cobaltstrike | 5d20f34e5f31d1dd6881aa688e48b61aa36d0eb492d66ddb9419c1106b15bb58

Analysis

max time kernel
145s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-01-2025 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

188f766db22e96fc15f019adae4690eb
SHA1

428a001f796e36b899e03569ba7736b5939f3c3a
SHA256

5d20f34e5f31d1dd6881aa688e48b61aa36d0eb492d66ddb9419c1106b15bb58
SHA512

a80170a4dbe35ddc9203f5a4e801cc1aac46ff35a06ff192d97b8997402606247d57bdf350b6d2bfbcfb48314b9b44563bd4c2f5b5f173314de94b945b8520b1
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUs:j+R56utgpPF8u/7s

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000a000000012262-6.dat	cobalt_reflective_dll
behavioral1/files/0x000900000001660b-10.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016c23-14.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016ccc-22.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016cd8-25.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016ce0-30.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016ce9-47.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000194a3-51.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019515-74.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001950f-67.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001957c-84.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195a7-87.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195a9-92.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195ab-95.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195af-103.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195b1-107.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195ad-100.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019547-79.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000194eb-60.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000016ace-64.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016cab-18.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral1/memory/2304-0-0x000000013FFE0000-0x000000014032D000-memory.dmp	xmrig
behavioral1/files/0x000a000000012262-6.dat	xmrig
behavioral1/files/0x000900000001660b-10.dat	xmrig
behavioral1/files/0x0008000000016c23-14.dat	xmrig
behavioral1/files/0x0007000000016ccc-22.dat	xmrig
behavioral1/files/0x0007000000016cd8-25.dat	xmrig
behavioral1/files/0x0008000000016ce0-30.dat	xmrig
behavioral1/memory/2892-41-0x000000013F3C0000-0x000000013F70D000-memory.dmp	xmrig
behavioral1/files/0x0008000000016ce9-47.dat	xmrig
behavioral1/memory/2648-53-0x000000013F1B0000-0x000000013F4FD000-memory.dmp	xmrig
behavioral1/memory/2656-55-0x000000013FB50000-0x000000013FE9D000-memory.dmp	xmrig
behavioral1/files/0x00050000000194a3-51.dat	xmrig
behavioral1/memory/868-39-0x000000013F210000-0x000000013F55D000-memory.dmp	xmrig
behavioral1/memory/1620-35-0x000000013FDD0000-0x000000014011D000-memory.dmp	xmrig
behavioral1/memory/2876-34-0x000000013F2C0000-0x000000013F60D000-memory.dmp	xmrig
behavioral1/files/0x0005000000019515-74.dat	xmrig
behavioral1/memory/2696-61-0x000000013F230000-0x000000013F57D000-memory.dmp	xmrig
behavioral1/files/0x000500000001950f-67.dat	xmrig
behavioral1/files/0x000500000001957c-84.dat	xmrig
behavioral1/files/0x00050000000195a7-87.dat	xmrig
behavioral1/files/0x00050000000195a9-92.dat	xmrig
behavioral1/files/0x00050000000195ab-95.dat	xmrig
behavioral1/files/0x00050000000195af-103.dat	xmrig
behavioral1/files/0x00050000000195b1-107.dat	xmrig
behavioral1/files/0x00050000000195ad-100.dat	xmrig
behavioral1/files/0x0005000000019547-79.dat	xmrig
behavioral1/files/0x00050000000194eb-60.dat	xmrig
behavioral1/memory/2664-66-0x000000013F620000-0x000000013F96D000-memory.dmp	xmrig
behavioral1/files/0x0009000000016ace-64.dat	xmrig
behavioral1/memory/2724-33-0x000000013FCE0000-0x000000014002D000-memory.dmp	xmrig
behavioral1/memory/2388-32-0x000000013FC50000-0x000000013FF9D000-memory.dmp	xmrig
behavioral1/memory/2000-31-0x000000013F0A0000-0x000000013F3ED000-memory.dmp	xmrig
behavioral1/files/0x0007000000016cab-18.dat	xmrig
behavioral1/memory/2680-108-0x000000013FA10000-0x000000013FD5D000-memory.dmp	xmrig
behavioral1/memory/3016-109-0x000000013F8C0000-0x000000013FC0D000-memory.dmp	xmrig
behavioral1/memory/560-122-0x000000013FC20000-0x000000013FF6D000-memory.dmp	xmrig
behavioral1/memory/2852-121-0x000000013FE10000-0x000000014015D000-memory.dmp	xmrig
behavioral1/memory/1136-120-0x000000013F440000-0x000000013F78D000-memory.dmp	xmrig
behavioral1/memory/2984-119-0x000000013F1F0000-0x000000013F53D000-memory.dmp	xmrig
behavioral1/memory/2088-113-0x000000013F8F0000-0x000000013FC3D000-memory.dmp	xmrig
behavioral1/memory/2796-112-0x000000013FF40000-0x000000014028D000-memory.dmp	xmrig
behavioral1/memory/1980-111-0x000000013FCD0000-0x000000014001D000-memory.dmp	xmrig
behavioral1/memory/2608-110-0x000000013F0C0000-0x000000013F40D000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2000	YUVSmCe.exe
1620	ffstJRi.exe
2388	BsbWUnz.exe
868	tiyoqYb.exe
2724	VhlNXRT.exe
2892	nAjPuhE.exe
2876	zLgUuCo.exe
2656	rrPyYgE.exe
2648	JoAXlgY.exe
2696	uKVFrdY.exe
2664	KBErblT.exe
2680	bdqNNIA.exe
2088	qLNMsaM.exe
2984	ZXedgJb.exe
3016	XGzQEkp.exe
1136	HxHtJNy.exe
2608	roLgOmu.exe
2852	gtDkUQs.exe
1980	zcamQwr.exe
560	cjTsCXd.exe
2796	LbDEFnh.exe

