cobaltstrike | b6c4068960959c38d02ac50ead6b8ce9844928075f1a5b00a4b3df1ef08a6507

Analysis

max time kernel
140s
max time network
144s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21/01/2025, 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

f526b2245134455559ad1febcccffa6f
SHA1

515d789194db6dbb2d481cf10f168883c8119327
SHA256

b6c4068960959c38d02ac50ead6b8ce9844928075f1a5b00a4b3df1ef08a6507
SHA512

af018d0a49160acbb46ae09fcd860fa0ac9db3354e953697a398459ac29adb024e1015c9ee7254fd025692bc93839627b64a081261551bdf6bcc1b574f3f76ce
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUd:j+R56utgpPF8u/7d

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000d000000012281-3.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016c66-12.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016c88-13.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016cd7-21.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016cf5-35.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016ecf-41.dat	cobalt_reflective_dll
behavioral1/files/0x000a000000016d2a-36.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000018686-75.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000186e7-81.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001878e-121.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000018744-117.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000018739-111.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000018704-105.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000186f4-99.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000186f1-93.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000186ed-87.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001755b-69.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001749c-63.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000017497-57.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000017049-51.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000016650-28.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral1/memory/2608-0-0x000000013F220000-0x000000013F56D000-memory.dmp	xmrig
behavioral1/files/0x000d000000012281-3.dat	xmrig
behavioral1/memory/2004-7-0x000000013FA20000-0x000000013FD6D000-memory.dmp	xmrig
behavioral1/files/0x0008000000016c66-12.dat	xmrig
behavioral1/files/0x0007000000016c88-13.dat	xmrig
behavioral1/memory/468-17-0x000000013FA80000-0x000000013FDCD000-memory.dmp	xmrig
behavioral1/memory/2584-16-0x000000013F2B0000-0x000000013F5FD000-memory.dmp	xmrig
behavioral1/files/0x0007000000016cd7-21.dat	xmrig
behavioral1/files/0x0007000000016cf5-35.dat	xmrig
behavioral1/files/0x0008000000016ecf-41.dat	xmrig
behavioral1/memory/2848-45-0x000000013FE20000-0x000000014016D000-memory.dmp	xmrig
behavioral1/memory/348-38-0x000000013FC90000-0x000000013FFDD000-memory.dmp	xmrig
behavioral1/files/0x000a000000016d2a-36.dat	xmrig
behavioral1/memory/2928-59-0x000000013F470000-0x000000013F7BD000-memory.dmp	xmrig
behavioral1/memory/2884-71-0x000000013FA10000-0x000000013FD5D000-memory.dmp	xmrig
behavioral1/files/0x0005000000018686-75.dat	xmrig
behavioral1/memory/2712-83-0x000000013FFC0000-0x000000014030D000-memory.dmp	xmrig
behavioral1/files/0x00050000000186e7-81.dat	xmrig
behavioral1/memory/2060-89-0x000000013F530000-0x000000013F87D000-memory.dmp	xmrig
behavioral1/memory/2280-95-0x000000013F250000-0x000000013F59D000-memory.dmp	xmrig
behavioral1/memory/1856-101-0x000000013F430000-0x000000013F77D000-memory.dmp	xmrig
behavioral1/memory/1644-107-0x000000013F2C0000-0x000000013F60D000-memory.dmp	xmrig
behavioral1/memory/1696-124-0x000000013F7C0000-0x000000013FB0D000-memory.dmp	xmrig
behavioral1/files/0x000500000001878e-121.dat	xmrig
behavioral1/memory/1976-119-0x000000013FD10000-0x000000014005D000-memory.dmp	xmrig
behavioral1/files/0x0005000000018744-117.dat	xmrig
behavioral1/files/0x0005000000018739-111.dat	xmrig
behavioral1/files/0x0005000000018704-105.dat	xmrig
behavioral1/files/0x00050000000186f4-99.dat	xmrig
behavioral1/files/0x00050000000186f1-93.dat	xmrig
behavioral1/files/0x00050000000186ed-87.dat	xmrig
behavioral1/memory/2648-77-0x000000013FB60000-0x000000013FEAD000-memory.dmp	xmrig
behavioral1/files/0x000600000001755b-69.dat	xmrig
behavioral1/memory/2736-65-0x000000013FC60000-0x000000013FFAD000-memory.dmp	xmrig
behavioral1/files/0x000600000001749c-63.dat	xmrig
behavioral1/memory/2656-53-0x000000013F3E0000-0x000000013F72D000-memory.dmp	xmrig
behavioral1/files/0x0006000000017497-57.dat	xmrig
behavioral1/files/0x0006000000017049-51.dat	xmrig
behavioral1/files/0x0009000000016650-28.dat	xmrig
behavioral1/memory/2740-33-0x000000013F6C0000-0x000000013FA0D000-memory.dmp	xmrig
behavioral1/memory/2404-29-0x000000013F4D0000-0x000000013F81D000-memory.dmp	xmrig
behavioral1/memory/2856-126-0x000000013F150000-0x000000013F49D000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2004	XIdxSyj.exe
2584	SnlAwXP.exe
468	LTJbYHb.exe
2404	wwDRBQf.exe
2740	ofSgnoz.exe
348	WlaGNIx.exe
2848	guqPNgi.exe
2856	DxKVmnP.exe
2656	qwZhFPS.exe
2928	aVbXpoK.exe
2736	ZrASNGX.exe
2884	SyTMTGl.exe
2648	VooPWZb.exe
2712	xYWSqCJ.exe
2060	maMLKxu.exe
2280	fEUTMjS.exe
1856	lIwmcSt.exe
1644	VrivfNA.exe
1908	sgPYqqA.exe
1976	HcALOAB.exe
1696	JdulUxM.exe

