cobaltstrike | b6c4068960959c38d02ac50ead6b8ce9844928075f1a5b00a4b3df1ef08a6507

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

f526b2245134455559ad1febcccffa6f
SHA1

515d789194db6dbb2d481cf10f168883c8119327
SHA256

b6c4068960959c38d02ac50ead6b8ce9844928075f1a5b00a4b3df1ef08a6507
SHA512

af018d0a49160acbb46ae09fcd860fa0ac9db3354e953697a398459ac29adb024e1015c9ee7254fd025692bc93839627b64a081261551bdf6bcc1b574f3f76ce
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUd:j+R56utgpPF8u/7d

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000c000000023b27-4.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b84-12.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023b81-11.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b85-26.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b86-29.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b89-47.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b8c-66.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b91-96.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b95-119.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b94-125.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b96-122.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b93-116.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b92-112.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b90-90.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b8d-87.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b8f-84.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b8e-81.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b8b-74.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b8a-60.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b88-44.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b87-36.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/224-0-0x00007FF607B30000-0x00007FF607E7D000-memory.dmp	xmrig
behavioral2/files/0x000c000000023b27-4.dat	xmrig
behavioral2/memory/2436-7-0x00007FF799230000-0x00007FF79957D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b84-12.dat	xmrig
behavioral2/files/0x000b000000023b81-11.dat	xmrig
behavioral2/memory/3196-13-0x00007FF61FCF0000-0x00007FF62003D000-memory.dmp	xmrig
behavioral2/memory/3528-21-0x00007FF61FBD0000-0x00007FF61FF1D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b85-26.dat	xmrig
behavioral2/files/0x000a000000023b86-29.dat	xmrig
behavioral2/memory/3384-30-0x00007FF743BC0000-0x00007FF743F0D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b89-47.dat	xmrig
behavioral2/files/0x000a000000023b8c-66.dat	xmrig
behavioral2/memory/3092-91-0x00007FF68D740000-0x00007FF68DA8D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b91-96.dat	xmrig
behavioral2/memory/4076-99-0x00007FF660E70000-0x00007FF6611BD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b95-119.dat	xmrig
behavioral2/memory/4828-126-0x00007FF6D79E0000-0x00007FF6D7D2D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b94-125.dat	xmrig
behavioral2/memory/2476-123-0x00007FF76FBE0000-0x00007FF76FF2D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b96-122.dat	xmrig
behavioral2/memory/3320-120-0x00007FF740C60000-0x00007FF740FAD000-memory.dmp	xmrig
behavioral2/memory/948-117-0x00007FF643660000-0x00007FF6439AD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b93-116.dat	xmrig
behavioral2/memory/2656-113-0x00007FF753F70000-0x00007FF7542BD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b92-112.dat	xmrig
behavioral2/files/0x000a000000023b90-90.dat	xmrig
behavioral2/memory/3476-88-0x00007FF6883C0000-0x00007FF68870D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b8d-87.dat	xmrig
behavioral2/memory/3304-85-0x00007FF7A6100000-0x00007FF7A644D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b8f-84.dat	xmrig
behavioral2/memory/3164-82-0x00007FF6D0960000-0x00007FF6D0CAD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b8e-81.dat	xmrig
behavioral2/memory/1328-79-0x00007FF7A1D30000-0x00007FF7A207D000-memory.dmp	xmrig
behavioral2/memory/1840-75-0x00007FF7F8560000-0x00007FF7F88AD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b8b-74.dat	xmrig
behavioral2/memory/4572-61-0x00007FF7788A0000-0x00007FF778BED000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b8a-60.dat	xmrig
behavioral2/memory/3188-54-0x00007FF73B110000-0x00007FF73B45D000-memory.dmp	xmrig
behavioral2/memory/4964-45-0x00007FF625820000-0x00007FF625B6D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b88-44.dat	xmrig
behavioral2/files/0x000a000000023b87-36.dat	xmrig
behavioral2/memory/2468-37-0x00007FF797060000-0x00007FF7973AD000-memory.dmp	xmrig
behavioral2/memory/2580-27-0x00007FF75ABE0000-0x00007FF75AF2D000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2436	eINJjQb.exe
3196	DKBQolH.exe
3528	nmbpbMN.exe
2580	aAVUBGU.exe
3384	kXhFCyu.exe
2468	XyyrpxD.exe
4964	dlqwqxu.exe
3188	dpoaiBN.exe
4572	mezILHj.exe
1840	pJqyfcQ.exe
1328	uWSxpuc.exe
3164	KkayzDO.exe
3304	poJiJTp.exe
3476	GYOAVGK.exe
3092	pSMnSBA.exe
4076	ElGcPFG.exe
2656	QatwGSJ.exe
948	vHYusly.exe
3320	sDPXmvE.exe
2476	wnxTrCg.exe
4828	FEbYQdW.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\dpoaiBN.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\GYOAVGK.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KkayzDO.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\poJiJTp.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ElGcPFG.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\QatwGSJ.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\kXhFCyu.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\dlqwqxu.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\FEbYQdW.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\XyyrpxD.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\mezILHj.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\pJqyfcQ.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uWSxpuc.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\vHYusly.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\eINJjQb.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nmbpbMN.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\pSMnSBA.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\sDPXmvE.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\wnxTrCg.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\DKBQolH.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\aAVUBGU.exe	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 2436	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 224 wrote to memory of 2436	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 224 wrote to memory of 3196	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 224 wrote to memory of 3196	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 224 wrote to memory of 3528	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 224 wrote to memory of 3528	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 224 wrote to memory of 2580	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 224 wrote to memory of 2580	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 224 wrote to memory of 3384	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 224 wrote to memory of 3384	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 224 wrote to memory of 2468	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 224 wrote to memory of 2468	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 224 wrote to memory of 4964	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 224 wrote to memory of 4964	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 224 wrote to memory of 3188	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 224 wrote to memory of 3188	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 224 wrote to memory of 4572	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 224 wrote to memory of 4572	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 224 wrote to memory of 1840	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 224 wrote to memory of 1840	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 224 wrote to memory of 1328	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 224 wrote to memory of 1328	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 224 wrote to memory of 3476	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 224 wrote to memory of 3476	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 224 wrote to memory of 3164	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 224 wrote to memory of 3164	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 224 wrote to memory of 3304	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 224 wrote to memory of 3304	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 224 wrote to memory of 3092	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 224 wrote to memory of 3092	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 224 wrote to memory of 4076	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 224 wrote to memory of 4076	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 224 wrote to memory of 2656	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 224 wrote to memory of 2656	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 224 wrote to memory of 948	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 224 wrote to memory of 948	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 224 wrote to memory of 4828	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 224 wrote to memory of 4828	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 224 wrote to memory of 3320	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 224 wrote to memory of 3320	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 224 wrote to memory of 2476	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	104
PID 224 wrote to memory of 2476	224	2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe	104

