cobaltstrike | 980b30878f30c9a389e1b0ba8afdac940fae796d1718b0a4b6af21512023664e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

19f20b95fd3576302bdaa85a60e8e1aa
SHA1

d8d7a9181209fd0c14aa51231c4d86bff3ff7b7c
SHA256

980b30878f30c9a389e1b0ba8afdac940fae796d1718b0a4b6af21512023664e
SHA512

b700726288987fc88a081abd8fd03720fb1d5fe694e5a02339448cd51faa8a08cae8424308bef4b617addf97f946672ea2075a2376ccee0b6affff8a645c66df
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUg:j+R56utgpPF8u/7g

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000c000000023b0b-6.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b5f-11.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b60-14.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b62-24.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b63-30.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b65-44.dat	cobalt_reflective_dll
behavioral2/files/0x0032000000023b5c-50.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b67-56.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6c-86.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6f-104.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b71-116.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b72-125.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b70-118.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6e-107.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6d-101.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6b-89.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6a-83.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b69-74.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b68-69.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b66-57.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b64-36.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/3396-0-0x00007FF647740000-0x00007FF647A8D000-memory.dmp	xmrig
behavioral2/memory/1084-7-0x00007FF64AA50000-0x00007FF64AD9D000-memory.dmp	xmrig
behavioral2/files/0x000c000000023b0b-6.dat	xmrig
behavioral2/files/0x000a000000023b5f-11.dat	xmrig
behavioral2/memory/1632-12-0x00007FF79A4B0000-0x00007FF79A7FD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b60-14.dat	xmrig
behavioral2/memory/4536-19-0x00007FF7B2D80000-0x00007FF7B30CD000-memory.dmp	xmrig
behavioral2/memory/2076-25-0x00007FF7B7FB0000-0x00007FF7B82FD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b62-24.dat	xmrig
behavioral2/memory/2204-31-0x00007FF699EE0000-0x00007FF69A22D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b63-30.dat	xmrig
behavioral2/files/0x000a000000023b65-44.dat	xmrig
behavioral2/files/0x0032000000023b5c-50.dat	xmrig
behavioral2/files/0x000a000000023b67-56.dat	xmrig
behavioral2/memory/4676-70-0x00007FF729220000-0x00007FF72956D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b6c-86.dat	xmrig
behavioral2/files/0x000a000000023b6f-104.dat	xmrig
behavioral2/files/0x000a000000023b71-116.dat	xmrig
behavioral2/memory/8-126-0x00007FF797ED0000-0x00007FF79821D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b72-125.dat	xmrig
behavioral2/memory/4564-123-0x00007FF6791E0000-0x00007FF67952D000-memory.dmp	xmrig
behavioral2/memory/1568-119-0x00007FF68D690000-0x00007FF68D9DD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b70-118.dat	xmrig
behavioral2/memory/512-114-0x00007FF72D970000-0x00007FF72DCBD000-memory.dmp	xmrig
behavioral2/memory/3480-108-0x00007FF6BC7F0000-0x00007FF6BCB3D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b6e-107.dat	xmrig
behavioral2/memory/1728-102-0x00007FF7DA9E0000-0x00007FF7DAD2D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b6d-101.dat	xmrig
behavioral2/memory/4008-96-0x00007FF6726C0000-0x00007FF672A0D000-memory.dmp	xmrig
behavioral2/memory/4352-90-0x00007FF602EB0000-0x00007FF6031FD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b6b-89.dat	xmrig
behavioral2/memory/1132-84-0x00007FF63ED60000-0x00007FF63F0AD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b6a-83.dat	xmrig
behavioral2/memory/2556-75-0x00007FF7D32F0000-0x00007FF7D363D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b69-74.dat	xmrig
behavioral2/files/0x000a000000023b68-69.dat	xmrig
behavioral2/memory/4112-63-0x00007FF61D170000-0x00007FF61D4BD000-memory.dmp	xmrig
behavioral2/memory/4796-58-0x00007FF652770000-0x00007FF652ABD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b66-57.dat	xmrig
behavioral2/memory/1344-51-0x00007FF6F8F90000-0x00007FF6F92DD000-memory.dmp	xmrig
behavioral2/memory/4672-46-0x00007FF6E00D0000-0x00007FF6E041D000-memory.dmp	xmrig
behavioral2/memory/2000-37-0x00007FF7F7820000-0x00007FF7F7B6D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b64-36.dat	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1084	NPUfvZs.exe
1632	omVGNEc.exe
4536	sowKSml.exe
2076	aXoRcWD.exe
2204	xyzaOeM.exe
2000	OomstWk.exe
1344	XICAvJR.exe
4672	KqOBQru.exe
4796	jYKjKwE.exe
4112	oOCELUo.exe
4676	ZTAoYOQ.exe
2556	SrGpPjC.exe
1132	RnSMVUH.exe
4352	BjBNres.exe
4008	djMORMu.exe
1728	tZSNCGl.exe
3480	JPCUjvh.exe
512	WIiUXLI.exe
1568	LcQgYZu.exe
4564	lWkTsqP.exe
8	oqiVBnz.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\NPUfvZs.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\omVGNEc.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\XICAvJR.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZTAoYOQ.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\BjBNres.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KqOBQru.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\djMORMu.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\tZSNCGl.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\JPCUjvh.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\WIiUXLI.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\LcQgYZu.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\sowKSml.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\OomstWk.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\jYKjKwE.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\oOCELUo.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\RnSMVUH.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\lWkTsqP.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\oqiVBnz.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\aXoRcWD.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\xyzaOeM.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SrGpPjC.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 1084	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 3396 wrote to memory of 1084	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 3396 wrote to memory of 1632	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 3396 wrote to memory of 1632	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 3396 wrote to memory of 4536	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 3396 wrote to memory of 4536	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 3396 wrote to memory of 2076	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 3396 wrote to memory of 2076	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 3396 wrote to memory of 2204	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 3396 wrote to memory of 2204	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 3396 wrote to memory of 2000	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 3396 wrote to memory of 2000	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 3396 wrote to memory of 1344	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 3396 wrote to memory of 1344	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 3396 wrote to memory of 4672	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 3396 wrote to memory of 4672	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 3396 wrote to memory of 4796	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 3396 wrote to memory of 4796	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 3396 wrote to memory of 4112	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 3396 wrote to memory of 4112	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 3396 wrote to memory of 4676	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 3396 wrote to memory of 4676	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 3396 wrote to memory of 2556	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 3396 wrote to memory of 2556	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 3396 wrote to memory of 1132	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 3396 wrote to memory of 1132	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 3396 wrote to memory of 4352	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 3396 wrote to memory of 4352	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 3396 wrote to memory of 4008	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 3396 wrote to memory of 4008	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 3396 wrote to memory of 1728	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 3396 wrote to memory of 1728	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 3396 wrote to memory of 3480	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 3396 wrote to memory of 3480	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 3396 wrote to memory of 512	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 3396 wrote to memory of 512	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 3396 wrote to memory of 1568	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 3396 wrote to memory of 1568	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 3396 wrote to memory of 4564	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 3396 wrote to memory of 4564	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 3396 wrote to memory of 8	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	104
PID 3396 wrote to memory of 8	3396	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	104

