cobaltstrike | 2ec0cb1fd332e410c48fa7ff4232964b7c9139c6ea700ae70dd0bc0d034f1016

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2025, 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

3353cf8ad412e04446e898042334cab4
SHA1

3075d70ed7b6f07029be75b178a726438c7b923c
SHA256

2ec0cb1fd332e410c48fa7ff4232964b7c9139c6ea700ae70dd0bc0d034f1016
SHA512

1203d3ee216749f256347b8e6f41112409dc5261b45900b3fb376fecd6b418d43b504801f3d2986bb891bb283d55b9de0c883c5a0808417de654d3fdc4d0f0a8
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUE:j+R56utgpPF8u/7E

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000a000000023cad-5.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cb5-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cb6-18.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cb7-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cb8-28.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023cb2-36.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cba-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cbb-46.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cbc-52.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cbd-59.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cbe-65.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cbf-72.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cc0-77.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cc1-84.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cc2-89.dat	cobalt_reflective_dll
behavioral2/files/0x000400000001e762-96.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cc5-102.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cc7-108.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cc8-114.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cc9-118.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023cca-125.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1056-0-0x00007FF621820000-0x00007FF621B6D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023cad-5.dat	xmrig
behavioral2/memory/540-7-0x00007FF64A8C0000-0x00007FF64AC0D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023cb5-11.dat	xmrig
behavioral2/files/0x0007000000023cb6-18.dat	xmrig
behavioral2/memory/2304-19-0x00007FF6D1480000-0x00007FF6D17CD000-memory.dmp	xmrig
behavioral2/files/0x0007000000023cb7-23.dat	xmrig
behavioral2/memory/3564-25-0x00007FF7CE7A0000-0x00007FF7CEAED000-memory.dmp	xmrig
behavioral2/memory/1456-13-0x00007FF63EFE0000-0x00007FF63F32D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023cb8-28.dat	xmrig
behavioral2/memory/3836-31-0x00007FF6127E0000-0x00007FF612B2D000-memory.dmp	xmrig
behavioral2/memory/4412-37-0x00007FF7DFF80000-0x00007FF7E02CD000-memory.dmp	xmrig
behavioral2/files/0x0009000000023cb2-36.dat	xmrig
behavioral2/files/0x0007000000023cba-41.dat	xmrig
behavioral2/files/0x0007000000023cbb-46.dat	xmrig
behavioral2/files/0x0007000000023cbc-52.dat	xmrig
behavioral2/files/0x0007000000023cbd-59.dat	xmrig
behavioral2/files/0x0007000000023cbe-65.dat	xmrig
behavioral2/memory/840-67-0x00007FF60A260000-0x00007FF60A5AD000-memory.dmp	xmrig
behavioral2/memory/4512-63-0x00007FF657590000-0x00007FF6578DD000-memory.dmp	xmrig
behavioral2/memory/1724-55-0x00007FF7C6F40000-0x00007FF7C728D000-memory.dmp	xmrig
behavioral2/memory/4936-49-0x00007FF73E4F0000-0x00007FF73E83D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023cbf-72.dat	xmrig
behavioral2/files/0x0007000000023cc0-77.dat	xmrig
behavioral2/files/0x0007000000023cc1-84.dat	xmrig
behavioral2/memory/4020-85-0x00007FF733AA0000-0x00007FF733DED000-memory.dmp	xmrig
behavioral2/memory/5060-79-0x00007FF786450000-0x00007FF78679D000-memory.dmp	xmrig
behavioral2/memory/2992-73-0x00007FF786150000-0x00007FF78649D000-memory.dmp	xmrig
behavioral2/memory/4700-43-0x00007FF6F78C0000-0x00007FF6F7C0D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023cc2-89.dat	xmrig
behavioral2/memory/3500-91-0x00007FF6A9020000-0x00007FF6A936D000-memory.dmp	xmrig
behavioral2/memory/4540-97-0x00007FF7688B0000-0x00007FF768BFD000-memory.dmp	xmrig
behavioral2/files/0x000400000001e762-96.dat	xmrig
behavioral2/files/0x0007000000023cc5-102.dat	xmrig
behavioral2/memory/3372-109-0x00007FF6C4340000-0x00007FF6C468D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023cc7-108.dat	xmrig
behavioral2/files/0x0007000000023cc8-114.dat	xmrig
behavioral2/memory/3132-115-0x00007FF7A8850000-0x00007FF7A8B9D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023cc9-118.dat	xmrig
behavioral2/memory/3540-121-0x00007FF68EFD0000-0x00007FF68F31D000-memory.dmp	xmrig
behavioral2/memory/4848-103-0x00007FF654DC0000-0x00007FF65510D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023cca-125.dat	xmrig
behavioral2/memory/4076-126-0x00007FF603590000-0x00007FF6038DD000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
540	KTzCpFQ.exe
1456	vORMvvQ.exe
2304	EMFDegj.exe
3564	OTlfsmN.exe
3836	IDGfwZd.exe
4412	hPqCaTx.exe
4700	pfOGHjm.exe
4936	zDmSYfg.exe
1724	VczulRF.exe
4512	jxKWYHf.exe
840	qRKCdwf.exe
2992	BYntqyi.exe
