cobaltstrike | 4c3398eb75bae8fe8ed9cb60d11fd9ddd121b0f9eed9128ea822fe6235572476

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

5e3946a658091abd537ab48bdb6500fc
SHA1

9f3fdc0663f2c8092614ce79cd86bea0d14b9d35
SHA256

4c3398eb75bae8fe8ed9cb60d11fd9ddd121b0f9eed9128ea822fe6235572476
SHA512

f86ed2b25cb56064364da2b9cc5ac8b6838e1fdc82e799d1ba5327105cb0d59372440871af58a6819d7acf9678492d7bc902d10d334adcc5c7e1c148a6ea9b80
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUQ:j+R56utgpPF8u/7Q

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000c000000023b47-4.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b5f-10.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023b5b-11.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b62-33.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b61-30.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b60-24.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023b5c-47.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b65-54.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b68-66.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6a-77.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b69-72.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b66-62.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b63-42.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6b-83.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6c-89.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6f-100.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b70-107.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b6e-95.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b71-114.dat	cobalt_reflective_dll
behavioral2/files/0x0031000000023b73-123.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b72-120.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/4520-0-0x00007FF7EFFF0000-0x00007FF7F033D000-memory.dmp	xmrig
behavioral2/files/0x000c000000023b47-4.dat	xmrig
behavioral2/files/0x000a000000023b5f-10.dat	xmrig
behavioral2/files/0x000b000000023b5b-11.dat	xmrig
behavioral2/memory/2960-7-0x00007FF6DD070000-0x00007FF6DD3BD000-memory.dmp	xmrig
behavioral2/memory/3980-13-0x00007FF77D470000-0x00007FF77D7BD000-memory.dmp	xmrig
behavioral2/memory/1364-19-0x00007FF6BC5E0000-0x00007FF6BC92D000-memory.dmp	xmrig
behavioral2/memory/1224-25-0x00007FF68F1B0000-0x00007FF68F4FD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b62-33.dat	xmrig
behavioral2/memory/4028-37-0x00007FF738AB0000-0x00007FF738DFD000-memory.dmp	xmrig
behavioral2/memory/1176-34-0x00007FF73B7C0000-0x00007FF73BB0D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b61-30.dat	xmrig
behavioral2/files/0x000a000000023b60-24.dat	xmrig
behavioral2/files/0x000b000000023b5c-47.dat	xmrig
behavioral2/files/0x000a000000023b65-54.dat	xmrig
behavioral2/memory/3692-55-0x00007FF61B470000-0x00007FF61B7BD000-memory.dmp	xmrig
behavioral2/memory/4944-49-0x00007FF63AD50000-0x00007FF63B09D000-memory.dmp	xmrig
behavioral2/memory/3036-43-0x00007FF675B20000-0x00007FF675E6D000-memory.dmp	xmrig
behavioral2/memory/2608-67-0x00007FF6786B0000-0x00007FF6789FD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b68-66.dat	xmrig
behavioral2/memory/2100-63-0x00007FF717EC0000-0x00007FF71820D000-memory.dmp	xmrig
behavioral2/memory/4088-73-0x00007FF7BE830000-0x00007FF7BEB7D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b6a-77.dat	xmrig
behavioral2/memory/556-79-0x00007FF6E3BE0000-0x00007FF6E3F2D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b69-72.dat	xmrig
behavioral2/files/0x000a000000023b66-62.dat	xmrig
behavioral2/files/0x000a000000023b63-42.dat	xmrig
behavioral2/files/0x000a000000023b6b-83.dat	xmrig
behavioral2/memory/1992-85-0x00007FF7633A0000-0x00007FF7636ED000-memory.dmp	xmrig
behavioral2/memory/5024-91-0x00007FF7D4030000-0x00007FF7D437D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b6c-89.dat	xmrig
behavioral2/memory/1456-97-0x00007FF726740000-0x00007FF726A8D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b6f-100.dat	xmrig
behavioral2/memory/1812-103-0x00007FF7CC3D0000-0x00007FF7CC71D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b70-107.dat	xmrig
behavioral2/memory/2124-109-0x00007FF78C090000-0x00007FF78C3DD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b6e-95.dat	xmrig
behavioral2/files/0x000a000000023b71-114.dat	xmrig
behavioral2/files/0x0031000000023b73-123.dat	xmrig
behavioral2/memory/384-126-0x00007FF678680000-0x00007FF6789CD000-memory.dmp	xmrig
behavioral2/memory/4592-124-0x00007FF72F410000-0x00007FF72F75D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b72-120.dat	xmrig
behavioral2/memory/4528-115-0x00007FF7EBF00000-0x00007FF7EC24D000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2960	nYwGwLu.exe
3980	PImNvwS.exe
1364	JZvUSKa.exe
1224	SZFBKUS.exe
1176	ubsHhmW.exe
4028	ceyNeZO.exe
3036	uVqNgUR.exe
4944	kqoUUxZ.exe
3692	cAmEMme.exe
2100	mqPgDRW.exe
2608	ZKsDsUd.exe
4088	EMAjRHx.exe
556	jyjlQyv.exe
1992	OOkugwb.exe
