Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/12/2024, 03:25
Behavioral task
behavioral1
Sample
2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20240903-en
General
-
Target
2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d38078b651c6e2485dadce11626e2481
-
SHA1
b6c6b34ecc52ff16a3cf013a365cdaf165fb3688
-
SHA256
5f488b05f9f67cd9240bec1207ea63315c58c927c51a20d3e701dea927009c70
-
SHA512
e6055514433314057634fa7c5cceb1a68fe871533812549accd7f89f11eeb435180dcc73eaa5f564254161b2f5ce4edb8567cb4496d9870643ce75dcfc307dd8
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibj56utgpPFotBER/mQ32lUC
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral2/files/0x0008000000023c81-4.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c85-18.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c89-30.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c8c-37.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c88-41.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c8b-50.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c8d-59.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c8e-66.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c8f-70.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c91-82.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c96-114.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c97-118.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c95-112.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c94-110.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c92-108.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c93-105.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c90-101.dat cobalt_reflective_dll behavioral2/files/0x0008000000023c82-74.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c8a-54.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c87-35.dat cobalt_reflective_dll behavioral2/files/0x0007000000023c86-25.dat cobalt_reflective_dll -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
XMRig Miner payload 45 IoCs
resource yara_rule behavioral2/memory/1076-88-0x00007FF71E250000-0x00007FF71E5A1000-memory.dmp xmrig behavioral2/memory/3456-86-0x00007FF620900000-0x00007FF620C51000-memory.dmp xmrig behavioral2/memory/1468-79-0x00007FF7E7760000-0x00007FF7E7AB1000-memory.dmp xmrig behavioral2/memory/2124-34-0x00007FF71B210000-0x00007FF71B561000-memory.dmp xmrig behavioral2/memory/5056-122-0x00007FF6E6580000-0x00007FF6E68D1000-memory.dmp xmrig behavioral2/memory/3540-129-0x00007FF748210000-0x00007FF748561000-memory.dmp xmrig behavioral2/memory/3264-136-0x00007FF79AED0000-0x00007FF79B221000-memory.dmp xmrig behavioral2/memory/1108-139-0x00007FF7DC480000-0x00007FF7DC7D1000-memory.dmp xmrig behavioral2/memory/3480-143-0x00007FF6A82D0000-0x00007FF6A8621000-memory.dmp xmrig behavioral2/memory/4872-142-0x00007FF7F7530000-0x00007FF7F7881000-memory.dmp xmrig behavioral2/memory/2244-141-0x00007FF7E6920000-0x00007FF7E6C71000-memory.dmp xmrig behavioral2/memory/1972-138-0x00007FF738360000-0x00007FF7386B1000-memory.dmp xmrig behavioral2/memory/4280-135-0x00007FF65BC40000-0x00007FF65BF91000-memory.dmp xmrig behavioral2/memory/4092-132-0x00007FF77CAC0000-0x00007FF77CE11000-memory.dmp xmrig behavioral2/memory/3988-130-0x00007FF61AE40000-0x00007FF61B191000-memory.dmp xmrig behavioral2/memory/4708-128-0x00007FF642680000-0x00007FF6429D1000-memory.dmp xmrig behavioral2/memory/4880-137-0x00007FF6C7040000-0x00007FF6C7391000-memory.dmp xmrig