5060	RVUeWJf.exe
4020	VoVeSkQ.exe
3500	LmoUFTY.exe
4540	rOUoCGv.exe
4848	GNBXBuZ.exe
3372	TmGlSMV.exe
3132	jHzceOC.exe
3540	Mbshfek.exe
4076	jzxVVQp.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\zDmSYfg.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rOUoCGv.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\GNBXBuZ.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\hPqCaTx.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\pfOGHjm.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\VczulRF.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\jxKWYHf.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\jHzceOC.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KTzCpFQ.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\IDGfwZd.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\BYntqyi.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\TmGlSMV.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\jzxVVQp.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\vORMvvQ.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\OTlfsmN.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\qRKCdwf.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\RVUeWJf.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\VoVeSkQ.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\LmoUFTY.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\Mbshfek.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\EMFDegj.exe	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 540	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 1056 wrote to memory of 540	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 1056 wrote to memory of 1456	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 1056 wrote to memory of 1456	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 1056 wrote to memory of 2304	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 1056 wrote to memory of 2304	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 1056 wrote to memory of 3564	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 1056 wrote to memory of 3564	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 1056 wrote to memory of 3836	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 1056 wrote to memory of 3836	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 1056 wrote to memory of 4412	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 1056 wrote to memory of 4412	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 1056 wrote to memory of 4700	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 1056 wrote to memory of 4700	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 1056 wrote to memory of 4936	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 1056 wrote to memory of 4936	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 1056 wrote to memory of 1724	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 1056 wrote to memory of 1724	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 1056 wrote to memory of 4512	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 1056 wrote to memory of 4512	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 1056 wrote to memory of 840	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 1056 wrote to memory of 840	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 1056 wrote to memory of 2992	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 1056 wrote to memory of 2992	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 1056 wrote to memory of 5060	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 1056 wrote to memory of 5060	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 1056 wrote to memory of 4020	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 1056 wrote to memory of 4020	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 1056 wrote to memory of 3500	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 1056 wrote to memory of 3500	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 1056 wrote to memory of 4540	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 1056 wrote to memory of 4540	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 1056 wrote to memory of 4848	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 1056 wrote to memory of 4848	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 1056 wrote to memory of 3372	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 1056 wrote to memory of 3372	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 1056 wrote to memory of 3132	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 1056 wrote to memory of 3132	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 1056 wrote to memory of 3540	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 1056 wrote to memory of 3540	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 1056 wrote to memory of 4076	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	104
PID 1056 wrote to memory of 4076	1056	2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe	104

