cobaltstrike | 5d20f34e5f31d1dd6881aa688e48b61aa36d0eb492d66ddb9419c1106b15bb58

Analysis

max time kernel
135s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

188f766db22e96fc15f019adae4690eb
SHA1

428a001f796e36b899e03569ba7736b5939f3c3a
SHA256

5d20f34e5f31d1dd6881aa688e48b61aa36d0eb492d66ddb9419c1106b15bb58
SHA512

a80170a4dbe35ddc9203f5a4e801cc1aac46ff35a06ff192d97b8997402606247d57bdf350b6d2bfbcfb48314b9b44563bd4c2f5b5f173314de94b945b8520b1
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUs:j+R56utgpPF8u/7s

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000c000000023af7-6.dat	cobalt_reflective_dll
behavioral2/files/0x0031000000023b5b-10.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b5a-11.dat	cobalt_reflective_dll
behavioral2/files/0x0031000000023b5c-24.dat	cobalt_reflective_dll
behavioral2/files/0x0031000000023b5d-28.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023b57-40.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b5e-36.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b5f-46.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b61-54.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b62-59.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b63-66.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b68-91.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b69-99.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6a-106.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6d-124.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6c-119.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6b-114.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b67-96.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b66-93.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b65-81.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b64-72.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1080-0-0x00007FF7006C0000-0x00007FF700A0D000-memory.dmp	xmrig
behavioral2/files/0x000c000000023af7-6.dat	xmrig
behavioral2/memory/540-7-0x00007FF63F6E0000-0x00007FF63FA2D000-memory.dmp	xmrig
behavioral2/files/0x0031000000023b5b-10.dat	xmrig
behavioral2/memory/4896-13-0x00007FF6F9090000-0x00007FF6F93DD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b5a-11.dat	xmrig
behavioral2/memory/3212-19-0x00007FF735620000-0x00007FF73596D000-memory.dmp	xmrig
behavioral2/memory/1624-25-0x00007FF781140000-0x00007FF78148D000-memory.dmp	xmrig
behavioral2/files/0x0031000000023b5c-24.dat	xmrig
behavioral2/files/0x0031000000023b5d-28.dat	xmrig
behavioral2/memory/116-31-0x00007FF798320000-0x00007FF79866D000-memory.dmp	xmrig
behavioral2/files/0x000b000000023b57-40.dat	xmrig
behavioral2/memory/2136-37-0x00007FF79B9F0000-0x00007FF79BD3D000-memory.dmp	xmrig
behavioral2/memory/4456-43-0x00007FF6D3160000-0x00007FF6D34AD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b5e-36.dat	xmrig
behavioral2/files/0x000a000000023b5f-46.dat	xmrig
behavioral2/files/0x000a000000023b61-54.dat	xmrig
behavioral2/memory/2840-55-0x00007FF6E2260000-0x00007FF6E25AD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b62-59.dat	xmrig
behavioral2/memory/528-67-0x00007FF6E5E20000-0x00007FF6E616D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b63-66.dat	xmrig
behavioral2/memory/2184-82-0x00007FF7D3FF0000-0x00007FF7D433D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b68-91.dat	xmrig
behavioral2/memory/944-97-0x00007FF747CB0000-0x00007FF747FFD000-memory.dmp	xmrig
behavioral2/memory/2176-103-0x00007FF7AD6B0000-0x00007FF7AD9FD000-memory.dmp	xmrig
behavioral2/memory/768-100-0x00007FF6978C0000-0x00007FF697C0D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b69-99.dat	xmrig
behavioral2/files/0x000a000000023b6a-106.dat	xmrig
behavioral2/memory/1192-108-0x00007FF6D40E0000-0x00007FF6D442D000-memory.dmp	xmrig
behavioral2/memory/4448-115-0x00007FF7EBA20000-0x00007FF7EBD6D000-memory.dmp	xmrig
behavioral2/memory/3996-121-0x00007FF694170000-0x00007FF6944BD000-memory.dmp	xmrig
behavioral2/memory/4616-126-0x00007FF6441A0000-0x00007FF6444ED000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b6d-124.dat	xmrig
behavioral2/files/0x000a000000023b6c-119.dat	xmrig
behavioral2/files/0x000a000000023b6b-114.dat	xmrig
behavioral2/files/0x000a000000023b67-96.dat	xmrig
behavioral2/memory/4740-94-0x00007FF764910000-0x00007FF764C5D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b66-93.dat	xmrig
behavioral2/files/0x000a000000023b65-81.dat	xmrig
behavioral2/memory/3516-73-0x00007FF7759D0000-0x00007FF775D1D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b64-72.dat	xmrig
behavioral2/memory/5080-61-0x00007FF642750000-0x00007FF642A9D000-memory.dmp	xmrig
behavioral2/memory/3116-49-0x00007FF78A320000-0x00007FF78A66D000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
540	PXwUqaJ.exe
4896	eWLlCXP.exe
3212	IRihdzq.exe
1624	LiFBgtK.exe
116	RoucTcb.exe
2136	gHvAwtM.exe
4456	WVoYRpU.exe
3116	fNHDZJk.exe
2840	LrRVkWS.exe
5080	CaVfQQp.exe
528	nJMcGIi.exe
3516	ytixsjE.exe
2184	QElWwji.exe