5024	cwlIlaA.exe
1456	OCXGhkh.exe
1812	csxpMOv.exe
2124	JTWVgaa.exe
4528	jLnEoEm.exe
384	AqysyKZ.exe
4592	YpfyXBO.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\nYwGwLu.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\PImNvwS.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SZFBKUS.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uVqNgUR.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZKsDsUd.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\kqoUUxZ.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\mqPgDRW.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\EMAjRHx.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\OCXGhkh.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\JZvUSKa.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ubsHhmW.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\csxpMOv.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\JTWVgaa.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\jLnEoEm.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\AqysyKZ.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\YpfyXBO.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ceyNeZO.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\cAmEMme.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\jyjlQyv.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\OOkugwb.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\cwlIlaA.exe	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 2960	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	83
PID 4520 wrote to memory of 2960	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	83
PID 4520 wrote to memory of 3980	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 4520 wrote to memory of 3980	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 4520 wrote to memory of 1364	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 4520 wrote to memory of 1364	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 4520 wrote to memory of 1224	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 4520 wrote to memory of 1224	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 4520 wrote to memory of 1176	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 4520 wrote to memory of 1176	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 4520 wrote to memory of 4028	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 4520 wrote to memory of 4028	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 4520 wrote to memory of 3036	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 4520 wrote to memory of 3036	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 4520 wrote to memory of 4944	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 4520 wrote to memory of 4944	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 4520 wrote to memory of 3692	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 4520 wrote to memory of 3692	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 4520 wrote to memory of 2100	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 4520 wrote to memory of 2100	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 4520 wrote to memory of 2608	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 4520 wrote to memory of 2608	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 4520 wrote to memory of 4088	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 4520 wrote to memory of 4088	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 4520 wrote to memory of 556	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 4520 wrote to memory of 556	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 4520 wrote to memory of 1992	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 4520 wrote to memory of 1992	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 4520 wrote to memory of 5024	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 4520 wrote to memory of 5024	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 4520 wrote to memory of 1456	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 4520 wrote to memory of 1456	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 4520 wrote to memory of 1812	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 4520 wrote to memory of 1812	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 4520 wrote to memory of 2124	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 4520 wrote to memory of 2124	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 4520 wrote to memory of 4528	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 4520 wrote to memory of 4528	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 4520 wrote to memory of 384	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 4520 wrote to memory of 384	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 4520 wrote to memory of 4592	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 4520 wrote to memory of 4592	4520	2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe	103