C:\Users\Admin\AppData\Local\Temp\2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\System\NPUfvZs.exe
  C:\Windows\System\NPUfvZs.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\omVGNEc.exe
  C:\Windows\System\omVGNEc.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\sowKSml.exe
  C:\Windows\System\sowKSml.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\aXoRcWD.exe
  C:\Windows\System\aXoRcWD.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\xyzaOeM.exe
  C:\Windows\System\xyzaOeM.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\OomstWk.exe
  C:\Windows\System\OomstWk.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\XICAvJR.exe
  C:\Windows\System\XICAvJR.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\KqOBQru.exe
  C:\Windows\System\KqOBQru.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\jYKjKwE.exe
  C:\Windows\System\jYKjKwE.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\oOCELUo.exe
  C:\Windows\System\oOCELUo.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\ZTAoYOQ.exe
  C:\Windows\System\ZTAoYOQ.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\SrGpPjC.exe
  C:\Windows\System\SrGpPjC.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\RnSMVUH.exe
  C:\Windows\System\RnSMVUH.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\BjBNres.exe
  C:\Windows\System\BjBNres.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\djMORMu.exe
  C:\Windows\System\djMORMu.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\tZSNCGl.exe
  C:\Windows\System\tZSNCGl.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\JPCUjvh.exe
  C:\Windows\System\JPCUjvh.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\WIiUXLI.exe
  C:\Windows\System\WIiUXLI.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\LcQgYZu.exe
  C:\Windows\System\LcQgYZu.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\lWkTsqP.exe
  C:\Windows\System\lWkTsqP.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\oqiVBnz.exe
  C:\Windows\System\oqiVBnz.exe
  2⤵
  - Executes dropped EXE
  PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BjBNres.exe