4740	szOpObU.exe
944	jeAfKBC.exe
2176	gWyhfTF.exe
768	tmmXsaE.exe
1192	hEXdvBb.exe
4448	kvZAksr.exe
3996	rWOHMaW.exe
4616	dmnvqOb.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\LiFBgtK.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\gHvAwtM.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\WVoYRpU.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\LrRVkWS.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\jeAfKBC.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\kvZAksr.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rWOHMaW.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\PXwUqaJ.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\RoucTcb.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\fNHDZJk.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\CaVfQQp.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nJMcGIi.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\szOpObU.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\dmnvqOb.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\eWLlCXP.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\IRihdzq.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\QElWwji.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\gWyhfTF.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\hEXdvBb.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ytixsjE.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\tmmXsaE.exe	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 540	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 1080 wrote to memory of 540	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 1080 wrote to memory of 4896	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 1080 wrote to memory of 4896	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 1080 wrote to memory of 3212	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 1080 wrote to memory of 3212	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 1080 wrote to memory of 1624	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 1080 wrote to memory of 1624	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 1080 wrote to memory of 116	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 1080 wrote to memory of 116	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 1080 wrote to memory of 2136	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 1080 wrote to memory of 2136	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 1080 wrote to memory of 4456	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 1080 wrote to memory of 4456	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 1080 wrote to memory of 3116	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 1080 wrote to memory of 3116	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 1080 wrote to memory of 2840	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 1080 wrote to memory of 2840	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 1080 wrote to memory of 5080	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 1080 wrote to memory of 5080	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 1080 wrote to memory of 528	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 1080 wrote to memory of 528	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 1080 wrote to memory of 3516	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 1080 wrote to memory of 3516	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 1080 wrote to memory of 2184	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 1080 wrote to memory of 2184	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 1080 wrote to memory of 4740	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 1080 wrote to memory of 4740	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 1080 wrote to memory of 944	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 1080 wrote to memory of 944	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 1080 wrote to memory of 2176	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 1080 wrote to memory of 2176	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 1080 wrote to memory of 768	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 1080 wrote to memory of 768	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 1080 wrote to memory of 1192	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 1080 wrote to memory of 1192	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 1080 wrote to memory of 4448	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 1080 wrote to memory of 4448	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 1080 wrote to memory of 3996	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 1080 wrote to memory of 3996	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 1080 wrote to memory of 4616	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	104
PID 1080 wrote to memory of 4616	1080	2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe	104