C:\Users\Admin\AppData\Local\Temp\2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-22_5e3946a658091abd537ab48bdb6500fc_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\System\nYwGwLu.exe
  C:\Windows\System\nYwGwLu.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\PImNvwS.exe
  C:\Windows\System\PImNvwS.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\JZvUSKa.exe
  C:\Windows\System\JZvUSKa.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\SZFBKUS.exe
  C:\Windows\System\SZFBKUS.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\ubsHhmW.exe
  C:\Windows\System\ubsHhmW.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\ceyNeZO.exe
  C:\Windows\System\ceyNeZO.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\uVqNgUR.exe
  C:\Windows\System\uVqNgUR.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\kqoUUxZ.exe
  C:\Windows\System\kqoUUxZ.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\cAmEMme.exe
  C:\Windows\System\cAmEMme.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\mqPgDRW.exe
  C:\Windows\System\mqPgDRW.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\ZKsDsUd.exe
  C:\Windows\System\ZKsDsUd.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\EMAjRHx.exe
  C:\Windows\System\EMAjRHx.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\jyjlQyv.exe
  C:\Windows\System\jyjlQyv.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\OOkugwb.exe
  C:\Windows\System\OOkugwb.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\cwlIlaA.exe
  C:\Windows\System\cwlIlaA.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\OCXGhkh.exe
  C:\Windows\System\OCXGhkh.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\csxpMOv.exe
  C:\Windows\System\csxpMOv.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\JTWVgaa.exe
  C:\Windows\System\JTWVgaa.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\jLnEoEm.exe
  C:\Windows\System\jLnEoEm.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\AqysyKZ.exe
  C:\Windows\System\AqysyKZ.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\YpfyXBO.exe
  C:\Windows\System\YpfyXBO.exe
  2⤵
  - Executes dropped EXE
  PID:4592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AqysyKZ.exe

Filesize
5.7MB

MD5
3a9ae0ddf860868c09422cda3624f8b5

SHA1
e44639ecfc2ffbb4d8a1521ae8f6fe049c8a9769

SHA256
4a7b9f920b603ca9247267e444049d82b9febd762d5624f5c6c24025e83473ee

SHA512
bbfb25f811ee78bcf175807e15fac33b0979579eac3231ad6ad75dc7750a098aa2450610d05e32a1955ff41f9a92c336fb67c2b5dbfe5d52d285060c015bb16e

Download Submit
C:\Windows\System\EMAjRHx.exe

Filesize
5.7MB

MD5
d5fdb79cd54c4540f3142fed42f6834c

SHA1
a65982a58e6357c2572ba5f9cf897f699f1490e6

SHA256
2566349c14610dfef1f0bf6b155c393176c52791389a7fafa858616988974e2d

SHA512
6be1c1d5ddd27404ebc06e7a6efee3bd095733bc9ee65b196dc7725fae21f05c6fa7ca8e152c5df3f075fb9a2c08018b71416c3a582bd58154a5ffd503850a03

Download Submit
C:\Windows\System\JTWVgaa.exe

Filesize
5.7MB

MD5
ac58031492f13626291c07e9ef1e8ad0

SHA1
0f321c7cd4584e7577b4567d332abfb7a10ba17d

SHA256
42db95ed18637f1d50515cc9613647027467bbae701cc6ad7297b52fec229c70

SHA512
869cf012231a1fb04d718f65d0368c088405ef9328d1caff0930dd75495e1a63b28f099f11ef490a25f9beb5e2644674c12c23f7c389b5d47f488b3aac82a36c

Download Submit
C:\Windows\System\JZvUSKa.exe

Filesize
5.7MB

MD5
a43fb960f76f90633e31e924056e8d6c

SHA1
a2dd499a8906e34e3bc72a39dcc5a3cb72310f03

SHA256
3ab403a21b4eb20d293da5b2d526eea2b6300c7db1ab1d0a14a1429f2ef4cae2

SHA512
1d4d3258a101f75b1d4372fe5745a36c0620b114b519c4397e126df88cd2e1738c9c84e134a290a81971131caa1aef0945cd03b8cc919666b94d2c5cff94c1a8

Download Submit
C:\Windows\System\OCXGhkh.exe

Filesize
5.7MB

MD5
7a3692ec58e1d9558d0408776655791f

SHA1
23fb62e6bb530e8a8dc1bb38001c36df81a28929

SHA256
68ecca1f8e3f944a2a58750dd7aa3bd44fb760f3ffef283dbd18bbbd53f4b48d

SHA512
6967e286888b8aae7fdb0197185de22705d9ec88f009e9dede9a87024486b243710bbc2fe64e2eb393d19bb74794c21a2761d7728e51f7891f84757e5d264030