behavioral2/memory/4780-126-0x00007FF639140000-0x00007FF639491000-memory.dmp xmrig behavioral2/memory/2468-127-0x00007FF78E1E0000-0x00007FF78E531000-memory.dmp xmrig behavioral2/memory/1116-125-0x00007FF6B75D0000-0x00007FF6B7921000-memory.dmp xmrig behavioral2/memory/880-121-0x00007FF701D90000-0x00007FF7020E1000-memory.dmp xmrig behavioral2/memory/3516-123-0x00007FF6E1DB0000-0x00007FF6E2101000-memory.dmp xmrig behavioral2/memory/880-144-0x00007FF701D90000-0x00007FF7020E1000-memory.dmp xmrig behavioral2/memory/880-145-0x00007FF701D90000-0x00007FF7020E1000-memory.dmp xmrig behavioral2/memory/5056-200-0x00007FF6E6580000-0x00007FF6E68D1000-memory.dmp xmrig behavioral2/memory/3516-202-0x00007FF6E1DB0000-0x00007FF6E2101000-memory.dmp xmrig behavioral2/memory/2124-204-0x00007FF71B210000-0x00007FF71B561000-memory.dmp xmrig behavioral2/memory/1116-216-0x00007FF6B75D0000-0x00007FF6B7921000-memory.dmp xmrig behavioral2/memory/4780-218-0x00007FF639140000-0x00007FF639491000-memory.dmp xmrig behavioral2/memory/3540-220-0x00007FF748210000-0x00007FF748561000-memory.dmp xmrig behavioral2/memory/2468-223-0x00007FF78E1E0000-0x00007FF78E531000-memory.dmp xmrig behavioral2/memory/3988-228-0x00007FF61AE40000-0x00007FF61B191000-memory.dmp xmrig behavioral2/memory/4708-227-0x00007FF642680000-0x00007FF6429D1000-memory.dmp xmrig behavioral2/memory/1468-224-0x00007FF7E7760000-0x00007FF7E7AB1000-memory.dmp xmrig behavioral2/memory/1076-236-0x00007FF71E250000-0x00007FF71E5A1000-memory.dmp xmrig behavioral2/memory/1972-242-0x00007FF738360000-0x00007FF7386B1000-memory.dmp xmrig behavioral2/memory/3264-240-0x00007FF79AED0000-0x00007FF79B221000-memory.dmp xmrig behavioral2/memory/4880-244-0x00007FF6C7040000-0x00007FF6C7391000-memory.dmp xmrig behavioral2/memory/4280-238-0x00007FF65BC40000-0x00007FF65BF91000-memory.dmp xmrig behavioral2/memory/4092-234-0x00007FF77CAC0000-0x00007FF77CE11000-memory.dmp xmrig behavioral2/memory/3456-233-0x00007FF620900000-0x00007FF620C51000-memory.dmp xmrig behavioral2/memory/4872-251-0x00007FF7F7530000-0x00007FF7F7881000-memory.dmp xmrig behavioral2/memory/1108-252-0x00007FF7DC480000-0x00007FF7DC7D1000-memory.dmp xmrig behavioral2/memory/3480-248-0x00007FF6A82D0000-0x00007FF6A8621000-memory.dmp xmrig behavioral2/memory/2244-247-0x00007FF7E6920000-0x00007FF7E6C71000-memory.dmp xmrig -
Executes dropped EXE 21 IoCs
pid Process 5056 wKVfNGp.exe 3516 PoMhcGZ.exe 2124 frqmHAs.exe 1116 DThEKOi.exe 4780 MlBeovg.exe 2468 JFXgnQs.exe 3540 ENzVpnc.exe 3988 cKkPviI.exe 4708 lDvejLk.exe 1468 onKUgbW.exe 4092 TOAsMtp.exe 3456 XJBFOQZ.exe 1076 PFrWhik.exe 4280 bXAjLig.exe 3264 bgaEJWs.exe 4880 VElglDi.exe 1972 DSkxXYQ.exe 1108 QYxlxNT.exe 3480 ptUOSUb.exe 2244 Amimjml.exe 4872 pdSNejw.exe -
resource yara_rule behavioral2/memory/880-0-0x00007FF701D90000-0x00007FF7020E1000-memory.dmp upx behavioral2/files/0x0008000000023c81-4.dat upx behavioral2/files/0x0007000000023c85-18.dat upx behavioral2/files/0x0007000000023c89-30.dat upx behavioral2/files/0x0007000000023c8c-37.dat upx behavioral2/files/0x0007000000023c88-41.dat upx behavioral2/memory/4780-44-0x00007FF639140000-0x00007FF639491000-memory.dmp upx behavioral2/memory/3988-47-0x00007FF61AE40000-0x00007FF61B191000-memory.dmp upx behavioral2/memory/4708-48-0x00007FF642680000-0x00007FF6429D1000-memory.dmp upx behavioral2/memory/3540-49-0x00007FF748210000-0x00007FF748561000-memory.dmp upx behavioral2/memory/2468-46-0x00007FF78E1E0000-0x00007FF78E531000-memory.dmp upx behavioral2/files/0x0007000000023c8b-50.dat upx