C:\Users\Admin\AppData\Local\Temp\2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-20_f526b2245134455559ad1febcccffa6f_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\System\eINJjQb.exe
  C:\Windows\System\eINJjQb.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\DKBQolH.exe
  C:\Windows\System\DKBQolH.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\nmbpbMN.exe
  C:\Windows\System\nmbpbMN.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\aAVUBGU.exe
  C:\Windows\System\aAVUBGU.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\kXhFCyu.exe
  C:\Windows\System\kXhFCyu.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\XyyrpxD.exe
  C:\Windows\System\XyyrpxD.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\dlqwqxu.exe
  C:\Windows\System\dlqwqxu.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\dpoaiBN.exe
  C:\Windows\System\dpoaiBN.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\mezILHj.exe
  C:\Windows\System\mezILHj.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\pJqyfcQ.exe
  C:\Windows\System\pJqyfcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\uWSxpuc.exe
  C:\Windows\System\uWSxpuc.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\GYOAVGK.exe
  C:\Windows\System\GYOAVGK.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\KkayzDO.exe
  C:\Windows\System\KkayzDO.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\poJiJTp.exe
  C:\Windows\System\poJiJTp.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\pSMnSBA.exe
  C:\Windows\System\pSMnSBA.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\ElGcPFG.exe
  C:\Windows\System\ElGcPFG.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\QatwGSJ.exe
  C:\Windows\System\QatwGSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\vHYusly.exe
  C:\Windows\System\vHYusly.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\FEbYQdW.exe
  C:\Windows\System\FEbYQdW.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\sDPXmvE.exe
  C:\Windows\System\sDPXmvE.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\wnxTrCg.exe
  C:\Windows\System\wnxTrCg.exe
  2⤵
  - Executes dropped EXE
  PID:2476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DKBQolH.exe

