cobaltstrike | d32c66a38a60e023d5a936c41cf5ed8b04fe27de2c3abbd5eb48bc299621d818

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

1b7deb1a82a7af372458458b5e2f4688
SHA1

e223fa9257989911d6ab247c53f55013c0e60428
SHA256

d32c66a38a60e023d5a936c41cf5ed8b04fe27de2c3abbd5eb48bc299621d818
SHA512

2a8294e3263b82cb0669a9ddcac64dbb3557b12166205f55caacb5f196c8edbbcc1c5e4c48a02aba206732f399861f2199a56ed2106f0b19463f442244530b54
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUb:j+R56utgpPF8u/7b

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000c000000023b1e-5.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b72-11.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b73-17.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b74-18.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b76-32.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b77-42.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b75-35.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b78-46.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b79-56.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023b6f-59.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b7a-66.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b7b-70.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b7c-78.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b7f-86.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b7d-85.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b80-95.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b81-100.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b82-108.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b83-113.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b84-120.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023b85-125.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/3932-0-0x00007FF625520000-0x00007FF62586D000-memory.dmp	xmrig
behavioral2/files/0x000c000000023b1e-5.dat	xmrig
behavioral2/files/0x000a000000023b72-11.dat	xmrig
behavioral2/files/0x000a000000023b73-17.dat	xmrig
behavioral2/files/0x000a000000023b74-18.dat	xmrig
behavioral2/files/0x000a000000023b76-32.dat	xmrig
behavioral2/memory/4152-36-0x00007FF7067E0000-0x00007FF706B2D000-memory.dmp	xmrig
behavioral2/memory/2380-43-0x00007FF622EC0000-0x00007FF62320D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b77-42.dat	xmrig
behavioral2/memory/2592-40-0x00007FF7B2280000-0x00007FF7B25CD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b75-35.dat	xmrig
behavioral2/memory/3300-25-0x00007FF6217D0000-0x00007FF621B1D000-memory.dmp	xmrig
behavioral2/memory/1372-22-0x00007FF79F720000-0x00007FF79FA6D000-memory.dmp	xmrig
behavioral2/memory/4688-19-0x00007FF6A3A30000-0x00007FF6A3D7D000-memory.dmp	xmrig
behavioral2/memory/3924-7-0x00007FF615840000-0x00007FF615B8D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b78-46.dat	xmrig
behavioral2/memory/2472-49-0x00007FF7AA240000-0x00007FF7AA58D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b79-56.dat	xmrig
behavioral2/files/0x000b000000023b6f-59.dat	xmrig
behavioral2/files/0x000a000000023b7a-66.dat	xmrig
behavioral2/files/0x000a000000023b7b-70.dat	xmrig
behavioral2/memory/5100-76-0x00007FF7A7D10000-0x00007FF7A805D000-memory.dmp	xmrig
behavioral2/memory/2064-79-0x00007FF65CCE0000-0x00007FF65D02D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b7c-78.dat	xmrig
behavioral2/files/0x000a000000023b7f-86.dat	xmrig
behavioral2/files/0x000a000000023b7d-85.dat	xmrig
behavioral2/memory/1368-91-0x00007FF766EB0000-0x00007FF7671FD000-memory.dmp	xmrig
behavioral2/memory/1576-88-0x00007FF606670000-0x00007FF6069BD000-memory.dmp	xmrig
behavioral2/memory/2640-67-0x00007FF60A510000-0x00007FF60A85D000-memory.dmp	xmrig
behavioral2/memory/2680-64-0x00007FF797FE0000-0x00007FF79832D000-memory.dmp	xmrig
behavioral2/memory/4196-57-0x00007FF76C610000-0x00007FF76C95D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b80-95.dat	xmrig
behavioral2/memory/1160-97-0x00007FF737880000-0x00007FF737BCD000-memory.dmp	xmrig
behavioral2/memory/3356-102-0x00007FF6829F0000-0x00007FF682D3D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b81-100.dat	xmrig
behavioral2/memory/1560-109-0x00007FF7C5CA0000-0x00007FF7C5FED000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b82-108.dat	xmrig
behavioral2/files/0x000a000000023b83-113.dat	xmrig
behavioral2/memory/2940-115-0x00007FF688500000-0x00007FF68884D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b84-120.dat	xmrig
behavioral2/memory/4236-121-0x00007FF636160000-0x00007FF6364AD000-memory.dmp	xmrig
behavioral2/files/0x000b000000023b85-125.dat	xmrig
behavioral2/memory/3152-126-0x00007FF642240000-0x00007FF64258D000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3924	JZTuZcx.exe
4688	TgGSEto.exe
1372	KCDueUU.exe
3300	jQEzoZD.exe
4152	xogDxuA.exe
2592	WSANLeh.exe
2380	jctQyfI.exe
2472	vvcapID.exe
4196	IIHMdZH.exe
2680	ppktRow.exe
2640	KFKxpqy.exe
5100	tILNwZX.exe
2064	uHXpBnt.exe
1576	fpDOWDa.exe
1368	vceDJvB.exe
1160	jFubFqE.exe
3356	bjKRDOJ.exe
1560	ewRhbHA.exe
2940	VNLkOrS.exe
4236	oNOzgSK.exe
3152	JQjFkEa.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\tILNwZX.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\vceDJvB.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ewRhbHA.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\oNOzgSK.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\JQjFkEa.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\IIHMdZH.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KFKxpqy.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\jctQyfI.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\vvcapID.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ppktRow.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\fpDOWDa.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\bjKRDOJ.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KCDueUU.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\jQEzoZD.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uHXpBnt.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\VNLkOrS.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\xogDxuA.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\WSANLeh.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\jFubFqE.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\JZTuZcx.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\TgGSEto.exe	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 3924	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 3932 wrote to memory of 3924	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 3932 wrote to memory of 4688	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 3932 wrote to memory of 4688	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 3932 wrote to memory of 1372	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 3932 wrote to memory of 1372	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 3932 wrote to memory of 3300	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 3932 wrote to memory of 3300	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 3932 wrote to memory of 4152	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 3932 wrote to memory of 4152	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 3932 wrote to memory of 2592	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 3932 wrote to memory of 2592	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 3932 wrote to memory of 2380	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 3932 wrote to memory of 2380	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 3932 wrote to memory of 2472	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 3932 wrote to memory of 2472	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 3932 wrote to memory of 2680	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 3932 wrote to memory of 2680	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 3932 wrote to memory of 4196	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 3932 wrote to memory of 4196	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 3932 wrote to memory of 2640	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 3932 wrote to memory of 2640	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 3932 wrote to memory of 5100	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 3932 wrote to memory of 5100	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 3932 wrote to memory of 2064	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 3932 wrote to memory of 2064	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 3932 wrote to memory of 1576	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 3932 wrote to memory of 1576	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 3932 wrote to memory of 1368	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 3932 wrote to memory of 1368	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 3932 wrote to memory of 1160	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 3932 wrote to memory of 1160	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 3932 wrote to memory of 3356	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 3932 wrote to memory of 3356	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 3932 wrote to memory of 1560	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 3932 wrote to memory of 1560	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 3932 wrote to memory of 2940	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 3932 wrote to memory of 2940	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 3932 wrote to memory of 4236	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 3932 wrote to memory of 4236	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 3932 wrote to memory of 3152	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	104
PID 3932 wrote to memory of 3152	3932	2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe	104