C:\Users\Admin\AppData\Local\Temp\2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-22_188f766db22e96fc15f019adae4690eb_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\System\PXwUqaJ.exe
  C:\Windows\System\PXwUqaJ.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\eWLlCXP.exe
  C:\Windows\System\eWLlCXP.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\IRihdzq.exe
  C:\Windows\System\IRihdzq.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\LiFBgtK.exe
  C:\Windows\System\LiFBgtK.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\RoucTcb.exe
  C:\Windows\System\RoucTcb.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\gHvAwtM.exe
  C:\Windows\System\gHvAwtM.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\WVoYRpU.exe
  C:\Windows\System\WVoYRpU.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\fNHDZJk.exe
  C:\Windows\System\fNHDZJk.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\LrRVkWS.exe
  C:\Windows\System\LrRVkWS.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\CaVfQQp.exe
  C:\Windows\System\CaVfQQp.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\nJMcGIi.exe
  C:\Windows\System\nJMcGIi.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\ytixsjE.exe
  C:\Windows\System\ytixsjE.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\QElWwji.exe
  C:\Windows\System\QElWwji.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\szOpObU.exe
  C:\Windows\System\szOpObU.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\jeAfKBC.exe
  C:\Windows\System\jeAfKBC.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\gWyhfTF.exe
  C:\Windows\System\gWyhfTF.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\tmmXsaE.exe
  C:\Windows\System\tmmXsaE.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\hEXdvBb.exe
  C:\Windows\System\hEXdvBb.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\kvZAksr.exe
  C:\Windows\System\kvZAksr.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\rWOHMaW.exe
  C:\Windows\System\rWOHMaW.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\dmnvqOb.exe
  C:\Windows\System\dmnvqOb.exe
  2⤵
  - Executes dropped EXE
  PID:4616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CaVfQQp.exe

Filesize
5.7MB

MD5
04d05a5fb709c745f63f4c45ee021c31

SHA1
dd84abf34348171359dc7020b17aa97ac29b84b4

SHA256
adc43ac89a58b0bb637ac25b420cd9b8eba285987003f89d143ca79c121945af

SHA512
f9f8a7822209894ef756d7e246e02168cef5eae4de23fc4f5639cc8cc2fa34996d5d57c7c324d89f726c3b1ee367bda5b37d2a6746c4310c3db810c557dafe9f

Download Submit
C:\Windows\System\IRihdzq.exe

Filesize
5.7MB

MD5
b381c4dd71d73d40d95c73a127a70f34

SHA1
161473d225b7057ab0cd269967a4fd27d5477c5a

SHA256
8c86b4bda9c3f753ec81a44eec440d93cdf7587ce4174d95fb22faeb4ddb9a60

SHA512
2b503c79d0389c31e87b2a037f21f6ed65ca438150b777b0c304ebac01ed34f0cf94d46cd8f2142cdb79e64f99e2d29ff30377843d88dee3f69ed7cd56ddb70e

Download Submit
C:\Windows\System\LiFBgtK.exe

Filesize
5.7MB

MD5
0cc37182f55b4f725841e7379550f144

SHA1
60ffcddd5716c923e8735462dc53e46fd3b07410

SHA256
fbf5afb7431dfae406647a81dc5812f21cb3f1c352fc03e58561c7b95b68ad29

SHA512
6a9dc13f1bb0fee8d5056b96cb4be3ae4408f35ea9619895df631d4ee8ede7247548e10b6567f2e489992ab81ef3247358b3916bc9efd1cc461931f4ea6d0eac

Download Submit
C:\Windows\System\LrRVkWS.exe

Filesize
5.7MB

MD5
5808abcf0de1d927e2f3d6d32b39e3ed

SHA1
5b96a95d534b38e25fc354bad1d59dd05270be3e

SHA256
a68ca20b56d400dbccef28c9641d0e7f5dc431346b53c36a69038a820f784bc2

SHA512
647c128e7bc41bf8581b69ad6f7e17567a5eaeb3e2d918721ad1a833a93ed24416db50df7fbc7700827d50d5a331971b8861bbec12cd5baea2e14f6648934a81

Download Submit
C:\Windows\System\PXwUqaJ.exe

Filesize
5.7MB

MD5
b6bfbd8267b9b31a46472ddded38a076

SHA1
f9931d5201ad3d7bc28c8abfdf359b1ba138b9d5

SHA256
17eb93024bea96ce164784a0a91830ca72677eae9ec8c3f17772820bbb8b0f76

SHA512
bcad8fb4540d17493b0d0213d6e6f958f68a25c816ba0c69bc3dee964a2af7fbd4f7b11c0862f48acdecd8e16d4928f8532f7d8f79daec8836e21ad7cf3e6412