Filesize
5.7MB

MD5
cbbb1dad5e33f74c25531bb9d0fc1614

SHA1
047256d3c178adbfb94a3ae7ee61d9573729ee32

SHA256
6ed8cf4cd6ec0c21d3e8d61d1de0e006dfdd3ce0e732a4d2b8f25a6fb55ae93c

SHA512
a45510405158b06bcfb807f2f3b03119076c8849fc43e8cc54c5a5ecde26594f2475df26bdc0b6d952a81251faf7e1de7650e585f8ca72858c2cc2ab9c4c7d5b

Download Submit
C:\Windows\System\JPCUjvh.exe

Filesize
5.7MB

MD5
5e45230d3cde270ed5728f27272a7e0c

SHA1
a6d6c491e1e5a83936e1481b64aa413c42693899

SHA256
b1bbb4e7c36cb913825d345251ed8eafe3a38db850445326cd28087bf54197bb

SHA512
d2bbd99a045679b3fa4d4b149e8420d82c4ca7eb65fac3bd88515349e4f37331c2ca460d684b4a0fab42d27ee6606967c5e8299cff06ec328ef125538eef6a28

Download Submit
C:\Windows\System\KqOBQru.exe

Filesize
5.7MB

MD5
174db3fbdee90e4f8ee3d3c70cfcbf87

SHA1
7686a055cd4da4028ad0b4f81b10929670f236e2

SHA256
ee19cbc4693224ead5bcdfe99b44e83d3b465a5c52f7ae37a1ff562378af286f

SHA512
6c192d2636b37eed283a9b5d36053eaaf73b4fb3bc687c54708f52c8ea3e468bc320e5df21ff9f4487fe89e6aade3901ef171e78330541b62e217018ccd17199

Download Submit
C:\Windows\System\LcQgYZu.exe

Filesize
5.7MB

MD5
a6a52f7054acbbbecb567b2019f9ba52

SHA1
e8f7748ce339a74efe2c88a63512e25d38e47597

SHA256
4918dc5905737424e9bedc41c1946f68fae130813390507556292a5d6c38b3d0

SHA512
d44ad0540443b85e2a0a5bc2c990d724ac342818b96a13f9b449f729cf28f724ccfca62d968b84fb3f90312e266a60f5b519fa3b66ce0fe4926c01d64786bec2

Download Submit
C:\Windows\System\NPUfvZs.exe

Filesize
5.7MB

MD5
10af4ddf0bc54ab9f3181144e13560b0

SHA1
a89672d32138012f0612577b968f2a693413c6e7

SHA256
91f1863a5679027c1379341153c9a844a5a39bfeecbe89b5ac2a212c6bf73ad7

SHA512
5e2c53c70f6a51770470d9c564441856b12be78d7ddf19122d8947d25632793aee48b1b276ea0423c1863872cd7b6e7ff1555a84beed69c929f24996139af21a