Filesize
5.7MB

MD5
c6f4f0f189ddccc89124df6a1f729415

SHA1
4cefc639d16508ca347cacdac5093b2918c99e93

SHA256
f135d0ded126c7b8b1bb9bffd53215b9f54097d8e0383dbe5fd76f979550d128

SHA512
ca42f0acc63d13c622f1dcf103159b1ec7d807ba64e37860675d28d5de0815c41f39d3d77136dce61825cf692508869f155aabcae2f988365e954b0a8ef4e042

Download Submit
C:\Windows\System\ElGcPFG.exe

Filesize
5.7MB

MD5
76f361d9b6229dcbac23ac471816e364

SHA1
3150991187e623a7f2f52288d4f08cda3658525f

SHA256
1bc69a38ab4836de8d4a89dac69e3111e18ccca739b93eb7f2fc11bcfb612dbc

SHA512
f9a2d0e2d11f17f5c3e7282b32af19c7dbc891baf1b03a2989e474d5388f0fe855bea40011e9c26247fcf1fdd3928f63dab84d9bfc550db8777434b8798ea0a1

Download Submit
C:\Windows\System\FEbYQdW.exe

Filesize
5.7MB

MD5
3d69c12b0bd38f2045ad623f6978f98a

SHA1
3050d204812c51cb3f46ddc0f2a8e2bef04c2e7c

SHA256
f32ba5032ec7debc4b1c133b8e34c3bc0effef63bb5811ca17fcf021e099b5f1

SHA512
71efa4be8a1a6700bc71757cb7ba8f4ab836e0b792292912dc90fbc5539537b96bbad9f66da49965bd4d5c00bbcdf16f9e006e10c24b403e90c574cc972c8d87

Download Submit
C:\Windows\System\GYOAVGK.exe

Filesize
5.7MB

MD5
989e02cc2aa76dc332efabf5d1cb6df9

SHA1
9ec12b85fba066e399e3148a5155d06ea5136c0d

SHA256
226571cde91c4cafdaa395ce5a2e72182adddc80354d02bd005d4349f80ef612

SHA512
282a6e30cac595c8550783c7a95449e986d026680ff0e1954c7233694a5eec560de204010828cafa12be90fd65dbfbbd1ddfa5f9cbecb535a50f610fa976a08f

Download Submit
C:\Windows\System\KkayzDO.exe

Filesize
5.7MB

MD5
df748225e9c1b1a5412059f0a599950a

SHA1
9bee0ea6b529f0d0898d51524ac591d57e834f7a

SHA256
39bbcc1af0ba6ea8721a445f1d0293864b3bf240549205727a01b8e810a76780

SHA512
0a4e4bc7ea6bc45b83bdf2d73a65fed4ae8e44ad6c949c4f6d67df6f26d63e3cc589839a5ee405c7372af79b82356440480eed9ee5f30cb8b1484cb18a9d93e3

Download Submit
C:\Windows\System\QatwGSJ.exe

Filesize
5.7MB

MD5
cbf09a1a05e89d7741e2b58a9a28148b

SHA1
f509fd7961d3ee235ddf1aa26ea11148b8c49ce2

SHA256
8bfb7915d1ddedbb5dfda4f706814a8ff91db35aa6c7c3074ca0e90b5da6690e

SHA512
2d53f6ea45d9ad6a62da3501f76d221ce9e0ed9bf62aa503dd5b681498fa93480999486d22bb99f2789b0e9292c4ad401440b6b9299fb3c1eab4012136a7581e