Loads dropped DLL 21 IoCs

pid	Process
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\WlaGNIx.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\qwZhFPS.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZrASNGX.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SyTMTGl.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\xYWSqCJ.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\maMLKxu.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\VrivfNA.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\XIdxSyj.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\LTJbYHb.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\DxKVmnP.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\aVbXpoK.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\fEUTMjS.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\lIwmcSt.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HcALOAB.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\guqPNgi.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\sgPYqqA.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SnlAwXP.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\wwDRBQf.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ofSgnoz.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\VooPWZb.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\JdulUxM.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2004	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2608 wrote to memory of 2004	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2608 wrote to memory of 2004	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2608 wrote to memory of 2584	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2608 wrote to memory of 2584	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2608 wrote to memory of 2584	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2608 wrote to memory of 468	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2608 wrote to memory of 468	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2608 wrote to memory of 468	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2608 wrote to memory of 2404	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2608 wrote to memory of 2404	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2608 wrote to memory of 2404	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2608 wrote to memory of 2740	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2608 wrote to memory of 2740	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2608 wrote to memory of 2740	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2608 wrote to memory of 348	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2608 wrote to memory of 348	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2608 wrote to memory of 348	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2608 wrote to memory of 2856	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2608 wrote to memory of 2856	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2608 wrote to memory of 2856	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2608 wrote to memory of 2848	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2608 wrote to memory of 2848	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2608 wrote to memory of 2848	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2608 wrote to memory of 2656	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2608 wrote to memory of 2656	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2608 wrote to memory of 2656	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2608 wrote to memory of 2928	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2608 wrote to memory of 2928	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2608 wrote to memory of 2928	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2608 wrote to memory of 2736	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2608 wrote to memory of 2736	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2608 wrote to memory of 2736	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2608 wrote to memory of 2884	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2608 wrote to memory of 2884	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2608 wrote to memory of 2884	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2608 wrote to memory of 2648	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2608 wrote to memory of 2648	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2608 wrote to memory of 2648	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2608 wrote to memory of 2712	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2608 wrote to memory of 2712	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2608 wrote to memory of 2712	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2608 wrote to memory of 2060	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2608 wrote to memory of 2060	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2608 wrote to memory of 2060	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2608 wrote to memory of 2280	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2608 wrote to memory of 2280	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2608 wrote to memory of 2280	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2608 wrote to memory of 1856	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2608 wrote to memory of 1856	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2608 wrote to memory of 1856	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2608 wrote to memory of 1644	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2608 wrote to memory of 1644	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2608 wrote to memory of 1644	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2608 wrote to memory of 1908	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2608 wrote to memory of 1908	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2608 wrote to memory of 1908	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2608 wrote to memory of 1976	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2608 wrote to memory of 1976	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2608 wrote to memory of 1976	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2608 wrote to memory of 1696	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2608 wrote to memory of 1696	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2608 wrote to memory of 1696	2608	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	51