behavioral2/files/0x0007000000023c8d-59.dat upx behavioral2/files/0x0007000000023c8e-66.dat upx behavioral2/files/0x0007000000023c8f-70.dat upx behavioral2/files/0x0007000000023c91-82.dat upx behavioral2/memory/1076-88-0x00007FF71E250000-0x00007FF71E5A1000-memory.dmp upx behavioral2/files/0x0007000000023c96-114.dat upx behavioral2/files/0x0007000000023c97-118.dat upx behavioral2/files/0x0007000000023c95-112.dat upx behavioral2/files/0x0007000000023c94-110.dat upx behavioral2/files/0x0007000000023c92-108.dat upx behavioral2/files/0x0007000000023c93-105.dat upx behavioral2/files/0x0007000000023c90-101.dat upx behavioral2/memory/3264-96-0x00007FF79AED0000-0x00007FF79B221000-memory.dmp upx behavioral2/memory/3456-86-0x00007FF620900000-0x00007FF620C51000-memory.dmp upx behavioral2/memory/1468-79-0x00007FF7E7760000-0x00007FF7E7AB1000-memory.dmp upx behavioral2/files/0x0008000000023c82-74.dat upx behavioral2/files/0x0007000000023c8a-54.dat upx behavioral2/memory/1116-43-0x00007FF6B75D0000-0x00007FF6B7921000-memory.dmp upx behavioral2/files/0x0007000000023c87-35.dat upx behavioral2/memory/2124-34-0x00007FF71B210000-0x00007FF71B561000-memory.dmp upx behavioral2/files/0x0007000000023c86-25.dat upx behavioral2/memory/3516-15-0x00007FF6E1DB0000-0x00007FF6E2101000-memory.dmp upx behavioral2/memory/5056-6-0x00007FF6E6580000-0x00007FF6E68D1000-memory.dmp upx behavioral2/memory/1972-120-0x00007FF738360000-0x00007FF7386B1000-memory.dmp upx behavioral2/memory/5056-122-0x00007FF6E6580000-0x00007FF6E68D1000-memory.dmp upx behavioral2/memory/3540-129-0x00007FF748210000-0x00007FF748561000-memory.dmp upx behavioral2/memory/3264-136-0x00007FF79AED0000-0x00007FF79B221000-memory.dmp upx behavioral2/memory/1108-139-0x00007FF7DC480000-0x00007FF7DC7D1000-memory.dmp upx behavioral2/memory/3480-143-0x00007FF6A82D0000-0x00007FF6A8621000-memory.dmp upx behavioral2/memory/4872-142-0x00007FF7F7530000-0x00007FF7F7881000-memory.dmp upx behavioral2/memory/2244-141-0x00007FF7E6920000-0x00007FF7E6C71000-memory.dmp upx behavioral2/memory/1972-138-0x00007FF738360000-0x00007FF7386B1000-memory.dmp upx behavioral2/memory/4280-135-0x00007FF65BC40000-0x00007FF65BF91000-memory.dmp upx behavioral2/memory/4092-132-0x00007FF77CAC0000-0x00007FF77CE11000-memory.dmp upx behavioral2/memory/3988-130-0x00007FF61AE40000-0x00007FF61B191000-memory.dmp upx behavioral2/memory/4708-128-0x00007FF642680000-0x00007FF6429D1000-memory.dmp upx behavioral2/memory/4880-137-0x00007FF6C7040000-0x00007FF6C7391000-memory.dmp upx behavioral2/memory/4780-126-0x00007FF639140000-0x00007FF639491000-memory.dmp upx behavioral2/memory/2468-127-0x00007FF78E1E0000-0x00007FF78E531000-memory.dmp upx behavioral2/memory/1116-125-0x00007FF6B75D0000-0x00007FF6B7921000-memory.dmp upx behavioral2/memory/880-121-0x00007FF701D90000-0x00007FF7020E1000-memory.dmp upx behavioral2/memory/3516-123-0x00007FF6E1DB0000-0x00007FF6E2101000-memory.dmp upx behavioral2/memory/880-144-0x00007FF701D90000-0x00007FF7020E1000-memory.dmp upx behavioral2/memory/880-145-0x00007FF701D90000-0x00007FF7020E1000-memory.dmp upx behavioral2/memory/5056-200-0x00007FF6E6580000-0x00007FF6E68D1000-memory.dmp upx behavioral2/memory/3516-202-0x00007FF6E1DB0000-0x00007FF6E2101000-memory.dmp upx behavioral2/memory/2124-204-0x00007FF71B210000-0x00007FF71B561000-memory.dmp upx behavioral2/memory/1116-216-0x00007FF6B75D0000-0x00007FF6B7921000-memory.dmp upx behavioral2/memory/4780-218-0x00007FF639140000-0x00007FF639491000-memory.dmp upx behavioral2/memory/3540-220-0x00007FF748210000-0x00007FF748561000-memory.dmp upx behavioral2/memory/2468-223-0x00007FF78E1E0000-0x00007FF78E531000-memory.dmp upx behavioral2/memory/3988-228-0x00007FF61AE40000-0x00007FF61B191000-memory.dmp upx -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\System\wKVfNGp.