C:\Users\Admin\AppData\Local\Temp\2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-22_3353cf8ad412e04446e898042334cab4_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\System\KTzCpFQ.exe
  C:\Windows\System\KTzCpFQ.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\vORMvvQ.exe
  C:\Windows\System\vORMvvQ.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\EMFDegj.exe
  C:\Windows\System\EMFDegj.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\OTlfsmN.exe
  C:\Windows\System\OTlfsmN.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\IDGfwZd.exe
  C:\Windows\System\IDGfwZd.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\hPqCaTx.exe
  C:\Windows\System\hPqCaTx.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\pfOGHjm.exe
  C:\Windows\System\pfOGHjm.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\zDmSYfg.exe
  C:\Windows\System\zDmSYfg.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\VczulRF.exe
  C:\Windows\System\VczulRF.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\jxKWYHf.exe
  C:\Windows\System\jxKWYHf.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\qRKCdwf.exe
  C:\Windows\System\qRKCdwf.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\BYntqyi.exe
  C:\Windows\System\BYntqyi.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\RVUeWJf.exe
  C:\Windows\System\RVUeWJf.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\VoVeSkQ.exe
  C:\Windows\System\VoVeSkQ.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\LmoUFTY.exe
  C:\Windows\System\LmoUFTY.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\rOUoCGv.exe
  C:\Windows\System\rOUoCGv.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\GNBXBuZ.exe
  C:\Windows\System\GNBXBuZ.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\TmGlSMV.exe
  C:\Windows\System\TmGlSMV.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\jHzceOC.exe
  C:\Windows\System\jHzceOC.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\Mbshfek.exe
  C:\Windows\System\Mbshfek.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\jzxVVQp.exe
  C:\Windows\System\jzxVVQp.exe
  2⤵
  - Executes dropped EXE
  PID:4076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BYntqyi.exe

Filesize
5.7MB

MD5
5b04299cfba2744ef71206ef5a6b239c

SHA1
0447444dd1b2840b6928539d302a1ed6ed45b9ea

SHA256
7919bf956eea49dd94fb7baff459c96ca296b827dee2cd60484791d42b611b4f

SHA512
38cb1007e1fb07820366eac3ee7ef84b3282eb59caf5b60b5599ee24cc0e003bd56f2d3560916a7a6de32294ffa535b9399eb8576d9017f1af6d2698118ae04e

Download Submit
C:\Windows\System\EMFDegj.exe

Filesize
5.7MB

MD5
98e965ec3e726af874e280825cb43724

SHA1
8ce93e869cc93508ba71ef23c8865a377e973e11

SHA256
7c9a20ac6c1c30bfb56a05958eca84e1c4a35093e9427106e426880a2773b777

SHA512
14c1c0b1cf606ea28d42bcdc68dfcee047697004b6b34214b2fac2e48f5994d5d1131431bd29c7f74ccbc36bf8e950209f5ca1c194ca51d7ff9772dce933e9ae

Download Submit
C:\Windows\System\GNBXBuZ.exe

Filesize
5.7MB

MD5
1b7b6808c0bd8faf53ff5ca3aa7952d9

SHA1
db84fc98af2cbc3faf80c14657f7ed1ccccb63ba

SHA256
1e3c4947bdea22449374e9e7fe7abaa70eca48965b73b9ed4c02659cbc4cc34f

SHA512
74a729cd47b403d4e18495967bec4f01bbf140f6c0d90250d601fde1b17c2df78af4cba391cbf5186d775c1ca2e9e7e05604ad01084d7bd8dd66ed8d7d639a54

Download Submit
C:\Windows\System\IDGfwZd.exe

Filesize
5.7MB

MD5
235d21ba8b89067ae729aef63f54f096

SHA1
235aa3300f644bc0e98af89416bdc76a88d8c25b

SHA256
be89399dce508034d1f35226557b40efb4aef0a5732f56ee009b70d839689979

SHA512
c14a9f4a718f018a1b676c7ac99afbe7cf20454374f2af2abe4d171555289af9679473f6c32e75e1b549844a929fc873dcaa25ee7b51f2930e07473e1aa48932

Download Submit
C:\Windows\System\KTzCpFQ.exe

Filesize
5.7MB

MD5
7543fbb5a6366e525d519c57f763d8a4

SHA1
a285661ae66446094194637c05a63ac145b1ba31

SHA256
d30f2cbe67a5e7e626ce0e577a68f6da8a6c49b83934149c44169529d2c19e8d

SHA512
63064d787182e362ba43efe2893659fcb94333b49b61a22eaa514adf4b53d930c6cb981fd8e33bde6906e4be49a181cb59f484769d76e52e0bfc62498a6c82f6