C:\Users\Admin\AppData\Local\Temp\2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-21_1b7deb1a82a7af372458458b5e2f4688_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\System\JZTuZcx.exe
  C:\Windows\System\JZTuZcx.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\TgGSEto.exe
  C:\Windows\System\TgGSEto.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\KCDueUU.exe
  C:\Windows\System\KCDueUU.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\jQEzoZD.exe
  C:\Windows\System\jQEzoZD.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\xogDxuA.exe
  C:\Windows\System\xogDxuA.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\WSANLeh.exe
  C:\Windows\System\WSANLeh.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\jctQyfI.exe
  C:\Windows\System\jctQyfI.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\vvcapID.exe
  C:\Windows\System\vvcapID.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\ppktRow.exe
  C:\Windows\System\ppktRow.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\IIHMdZH.exe
  C:\Windows\System\IIHMdZH.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\KFKxpqy.exe
  C:\Windows\System\KFKxpqy.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\tILNwZX.exe
  C:\Windows\System\tILNwZX.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\uHXpBnt.exe
  C:\Windows\System\uHXpBnt.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\fpDOWDa.exe
  C:\Windows\System\fpDOWDa.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\vceDJvB.exe
  C:\Windows\System\vceDJvB.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\jFubFqE.exe
  C:\Windows\System\jFubFqE.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\bjKRDOJ.exe
  C:\Windows\System\bjKRDOJ.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\ewRhbHA.exe
  C:\Windows\System\ewRhbHA.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\VNLkOrS.exe
  C:\Windows\System\VNLkOrS.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\oNOzgSK.exe
  C:\Windows\System\oNOzgSK.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\JQjFkEa.exe
  C:\Windows\System\JQjFkEa.exe
  2⤵
  - Executes dropped EXE
  PID:3152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\IIHMdZH.exe