Loads dropped DLL 21 IoCs

pid	Process
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\tiyoqYb.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\qLNMsaM.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZXedgJb.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\XGzQEkp.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\cjTsCXd.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\LbDEFnh.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\BsbWUnz.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nAjPuhE.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rrPyYgE.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uKVFrdY.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\bdqNNIA.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HxHtJNy.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ffstJRi.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\VhlNXRT.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KBErblT.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\gtDkUQs.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\YUVSmCe.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\JoAXlgY.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\roLgOmu.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\zcamQwr.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\zLgUuCo.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2000	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2304 wrote to memory of 2000	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2304 wrote to memory of 2000	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2304 wrote to memory of 1620	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2304 wrote to memory of 1620	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2304 wrote to memory of 1620	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2304 wrote to memory of 2388	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2304 wrote to memory of 2388	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2304 wrote to memory of 2388	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2304 wrote to memory of 868	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2304 wrote to memory of 868	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2304 wrote to memory of 868	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2304 wrote to memory of 2724	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2304 wrote to memory of 2724	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2304 wrote to memory of 2724	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2304 wrote to memory of 2892	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2304 wrote to memory of 2892	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2304 wrote to memory of 2892	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2304 wrote to memory of 2876	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2304 wrote to memory of 2876	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2304 wrote to memory of 2876	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2304 wrote to memory of 2656	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2304 wrote to memory of 2656	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2304 wrote to memory of 2656	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2304 wrote to memory of 2648	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2304 wrote to memory of 2648	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2304 wrote to memory of 2648	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2304 wrote to memory of 2696	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2304 wrote to memory of 2696	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2304 wrote to memory of 2696	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2304 wrote to memory of 2664	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2304 wrote to memory of 2664	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2304 wrote to memory of 2664	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2304 wrote to memory of 2088	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2304 wrote to memory of 2088	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2304 wrote to memory of 2088	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2304 wrote to memory of 2680	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2304 wrote to memory of 2680	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2304 wrote to memory of 2680	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2304 wrote to memory of 2984	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2304 wrote to memory of 2984	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2304 wrote to memory of 2984	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2304 wrote to memory of 3016	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2304 wrote to memory of 3016	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2304 wrote to memory of 3016	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2304 wrote to memory of 1136	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2304 wrote to memory of 1136	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2304 wrote to memory of 1136	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2304 wrote to memory of 2608	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2304 wrote to memory of 2608	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2304 wrote to memory of 2608	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2304 wrote to memory of 2852	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2304 wrote to memory of 2852	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2304 wrote to memory of 2852	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2304 wrote to memory of 1980	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2304 wrote to memory of 1980	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2304 wrote to memory of 1980	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2304 wrote to memory of 560	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2304 wrote to memory of 560	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2304 wrote to memory of 560	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2304 wrote to memory of 2796	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	52
PID 2304 wrote to memory of 2796	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	52
PID 2304 wrote to memory of 2796	2304	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	52