Download Submit
C:\Windows\System\LmoUFTY.exe

Filesize
5.7MB

MD5
ab1cb7acd40ae746bd9b336b6910cb9b

SHA1
5bd795310fee64e8a4e34ce9b9868ebadb235cad

SHA256
6210e72e14900132ecbf621efe6d0e5735427900a85e19b9d560e933aee39e1a

SHA512
4164477cb18b550272e9eb53b86919fd3f793b7a0fd581e286e0582db5b00ee3b795b6893374915088603b2241eca28e03a87aaf0d4dae1caea6b305e10517e2

Download Submit
C:\Windows\System\Mbshfek.exe

Filesize
5.7MB

MD5
c0abd03cf09b1f849657d6e648d3d486

SHA1
7f6cf77e3e9b2f79508af03ccca58ee39d9d2a7b

SHA256
6f2e6c8280938b99243542475042430dff9e00ad5ed4c5df06223843bb8587a3

SHA512
13064a2f6783d45b9315638381cb546cbccbbf824523183fc9add4a9a613f97ab43ec47eb0df2930aaaf08ec007e1f52e5512296aa002922bc224d694c805bdf

Download Submit
C:\Windows\System\OTlfsmN.exe

Filesize
5.7MB

MD5
abf07e7fdea3117166252ae27c4d0ed6

SHA1
17b5721f241e258f01b7471db67662592150571d

SHA256
84fa2e78827bda751ac7c53d973ba82761ca7ac4900c282c9951004a5c80e116

SHA512
03f8169e8c78cc20e710dd3c1f3fe92521a7813fb2bbaf2872df5b8a7e20db5330bb9ce9f139a0f9397a5e77b01e81acf3ae7a8405765b44266cadeb70f4c5a3

Download Submit
C:\Windows\System\RVUeWJf.exe

Filesize
5.7MB

MD5
03f98a113fa30bf240f5b4e9918835c5

SHA1
55d599acae8f4d1752b9e32ffa96c2e9747e3de0

SHA256
adfd8594f5d8035375ab0f6cbd5499768a84e3f8941db3370376d5532c83ab24

SHA512
83ba125f85584a7615c0b9c3d4676fc831d2ca498f8c9fa46f567f239dea8dba291e83ee4b28ac602b4a6aa6684107acd5a73eb00e142227a1bdbab2562659f0

Download Submit
C:\Windows\System\TmGlSMV.exe

Filesize
5.7MB

MD5
981c4eb9f83cec4b4bb60454a1216129

SHA1
af363bbd0c1f04a1ce097a9b3ecdbb68c2e49ba7

SHA256
fe64e473c9a02a8057dffda7a843b46462946b3b89c006aeeccc690dd6ded264

SHA512
dff3da938b76ffdf5d6ee76fe72729870f4d66792f0ff2c1495ba3998ac9c43c2e06f73ac72e564eee4281aee2630adec16fdd18432f5d32a35934c2863aa1fc

Download Submit
C:\Windows\System\VczulRF.exe

Filesize
5.7MB

MD5
efe041d40647e7dcc7056a1134d3a172

SHA1
48f1b20005820a3b6c442d5b4b057984e1d17755

SHA256
1a05dfe1627e8fc54d7449fe9e49f33524e08d6a17c3f6722b7d19f87f274c5d

SHA512
994f368d7cdb3b6283bdbebf91af000698e9999c47c65aefd651f0bf1afbcca20a7ee65763dd706b71ca39b02ed4859f94643ffb46efe22cb30f6d1e777ebd3d

Download Submit
C:\Windows\System\VoVeSkQ.exe

Filesize
5.7MB

MD5
c7cdd7ad3a6d3da9d9126eb443fd77b8

SHA1
2d1ce9e3c026accea05294d157eb3fd2d3b2baf8

SHA256
46a0d3a844e071b271ea73cf2b91fc94ec27eb199ee8338dd6e66d125d91a723

SHA512
25b6dc5a867eed169ff0c4183ea7de05414a4e42f44dfd16057d7e771640fc0060b868c486c1d138d3d347a287e783e815ff51299232d9b18226081494fa1730