C:\Users\Admin\AppData\Local\Temp\2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\System\XIdxSyj.exe
  C:\Windows\System\XIdxSyj.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\SnlAwXP.exe
  C:\Windows\System\SnlAwXP.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\LTJbYHb.exe
  C:\Windows\System\LTJbYHb.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\wwDRBQf.exe
  C:\Windows\System\wwDRBQf.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\ofSgnoz.exe
  C:\Windows\System\ofSgnoz.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\WlaGNIx.exe
  C:\Windows\System\WlaGNIx.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\DxKVmnP.exe
  C:\Windows\System\DxKVmnP.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\guqPNgi.exe
  C:\Windows\System\guqPNgi.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\qwZhFPS.exe
  C:\Windows\System\qwZhFPS.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\aVbXpoK.exe
  C:\Windows\System\aVbXpoK.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\ZrASNGX.exe
  C:\Windows\System\ZrASNGX.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\SyTMTGl.exe
  C:\Windows\System\SyTMTGl.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\VooPWZb.exe
  C:\Windows\System\VooPWZb.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\xYWSqCJ.exe
  C:\Windows\System\xYWSqCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\maMLKxu.exe
  C:\Windows\System\maMLKxu.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\fEUTMjS.exe
  C:\Windows\System\fEUTMjS.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\lIwmcSt.exe
  C:\Windows\System\lIwmcSt.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\VrivfNA.exe
  C:\Windows\System\VrivfNA.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\sgPYqqA.exe
  C:\Windows\System\sgPYqqA.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\HcALOAB.exe
  C:\Windows\System\HcALOAB.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\JdulUxM.exe
  C:\Windows\System\JdulUxM.exe
  2⤵
  - Executes dropped EXE
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\HcALOAB.exe

Filesize
5.7MB

MD5
37b57218f1d08da3e378648c536d21f5

SHA1
ed8448a98fa7094dd8e124892caaccae119b9719

SHA256
689505e22fe1a9e72266d401cae4aa31c20d881c7a46cc7d642b9ce1f53d0894

SHA512
c664372e71414b5616e97e4195af2b577b44fe8eccf0deea5851612b6842df3e852c06c7e1149f028e8937d4c2da25f6ef0a08b67b62be09d6f2bf50cad02d89

Download Submit
C:\Windows\system\SnlAwXP.exe

Filesize
5.7MB

MD5
cea006eaaa719441dd24f7547dfc52f4

SHA1
2ca48f2f0f1811e68072f42f972eb4624e0249f8

SHA256
8a950292a407014ce83ebcbca44f5ecee92dff874000b3e3f6487187878a4364

SHA512
62a81683929a345962680e1cee71d4320f93f7ead12a939467e832c993e85b90d44cdb99a9c6349f2c1d0b43314e3c585be97b9aa52ae78a989a32c92357c396

Download Submit
C:\Windows\system\SyTMTGl.exe

Filesize
5.7MB

MD5
627230a5954eec81285e32035e467be0

SHA1
8cb1195a19e7dd3681266350646ecfa5ecdf5f0f

SHA256
7f1436e178b6f6f0522c3f1f22f21d4e0cfedf971fff46b5b80c7547023f0018

SHA512
8f52a852a8098a326591bd8f91e461b02f39361426c89afbe77100a95ea207815f8b7dd7f592dac587d60b6331da350ae3bda49a3a38f5cb1c9775d423e58afe

Download Submit
C:\Windows\system\VooPWZb.exe

Filesize
5.7MB

MD5
bb91d09ec6be5f3bd9eae2a94917300c

SHA1
ccd9841fd74d1e6a1da5efccf146e06621f1af83

SHA256
663fbba717535ebdfde84ca6c074c50249f94bb10b29321262ea6b48ad083584

SHA512
fc1a71b53de5e3f56497532e906d043b2374f4c166bdeb5bf8cfef695bd0772a1e444b370e8fa26629508fc4a0b70a7b4784c95c23e6fba91ed24bb989c51fca