C:\Users\Admin\AppData\Local\Temp\2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\System\YUVSmCe.exe
  C:\Windows\System\YUVSmCe.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\ffstJRi.exe
  C:\Windows\System\ffstJRi.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\BsbWUnz.exe
  C:\Windows\System\BsbWUnz.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\tiyoqYb.exe
  C:\Windows\System\tiyoqYb.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\VhlNXRT.exe
  C:\Windows\System\VhlNXRT.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\nAjPuhE.exe
  C:\Windows\System\nAjPuhE.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\zLgUuCo.exe
  C:\Windows\System\zLgUuCo.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\rrPyYgE.exe
  C:\Windows\System\rrPyYgE.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\JoAXlgY.exe
  C:\Windows\System\JoAXlgY.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\uKVFrdY.exe
  C:\Windows\System\uKVFrdY.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\KBErblT.exe
  C:\Windows\System\KBErblT.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\qLNMsaM.exe
  C:\Windows\System\qLNMsaM.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\bdqNNIA.exe
  C:\Windows\System\bdqNNIA.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\ZXedgJb.exe
  C:\Windows\System\ZXedgJb.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\XGzQEkp.exe
  C:\Windows\System\XGzQEkp.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\HxHtJNy.exe
  C:\Windows\System\HxHtJNy.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\roLgOmu.exe
  C:\Windows\System\roLgOmu.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\gtDkUQs.exe
  C:\Windows\System\gtDkUQs.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\zcamQwr.exe
  C:\Windows\System\zcamQwr.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\cjTsCXd.exe
  C:\Windows\System\cjTsCXd.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\LbDEFnh.exe
  C:\Windows\System\LbDEFnh.exe
  2⤵
  - Executes dropped EXE
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BsbWUnz.exe

Filesize
5.7MB

MD5
e7dcc9e39f272f45826667be3ba43c45

SHA1
8ac42b7e45b454c7332f2acadff44be0d8103183

SHA256
e970176112e1335ba1c0587026470ed1bdc07370b5bd4f38f6a82a9f53ee29b7

SHA512
d24d381b0446f29d8e0b67b270512b5b72cd9c1d7c2516db4028296e80a274a7b8b411cf196d8120c9501f3da16f104eccb28e8731cdb41d4a4dcfaff381fde3

Download Submit
C:\Windows\system\HxHtJNy.exe

Filesize
5.7MB

MD5
f54e1562a37c18f6f8b3c87d72a44f79

SHA1
01a8dc622fc393f05597d12ebca772d448e7a7f2

SHA256
a5ca02c540c1df5ae713a410127f3f55c81a8ce9a4ba9bb4dec2599701f13d21

SHA512
b328d79aed5e3797894056823fee2949aabc682478760f09092b31dbbdb087029baf58b459844844366f4a7fc4852323af1eac944829a7a40e2ab67642395c71

Download Submit
C:\Windows\system\JoAXlgY.exe

Filesize
5.7MB

MD5
74c49ed4410dbb1457b18ae88a529bdf

SHA1
17ca59cdce760535c2dd613419d42245fa5c671c

SHA256
629b2bacd0c2f7864d3d6bfa16e8aee31b8b3c348aaaf5c2fb8d5c5d17eec1db

SHA512
ba7a277bd9ffff449292317eed0a1ce0fe063f6f6cdc16feed7af3c37d176b3b938b32734e27c59d86ca8dbf69443e8a2f8cc518d7d41b4910abad2ee00efdd2

Download Submit
C:\Windows\system\KBErblT.exe

Filesize
5.7MB

MD5
f8a591924d58f65b518630deb202c7db

SHA1
91512d8a95b9c362bdb7e98c9e7c55571938d4df

SHA256
ac35eebad8dca2a90128b1d2138ccb2067923986ced9717665d504cbdbfe2c71

SHA512
b9369eb8b5c0df04430527f7e0df4116663555d6536211e77d6fe873d2feb3da595bac77755cc623b406f2ef115a575af8fe53455cab4b9332b367084dff873f