Download Submit
C:\Windows\System\hPqCaTx.exe

Filesize
5.7MB

MD5
736808851060f7e4842a2a2a859a4b3d

SHA1
78130b2f85fd13604aad1df30552451325df26e0

SHA256
8bc58c159d61c21d627a3d34c364f5ed481014048922aef71b8f6274aa4b8ad9

SHA512
a77bdbd917b8549d0dde657bd32caa8690c2a3ea5561f24974ba4dc59542ce0932c23805b064e805fea0d3ba8981b39c13e34ab98c8a95000f0fed5810e18563

Download Submit
C:\Windows\System\jHzceOC.exe

Filesize
5.7MB

MD5
52ce718fa51cbaa49b9d13bba6654238

SHA1
ca3dd0ca0a3b2d2d2302f5c7afd97284255d412c

SHA256
b4902f5919d85faf72da9d95e89a51419a747d5eaa503e7326a7e96d7525548e

SHA512
0f0121ca80b22c8d526e702eeee00d69e510784439f285fdba263ae7904eda525956c4d58ea88acf017a56e3562fac4ee589419751080260d8928be63970c9d8

Download Submit
C:\Windows\System\jxKWYHf.exe

Filesize
5.7MB

MD5
5d6e90f6db85f205aa5c4f62cba44663

SHA1
4585cbdc44aa85436e2dd9c9da62e010659f4ca7

SHA256
c919afaf0334d90bbcb3852372601e290741632463a5d9aa35efe1525c73e6e2

SHA512
0959e5c3e55e23562e5d3a7fdaefe4f32acba7dfe50d595df821b2421e6be8d2870a84b3dc3fb97b83591a8eaac7c6804ddc088371ee9d5710591296cf95e5d4

Download Submit
C:\Windows\System\jzxVVQp.exe

Filesize
5.7MB

MD5
ea01ebd121ef49ab11c99fcbb93b7610

SHA1
aaa16b386f48eb9c7c36c7a61cc2f1cd62cb7024

SHA256
bbded2ceea1ed4dac3004555bac61861a18fcf38f0896b73c9f163f9642dc08c

SHA512
49a1c30d4bcd10670426b78af6ab4e1fce5b2b19893134df6be3e95ee554e5857a97735c623029adf92ffdb230b610d1e91cf84ac52ebcd89c30046b4bf904f1

Download Submit
C:\Windows\System\pfOGHjm.exe

Filesize
5.7MB

MD5
0d66d0a3fd60a0632fdc1f2ac6295086

SHA1
81c467626053d1b4393e106d40563413e56059e0

SHA256
647df3e14389a6445a5c8f72bbfd2f02b2ae013499d0a79649b6b021bd9c1805

SHA512
85c90f76e74478435d503222e6f8e68c8b7bdf0b21ca5963160cb0b1c86e789c2c8fcd58094751df4f36dc1dad7071f3b643b990321c073dde87a49cd1d6c1e8

Download Submit
C:\Windows\System\qRKCdwf.exe

Filesize
5.7MB

MD5
d708bb48e4fd366bece77ac72ef4e94e

SHA1
9aa50e0acbcf154abfc262d698274e138ab95ecd

SHA256
401184cfbc636e28d6154f00d521474ef74e6017f5f3ec43afc509b7ee291ecb

SHA512
f48a08fa07f6a68bd7fe3f29488ff7649866528bf34828c17e8c78f70e0dac4244e720826bfd225238d880cf8163e632c74e2bc553262529528cfe50bb68bdaa

Download Submit
C:\Windows\System\rOUoCGv.exe

Filesize
5.7MB

MD5
b1847619acdafc8429b948aef0306e27

SHA1
5eef33cccaf8146c99a2073fe7d53c52956891aa

SHA256
227ff0e1f7c28c568eac322bf60a95bb0aaa80bdc0cf71a27bd8a3c5977e39e0

SHA512
5a9bacfc0b061e039475c4c760e5ea2be8b8ab3fac994e678b51c56ea3670bce03703b003dca36be022c48b69224d047d8a514404e9c6d00f1c1fe3d0941bd0a