Filesize
5.7MB

MD5
652f3ab6d65f289fbe781b207b46386b

SHA1
8cb8a603561c39f2bd2f528681091200b64b5a9d

SHA256
db4cfb1cc5bea2a5c00409b5735ff15440d937565d72229ee3d11dab63508b3b

SHA512
0836f101123d0276d606315f35f111a8edd6a9e2885aeaf6803dbff48a9da3d91104ce2a29ed21f31010ca1931eb30daf529082bda778394a939aaa730e6d16d

Download Submit
C:\Windows\System\JQjFkEa.exe

Filesize
5.7MB

MD5
9288744084c45527d972599b145c256e

SHA1
bf8e3b369c417f850b4979b9a081fa63a031a27c

SHA256
61f90785b6872d77afe9b8f7b30c927ec895d61923bbd1735062f7b3965ba24d

SHA512
71ba973ebeb863f08c25a7491cb0701a24dce2aaddec65589a6a61e8954ac72de1f6b88461e7c4ef2425bbaf9d4382df456b21d7119d1ed83d82830a51dddf64

Download Submit
C:\Windows\System\JZTuZcx.exe

Filesize
5.7MB

MD5
2f8fe2543cb7488c1e787e809133b7fd

SHA1
015438b669eb9030cd93194a64deeb54d9db8785

SHA256
ce77e830d761bbf257e2d1559437bddd6d014178f1ac351964954e9749e534a0

SHA512
a5038cdf7488e04783b7b6b46ddd1805ce45ea406ae2097823ed06b83531b9d94ae5d7b71d13be6cd952584ef7dac0ace5ac88f17548d5ff19c93235a38043b0

Download Submit
C:\Windows\System\KCDueUU.exe

Filesize
5.7MB

MD5
22530139d8770ca6566c2ab681f0c777

SHA1
cf7f3c82e10e783db5b5639bf26a7f954a1f1354

SHA256
34786408c2be8213a25e8a70c5aba0ebcf7fa9bdb360676688d39fc9e6b71ffb

SHA512
f85f8f3afd3a073f227d00c3cbee8485a118312994a5551c368106997591fe7feb2e7499587b050f15fc6a9ddd7c305cdd5c606abff0afbce3bbb6d6a50df95d

Download Submit
C:\Windows\System\KFKxpqy.exe

Filesize
5.7MB

MD5
acdde3616e8a9d0cfc7741f48bcb8004

SHA1
cd42873fa5958aef9c85f8ff42bd7b39968f9439

SHA256
69f0a3b0e8d84699a3f34d88d8b66e0a45e7f78583986b63367f05cc89a221d3

SHA512
6908fafdc07d832558f2936158257ed315d771c2cc3ac830eab49423d1e624258dc91d3e7b10e64d12931892e88aa189de809e27b04cbc384340af0fc8c6bfc4