Download Submit
C:\Windows\system\VrivfNA.exe

Filesize
5.7MB

MD5
cb68cd262de775626b45b6be36cda76a

SHA1
c8a01e231b443b58580909a2c6c021be47a07bb8

SHA256
98d21a2ed7cf5e14bd00b4d7c3b05db323481d914bafec2e411db8b3004b5235

SHA512
381c4b858614c718d989d59bbda54a7c84283866f188eb1cde861a8ee66bbc37a8296a4a2078b9321534d4cd1c54463693abd951f34650e7b5289619ec1544fd

Download Submit
C:\Windows\system\WlaGNIx.exe

Filesize
5.7MB

MD5
f65e1a7ba23d69230195d4ebc91f6280

SHA1
0c1ce00742fdd294a6bcb161c91eba1ccc8097c6

SHA256
c27dc6a31527b7275f1b6d9729d814133c96756561fa59c7746c6addf846e585

SHA512
90ca520cec3b4480f0d543b43312c29b99785d52c11f2e21f97d3cc122e85ba8d4fdc6e8daaeffb98ca0c3f3c1e7bf476df380a645998934a338302477bbed97

Download Submit
C:\Windows\system\ZrASNGX.exe

Filesize
5.7MB

MD5
6dd7aabe1c96723df372fce239dd8c2c

SHA1
40c389e617f399aa7f99ab42ef72e2deef1a45fe

SHA256
89c80343ab4307eb70cac453a49d17a8a16132da91d73054ee296a41c1239954

SHA512
788aeea3ac8440f7fe206ecc6c227715951e95d01febae1d628f66a6db1b19458f1fb4c1c25b376e6e99dc150fe5c8981175500312a99bf3d6e228e17364e190

Download Submit
C:\Windows\system\aVbXpoK.exe

Filesize
5.7MB

MD5
11d48a189958a883168c2bd375afa47b

SHA1
094064335bed4efdb46ea9a8b131faafc349349d

SHA256
17b19c29b6a7fbab855be4a811aa26c225840295b9afa2a29daaa3e166ba3115

SHA512
de9aa53d96c828da1d9ced46b4ba9a6f95e32252200b9427f5c4ea6fb9e3f73d9518e496e6205ead076398a456b84cb667fb43241a670c66a71d79b2306db6c1

Download Submit
C:\Windows\system\fEUTMjS.exe

Filesize
5.7MB

MD5
04dcc874291b0cab3ac11e665456bfb5

SHA1
60dab36992744273b7b678e4bcffc959b033b320

SHA256
c3f778d176d24aa7c810ddcafbffe9a27d5f7900efb84a4ab251d524e868a31a

SHA512
bc3a8bed0d167537b357247dda9741178793b6357e9d6320d65d2c2d21185a397d8de366180a95347bc1c7ba955482618aaf16dc25703ac7384e7d7f2a58d905

Download Submit
C:\Windows\system\lIwmcSt.exe

Filesize
5.7MB

MD5
347d3f17589251c13602ab37ab92943d

SHA1
7d8964218d493e3ddeeeca01d0be7f1169739e22

SHA256
d4dbd3a47f2c519f9dc085e386941dc10e4d1bc8d6c273f6f4bb7d8475da86a5

SHA512
efd912be8f24e575ef39f7f164806dc2a7fa15549d28128b7f8b38623d7fa28165da4fe9300abcbb00cbbea5b4c399e994ea4ff97286d3f2deee7a62ef886b22

Download Submit
C:\Windows\system\maMLKxu.exe

Filesize
5.7MB

MD5
6a7aff89303f5b08d386ac8bdfc611f6

SHA1
5ae8be2735a14cb05648b8e9e0cae1d18185f344

SHA256
7ac6f09203fb84ce3be125087c2537b2ad12d03154177842fd126e9c0c149cfe

SHA512
413813522c6a386eda107945ae30951b50a242d00b651a5fe3bb574ae96dd9211578148014f9ceb0eccb093f024180156412133180c505588f2b706cc2c8f867