Download Submit
C:\Windows\system\LbDEFnh.exe

Filesize
5.7MB

MD5
9b5d837b3aeac76615b8bb34c7568287

SHA1
4d5b15b9496222f21a4237be46a4e0a47265fc51

SHA256
ccce08c2f416c7587a348c5c2abb92c5f41b51d35b5117a5caf71aec8196123a

SHA512
ea417eec863073c11d5c7d86440e3b924972f496f79bf1e1326c6a9bee77067f6bb76065f8a2d0df5d5d820d506098bf8e3f13f2e98e9e3969d78693ba0f50c7

Download Submit
C:\Windows\system\VhlNXRT.exe

Filesize
5.7MB

MD5
6b59885b2361601cb58e743a8fbafe28

SHA1
8b8e9394c2366eaf71b4dd211435bdc37de92966

SHA256
5fff88c9d5b4cf714380248d76b950551aaf75fc354b60425e07d80184c454f4

SHA512
533feababb172d43eb32f64d4992c49c235f508b775b06662fd64ccf7fcd97c24a3cabaa37c7cff3871c8621c72c63776bcdac467f8d6b0624080bbaefa295a1

Download Submit
C:\Windows\system\XGzQEkp.exe

Filesize
5.7MB

MD5
95d0cff619fac7c28a1dba63910679b8

SHA1
fa891e4a130cb19af9324f6e0b3208767e220ebd

SHA256
cc1b22da128e9f35b936b995f488038e4ea6662bb0e9ea9036f1c5d7566f10a9

SHA512
877b72ce7da9f694dae3cc0b7046a0ab1c462ba210ed87dff63cc115f5e23477a22ee2340b6b325e93c72a5ddf9854b57bd52c063734a7a99aaceb29f7f946c6

Download Submit
C:\Windows\system\YUVSmCe.exe

Filesize
5.7MB

MD5
4f89ea79d4e5bfc9bd917fd4bf062110

SHA1
afb6b05a723812d59615836b1dad2eb3704d0ca5

SHA256
7eb044a1b6c9479f20f12a60924040fc89a9e4aa59e805a29bcf02c6c380a777

SHA512
aefeb76227201114fef05ba64a272c83a299871224a1ac2e7aae181c568732c2332f7b1b2b0d1ef742dfa5e96998fd9cc378801c38a9543037a93c0679a9bf0a

Download Submit
C:\Windows\system\ZXedgJb.exe

Filesize
5.7MB

MD5
4dc705cc5854ad35a882ce879fa5289f

SHA1
81e2bc9236c3fe6c1f45c4916df69f4e5ee6bc46

SHA256
6b3a0ff279f4b30566367f09e36632211659efb2b30fdaa34b8846251f09377c

SHA512
a0eff6d10864864941bb132845fcd0674681a7d2a5b0878ce2a5a8c9b39a8b6f33ada891db44503625b339d32287a3a3fc1e76df713a0ed8906399c8268a2f66

Download Submit
C:\Windows\system\bdqNNIA.exe

Filesize
5.7MB

MD5
69beb0dea0d6076770970a187495649c

SHA1
0ca77035496f93a094a2d22085f25afe19d31aa8

SHA256
e46de5dbd9dc7f0925fb2fe22d418fba4ab75e2e685210a1d329eb39d8c00b3a

SHA512
180a588260ff1b1685d71dccfa3bfcd94122a4c79c3d155348eab1000e5138af2a29d5e4a58dd3d041a3828f78aef8a09ae6273b5cb44343bbd1a197ded37362

Download Submit
C:\Windows\system\cjTsCXd.exe

Filesize
5.7MB

MD5
9cdceae9a9a73b0b1bc7223f23b48f59

SHA1
941431b19c20434bf5d5c88c900e3a69193584fc

SHA256
38e7182621f3e6bcb283ac0692625f62182a4b6d3a53451481174b398ebbed6d

SHA512
9b7f9f5e8e8ac3059585a6b3a8552307dc687e448ff29322bfaf4b873909beae39ac7ce0222dd8546ef36e0edd2cc8db01a5bf398a94c76c32dd5964fbc30419