Download Submit
C:\Windows\System\TgGSEto.exe

Filesize
5.7MB

MD5
591cac4db1d3050772696a6db3195a77

SHA1
5711b3ef5114515b83527c5f64809c4fefd9587f

SHA256
4a66d137eb45517474669be60f565584ba3f7c173530592763b36b2a5069be97

SHA512
4808e7e4ea3043948f7419a50d62660256c7d82e30261ed649d292d8a2bdf6fb86030574e842f53ffebb908b9864f24fa6581f187ef637e0131ceb8d152f233a

Download Submit
C:\Windows\System\VNLkOrS.exe

Filesize
5.7MB

MD5
989fe48b29eed5ab03fe3085d13793d0

SHA1
58a82855d71385f60309b9b9d0b1d3af2d500f53

SHA256
e9d552ef09cd9f02109d8adcfdd816520091ba817706055221e8fa98917bcb72

SHA512
b0e069b7f9af1674ddcc91cc971d2162e4fea9eec88f0c0695463a293f4aca9bf7ce034c4febdeff240efcad0d51907fb50ecc15fff2180dd6148a6d2c9d1f61

Download Submit
C:\Windows\System\WSANLeh.exe

Filesize
5.7MB

MD5
e0fa8d2acede4bdbb7a70db698c1b848

SHA1
f2b33c5680dbc86ffeacc305a4834cd439167e9d

SHA256
7fd5e8d18f0d644a9ef45b6e953714a9b143573c6d90b205261ea50a25f3257f

SHA512
3ff4e4894d6d8e1b86a26bd8d9e6111cde1f4fdcd29e2b6bc2c6359d8ddf57a7aabe1c662192088ba1ba08058302a2540125bf95b3fe08af1fbded2aa674d7a3

Download Submit
C:\Windows\System\bjKRDOJ.exe

Filesize
5.7MB

MD5
9b369b3cf786202a9c1271227e5ee19f

SHA1
4f4a3ee3070ccc010ce9ee26e610605c4fdc91c8

SHA256
6910bbebd42d2fba04d2745d4343ab74555cbf4d82c0f2f91f0bd00a4af2b2e8

SHA512
d7fa3c8ae906d5aefd09a79614ba5c69817f26a46bfdc47b5c0d0ac5cb925c7c2d0e723fbd1d9f5b6f426093b61d9b0e8dbff497cccdf36a89c4eccefc8c5297

Download Submit
C:\Windows\System\ewRhbHA.exe

Filesize
5.7MB

MD5
39048ba210ef3fd0be502ac0227d94a9

SHA1
13a3422c05e19c9000ce09391183777bda552365

SHA256
ca77b28aa4b1ff8f2c0a5a0e8af368d690ba508f8a7dc2a809dffab8dedfd01b

SHA512
0ad443b925502186735d928996f1e349e192599685a6578fdd86ef441c82980166c42c89ac583b5c41059840d8e68bd2d449ea2ed5d2d585213a6c8d91dfec23

Download Submit
C:\Windows\System\fpDOWDa.exe

Filesize
5.7MB

MD5
c743d06b4fb9434550cbfc832b2b42ef

SHA1
443944468dfca801cd0eafbb5b35773ea49bcb9e

SHA256
27875cd55261d519378a7c2a4c5eae279383be94b7100266e01db50b25ec1e57

SHA512
66939ac9dca6cc52fcc0a0a246b1651ed3cc0b1f93d07741b64f4c4e51f2363ffb6a5b8fb1331cb315f49e8ed451eb580b32f346a55f2893c6630015c112a458

Download Submit
C:\Windows\System\jFubFqE.exe

Filesize
5.7MB

MD5
b11879953020e8a369ff212f30d75b2e

SHA1
222baa4ac6f567b8a7ec259e4053ebe6fe402860

SHA256
d0bad397b640fc506b81f42dffb081bf5f12c6be175fe06f2ea53bfbee8394b9

SHA512
6d2f7c0848d8d8f393a25f11cb49446c156ce74d734341d88f117ff915f776019e09364e40996006557acf755cf1140595c8e4575d82f4cedd0e349130003780