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\PoMhcGZ.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\DThEKOi.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\lDvejLk.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\MlBeovg.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\ENzVpnc.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\bgaEJWs.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\ptUOSUb.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\pdSNejw.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\JFXgnQs.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\onKUgbW.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\TOAsMtp.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\PFrWhik.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\bXAjLig.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\DSkxXYQ.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\Amimjml.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\frqmHAs.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\cKkPviI.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\XJBFOQZ.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\VElglDi.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\QYxlxNT.exe 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe Token: SeLockMemoryPrivilege 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 880 wrote to memory of 5056 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 83 PID 880 wrote to memory of 5056 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 83 PID 880 wrote to memory of 3516 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 84 PID 880 wrote to memory of 3516 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 84 PID 880 wrote to memory of 2124 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 85 PID 880 wrote to memory of 2124 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 85 PID 880 wrote to memory of 1116 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 86 PID 880 wrote to memory of 1116 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 86 PID 880 wrote to memory of 4780 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 87 PID 880 wrote to memory of 4780 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 87 PID 880 wrote to memory of 2468 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 88 PID 880 wrote to memory of 2468 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 88 PID 880 wrote to memory of 4708 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 89 PID 880 wrote to memory of 4708 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 89 PID 880 wrote to memory of 3540 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 90 PID 880 wrote to memory of 3540 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 90 PID 880 wrote to memory of 3988 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 91 PID 880 wrote to memory of 3988 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 91 PID 880 wrote to memory of 1468 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 92 PID 880 wrote to memory of 1468 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 92 PID 880 wrote to memory of 4092 