Download Submit
C:\Windows\System\OomstWk.exe

Filesize
5.7MB

MD5
70b9d07ae7d1beb00eef519a391d5587

SHA1
caaee41805ad8c6cb05fe968e2afdbcf849b9940

SHA256
be65ea313629cdc0786c528383908b646c16d1cc720aa8b5d134b6cbcd5054db

SHA512
582a3d432709fcdea41398ee7b14031ddf66cbe22c1c9709cfd8ab8515ec5620569806d87f068dc42fba494e3b821a8cbcf87237f0728e54557e58f8cf6e5f89

Download Submit
C:\Windows\System\RnSMVUH.exe

Filesize
5.7MB

MD5
0239c1d45694d19b5bdc769038486b64

SHA1
8157f1cb99549b05511b5e8426a8d5a8b3a9858d

SHA256
bfa892ec4bbee385d5da781e26fedc184daa8baca37ec3fd4a68a809225727b0

SHA512
a7fe8ff6278695ddd875d109cb8adf0d542e664c920196553a7d33034ac0be7550e6072cad97ec9c249c2f284ceb9fd7bc15e3c211d707a63211e12c842f5a36

Download Submit
C:\Windows\System\SrGpPjC.exe

Filesize
5.7MB

MD5
e5cdcda185a4440c5a16fd5fc4d36a6a

SHA1
ea432c3f3cbe8b57a96f0aa0783816b1cf8660cd

SHA256
4839e1db8b0fed5fdfa6d9a2c1af5a2febfd478642d784a59adb4e328d28174b

SHA512
466740ed3707cb1e1991a9deed254ff7287bf214bade8bc86c6e973df951fa62f82428ec9e09b7e16e469eb0da158de498d9779c8caa4524890dc6f6049734b1

Download Submit
C:\Windows\System\WIiUXLI.exe

Filesize
5.7MB

MD5
521a3c303bacd8df2443869dee4fb204

SHA1
927f7e45264dc6819a62f8def5647bbbd3bc9737

SHA256
7eca54d40a8a602dcd1090c76ea639b0e00aec49536534dc67f0dc60e0baeb2a

SHA512
cba9a59737e5dc2f578f7a3484fb467109e843a71d1a26b80527f40c80bf5ab65733c994f9e75f26b43658730778595ef01903a91da1e7638f315d6e8b3bd1ed

Download Submit
C:\Windows\System\XICAvJR.exe

Filesize
5.7MB

MD5
c90cb41221ddd29221e8b5d7698286e4

SHA1
c9f5079f6b17c3dcd8252fd830572d216f6c6c14

SHA256
03ba01dc3c218d7a2912bf4f91a75da70f3b05a9c3cf4c389bd1fed5ba1b61aa

SHA512
5d53753ba47b7e60eac8882830fa9cb82f7be89835abed9c449ed95b03187dd001571a195a607b04c1b0745c21a360f7d7050aea4cf9a39fb07236e715e3644f

Download Submit
C:\Windows\System\ZTAoYOQ.exe

Filesize
5.7MB

MD5
96bcbaf7817fc211badb0044dd1da2cf

SHA1
6132a794b3ce48ff5f08883380346d24f951e46f

SHA256
dfa52919bfa137d02c0a34db57852755785dadcf7dcdce23f213f6381738ff75

SHA512
1597c734a606be3fcc5d3f20e8cdbb6660302e6ce7cdc7db812bc02791214a65c7f678432233159bb908c06c3a51c93694eb471567540a1389b276e632ff0d19

Download Submit
C:\Windows\System\aXoRcWD.exe

Filesize
5.7MB

MD5
3fc69066feb324eeb179399a9fa1243a

SHA1
77d6c5337679d03637aedd27b6ba05507ad6072b

SHA256
2fe39d0c0f97859fdb458530ff203f786e073951131ccce2c5ae7a4f5320a119

SHA512
dd282f8f560b2e98f89767cd7592a1d0284d7e3b9f951f44f9950c76bf26e00b24d936d665fe330393c43d29bc6978ec6d1e7c3a7d589fff7d3bd46ade1498ac