Download Submit
C:\Windows\System\OOkugwb.exe

Filesize
5.7MB

MD5
50eecab9ffcb8ae46a7ef6412ae33e2e

SHA1
3060a32e9b96376da4ae61661b37a4a72556d705

SHA256
2ac6a9c997f15c6d4dae4097b4291c44d03744e3a5aa8f5ab85fd8c89004ff03

SHA512
ddd3d4909ccec9b213952f67b96497928aff868153d6e25868b3508210eed7493594e5d5ee39190724a3b24c652f6077c182ca44d36f914171f588718a01dcc0

Download Submit
C:\Windows\System\PImNvwS.exe

Filesize
5.7MB

MD5
e47180d98513163520967829c504a27a

SHA1
09cb97d471f4bbc84fc8c905efd781c5f86a1af2

SHA256
969e2e8e349681aec598938c9a93bf69ed88f7ee142c3b9a742b976989d7e502

SHA512
97175844cc0ab56a71fa9826a4c887dd0a586bf2b1a9ae6443c3d72e27aeddd0826aeb3fd558ba405e9cc1bf4b7ad26fda7822667b7162f867f0440ff133b7b8

Download Submit
C:\Windows\System\SZFBKUS.exe

Filesize
5.7MB

MD5
1e2e33abcd8b440e09ac62ae975b1deb

SHA1
dbb8410d748e9a39eca17ea6967f4ece0f80a4b6

SHA256
64b2ebb3480e9f58431f88a5f3bb734c01ad3d30020f3815f89b708f027e75b2

SHA512
f59aff98007f83600a471331047bd35e78b1e638532175fff4a4685a32c51be5ce954cdd91a08f292d602051cc79228413d92eedde94c818255ed8f2309f4748

Download Submit
C:\Windows\System\YpfyXBO.exe

Filesize
5.7MB

MD5
81c0f83c3efd308bd52450e093a42c42

SHA1
3e29aab93ba1f309d1084eea404d1dd06d06b54a

SHA256
6ae8e3f875179d5814fadde6db65ea7e97c2f7fa319054a633ee6c7ba2140f13

SHA512
6053d30b2261b44dee4e20de0b67fdbc46a7441c121df4983493a299646ec57ad0e3ad9dbd735fd2267e3b6fba2aba8086e1c3ff56bef04fe98763111657873e

Download Submit
C:\Windows\System\ZKsDsUd.exe

Filesize
5.7MB

MD5
a97e3c16a7f74d8a39e247fa77ddbf5d

SHA1
1ec9d723171de0498b589b159faed0727b752bb2

SHA256
5ec02264d9c7423b40f50746c9cd1f02d6f2fb81ad03cb929db25dfa82885dbf

SHA512
60938d91994ffe659c61f550e8152ace9a5d7330bf31d47ae992f48956072e1ea1f7d78aa8e3472afe31d6922c16238885702651da12c1cdf6aa9a2c831213b4

Download Submit
C:\Windows\System\cAmEMme.exe

Filesize
5.7MB

MD5
6520e3fd5eb2c6f9766d1f4357ed396d

SHA1
230a4d052f41c4e4c184161576fef19ad0236c04

SHA256
56b98cdb68ecb019815f31ace5d6f9d8ed429d6c8d18573c22f490c4f2689452

SHA512
debcfd6df2d4a431c58f20a8b7b53d379bd227cafe4d905c48a4a8842f74a4d50e668a313e51f988c536659dd2126e62827fd02af5015171419866d4be06392f

Download Submit
C:\Windows\System\ceyNeZO.exe

Filesize
5.7MB

MD5
4188a9fd5361704f1075e4eae457d7b7

SHA1
1bf397af7dfa4cb3eaa96c6f8d762e955ce267d7

SHA256
0667b9eb8480472d402011a14e4deb21596571bf86849513875365471059ac08

SHA512
3a06cb2d9627af686d0c4a10a76233c032976242fba327056c0d3bf7d9c88ee6d2e4a0e940a25b3e6adc00b12953c907f4970a3108228915d8549a5ed8592d39