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 93 PID 880 wrote to memory of 4092 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 93 PID 880 wrote to memory of 3456 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 94 PID 880 wrote to memory of 3456 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 94 PID 880 wrote to memory of 1076 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 95 PID 880 wrote to memory of 1076 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 95 PID 880 wrote to memory of 4280 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 96 PID 880 wrote to memory of 4280 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 96 PID 880 wrote to memory of 3264 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 97 PID 880 wrote to memory of 3264 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 97 PID 880 wrote to memory of 4880 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 98 PID 880 wrote to memory of 4880 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 98 PID 880 wrote to memory of 1972 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 99 PID 880 wrote to memory of 1972 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 99 PID 880 wrote to memory of 1108 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 100 PID 880 wrote to memory of 1108 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 100 PID 880 wrote to memory of 3480 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 101 PID 880 wrote to memory of 3480 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 101 PID 880 wrote to memory of 2244 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 102 PID 880 wrote to memory of 2244 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 102 PID 880 wrote to memory of 4872 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 103 PID 880 wrote to memory of 4872 880 2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_d38078b651c6e2485dadce11626e2481_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\System\wKVfNGp.exeC:\Windows\System\wKVfNGp.exe2⤵
- Executes dropped EXE
PID:5056
-
-
C:\Windows\System\PoMhcGZ.exeC:\Windows\System\PoMhcGZ.exe2⤵
- Executes dropped EXE
PID:3516
-
-
C:\Windows\System\frqmHAs.exeC:\Windows\System\frqmHAs.exe2⤵
- Executes dropped EXE
PID:2124
-
-
C:\Windows\System\DThEKOi.exeC:\Windows\System\DThEKOi.exe2⤵
- Executes dropped EXE
PID:1116
-
-
C:\Windows\System\MlBeovg.exeC:\Windows\System\MlBeovg.exe2⤵
- Executes dropped EXE
PID:4780
-
-
C:\Windows\System\JFXgnQs.exeC:\Windows\System\JFXgnQs.exe2⤵
- Executes dropped EXE
PID:2468
-
-
C:\Windows\System\lDvejLk.exeC:\Windows\System\lDvejLk.exe2⤵
- Executes dropped EXE
PID:4708
-
-
C:\Windows\System\ENzVpnc.exeC:\Windows\System\ENzVpnc.exe2⤵
- Executes dropped EXE
PID:3540
-
-
C:\Windows\System\cKkPviI.exeC:\Windows\System\cKkPviI.exe2⤵
- Executes dropped EXE
PID:3988
-
-
C:\Windows\System\onKUgbW.exeC:\Windows\System\onKUgbW.exe2⤵
- Executes dropped EXE
PID:1468
-
-
C:\Windows\System\TOAsMtp.exeC:\Windows\System\TOAsMtp.exe2⤵
- Executes dropped EXE
PID:4092
-
-
C:\Windows\System\XJBFOQZ.exeC:\Windows\System\XJBFOQZ.exe2⤵
- Executes dropped EXE
PID:3456
-
-
C:\Windows\System\PFrWhik.exeC:\Windows\System\PFrWhik.exe2⤵
- Executes dropped EXE
PID:1076
-
-
C:\Windows\System\bXAjLig.exeC:\Windows\System\bXAjLig.exe2⤵
- Executes dropped EXE
PID:4280
-
-
C:\Windows\System\bgaEJWs.exeC:\Windows\System\bgaEJWs.exe2⤵
- Executes dropped EXE
PID:3264
-
-