Download Submit
C:\Windows\System\djMORMu.exe

Filesize
5.7MB

MD5
d9ac787ebba1a890e7fdd839efc7f52f

SHA1
0d82766e7048f48e827e94183386f093ec485bcf

SHA256
4d7f96d49e84ab42946cda0af0deae23a6002403a919eb41774feb596c4c3272

SHA512
9885350fb9a752b38e0b1f908f260539fde8aee6e6fe411cdede98d0766444a0c5bfa4af18a0c032855521db87661b946d6bdd1a205dd81c484927603ae31151

Download Submit
C:\Windows\System\jYKjKwE.exe

Filesize
5.7MB

MD5
9b4e0c5bacdc729dfc1687ff53221a1d

SHA1
a18973bdb335060e51de1e9dbaa048007dc0032d

SHA256
92ee092500f3f4a06c20c56eb6160d401bdf51e758a552a887939462116ceadc

SHA512
f84b03f15b216721001c451fbbb048e218e51693511e1f637e99576c1ace1c277bc7cfba0195bd3edebca722f45ee9887df0c6d874ae8d3dc36d42fdd0429bb7

Download Submit
C:\Windows\System\lWkTsqP.exe

Filesize
5.7MB

MD5
be71b159e5269aa7b3d76ec0ea025891

SHA1
2ffaaee26535fcaacbce9369881da94b49c5e480

SHA256
680abac2e7c58ede0e19cdfd8a95f553e826338e37557b9fa3a1069d62ea72c3

SHA512
5642963115d0241022802cd7c1157a9d209a029878b25eb10bed79ca06491fac1749ff29f9d2761fea907bebedb7408d3f3a2f6151e7890618455e5e9127e767

Download Submit
C:\Windows\System\oOCELUo.exe

Filesize
5.7MB

MD5
3f240e5f021165b53a9125dec670d4a6

SHA1
fa6d99022978376bb2174cc68473ac71e7a79fa1

SHA256
927ebf4d03b03ba47f1ee653f768ac3e5dc3f5ff8ac249a5b96c1deb0ed46576

SHA512
431edd2c21a7fe361b0c3381c2444eaed636234e0fb0ccf9516f6cf1ee1efbe036a18493f7dc34054972d76ae719f20dfaed02b9efb5020bc6c9519904ab92cc

Download Submit
C:\Windows\System\omVGNEc.exe

Filesize
5.7MB

MD5
29729fb2ee4ec52640146e21b70f807c

SHA1
6569d7cfecf8342cfda17d6630f7f8cab14693b1

SHA256
0115193e17b14c1bde37c1ef1dee25996682c829d7459033588c03041894162c

SHA512
7c08728381dc88d38e351a2c74bd06b5ccda2f0e1071f6dbf1714d9d3b59f24cb306b40a159bead3d689904833927b9271db00fbdb8f2cfea20cfc5b1e4ff24c

Download Submit
C:\Windows\System\oqiVBnz.exe

Filesize
5.7MB

MD5
9d568a68027eef7d11a8ade1be825e45

SHA1
adc54e0ee3c6b9d78f3ea76dac913cfdf24da517

SHA256
db2a0f2e3a4b4d346dbbe3ba1329c4024c4f462567c2833a5e646fc3f1b08629

SHA512
ea0caa621ea9f47fbf2aedd23d23385d89e33b145576f1486e95b5a3e45d2d3df921d319a3bd07aac517d8ea935c4f22ccb5fbf5e96b82a57b4b4fd68600cfba

Download Submit
C:\Windows\System\sowKSml.exe

Filesize
5.7MB

MD5
0be205cca7fdf721b575c1e438c26098

SHA1
f097f89b792e9037e966e2c04c83cac1b79e2638

SHA256
121535661a2b75f5ffe2490d94476c458e9e492b1b7d8184b6dd3ffbe49b41c1

SHA512
4e8232cdbdb75c3096874f1e2aab66439f046848a387ffd2c4fa80b58ee634a60b748a6fcae857c1fc00a1b027f823ef03cd7cf1d0b2595418ae15e0b3f6a0e2