Download Submit
C:\Windows\System\jQEzoZD.exe

Filesize
5.7MB

MD5
31d41c6026db56139520973cff4bd1c8

SHA1
b50cc84ece64061da895f698316213e29c20f718

SHA256
320e879a2bf83d4c95b56bf943e8213996d5bd28d6d6341151fe61f90b18a0da

SHA512
17517a71c35d557f1c26334c775375c64ea4bfa70b4427ad933ba4019d9fa732daf278168317a854e65135bf6d898243ea004638f6c0df2678c3bad77fae9379

Download Submit
C:\Windows\System\jctQyfI.exe

Filesize
5.7MB

MD5
18c9279775a3296c3026ef8cb63bfe4d

SHA1
9238c90f7c9bf05885beb4a6764dc0dbe54983b3

SHA256
5a1c37ae998439ffd83b238b30fc28ad23718c0fee24a50d585df17dab113dfa

SHA512
c46ff258542196c7f8338c34ef2312476c733bbf72f592804fa079d8cd5c1056426096c3e85b9db63398c8b8d6177f12389b00ee960c726530751b09a06b78b0

Download Submit
C:\Windows\System\oNOzgSK.exe

Filesize
5.7MB

MD5
531308095159c532afd832b2e2e943eb

SHA1
11c94aa8f08e378a106a66950066459cd48f10fb

SHA256
3e41dcf930d61687cf616e7ea275ce7ed44c9e599233a47f545476cc8c2bdff4

SHA512
00fb53d3c554b87a64f67819ba873fd2d50dd3f4af7ed573b36d7844d3437c831cb2e7a8c3aa7aa33682459b02bef6a5e6331018d4d11f842055254d880b0ca7

Download Submit
C:\Windows\System\ppktRow.exe

Filesize
5.7MB

MD5
c47165d7858846a9599adace3f9ef548

SHA1
7a9b2a7ed2adfd1a5957aa7ea24b0a495557259e

SHA256
7c898f19775fff92881710ed664f1911ce83ab2950fafceebe5a1d5b25de2314

SHA512
413aa94330918d5571a64699b0866263704942e775deff15fb08a4f5091531e1e570071422a78cf77b28e7cf1aa5b40f4714f3ccfeb744f1c341bb37a346bd49

Download Submit
C:\Windows\System\tILNwZX.exe

Filesize
5.7MB

MD5
2bc4495d4983236368dfd4f29d61c3eb

SHA1
52a364cab4310723e1b2c074409c06c4b7ef5571

SHA256
1bf50c3eaf056c342c7cf86924643fa1cbbf15b2140cffb3d01220f67e0aee98

SHA512
52e81f4810d7d45dea4c3daa0ae50c73db9799c1a01e8ca65d301fb53e1b92108f0b075dca22321f2354b0a5870ffddb48ca343c23665cb3cdb90c43423f9317

Download Submit
C:\Windows\System\uHXpBnt.exe

Filesize
5.7MB

MD5
b2867879f88114753ac2a325ebed53c8

SHA1
ba43a1c53ad84953694edd00fd7c8b2737f03fa3

SHA256
bdb2d977b0d35e1573c653af3a58976d7b9e2be1a7163880037766c7710fb4fd

SHA512
9ecb746975cc6fb1f8c0e0b5f48aa5f2103f9e3b0e42f27a81f120ee76e1a34979ce629b378767587a593be04a3051a9f7e939b24d0d8182976fa01d091cc613

Download Submit
C:\Windows\System\vceDJvB.exe

Filesize
5.7MB

MD5
d76ffe01357eaeb133ae971eabfc01c7

SHA1
787cf0823738b00b5deecbe4f13ea5286e704d2c

SHA256
b988c3ce1fee585c507f2699f8cc747755144b7a3d9992fd7c1e4a9a2dde00d6

SHA512
3669488cb8966b2b91fa6af35412673329ff048010c6617f548c94093952e23b13cd542def9f9017bc0c2e2a23cdc0a68784a66851d366e9196b8589b8210b31