C:\Windows\System\VElglDi.exeC:\Windows\System\VElglDi.exe2⤵
- Executes dropped EXE
PID:4880
-
-
C:\Windows\System\DSkxXYQ.exeC:\Windows\System\DSkxXYQ.exe2⤵
- Executes dropped EXE
PID:1972
-
-
C:\Windows\System\QYxlxNT.exeC:\Windows\System\QYxlxNT.exe2⤵
- Executes dropped EXE
PID:1108
-
-
C:\Windows\System\ptUOSUb.exeC:\Windows\System\ptUOSUb.exe2⤵
- Executes dropped EXE
PID:3480
-
-
C:\Windows\System\Amimjml.exeC:\Windows\System\Amimjml.exe2⤵
- Executes dropped EXE
PID:2244
-
-
C:\Windows\System\pdSNejw.exeC:\Windows\System\pdSNejw.exe2⤵
- Executes dropped EXE
PID:4872
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c4e1e805f41e199de3a3131b463d1721
SHA1e055da1d7323445edd54b26be34fdbc772a414df
SHA256b18ed745481d4a205173bc22979aa59408f5ed57336fb0b14bc812af07bd91f4
SHA512ab5320fce27667e38ca9fb2aceb52504fbbef43d4d14d90176679ef12220b3897657e5b16648a439dd686fe4ea448254052011d4889d736a48c2c20f8158009d
-
Filesize
5.2MB
MD5bc498c68b41bce69e9177a2016e4f58a
SHA188791a5aa9c091589139b286b2b57e055312f4f2
SHA256d0ac1e517d6f5a6efa70124d4210471b203761501f05a53418807befa7757aec
SHA512bcceefa220a7d459bc134d125ecbbde834841e645f9ee385ffb5f5cc2767c730b83b4b06b63dc1938067c7222d9c3b58320e760dbda8fb896933800bdb12f412
-
Filesize
5.2MB
MD57cf1bd7846e2a80289c92229b344a4cc
SHA1344d2c5ae499ca6f0e704692713b9421a04dc304
SHA256d98232ab0da22fa044f927a8ba887d374413edb364f0d2baaf6d44ca5c92cfd0
SHA51233352fca290a00bece62ab8740112169bed2e0bd4cd67e2c9b06832d8b375a5a1fbecaab0e9492f52b3fb4e98aff0da645b18f39b857b66369ce20b9a7445668
-
Filesize
5.2MB
MD567dfba7fda3605f99d9371d580263aa0
SHA1b92517d13e0cd98db5fe3557a41bb9b00ffde755
SHA2568366b6cb95606b36115c0bfc07b0ff235eac25c59c2e56ba09ac58d91ebf629f
SHA512167581699fc44295853967f0e7ee2a199b503565801ba575e6aae9bf88f95598baa55e1624944bcaffc9ddbe442e440cdb034492ca4e992e9fc779013b201de4
-
Filesize
5.2MB
MD550ad25808cfef0c8ceb2e2ceb5920603
SHA17e760dad9cf7b59023485440bd46e28dfa4ccbd9
SHA2562d1e1a31a3a0fd59a66b3f883f6e7ef7d6e7f42b250162e3461a08b01e7de6a6
SHA5126c5502635212dedd71b0d6665c774d05c992abd3f86246dc9c8e94cf3f368f381cee4c5f5eb179d763edbf9123c4e02eceb47f0b4818407cb662e312415e3394
-
Filesize
5.2MB
MD5858cabe6beb85914d46b29218f5c5a43
SHA18933b122a0307f2ec29749efd3bd6293a6e87c70
SHA2566518c55ea61d9323c4bb7b61ed8268b9b2751c280d790a251d1c399a114f4ab9
SHA51207b00522f054d549167ead4a687c962ac9fdf8de7df2ea0bea3eb426f3ec87743b3b9f9e7e8d5ebc5dab12fd79e17c768cca68e43004a36c4d3b183e3349c86e
-
Filesize
5.2MB
MD5e6b5a785ba70bb62a822024b6b1cc473
SHA14a590e6de20a8eb16032e62a6ae84de77f038c19
SHA2561c0a6bca77c7d37b60dfdb337a61260701142029b3ae754d33c86152efdbd3c2
SHA51264768adf5b7817c639908ed421b2baf7765bb46917f1681dde0b5bd753f2ec5b0198a4de976883b45a76731363c6445ac6cdbad235e75f3ed243e3263f994f1a
-
Filesize
5.2MB
MD5b21575609af59dcbdc0b03ca8b7d3d4d
SHA10bd665d4c55204fcd3aeb6dee0470d461e80d168
SHA256b97bcbd9cfd867b14812651ac443efd8800071e1406e72ea5336b4ab646e0c52
SHA512dbf0e11c9a268ac281a4b7677238d5f127dc47704b1e126dbfbbb9e6b3f3bb634e5137589e8100cd7f87bff9fe6885328257556260c59e4e22dee13e84545827
-
Filesize
5.2MB
MD574b5fd47984f4bf5f95b38858ab9c303
SHA1f122d97f215e343897665d8cf8aeed66603065b5
SHA2565c86496ffeac2c81b081d10a547aedeaa8e82fc6694b4d83ae9be83f5ce21417
SHA512087b8796e5021ecf29979ff9ee1d6ca746ff7e9d05270173eee16680bc1899b718fed97f1bdb6b95fbcf151b9330ad7d93d1b74b8315dcb7f94edeb3c48c5108
-
Filesize
5.2MB
MD5380ec39425b59cc58d952c5190380eba
SHA181d0549ff6c21ba9312311e2937ccd7f68fc766c
SHA256aa48e6b0ad738169a6b78161a46fd5fe1f0cebe98aa46d821740e85f3d331596