Download Submit
C:\Windows\System\XyyrpxD.exe

Filesize
5.7MB

MD5
3d9e9b0582d69f437c8f98f467aeeb94

SHA1
2bc12f7abd3a0e06c87610d6b7558a2245b679cd

SHA256
fcdc011486a3dc2942521fe5f1d08c7321a487c2626c43bb0229a58383ac52f3

SHA512
69625116f7f319596e268a6016f18fa216f304b48e4063138b5ac35b4887c4270be6402d3737969d8ba17e86221bc0e6fec14be451ec171782eae1aaec7ca464

Download Submit
C:\Windows\System\aAVUBGU.exe

Filesize
5.7MB

MD5
17ce4fae8d437fe2c45774d23311120a

SHA1
c3ab72a5a24fecb24a8d7b9a589245ede92e610a

SHA256
fabc2515343637641a1a8832da740de6f960dfb7d481abf6f4c5299fbbfb711d

SHA512
8f94fb18781593a62da6d9d75c4c3c6a2e938038caabf680113313198811973128469f1f41bcf7e7d02d75fd41cdf9c9519f02e50696b5e4ea653678853c06da

Download Submit
C:\Windows\System\dlqwqxu.exe

Filesize
5.7MB

MD5
2ad6e537bddf4d26295af51b9dad46be

SHA1
429650500e8ea32767e5ed00da1fc1ed1074e47b

SHA256
9a6e9d21742f9f15faf6960580b67202d77f05c0cba500b18fde9706c5d9e350

SHA512
40c30712b4aba0f9365970429b30886eae589c92a33d5876d6f11632ce62bd112284953e417cc67099473a2fd29e07b8a953944f266b23ff9e3d808691eca6e7

Download Submit
C:\Windows\System\dpoaiBN.exe

Filesize
5.7MB

MD5
36930faef2d5d4c7eb332fda2bb8fae0

SHA1
2c2491f95e8f75f3f05ed1e57951ae7d1c953382

SHA256
27d4dadf5ec0200fcbaa3879b95f5070dc8689ee502d91e426dc8b762b5460e5

SHA512
2ce21e6d5a023a2da97f0ee02cc276e5113d2b1513714c3a459b8583ac194d4731bc600825e083975ab0ef66703a8d0fea4c9588d0c57d1461a78570ce6fb4a9

Download Submit
C:\Windows\System\eINJjQb.exe

Filesize
5.7MB

MD5
52f2f58a5d234303cb8d0dc2a7001303

SHA1
fb5dd29eb9cab88fa6493a778769654a4f74b894

SHA256
980010d6b465af13a4c3fc5c1db2bbc1ac6a0df348f897a5cf0fa4fac5df164f

SHA512
0d8dd1fed411fcefad1450b945cde1fcb46a6d90769652ad9acd893f142e46fa62b064695ef7f0bc3f71e8203e30cb35e2fe0c444f1acf330acef315f1fe0df3

Download Submit
C:\Windows\System\kXhFCyu.exe

Filesize
5.7MB

MD5
a92d06260815067d22989f44159bdc7c

SHA1
a83030ae1a0218fa2daef91c60e77ea751e8c721

SHA256
a786df1233dbc05d4aca05033bdc3821882d549b1b05a9ab8021d59bb7ecdc75

SHA512
1cefe9a47e5056cbd438aab337d2eb8905963f66a8d2473e5b2f8593574e3404dc952320cc2417b34bc91d77daf553813cc9e8a8d41e33b3c925fbe2a470092c

Download Submit
C:\Windows\System\mezILHj.exe

Filesize
5.7MB

MD5
6e6491656bcf90dfa1bcfad8e868c8c6

SHA1
9f009da7660a581d58758dd1bcf7fdf7a3a43813

SHA256
45e43186d12dd8b9c5c4b9692fdba8233a08dee37c9817b5bcd6b82b52d2b36a

SHA512
bb210de1555ba7a4d64aaa7c46e1112c04e1c3d2e09b2d6f4a5147275b9c786858c016555a8753c44dba635ef56d467eeaa1d3383060a32f08d01ea0d2558597