Download Submit
C:\Windows\system\ofSgnoz.exe

Filesize
5.7MB

MD5
778cf04a64a04bded457e7035a9f0e32

SHA1
b141c38805d124655529f120f0693c5a242f4a40

SHA256
13e6a62ffd81d7d93f548998313c6a6501e3bffbecaf9f272795886ad6a43359

SHA512
39a0b9a01301a7e7b8c0d267273b9ed322cb84deece7584fd248de0ad549a4a661c892e8d5d370215f7940e2f7303f5f1bf0313421ea4c2ce4019ccf62efc245

Download Submit
C:\Windows\system\qwZhFPS.exe

Filesize
5.7MB

MD5
eb5182bbe27637ff039dcef6c5c5be0c

SHA1
e0f2c13e0b59b2c6f53fefbe9c8dfaeec4be874a

SHA256
36143fc3d2833ecf30e61a52983ffc2c5f696cc5c56ccff8d3d8f2fa64791389

SHA512
ee35565b0ac927eec553965ea7512b78ec2fd57ac3ad238f3e5ceef174d56f4dac101da21b947a350b51e8c56c1e95f9eb5f39e253bf887316bc6943f748b547

Download Submit
C:\Windows\system\sgPYqqA.exe

Filesize
5.7MB

MD5
6854b87563d2498100fa759d8bfde1b7

SHA1
3bd04e3ea82452b3b93b4d065e0b1f639b2bb2c5

SHA256
de43dcc2b341cc25d72ec22ffe784459e533f0ec72b93521b0f70552a54ffb68

SHA512
07d7da9c1bbf3b33fba1b5181f4d9e28d1864a780ad9558f5a0fd1163348cf7170a3ac31a53c70f05a7456d7ccf995ff4a77cea49e57e2635db648ea756c2941

Download Submit
C:\Windows\system\xYWSqCJ.exe

Filesize
5.7MB

MD5
2faafcd17066dbeae87262d563d47ee8

SHA1
739fea5626b13ee2b1e6ff15cb019d798460c714

SHA256
2a314be7675d781c95005d1ea8ca9d8df93838fbb3f477576842da5131fa3e11

SHA512
c9c8088bee1677f9cf683952dbbfa0f63b21ab360e67db97baf3f80702721032c8110ae4874316291eaa1bfa3dc2e0a3b0c9423a2e7e731df27f81e1b85cabb3

Download Submit
\Windows\system\DxKVmnP.exe

Filesize
5.7MB

MD5
2fd5b037539ee68c57f5a1cd5146d973

SHA1
1f60d4b0dba6787c9c06aba333bbd4c3b2299a25

SHA256
1bcdd91359ce7f089600c4dfdddb5ec80116a252897222ff7a732cf4983d1b37

SHA512
9ac31e79141b85fa0c8811b1626d27c5a9085322e5ff0cce45b715b3e2e39d25e39fb170bfe00a23047cfd542230391ea000a14dd87dbac932022904dfbc4835

Download Submit
\Windows\system\JdulUxM.exe

Filesize
5.7MB

MD5
23e5ee5b06fe36495f5f08e2c40d6269

SHA1
01b8758df4b4e2a0a41c080f398eb332c50c8ee1

SHA256
04906536065d84faa9598b9260ede2547986005e173449e2d58bb4f7ba16bb39

SHA512
a244eab69504089062011f9a3ac49a70d3274e1e88e3f0cda2ddd65de74bd4520211cb37accecdaf4f22c02c5f624335ccf01401e62adbf3369b5a0f9d6d997c

Download Submit
\Windows\system\LTJbYHb.exe

Filesize
5.7MB

MD5
943b97869d0bcc94ae0656484c84d76a

SHA1
e8deaff477e1ec2b5108dd0f996b95da3afc3793

SHA256
fe91bc290e8189941ef5a3481b74bd0a9f40ebd8fc32c45de1eeba9221c569e0

SHA512
d40230926639e84d18a26f4f38f9b3a0c23bad1cb029f09be35f6089704151e137fd81b45953990aff74e972717eefed4a7085fa99a1febb1546f58e34247d1e