Download Submit
C:\Windows\System\csxpMOv.exe

Filesize
5.7MB

MD5
4b627e7814dcb6fb3d32054525d2d620

SHA1
d5c9d551b8643b075d82bea32ca960baa86b4c86

SHA256
d59dbfe1843dd6269af0ab1f043379f82daf4ddc7267945fa6262c8799851cf7

SHA512
9029ef1f4bf9a2d080c8297f163b8ea57ae1a92a213ce515a90f4fcc352cb66d5ae51973ca70a7b01dab4e88140c447d2195ee2ced5692fdb034506abd2e5985

Download Submit
C:\Windows\System\cwlIlaA.exe

Filesize
5.7MB

MD5
f41a91f02334bd4d28430aeec2bb9fa8

SHA1
bf013e4d5b9e1d7a419d44c6d029bc2b5a4a9691

SHA256
9b74d6f166949d7860f431afd72f3dd70afbc50225064bcdd5e2367360b677a6

SHA512
f7092cced8b4fb5820d66bf33a8400be8b0e7f7462cad66944218c2bc2bb5a8b85f394f61659406b5cd537810800de23eecddae4826fedfaffbdf406b942d057

Download Submit
C:\Windows\System\jLnEoEm.exe

Filesize
5.7MB

MD5
b0416a55925b5a5cca365e1fad4fe41e

SHA1
78f9ebe958815263f65bbcc55dfa3ec5ce2953dc

SHA256
75807453a481fd9f519842ebb75ec6b54772c81392bfbef92a2471ec41b235e2

SHA512
d7611a2611b9930450228c50c3a42889ec87601bedb6ce3414dc8f0c7c1bd365b229370d00666e8563f08bb5fb2cb7f295d4017eed01696f887799f7eba2228c

Download Submit
C:\Windows\System\jyjlQyv.exe

Filesize
5.7MB

MD5
8662695b21c76862f86f681d6e4a1f93

SHA1
e5aa2ebd7c4b12e0f0a76c46edce6c67e4467eca

SHA256
04aa9e7dea9efd878233c7b2505c7c2d1f8754a768bf3524a4303380ab2e9ec0

SHA512
b5d6ad31c86e8b5221299128e2ef2ba1a1809b430dfa1d992a4b89765328c286514b0293c80c44780435758e07e903224c6ee639c969384e563e7ef1b3349559

Download Submit
C:\Windows\System\kqoUUxZ.exe

Filesize
5.7MB

MD5
0b0d83f79d59131f24ac8b8c0687b9ff

SHA1
34fc304c1cd00115a68c73888c3e181bcca95100

SHA256
fd9b3a381cc2e0b2c8b77ed90d69a11b8f8e27aef7468f4f1164068ca01b9f7e

SHA512
036799fe7b204554dad8bb3fda1a1d2aa13c64ffc48b87d166fbbd90b57306396cf59dadcd1e91b8153ec88e064dc74b116f332d69de8ac1eb9380f4e6407da7

Download Submit
C:\Windows\System\mqPgDRW.exe

Filesize
5.7MB

MD5
d9b418e30fd93afa888e0d3ff02f0631

SHA1
fa1dd5ced84ed2151bfb8a3056d62429c5c96640

SHA256
7d05ebfc5e28e257a812578765ea6d96635196a51538cb8f18491f948eea248e

SHA512
ee0cc4e987dc16b7f201813c20de3cd8457058a36266e048b824b76d028e684079debdb7acad1af9dccdd5f07260892d1733fc91a34ec219c760683fd94e7e63

Download Submit
C:\Windows\System\nYwGwLu.exe

Filesize
5.7MB

MD5
54f40d8392efe7f954a1de68de94dd44

SHA1
9302915718ffbc1368373b5e54974b758fb7434f

SHA256
38bf8f7a243781ca9b4e38e3e5c5be6191eb09266ac5d2404982123de8412b88

SHA512
b1fa4b679860ad43f3f2442c55360c9c0940ffa047f68107a302935b5b9eb1eb7c3cdeef50535af725016c87c94c2210add99a9e75ba8fedbc73b6eb737bcd97

