856006346d2955e1928133013401fc4af90b2cbd306518817b8da4c3758a209ac50374ad
-
Filesize
5.2MB
MD5d3a2840a28f04445dc36bd9bf80f3ed2
SHA1eb087a3597532c95040e64d386cb736ed7af0730
SHA25626945acb3e7a65691e680dcbc7614e818c059412f71de46b7d55600de2468f10
SHA5129a74d7ac00e801a1b5261e236cdc53b3d3fc4db4eef1ff6bf9bf0d378c847b402b431baae33890e94362224e5761f6099200b701a4dd2d14d5436ea25e51a08a
-
Filesize
5.2MB
MD5bf82080361fa29256982ad0df79eb2c4
SHA122002230000f652d7cda5c9807dde67ca711df47
SHA2568e69901c6b6d178b5d2a000d57b805efb716a766012a32fd5fd6e3aade23756c
SHA512ce9975995bfc4523b55dda53007b69e867b36cd0c82d8a364549622fe12cc33d931a517cfe3c38867a03452e94d09eb65fb92567659194344ad11bbd9a72854b
-
Filesize
5.2MB
MD58032e79c45359c56db3782ab02a0a609
SHA122dceb8362c29889027ff8edd0b212cc76a25ef6
SHA2568efc83a52aa54c4341768d0a29cabd4c7dabf3a641bf344f275c32440a478f63
SHA51246e2dc0ccf7b86f6aa2d4bf0b29f79bda81bb6f82baef2a022ffac61050378380483a18d8d7fb707bfdc08314e88e31828528fc418b71b93445934efe296449c
-
Filesize
5.2MB
MD50112b16f92f362a8b275bf0dcb150a0c
SHA11b2f1efd4f0baac02999e2ef651b94f4aa275259
SHA256764ab91725fd2b3cd3942a8730dccc16096084d9d11e7028b28e7bd09b86fd13
SHA512fe7ecf53682952ec15bedee6e62f0e701fda529c241819ab8578900a275bceeff6a55385d0155ea84737e9ecf6811a8da3c7e2374c33902b75e5952bdd9163a0
-
Filesize
5.2MB
MD5931fbda902d03f9cb8ea0bd050e8297d
SHA1c07d7d16ebd9d3b1fe6a74f068fadeb4d0c3a300
SHA256e1dbf429c4f2d8b9acf85ec565e186e2a79e1790eef1d23d435d697f96e18a74
SHA512880c68d13087e69b231aeb62ef3811cef68b97b0fd314ed59d7a3424f34f132fc0909ff5739e4b490296d5b98b5f647dbc23b329e528e24ae617596e9e21f043
-
Filesize
5.2MB
MD5963520b4a10e5a41d161e4fbea6cc286
SHA1baa86f283800b9a76124f0f248d99af9d01780ed
SHA256c8e601b547471b80461452aa36db296b1e21030baec1d8185bb0fbaaa8f46e7e
SHA51217ce880ccd923bff50a85e7e76ff40cfeebd4f95ff478abadf6dce84a8915b1badfda61d5b49a1252e6c1455952b9356af70d51294cad8d8908a3018c3fb9c2b
-
Filesize
5.2MB
MD53072571f94a74b8c7ece74ef978928aa
SHA1df35bc477899f3cf55da772787affe3ef14721ef
SHA25671f999b82b273f74a91f9a965b5b07afa57cb6cb2b15b4fa2aadae920d6d34b5
SHA512cb9548d105c08617cca3ac1653bb2328dd7f22926737b748116eb50c130af5e2e3e6a61c3c9d2cdb267271ab2289c2d186942b3b5bdd5cab1580b760c97b3d25
-
Filesize
5.2MB
MD53877ced715efefd8f51c9f960dfa228f
SHA1318d36d786ca6a2a6880e9151596dec79513fc82
SHA25620cfb866f4b66087cd9a270454769a5cdc44b700ade605cabdf248ddb4d4de85
SHA5127f1a015df0c5550afa07f6c69366f6e485275b080baf4e6616b9aa88b2daaae8ad2276739f4939210822fffd01f13c8d82a272782122bb69bbc72d1e120b087f
-
Filesize
5.2MB
MD5747920cd261f8784fd6a4e60d920d43f
SHA1784913f36dca162ab2d93ff6d101f39f01d2795c
SHA256a0d4f5bdb9f1ac317c93a6137d517463602f1f6901f2c04825bb632703b4e28d
SHA5125f204144078111391b6ff0061faf2f879ac417c5227f7267721a57d2f6cce5299ac2c516182735eeae47402dfb01179349f4312271940ba9bb5e5fe302a55a1c
-
Filesize
5.2MB
MD5fd77e48a9bb46e39fcc4b758a0ff66ac
SHA13894794ebf304048e6ac61c0c7c00da488445a9f
SHA256b312fe878244bb14b9ef4b4ed9add1b7c880480bc38a745433e0eead7d424548
SHA51228143a7b79d4d0a6062be685157e3de73a47adde4a5d7b8b991bae0f27e9e56534d0ba8ea6ffd3ccc6197e9f3781a75ea7c82584d3e432fb09a9e30de7f5bdf8
-
Filesize
5.2MB
MD5c89b24ea51643d523498b943447dde3b
SHA1024d3fdca07ab191162e61e3178fd079fcdd1cff
SHA2569ca2ece5260a9c3c081bd7b95aaa49c67060f8ff937f3150c85901fa0e4a0ff8
SHA512d59b15badf1dad63d1a3ccc11222e4805b8f857c31cfe6c0fee0bcc5011f20bfb20f2b326bf4d0ea3706eb5ec97237678a5378877a61f18b1ca7de1d9eb30cce
-
Filesize
5.2MB
MD554c401c9d8a0eb5070d04e828db41a7a
SHA1bbdc5c3771b7dbf50eaeb095ed23d59c31204908
SHA256ee72ccbaabdb2a205a1e6cfa862caae0918587054c71fbda4b6b4dd51064f78e
SHA512c4a195e78ef2a3a22c1506e9eb9857a45bacb5a95a37d3a58cd9a82116d03da7c4736e4c7b7781f7962958cab17ba8bebf2bf4057738a8f62c68e157bdd96f64
-
Filesize
5.2MB
MD56df79a93b66d0516a12a14ffe817beaf
SHA189a607952bc583e2d236c42d0c1f99737041052b
SHA2566c7435d33623c16bb0c311b3b8a3de8844f156216a4b6a5061fd79ae5158f480
SHA512121dad7d6e4adb81172ef6f2f1cb86866e8587d5847d0abc9b6e2a30ab21d35faa625081598d7c20b06e1694c1da7048c86f95d0d72de8df1804b7c1a0a3658d