Download Submit
C:\Windows\System\vORMvvQ.exe

Filesize
5.7MB

MD5
eea67770696e34cdefb74b8b7486136c

SHA1
c6a47065a7414ed1f87636df8a692f100b4ceb34

SHA256
86e182155a70790313fd36f11e98a5656f52955508b8b69c8c02592b54eb10da

SHA512
a2eeb62fb313d31e70f92de14f82341d44c5549dce6f458469209d0ae9588add54aca975fc2ae36cdae0cbd70747bb31fa36872af8e5add43319272c5c36469f

Download Submit
C:\Windows\System\zDmSYfg.exe

Filesize
5.7MB

MD5
2f4dd6c80ab3dcf4314d0e4308100b99

SHA1
743bd59280d79b77a3e793bea45236e7f1bb5c73

SHA256
156751af487c07af1845724c0100677da33193ff63450df3c0fdbeb9468c38c0

SHA512
eb70da98aaa9ec16c2be13a7054cd0c2c9c89e67be17154c7e5cd69c28cefc2618bd135f20ee9f3f1429391a87a3a95875e6062bb62832a44f7d590551207fd8

Download Submit
memory/540-7-0x00007FF64A8C0000-0x00007FF64AC0D000-memory.dmp

Filesize
3.3MB

Download
memory/840-67-0x00007FF60A260000-0x00007FF60A5AD000-memory.dmp

Filesize
3.3MB

Download
memory/1056-0-0x00007FF621820000-0x00007FF621B6D000-memory.dmp

Filesize
3.3MB

Download
memory/1056-1-0x000001E504680000-0x000001E504690000-memory.dmp

Filesize
64KB

Download
memory/1456-13-0x00007FF63EFE0000-0x00007FF63F32D000-memory.dmp

Filesize
3.3MB

Download
memory/1724-55-0x00007FF7C6F40000-0x00007FF7C728D000-memory.dmp

Filesize
3.3MB

Download
memory/2304-19-0x00007FF6D1480000-0x00007FF6D17CD000-memory.dmp

Filesize
3.3MB

Download
memory/2992-73-0x00007FF786150000-0x00007FF78649D000-memory.dmp

Filesize
3.3MB

Download
memory/3132-115-0x00007FF7A8850000-0x00007FF7A8B9D000-memory.dmp

Filesize
3.3MB

Download
memory/3372-109-0x00007FF6C4340000-0x00007FF6C468D000-memory.dmp

Filesize
3.3MB

Download
memory/3500-91-0x00007FF6A9020000-0x00007FF6A936D000-memory.dmp

Filesize
3.3MB

Download
memory/3540-121-0x00007FF68EFD0000-0x00007FF68F31D000-memory.dmp

Filesize
3.3MB

Download
memory/3564-25-0x00007FF7CE7A0000-0x00007FF7CEAED000-memory.dmp

Filesize
3.3MB

Download
memory/3836-31-0x00007FF6127E0000-0x00007FF612B2D000-memory.dmp

Filesize
3.3MB

Download
memory/4020-85-0x00007FF733AA0000-0x00007FF733DED000-memory.dmp

Filesize
3.3MB

Download
memory/4076-126-0x00007FF603590000-0x00007FF6038DD000-memory.dmp

Filesize
3.3MB

Download
memory/4412-37-0x00007FF7DFF80000-0x00007FF7E02CD000-memory.dmp

Filesize
3.3MB

Download
memory/4512-63-0x00007FF657590000-0x00007FF6578DD000-memory.dmp

Filesize
3.3MB

Download
memory/4540-97-0x00007FF7688B0000-0x00007FF768BFD000-memory.dmp

Filesize
3.3MB

Download
memory/4700-43-0x00007FF6F78C0000-0x00007FF6F7C0D000-memory.dmp

Filesize
3.3MB

Download
memory/4848-103-0x00007FF654DC0000-0x00007FF65510D000-memory.dmp

Filesize
3.3MB

Download
memory/4936-49-0x00007FF73E4F0000-0x00007FF73E83D000-memory.dmp

Filesize
3.3MB

Download
memory/5060-79-0x00007FF786450000-0x00007FF78679D000-memory.dmp

Filesize
3.3MB

Download