SHA5123e7f96fb38fbf3fad1986f6a8bc4daf47b944e75551c0ddc1afa87cb0c4590775954845deb5aae4b4d589d499681dc5d44d95ad8b2037280981cd6d397db4ca1
-
Filesize
5.2MB
MD56c279e3c1576fe0756edb6f76b7bb367
SHA13108bebbe81d55f2152543ce02ddd3e44000ece8
SHA256bea2f2b8668b0fd552feafcd126404435600536d05b3e95070d10d5d88cf6290
SHA512d4c6ccfa7a48c3f28eb077e1ee41de12e5e5691440703277cff39d624146d27573de84a5a1564cb6df84ba6fcab5735ebb0b7cda1acfc4e26104dd600b347c6e
-
Filesize
5.2MB
MD5d272cd2b943aeafe00db43fc3299ce39
SHA12ba07c63e7ae21ce821b3ec57627a892d09dad4d
SHA2561eb97040fd0eba713beebf6cec20fe7ed04b53a40589ee545e74733b4bbb8946
SHA512f9178cfb04f6ca16f460bb16042e1c730983098e5e5f86a722ace54bc4cc8d6fa6b2aea93cfab97d3bec64b5933ba8bd0b79f056cebbc3750c86ecd5548b2c1b
-
Filesize
5.2MB
MD55e52d77a4906460c7acec56520122d22
SHA10bee77999c97c7622e625e749ef8f2eb907a7055
SHA256506d77c142a22dc72f26a4557437f7ac91f76fc6dc51e0539bc03dd5686f9816
SHA512b92d59cf98b75aaad9484b0668a8f1c9f667e14703048ce31fac9e552348edf3e5e29b05686550f2b17f0d81e69030b69a16b5e6b57eebaa2e349183e2914b29
-
Filesize
5.2MB
MD58ee13bd7d9fade5b4543f45a7209b2b5
SHA16bff74faf33ba78ed96f01c111ee0addf788baca
SHA256b4f66df6bb819fff5df34d6b9fcca271c8ff29b9a4d5de3fc09d37f98e645068
SHA5125c878ad3271b608ad4947bb8a5854594ef1f464c8b7e9f4ecc52acde6f8fa5e276f94588b8bf253c1422bb7f906cb5be7cf2e11097c85309259b94e2ac7e1b6c
-
Filesize
5.2MB
MD58bb6afe4b8ad95348b8dcd7bd1b9d893
SHA1f387bf65dc2d9a46fd6274ef2b76813f4148b360
SHA2569195c9f18535918f71fcbac9e9ae5494c83460124748d309487f1f4c920d8b78
SHA5128f33af7b2e3967cd778c94709f946f3db522407292b5918e6060c6d9f037e229674b5d400a8adc999d6d7ec018f86d684b272c622c258d5803f62feff4b0bd96
-
Filesize
5.2MB
MD566e9fad47a24c4703247d8a25d8c9e28
SHA1ff4931ece498bddb89ea23543a0c5dc504161ae8
SHA256ff01824d2e62a874b9ec1255643ce3bfbaa84dd96a8bd34327b7276f3d20e044
SHA51203df4df5dbfbaf88578826a5835dbcbcba7355c46300afdd29378c7b683b67cc7cfd98ad9221903cb4360344db490660e3d0db36ce003123ef131b54d77cef36
-
Filesize
5.2MB
MD584bc4d0e2a75af1219ad1d2aeb000b11
SHA1696516102b24104c45fc8abe72df1f203b167e42
SHA256aefb2229593a5da746efc46e99059d37ba4f22e0a318e473de4918cb935556e5
SHA5127c684f647c63568321b97c93ed962b9c273f2a829fd3e5db60a9a4373ab8fdc3d95dc73ebb8bf25d7403387f2ebaaf8fb04f3f9a5e07202336ea60a0f75e9fe9
-
Filesize
5.2MB
MD597f7690b4bdfe041eb51d1c0d2f377fc
SHA16762ebebb2ab593dd48285e9e436df851163746a
SHA2565f5943ab15c28400127ccd6bb809126541d219dfc437cbb1b37096e89cfb5655
SHA512b3236b07ca1ba946947fff19b2535dd81e79b9f50f79f743736bf8fe86351c8c3090164121102489fe9613ba1f2be27a251265dca7f4641bf6b109acbc2ec249
-
Filesize
5.2MB
MD5e6e7eb12cee26e21c394f4b06ce02f36
SHA1c1d29954b8e558354ca92ea1b73fcc8727d16453
SHA256f34fba6ba6f2f7e2ca8bc7a06c23b3015ba5b1d3b3cf49fbfe46827cbfde27d9
SHA5120d646a071f4cee6cfd21135e0e05a1879f92b6e1c493ecdd9a0b1f64ec996ea9c40de02881f5a46ba497f5d44a0a2d6c92726f8137f4131ffb3098bd88d122c1
-
Filesize
5.2MB
MD511470fe8d3be941cbe1defc4c7e83f8a
SHA1af598177ff5872496e3aa5935aecad174dd18717
SHA256b44f2dddd3c3cd8d40727e68d25e81f3d51f19f7604dfe8ab409b42f3e01b626
SHA5120da023b475c11d6cc355887fd1364494b8d47e55085e281dccfffbffd3f8e9db8a05c22a5a6b1024ea68cd9b67a5152c1a025ed0fcf22a2edb4f2ed5c30a4c9d
-
Filesize
5.2MB
MD56eb77a7584d80d07ebdfcf2dd1a8b9a9
SHA11ce689e01788799d2c2f561dadd4537a9e066ee0
SHA25628dc5169f13a557f372a7ffa5aaac4c8845e551457b0eefeb82daaa99fde637d
SHA5120c076a946da8a1341f3c45ab4f87fe090d208bffdcc04f1ddeaef052d432b0cd49add061da2c91c4899eb153138738c2d8637a39c43954e55c5236848a1dfaaa