Download Submit
C:\Windows\System\nmbpbMN.exe

Filesize
5.7MB

MD5
f402a26d3f0b34f12dbfbe24c1e90284

SHA1
4f423ea5f3c3e58ea7e11024a0295a1a75ff99f5

SHA256
be28148e507e57fdedb796410fab80f45d218fc9e9f58c8253c47430efae5ba4

SHA512
b89fb4b3cc25b4cdefdd5bbbf997b96b81d63e2c289d3062b8dc976692db0ed9f7ce9f1f12c8bf888ee6b7075600c5eca837fb16dd681405c89e67a62ba3357c

Download Submit
C:\Windows\System\pJqyfcQ.exe

Filesize
5.7MB

MD5
d8ce4afb1d163937de9d3767ac45433b

SHA1
57a28cd9397b16c4cce32c00f2f2c524ee502687

SHA256
351a8ccceada8c41a42c9887ceeb61efa8aadd938532f002369c702e68b70bc1

SHA512
7965396e72e740bd6e949778152e3ba55a3ac4be96dac9ba3197cf4b83e0b071d9b0b0bb39a9f4f276a6b79bf7dc536a15c4051a70d3c095d6b81e95d01479bd

Download Submit
C:\Windows\System\pSMnSBA.exe

Filesize
5.7MB

MD5
5002023ed0ce424a8a88b9d2985df069

SHA1
a3b5fbea26ebf54926a0300b6db2234d0b8ce90e

SHA256
ce4e22d90deeb1b98eb0ea8692becbc6f5c75d68d353c734121ef328810af151

SHA512
dd6e06b7f7483a0a48f88f2c412879a8f6de9734f944840f57d6ed3e7b9ccba06e532967c62332cc0e2a89bb10391739b79a374ca87cbb24b524881a2d5ea63c

Download Submit
C:\Windows\System\poJiJTp.exe

Filesize
5.7MB

MD5
2c147d3cacc0337cc7fada435b727087

SHA1
99398a885f4ffd5a3fed18b3b2f4d602cb4cfa6c

SHA256
626bae702738b81a7045ad6be2548eb55052f53ac76eec012f4c4632d2e979e2

SHA512
de3d7e2633dcd8c7f3b7db72bce128e1fdc5b3e72efec81b6f4dd937de99dd8bfad5b3d545aea8016c73ec07456b32cb0f214e117c9402c32356cf0768aad0c9

Download Submit
C:\Windows\System\sDPXmvE.exe

Filesize
5.7MB

MD5
7f18d928f25584b596b1c3b77ba14119

SHA1
9ea8e2c9def346c37da0886a32884b8589b6974e

SHA256
d91e36fdbed8a08565c562dd03c55c7f1b343c0356f285d31f1ded43921b3a28

SHA512
adec753be70dd95fa9934af5f43e1f80bed51fc2c3057ef94e7f6c31befc81cd34015041efdac0f42f2b82189b51a56089d870b650cf64e8469a63c15ad3b5b0

Download Submit
C:\Windows\System\uWSxpuc.exe

Filesize
5.7MB

MD5
b5dc876bf3477f883c8612c93040b555

SHA1
29faebf55de65c0a9e3b3c4c6d2843bcba231019

SHA256
8c4a391e4877160f9c845f45ca2e13e38885dd0a5cea7eb29cb30927aba3117e

SHA512
d1d9655f607772cc4d0931d38b8a8c051d1a1fd8b189e8edb1e93620f0d3f1627c2a44f405cfb126aec0e864890f8919ca9fc441aafeadaeb7be9b5cd0711d50