Download Submit
C:\Windows\System\vvcapID.exe

Filesize
5.7MB

MD5
d27fe6f1741f4ae7dbb687adc74ccc84

SHA1
16904cba6d697d9644f6ba7f3a502f369b2c90c2

SHA256
1d95e16a4fc4131ddd68e17ebd932ba8e42cb4b060908316872d72ab8dd31c45

SHA512
6a094bcdb9ea033e79f73f9e8cd2d5de7a0463b8f665df52f28455a7a213036613bd2ce1d6efb2827fe28186efdedb7665f1a58d7be15530f61fd993d614af85

Download Submit
C:\Windows\System\xogDxuA.exe

Filesize
5.7MB

MD5
f2d72ec20e14649a35a742a87ebdf9ab

SHA1
2d470772ec90b75634e2aa9089b741c1694da6b7

SHA256
b8b8c1a77210e5b53751a0b7dfaaec46c4858c31ac99f1a85d6c186a153e48bf

SHA512
7109e883c02e7ba1e1aca1f8d83e4b926ff82a6c20310f4f6933ea234f0eeb621f928b2e253abc34b5685156465f1e50b1fea39761b911be75716de6f03d9c53

Download Submit
memory/1160-97-0x00007FF737880000-0x00007FF737BCD000-memory.dmp

Filesize
3.3MB

Download
memory/1368-91-0x00007FF766EB0000-0x00007FF7671FD000-memory.dmp

Filesize
3.3MB

Download
memory/1372-22-0x00007FF79F720000-0x00007FF79FA6D000-memory.dmp

Filesize
3.3MB

Download
memory/1560-109-0x00007FF7C5CA0000-0x00007FF7C5FED000-memory.dmp

Filesize
3.3MB

Download
memory/1576-88-0x00007FF606670000-0x00007FF6069BD000-memory.dmp

Filesize
3.3MB

Download
memory/2064-79-0x00007FF65CCE0000-0x00007FF65D02D000-memory.dmp

Filesize
3.3MB

Download
memory/2380-43-0x00007FF622EC0000-0x00007FF62320D000-memory.dmp

Filesize
3.3MB

Download
memory/2472-49-0x00007FF7AA240000-0x00007FF7AA58D000-memory.dmp

Filesize
3.3MB

Download
memory/2592-40-0x00007FF7B2280000-0x00007FF7B25CD000-memory.dmp

Filesize
3.3MB

Download
memory/2640-67-0x00007FF60A510000-0x00007FF60A85D000-memory.dmp

Filesize
3.3MB

Download
memory/2680-64-0x00007FF797FE0000-0x00007FF79832D000-memory.dmp

Filesize
3.3MB

Download
memory/2940-115-0x00007FF688500000-0x00007FF68884D000-memory.dmp

Filesize
3.3MB

Download
memory/3152-126-0x00007FF642240000-0x00007FF64258D000-memory.dmp

Filesize
3.3MB

Download
memory/3300-25-0x00007FF6217D0000-0x00007FF621B1D000-memory.dmp

Filesize
3.3MB

Download
memory/3356-102-0x00007FF6829F0000-0x00007FF682D3D000-memory.dmp

Filesize
3.3MB

Download
memory/3924-7-0x00007FF615840000-0x00007FF615B8D000-memory.dmp

Filesize
3.3MB

Download
memory/3932-1-0x0000027F75FF0000-0x0000027F76000000-memory.dmp

Filesize
64KB

Download
memory/3932-0-0x00007FF625520000-0x00007FF62586D000-memory.dmp

Filesize
3.3MB

Download
memory/4152-36-0x00007FF7067E0000-0x00007FF706B2D000-memory.dmp

Filesize
3.3MB

Download
memory/4196-57-0x00007FF76C610000-0x00007FF76C95D000-memory.dmp

Filesize
3.3MB

Download
memory/4236-121-0x00007FF636160000-0x00007FF6364AD000-memory.dmp

Filesize
3.3MB

Download
memory/4688-19-0x00007FF6A3A30000-0x00007FF6A3D7D000-memory.dmp

Filesize
3.3MB

Download
memory/5100-76-0x00007FF7A7D10000-0x00007FF7A805D000-memory.dmp

Filesize
3.3MB

Download