Download Submit
C:\Windows\system\ffstJRi.exe

Filesize
5.7MB

MD5
c4c81c8c046184c9efa52ff05af9c655

SHA1
777f81b05f3b8302401f16a7c392bc51c127607e

SHA256
1645cd18f9425af376c2e38cb93389a0c7b5ea86a65c41b7c4e6124a9fbe6e42

SHA512
7f1218ab7290def3b8ab1b2263c808000b038047a685c73e98a3368bc864f4bfafb653c8bd717def76134c3dc0e41de535b3b4d923795722b3d6808ab08fc8a0

Download Submit
C:\Windows\system\gtDkUQs.exe

Filesize
5.7MB

MD5
a93a17f00077decc97daaa52f2cf899e

SHA1
45a28b7764d2509105821e0a5ae7e08e98151fb4

SHA256
f39b1fc7279481fae429860b134721c863728f6b1f69b01b2eb056e15b7a718e

SHA512
f04f4b3067833427cc3576f46062e3c39058a4a9b3387de9b9007059464ad5dac5c280261ab7a65bd385fe533f1be9c97b9a62ad7403ac33db97132d057b1632

Download Submit
C:\Windows\system\nAjPuhE.exe

Filesize
5.7MB

MD5
651f8d6ac8ecc0663909395bcd05d250

SHA1
d69438485df5db8bbcf0b3f10a949f3089e19f31

SHA256
ab9db966a12ea7f43457a73b9cda93f0da4b6f64b77cb425ccd7c77a20d6900f

SHA512
3ddbb2d73a1dc7f75116d1efb9a6d9be14f5c4b6858f3536cd5f68768e0377b126726d5b8b88af79648183d7daed4de9943395e717fda241da333e895422ba0e

Download Submit
C:\Windows\system\roLgOmu.exe

Filesize
5.7MB

MD5
fd4037c1c598c5ae46823209ebb10718

SHA1
c02286aa9f4f85826c5c77b5695d47dbbdfb54c7

SHA256
ad37aad5379a61c4e1739260ab0ca3b2351e9318fbfc42181b1f68debe121d7e

SHA512
b5c8d7540c5d3003fc2d34df85487196beed0bbddcd4e8dba9ca853fb1f3e07b6d5ebbdcc7ed5ca577887ba9430e5504b9c88810a18497b0bbec0812bd47b1bd

Download Submit
C:\Windows\system\rrPyYgE.exe

Filesize
5.7MB

MD5
b230a871da5d52b48124158bc1182c31

SHA1
c17eda2ad7463890ae97ef6aaf11e86b29db2e95

SHA256
9f3bceef800a970e51095276aa2a5d6da39f0800d4824f918e7b884b32738bac

SHA512
9a55c01635aeada5cd0a3f31237968f8e925efd80b01f7247911b89facffa1396c8e2a3b22d7260a909010f206eb391339b08b13681f80c7015c61f667c4a97f

Download Submit
C:\Windows\system\tiyoqYb.exe

Filesize
5.7MB

MD5
702e4f2c19dd60d501f1ff9b15f0925a

SHA1
dd860580694333c735898c71df421b64daba35fd

SHA256
e0aa895e1493d914805084ce41ca610bea5ca2f3bc709b8109ba09b0e3c45d9b

SHA512
a433cc24393b9d8f0d999e6577f80bf1de6db9df4b02de7477c0ec8da2d968f1f430d0fc9504edd5d09085ead224fa2a68c4be63a79908c6b39e52ed203f77c6

Download Submit
C:\Windows\system\uKVFrdY.exe

Filesize
5.7MB

MD5
1164153cf0d4302d80cc68d3b0d2bf08

SHA1
81d3ab0baad09175018f299d36e45ec25a24b673

SHA256
48998f3de56c73283b8c3661fcda7fd7213fbffb198c22f18c5e792d7aee1587

SHA512
118ed77167c8a0f4dd74e71a4439efe7ba1c8ccd699be274af809837eb1279c0a3cacc05da290c9cbc09edf623ca40f1c3877a78179da62f140d6e6459a450d1