Download Submit
C:\Windows\System\QElWwji.exe

Filesize
5.7MB

MD5
d103fcd7aa4ec776ed0fd19bd5889f67

SHA1
1a7a4c97ed746499ca20ebffa06f8ed117b8ce48

SHA256
0cfb7017e96cf654a8d54817d7783edbc6e0e8ef3ad50eac5340cd4a30d93efd

SHA512
39a392d6daf755126c1ebf6489112309a440c66dad2dba98f113bb50f1a7b940d261a3020bf67b0637116d6d39524975513f74e19778fcad5b5ada9a94b8f7c7

Download Submit
C:\Windows\System\RoucTcb.exe

Filesize
5.7MB

MD5
f7c5fa9ee0889da20dd0c1c4d5c3ebb6

SHA1
6a3b93ff2048f0e1166b134c904e539956d63a6c

SHA256
9bff98858f86cb08af22e913e42100ea7c511df6e291b0ce4b6e0df72492a6f7

SHA512
4373f81902c0757173d633dfec8ab7aa6e6e45f9b3f9cf705e680cb96d25c2a5616093b0df29f807b3bc014ff6a7ae842052e3f6e995b409ef9563f05d1c3831

Download Submit
C:\Windows\System\WVoYRpU.exe

Filesize
5.7MB

MD5
4ee3de5a2d499cf36e76b7a8e04e6326

SHA1
ecf11345e17b23dcc6e3b65e9a5a57e1bc8ffc4b

SHA256
305f2440103a0ebf6a685cdad90fbc128c8d64c5261db20f69ba1f4f60e31b82

SHA512
988a04ddc68e3ec7ccb9c175f08cbdf473aa9913a809605f9461d112830a77d196761c773b10a26716f05677a55021d8e4fcafc2adec65b238e96be0399c5693

Download Submit
C:\Windows\System\dmnvqOb.exe

Filesize
5.7MB

MD5
2e93539403f65d78c8d4b204116c6a8f

SHA1
e1f7004143ccbfb3c0565d71b18cd486150fd971

SHA256
ba11128ad09199257abcbab96c06df19b4670dcfc5ac0f4535f7d414f10910d5

SHA512
f6b691fd89a3a2dbd4af90184a902d9d912defa25491c12d89c0c6d0e92e21c0334105230b3c6c7f5fac7c0b22e6a3c9fe55cfa78da8bdeed6d5b393ee67f69b

Download Submit
C:\Windows\System\eWLlCXP.exe

Filesize
5.7MB

MD5
ced52f58eb3e57bee6c56206173470ce

SHA1
dc73f89b8455da15f1e2838a72eb204baa767e72

SHA256
0b45af7bc4499acd1a07ca12a8fda6ce5926def0f923291fd53a06d6c2dbef1b

SHA512
f740d7e92a3ddd554222a71af44f3897a764ccf70b647503afec68961c38599732b7cb68d616cbb47c9b1ea007b12918704c63915b4684c7ebf32a248c2de22f

Download Submit
C:\Windows\System\fNHDZJk.exe

Filesize
5.7MB

MD5
56d7ab83a761cbce96028c76056dbe6f

SHA1
576b7bf42fde3a75055cf9c6d43fbf15043f4015

SHA256
8eb2ff56399ec5d3a4e699af5f1244bb46ec595a91a1401a72794c2c4031c82c

SHA512
6896ea822aba38a50aaaebfd74a9a8051e288a39d0596e8634777c13f0e828cdc04c626845c2fc3dc99a2049bf76f8e661528a302fcd17968228b2535340fa5f

Download Submit
C:\Windows\System\gHvAwtM.exe

Filesize
5.7MB

MD5
12fcced31e9ef2f527e70a73170921c0

SHA1
ea1afb75ab60e1bace4be6c55dbb390775a98105

SHA256
91e836924a01d309987f9d0fc25f0c1b4a7c25f877d5e7303be78b7e8825815b

SHA512
a81864c4bb818041de8cf111182ee2823f33972d8bca260cd0927bc1b30fc59553ced000361f4b5bb5b8ca8855d478c8242a8dfa6a1a113a60e455283e5efc5b