Download Submit
C:\Windows\System\vHYusly.exe

Filesize
5.7MB

MD5
ab7eacf806dc5ef273c784888920cc3c

SHA1
18c6ec09e1467014647b031f73f341336f86ad38

SHA256
b54a694a0a1469747eeefefe49d861c57257142c7643fafcc862f554cb55f64e

SHA512
a1320280b161aaefcc5470b06e9940361cac50b1748f385a8b6a84c913b96c4fdb6bfaba6e0e746c0a5a26728e17397d3329e896219a5d0932e216ef529effa6

Download Submit
C:\Windows\System\wnxTrCg.exe

Filesize
5.7MB

MD5
6f243395e8b78e1767b2851d7630371e

SHA1
769ee01e1a9d7e3e25db86747fa132e935ac7f24

SHA256
5bcaaf4da7b97b4046398072946101e8e907f4d288dfc320588fb72c5eb13911

SHA512
86e9a905d20af6583525d24177fe91cc9555125ff6c1082de229c012a009354b94bc7c2025832f7781c943c5b6689055c0139bf4ed39152a9e703a9951275a1c

Download Submit
memory/224-0-0x00007FF607B30000-0x00007FF607E7D000-memory.dmp

Filesize
3.3MB

Download
memory/224-1-0x00000231FD3B0000-0x00000231FD3C0000-memory.dmp

Filesize
64KB

Download
memory/948-117-0x00007FF643660000-0x00007FF6439AD000-memory.dmp

Filesize
3.3MB

Download
memory/1328-79-0x00007FF7A1D30000-0x00007FF7A207D000-memory.dmp

Filesize
3.3MB

Download
memory/1840-75-0x00007FF7F8560000-0x00007FF7F88AD000-memory.dmp

Filesize
3.3MB

Download
memory/2436-7-0x00007FF799230000-0x00007FF79957D000-memory.dmp

Filesize
3.3MB

Download
memory/2468-37-0x00007FF797060000-0x00007FF7973AD000-memory.dmp

Filesize
3.3MB

Download
memory/2476-123-0x00007FF76FBE0000-0x00007FF76FF2D000-memory.dmp

Filesize
3.3MB

Download
memory/2580-27-0x00007FF75ABE0000-0x00007FF75AF2D000-memory.dmp

Filesize
3.3MB

Download
memory/2656-113-0x00007FF753F70000-0x00007FF7542BD000-memory.dmp

Filesize
3.3MB

Download
memory/3092-91-0x00007FF68D740000-0x00007FF68DA8D000-memory.dmp

Filesize
3.3MB

Download
memory/3164-82-0x00007FF6D0960000-0x00007FF6D0CAD000-memory.dmp

Filesize
3.3MB

Download
memory/3188-54-0x00007FF73B110000-0x00007FF73B45D000-memory.dmp

Filesize
3.3MB

Download
memory/3196-13-0x00007FF61FCF0000-0x00007FF62003D000-memory.dmp

Filesize
3.3MB

Download
memory/3304-85-0x00007FF7A6100000-0x00007FF7A644D000-memory.dmp

Filesize
3.3MB

Download
memory/3320-120-0x00007FF740C60000-0x00007FF740FAD000-memory.dmp

Filesize
3.3MB

Download
memory/3384-30-0x00007FF743BC0000-0x00007FF743F0D000-memory.dmp

Filesize
3.3MB

Download
memory/3476-88-0x00007FF6883C0000-0x00007FF68870D000-memory.dmp

Filesize
3.3MB

Download
memory/3528-21-0x00007FF61FBD0000-0x00007FF61FF1D000-memory.dmp

Filesize
3.3MB

Download
memory/4076-99-0x00007FF660E70000-0x00007FF6611BD000-memory.dmp

Filesize
3.3MB

Download
memory/4572-61-0x00007FF7788A0000-0x00007FF778BED000-memory.dmp

Filesize
3.3MB

Download
memory/4828-126-0x00007FF6D79E0000-0x00007FF6D7D2D000-memory.dmp

Filesize
3.3MB

Download
memory/4964-45-0x00007FF625820000-0x00007FF625B6D000-memory.dmp

Filesize
3.3MB

Download