Download Submit
C:\Windows\system\zLgUuCo.exe

Filesize
5.7MB

MD5
9e1fd37b0b0e5c66720c8903abe89fcd

SHA1
dacbb9cadf3939e7a80e3a3f302eb82b3e5c44e3

SHA256
efaae9c52f213fac1568959f5f5a64a5df7ecc865fa93813c3a1aa7d5a38f6da

SHA512
184226739ad0440d044894fea0c3d5551fdff69203882ccd5cf2179e7daa170d0e7bdfda64d51c0875aea6649c3f6fe197375d76a5013a6e464e44bce7f5629f

Download Submit
C:\Windows\system\zcamQwr.exe

Filesize
5.7MB

MD5
158ab2d1ceb372684f4b97f386072afc

SHA1
111b6e356172fd779871fa4674f017b21cb35321

SHA256
e9aff15fa99bdbc4212a6b18989bb37752d1629dbad7242518ca1152618cb311

SHA512
fc26156eb2a579e23641b250be6e438baadfc29b02c74b766828926d6bb0fa26fb11e2678c3aa060a17d3891bd535e82e516848e5e1e3ec2ed347ea6c302387f

Download Submit
\Windows\system\qLNMsaM.exe

Filesize
5.7MB

MD5
849cfce1cee87143b21e6016df1a082d

SHA1
052b708d48f82a5fd12d4f789a59b58132c9698f

SHA256
7f7e4af7dad87240fa37a993fb5e4bc6b2d49577cf05cc184ad324b5c26121d0

SHA512
1be31759a451c51bb97f5e4495ed07d47b6a730eba229e2cf69d66a771eeddfe188be60e95742a2d594e553e1940d16df2a880e3d2b9b0561746c347f80c45a9

Download Submit
memory/560-122-0x000000013FC20000-0x000000013FF6D000-memory.dmp

Filesize
3.3MB

Download
memory/868-39-0x000000013F210000-0x000000013F55D000-memory.dmp

Filesize
3.3MB

Download
memory/1136-120-0x000000013F440000-0x000000013F78D000-memory.dmp

Filesize
3.3MB

Download
memory/1620-35-0x000000013FDD0000-0x000000014011D000-memory.dmp

Filesize
3.3MB

Download
memory/1980-111-0x000000013FCD0000-0x000000014001D000-memory.dmp

Filesize
3.3MB

Download
memory/2000-31-0x000000013F0A0000-0x000000013F3ED000-memory.dmp

Filesize
3.3MB

Download
memory/2088-113-0x000000013F8F0000-0x000000013FC3D000-memory.dmp

Filesize
3.3MB

Download
memory/2304-0-0x000000013FFE0000-0x000000014032D000-memory.dmp

Filesize
3.3MB

Download
memory/2304-1-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2388-32-0x000000013FC50000-0x000000013FF9D000-memory.dmp

Filesize
3.3MB

Download
memory/2608-110-0x000000013F0C0000-0x000000013F40D000-memory.dmp

Filesize
3.3MB

Download
memory/2648-53-0x000000013F1B0000-0x000000013F4FD000-memory.dmp

Filesize
3.3MB

Download
memory/2656-55-0x000000013FB50000-0x000000013FE9D000-memory.dmp

Filesize
3.3MB

Download
memory/2664-66-0x000000013F620000-0x000000013F96D000-memory.dmp

Filesize
3.3MB

Download
memory/2680-108-0x000000013FA10000-0x000000013FD5D000-memory.dmp

Filesize
3.3MB

Download
memory/2696-61-0x000000013F230000-0x000000013F57D000-memory.dmp

Filesize
3.3MB

Download
memory/2724-33-0x000000013FCE0000-0x000000014002D000-memory.dmp

Filesize
3.3MB

Download
memory/2796-112-0x000000013FF40000-0x000000014028D000-memory.dmp

Filesize
3.3MB

Download
memory/2852-121-0x000000013FE10000-0x000000014015D000-memory.dmp

Filesize
3.3MB

Download
memory/2876-34-0x000000013F2C0000-0x000000013F60D000-memory.dmp

Filesize
3.3MB

Download
memory/2892-41-0x000000013F3C0000-0x000000013F70D000-memory.dmp

Filesize
3.3MB

Download
memory/2984-119-0x000000013F1F0000-0x000000013F53D000-memory.dmp

Filesize
3.3MB

Download
memory/3016-109-0x000000013F8C0000-0x000000013FC0D000-memory.dmp

Filesize
3.3MB

Download