Download Submit
C:\Windows\System\gWyhfTF.exe

Filesize
5.7MB

MD5
d62aa8cff3343d68172926cdbb48fca7

SHA1
ce7736b36b7aceda0871d6d34e7e5d8909ac4fdf

SHA256
70afe5184b95074d5f0071fa58eeb0188c7fea76743b5433f21fe8dfbfee3cfa

SHA512
d2a0d222ce13d7a59f76e86cea02fcba6a201f8834d2457df8b6976230500069abbaf32877318dc9a2c4a0d6ac8c5647695b5a66d8b866b7907e3b3c960aecf0

Download Submit
C:\Windows\System\hEXdvBb.exe

Filesize
5.7MB

MD5
16fe172d662b528d679f18aca643a5d9

SHA1
263e8ed2d1a827ac2d32f00ac412a335d85582a7

SHA256
07f876252064a9e9d3baa25bfbebccbfe2e0368c3710be96698c1009d977b304

SHA512
508fa4d8e5344711c84d562302097b7b5c52afba05b3086947bbef4d945727aa5a7b725efb86823dd722b8257f5224c5f56ea67732cd296bd3175c8fb1e299a9

Download Submit
C:\Windows\System\jeAfKBC.exe

Filesize
5.7MB

MD5
f157acfbc77cdec7c52237cc696c0efb

SHA1
664d4a4f53f1b5a7138c18d540f03552f6a5856e

SHA256
e2731228da2cbf057a0e29852c164af217626ad7a3498a0ca6cd7d00b2148deb

SHA512
cabe63fb5a5a140778d10d463828d889d5cdbc786876d8e7890d47ae30c5994f69a7d4e2ebe20903a4cf21b4a50a53483556148ca2649a46344a4d396e922d3e

Download Submit
C:\Windows\System\kvZAksr.exe

Filesize
5.7MB

MD5
473f69966a4942ba2f9adbbdd711018b

SHA1
39f9e5a707e062975a46d0c074b1fe33def62f6e

SHA256
816507d7567707c7ee3593268a0c07eb6265b00ef4748fe23c4b2d4daf860b99

SHA512
2beac509b0207eea32ec6827cd2226787e8bc872e65f0bb3cb769e76cdfcd0db644427849abfa1a045b7e76099df47f984f45ae48de07024119a31c508f9a98a

Download Submit
C:\Windows\System\nJMcGIi.exe

Filesize
5.7MB

MD5
6a73a77e82db45914931ff499c90b74e

SHA1
b155f58b1c24e8675db643de9d70c5f060d4e326

SHA256
d8a9c383668b6155d65abb0f270863c92546e83b84ea950ee83109b980e10428

SHA512
11c2d5f76f8488dcb07358d680f6fc75f58929a07041ed946a400c6a8726e6d6802cd00a459cef019f0ec16715a45f93923adf54914fb5c5dbf9b8ff5c300917

Download Submit
C:\Windows\System\rWOHMaW.exe

Filesize
5.7MB

MD5
104b40d9e1b1b8842bc11d21edef407c

SHA1
f0d3688a9f150a314211809ddb6635a185def891

SHA256
fe93c4a44d31c5ca2d58e2e4a67787422caef3a74ec8d3d40b7c148a19e2ee89

SHA512
a39695f2f2fc706d9c05f12746cd61cde856a5528bad92bf17bddc5f66a3d6c813d187c3567002a625b579fb8f67648ec025b060ab4a8a08d1e3615c0f6febb0

Download Submit
C:\Windows\System\szOpObU.exe

Filesize
5.7MB

MD5
097bd1d98bc1382b258757d39927cd43

SHA1
6f848c1f6d66452f073d2c13619ceb1ebe354efa

SHA256
6d9b5f33d828c590798369185090400fb811b0b21094b3de9d1c1c0f30faa615

SHA512
f849dd8f86baacb755f2f929d3d8220018ff331bf2b1c41b28153ae9b54ef166a013250cd505f4b59ec06851797c8c0636075bdfef89959a7c7898e66eacd548