Download Submit
C:\Windows\System\uVqNgUR.exe

Filesize
5.7MB

MD5
b2b5c174cb78a8cc52a3f13c6746abae

SHA1
640ad7a08b633fea4fdc8baba77d193421006640

SHA256
5be7cdd530dff3efcf16cc29a7e6888cb50f4f9d8e77e32f2e0ac8690dfb435d

SHA512
9939d4b6491d869da90aad0966d5cd12643c6f5a024cb2addbd889d3e367d4c63a02cca390ca1866f53245b97a2447e8296740b7fe4cf271488ffe25355f0232

Download Submit
C:\Windows\System\ubsHhmW.exe

Filesize
5.7MB

MD5
0e304349012cb3904b41ebab1e46aaab

SHA1
a2f94a3531ff0fcfc5e19b02222895d6cc6219bb

SHA256
aceac685721e1909d2f4e0b7f9b140a713689566d872f5192722c6da7012e24f

SHA512
0d317db1a6ed0c3f69d58fd98b2e6cf3c162a574269130812003d1d776c2f1c560135c964cfe177fbdef392dfa52c971a58a75dbff450d3fd984358d50dbb2f7

Download Submit
memory/384-126-0x00007FF678680000-0x00007FF6789CD000-memory.dmp

Filesize
3.3MB

Download
memory/556-79-0x00007FF6E3BE0000-0x00007FF6E3F2D000-memory.dmp

Filesize
3.3MB

Download
memory/1176-34-0x00007FF73B7C0000-0x00007FF73BB0D000-memory.dmp

Filesize
3.3MB

Download
memory/1224-25-0x00007FF68F1B0000-0x00007FF68F4FD000-memory.dmp

Filesize
3.3MB

Download
memory/1364-19-0x00007FF6BC5E0000-0x00007FF6BC92D000-memory.dmp

Filesize
3.3MB

Download
memory/1456-97-0x00007FF726740000-0x00007FF726A8D000-memory.dmp

Filesize
3.3MB

Download
memory/1812-103-0x00007FF7CC3D0000-0x00007FF7CC71D000-memory.dmp

Filesize
3.3MB

Download
memory/1992-85-0x00007FF7633A0000-0x00007FF7636ED000-memory.dmp

Filesize
3.3MB

Download
memory/2100-63-0x00007FF717EC0000-0x00007FF71820D000-memory.dmp

Filesize
3.3MB

Download
memory/2124-109-0x00007FF78C090000-0x00007FF78C3DD000-memory.dmp

Filesize
3.3MB

Download
memory/2608-67-0x00007FF6786B0000-0x00007FF6789FD000-memory.dmp

Filesize
3.3MB

Download
memory/2960-7-0x00007FF6DD070000-0x00007FF6DD3BD000-memory.dmp

Filesize
3.3MB

Download
memory/3036-43-0x00007FF675B20000-0x00007FF675E6D000-memory.dmp

Filesize
3.3MB

Download
memory/3692-55-0x00007FF61B470000-0x00007FF61B7BD000-memory.dmp

Filesize
3.3MB

Download
memory/3980-13-0x00007FF77D470000-0x00007FF77D7BD000-memory.dmp

Filesize
3.3MB

Download
memory/4028-37-0x00007FF738AB0000-0x00007FF738DFD000-memory.dmp

Filesize
3.3MB

Download
memory/4088-73-0x00007FF7BE830000-0x00007FF7BEB7D000-memory.dmp

Filesize
3.3MB

Download
memory/4520-1-0x00000256C4EC0000-0x00000256C4ED0000-memory.dmp

Filesize
64KB

Download
memory/4520-0-0x00007FF7EFFF0000-0x00007FF7F033D000-memory.dmp

Filesize
3.3MB

Download
memory/4528-115-0x00007FF7EBF00000-0x00007FF7EC24D000-memory.dmp

Filesize
3.3MB

Download
memory/4592-124-0x00007FF72F410000-0x00007FF72F75D000-memory.dmp

Filesize
3.3MB

Download
memory/4944-49-0x00007FF63AD50000-0x00007FF63B09D000-memory.dmp

Filesize
3.3MB

Download
memory/5024-91-0x00007FF7D4030000-0x00007FF7D437D000-memory.dmp

Filesize
3.3MB

Download