Download Submit
C:\Windows\System\tZSNCGl.exe

Filesize
5.7MB

MD5
36fadfe5de834b04e5b98c21049d428f

SHA1
45fb57e837d82a45a0b9fa2e13d04f1a8d8bd1be

SHA256
0774ff4a4140e3f752652e6f7c5da3820dfec98c72bd5bac2a1f2a142a6bfd23

SHA512
a03b0f46823da65899c7e2d3f7988ae46b82759c481a7c16829831458b7eac0cfa8864c4c59186b93e6de791d64987948b8fb74fe1ee4e27e9ee0f126829c017

Download Submit
C:\Windows\System\xyzaOeM.exe

Filesize
5.7MB

MD5
c717ec9d213160114e8760b35c993308

SHA1
6c53ed69e32eac211e8d9126d86ce863a49e6067

SHA256
0135970b9c75ccabf102ad603490b4ff2534b23637b0f76645bcc87676d6f7ac

SHA512
48651268d8e767c7c7ae9df9d1b387f57dc39430e3b48f0e4234d946cc83f779bf8ff9a75cc3af9a91fc58f8ba248abcb8c5681cb5fc1bdcba8ceaf4ea4d404d

Download Submit
memory/8-126-0x00007FF797ED0000-0x00007FF79821D000-memory.dmp

Filesize
3.3MB

Download
memory/512-114-0x00007FF72D970000-0x00007FF72DCBD000-memory.dmp

Filesize
3.3MB

Download
memory/1084-7-0x00007FF64AA50000-0x00007FF64AD9D000-memory.dmp

Filesize
3.3MB

Download
memory/1132-84-0x00007FF63ED60000-0x00007FF63F0AD000-memory.dmp

Filesize
3.3MB

Download
memory/1344-51-0x00007FF6F8F90000-0x00007FF6F92DD000-memory.dmp

Filesize
3.3MB

Download
memory/1568-119-0x00007FF68D690000-0x00007FF68D9DD000-memory.dmp

Filesize
3.3MB

Download
memory/1632-12-0x00007FF79A4B0000-0x00007FF79A7FD000-memory.dmp

Filesize
3.3MB

Download
memory/1728-102-0x00007FF7DA9E0000-0x00007FF7DAD2D000-memory.dmp

Filesize
3.3MB

Download
memory/2000-37-0x00007FF7F7820000-0x00007FF7F7B6D000-memory.dmp

Filesize
3.3MB

Download
memory/2076-25-0x00007FF7B7FB0000-0x00007FF7B82FD000-memory.dmp

Filesize
3.3MB

Download
memory/2204-31-0x00007FF699EE0000-0x00007FF69A22D000-memory.dmp

Filesize
3.3MB

Download
memory/2556-75-0x00007FF7D32F0000-0x00007FF7D363D000-memory.dmp

Filesize
3.3MB

Download
memory/3396-1-0x000001EB39690000-0x000001EB396A0000-memory.dmp

Filesize
64KB

Download
memory/3396-0-0x00007FF647740000-0x00007FF647A8D000-memory.dmp

Filesize
3.3MB

Download
memory/3480-108-0x00007FF6BC7F0000-0x00007FF6BCB3D000-memory.dmp

Filesize
3.3MB

Download
memory/4008-96-0x00007FF6726C0000-0x00007FF672A0D000-memory.dmp

Filesize
3.3MB

Download
memory/4112-63-0x00007FF61D170000-0x00007FF61D4BD000-memory.dmp

Filesize
3.3MB

Download
memory/4352-90-0x00007FF602EB0000-0x00007FF6031FD000-memory.dmp

Filesize
3.3MB

Download
memory/4536-19-0x00007FF7B2D80000-0x00007FF7B30CD000-memory.dmp

Filesize
3.3MB

Download
memory/4564-123-0x00007FF6791E0000-0x00007FF67952D000-memory.dmp

Filesize
3.3MB

Download
memory/4672-46-0x00007FF6E00D0000-0x00007FF6E041D000-memory.dmp

Filesize
3.3MB

Download
memory/4676-70-0x00007FF729220000-0x00007FF72956D000-memory.dmp

Filesize
3.3MB

Download
memory/4796-58-0x00007FF652770000-0x00007FF652ABD000-memory.dmp

Filesize
3.3MB

Download