Download Submit
C:\Windows\System\tmmXsaE.exe

Filesize
5.7MB

MD5
0680bce8b917f5906a6d39ff061efe9a

SHA1
7ef0b07c3a6901e144b495c6bd5404b03ee3fe34

SHA256
35a843ecefd1a5fbe9f3f46563b2cfc3be0b3743429385109a32af74271f52ce

SHA512
1e4924dae6c336311b84b23807b46bfcd57d1e6c9f60cc7162b48e03ad5e51ad6c481ef32a8797f8e07b142f6b7ad93c5829a3d57408072be664968db7c47e84

Download Submit
C:\Windows\System\ytixsjE.exe

Filesize
5.7MB

MD5
1cb6cecbcaa7d0f402bf7ed2187cc0f9

SHA1
af6a024c9e7c151e551747f237dd127b6807861d

SHA256
ed6899d27e249ff90e4dcce9d876a6b6bee8dc9272b6e1b765e0edd6944f21f5

SHA512
73678f6dfbe573db00b4f79c9585a929e388fb64af3bc0fea29dfa7e01d94d8ba9c4786f49f71ecb85ae60c29c18746152a2df53fba822ff0352f0b2b08537b8

Download Submit
memory/116-31-0x00007FF798320000-0x00007FF79866D000-memory.dmp

Filesize
3.3MB

Download
memory/528-67-0x00007FF6E5E20000-0x00007FF6E616D000-memory.dmp

Filesize
3.3MB

Download
memory/540-7-0x00007FF63F6E0000-0x00007FF63FA2D000-memory.dmp

Filesize
3.3MB

Download
memory/768-100-0x00007FF6978C0000-0x00007FF697C0D000-memory.dmp

Filesize
3.3MB

Download
memory/944-97-0x00007FF747CB0000-0x00007FF747FFD000-memory.dmp

Filesize
3.3MB

Download
memory/1080-1-0x0000021D769E0000-0x0000021D769F0000-memory.dmp

Filesize
64KB

Download
memory/1080-0-0x00007FF7006C0000-0x00007FF700A0D000-memory.dmp

Filesize
3.3MB

Download
memory/1192-108-0x00007FF6D40E0000-0x00007FF6D442D000-memory.dmp

Filesize
3.3MB

Download
memory/1624-25-0x00007FF781140000-0x00007FF78148D000-memory.dmp

Filesize
3.3MB

Download
memory/2136-37-0x00007FF79B9F0000-0x00007FF79BD3D000-memory.dmp

Filesize
3.3MB

Download
memory/2176-103-0x00007FF7AD6B0000-0x00007FF7AD9FD000-memory.dmp

Filesize
3.3MB

Download
memory/2184-82-0x00007FF7D3FF0000-0x00007FF7D433D000-memory.dmp

Filesize
3.3MB

Download
memory/2840-55-0x00007FF6E2260000-0x00007FF6E25AD000-memory.dmp

Filesize
3.3MB

Download
memory/3116-49-0x00007FF78A320000-0x00007FF78A66D000-memory.dmp

Filesize
3.3MB

Download
memory/3212-19-0x00007FF735620000-0x00007FF73596D000-memory.dmp

Filesize
3.3MB

Download
memory/3516-73-0x00007FF7759D0000-0x00007FF775D1D000-memory.dmp

Filesize
3.3MB

Download
memory/3996-121-0x00007FF694170000-0x00007FF6944BD000-memory.dmp

Filesize
3.3MB

Download
memory/4448-115-0x00007FF7EBA20000-0x00007FF7EBD6D000-memory.dmp

Filesize
3.3MB

Download
memory/4456-43-0x00007FF6D3160000-0x00007FF6D34AD000-memory.dmp

Filesize
3.3MB

Download
memory/4616-126-0x00007FF6441A0000-0x00007FF6444ED000-memory.dmp

Filesize
3.3MB

Download
memory/4740-94-0x00007FF764910000-0x00007FF764C5D000-memory.dmp

Filesize
3.3MB

Download
memory/4896-13-0x00007FF6F9090000-0x00007FF6F93DD000-memory.dmp

Filesize
3.3MB

Download
memory/5080-61-0x00007FF642750000-0x00007FF642A9D000-memory.dmp

Filesize
3.3MB

Download