Download Submit
\Windows\system\XIdxSyj.exe

Filesize
5.7MB

MD5
52e5e7e52e35afbb56c69dcc423b684e

SHA1
bc01d944e76dcf6ad4b6a49ceffff28edbd2f4c6

SHA256
b296fd00a971541055f4cbec6299641fa4b68ce7d6d5ab5f2b302fc0d5421673

SHA512
43337df4c30cecd49b3ba5d21785a1d4472b53bc156391ac048f673d7b86a372e739b9595cf7cc4861f7a2914aef524aad6f66f7df6a263b5ce9f595f4950371

Download Submit
\Windows\system\guqPNgi.exe

Filesize
5.7MB

MD5
1d9247628f85c788a0d4d24204c7b76f

SHA1
88c3a9fe97c8c184f41c7d0e4d249c16473dd27a

SHA256
f38cdc40b19fe05462d1aaae966e7f38a7d1890180de9d91571b5c94713eff9b

SHA512
2c34ccce8f41847f316bd755c0a933353515e2f363a1cb516f972651a840a803599ab269cc6452487b1003bc37ba54452290d7f6914adb8ede9f8f7d4238dce9

Download Submit
\Windows\system\wwDRBQf.exe

Filesize
5.7MB

MD5
129d4f418ef0491779372adb56db0365

SHA1
703b141373e09305cc619fed8f1c7abbf52bdfdd

SHA256
d3a5117d45d3f2a82beb175c0ab94ff3b453092919e8cf78e968c8e13cde68f1

SHA512
96317b2af04cfc2784b147284441cfd3826aa03548cac59e5f786778b807e9c2adf4b3d1dff5ed382dc860264098e75feaedbadfb06d1529e8fe493f305f1212

Download Submit
memory/348-38-0x000000013FC90000-0x000000013FFDD000-memory.dmp

Filesize
3.3MB

Download
memory/468-17-0x000000013FA80000-0x000000013FDCD000-memory.dmp

Filesize
3.3MB

Download
memory/1644-107-0x000000013F2C0000-0x000000013F60D000-memory.dmp

Filesize
3.3MB

Download
memory/1696-124-0x000000013F7C0000-0x000000013FB0D000-memory.dmp

Filesize
3.3MB

Download
memory/1856-101-0x000000013F430000-0x000000013F77D000-memory.dmp

Filesize
3.3MB

Download
memory/1976-119-0x000000013FD10000-0x000000014005D000-memory.dmp

Filesize
3.3MB

Download
memory/2004-7-0x000000013FA20000-0x000000013FD6D000-memory.dmp

Filesize
3.3MB

Download
memory/2060-89-0x000000013F530000-0x000000013F87D000-memory.dmp

Filesize
3.3MB

Download
memory/2280-95-0x000000013F250000-0x000000013F59D000-memory.dmp

Filesize
3.3MB

Download
memory/2404-29-0x000000013F4D0000-0x000000013F81D000-memory.dmp

Filesize
3.3MB

Download
memory/2584-16-0x000000013F2B0000-0x000000013F5FD000-memory.dmp

Filesize
3.3MB

Download
memory/2608-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2608-0-0x000000013F220000-0x000000013F56D000-memory.dmp

Filesize
3.3MB

Download
memory/2648-77-0x000000013FB60000-0x000000013FEAD000-memory.dmp

Filesize
3.3MB

Download
memory/2656-53-0x000000013F3E0000-0x000000013F72D000-memory.dmp

Filesize
3.3MB

Download
memory/2712-83-0x000000013FFC0000-0x000000014030D000-memory.dmp

Filesize
3.3MB

Download
memory/2736-65-0x000000013FC60000-0x000000013FFAD000-memory.dmp

Filesize
3.3MB

Download
memory/2740-33-0x000000013F6C0000-0x000000013FA0D000-memory.dmp

Filesize
3.3MB

Download
memory/2848-45-0x000000013FE20000-0x000000014016D000-memory.dmp

Filesize
3.3MB

Download
memory/2856-126-0x000000013F150000-0x000000013F49D000-memory.dmp

Filesize
3.3MB

Download
memory/2884-71-0x000000013FA10000-0x000000013FD5D000-memory.dmp

Filesize
3.3MB

Download
memory/2928-59-0x000000013F470000-0x000000013F7BD000-memory.dmp

Filesize
3.3MB

Download