Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
22/01/2025, 07:46
Behavioral task
behavioral1
Sample
2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20241023-en
General
-
Target
2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.7MB
-
MD5
7f4d659cd45dcdab09d655024f070793
-
SHA1
c93efe2fd41309a6b94fa9a3e3611c6158e139fd
-
SHA256
283544ccaeb8547fc78ac6e287074cd1928a6415c6ecebee11d123bc9dcf8f39
-
SHA512
3c7f9b3d8feede68f4d2e055cdf993621713196dd90e146528373c6e9a4da47b8438459b610b2afdac25519776ad50988798efd354bf2f842e61922cc1843a02
-
SSDEEP
98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUt:j+R56utgpPF8u/7t
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x000c00000001202c-3.dat cobalt_reflective_dll behavioral1/files/0x0008000000016c66-8.dat cobalt_reflective_dll behavioral1/files/0x0007000000016c80-12.dat cobalt_reflective_dll behavioral1/files/0x0007000000016c88-21.dat cobalt_reflective_dll behavioral1/files/0x00090000000165c7-27.dat cobalt_reflective_dll behavioral1/files/0x0007000000016cd7-31.dat cobalt_reflective_dll behavioral1/files/0x0007000000016cf5-39.dat cobalt_reflective_dll behavioral1/files/0x0006000000017497-57.dat cobalt_reflective_dll behavioral1/files/0x000600000001755b-69.dat cobalt_reflective_dll behavioral1/files/0x0005000000018704-97.dat cobalt_reflective_dll behavioral1/files/0x00050000000187a8-123.dat cobalt_reflective_dll behavioral1/files/0x000500000001878e-117.dat cobalt_reflective_dll behavioral1/files/0x0005000000018744-111.dat cobalt_reflective_dll behavioral1/files/0x0005000000018739-105.dat cobalt_reflective_dll behavioral1/files/0x00050000000186f1-93.dat cobalt_reflective_dll behavioral1/files/0x00050000000186ed-87.dat cobalt_reflective_dll behavioral1/files/0x00050000000186e7-81.dat cobalt_reflective_dll behavioral1/files/0x0005000000018686-75.dat cobalt_reflective_dll behavioral1/files/0x000600000001749c-63.dat cobalt_reflective_dll behavioral1/files/0x0007000000017049-51.dat cobalt_reflective_dll behavioral1/files/0x0009000000016d3a-46.dat cobalt_reflective_dll -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
XMRig Miner payload 42 IoCs
resource yara_rule behavioral1/memory/2988-0-0x000000013FE60000-0x00000001401AD000-memory.dmp xmrig behavioral1/files/0x000c00000001202c-3.dat xmrig behavioral1/memory/2056-7-0x000000013FA70000-0x000000013FDBD000-memory.dmp xmrig behavioral1/files/0x0008000000016c66-8.dat xmrig behavioral1/files/0x0007000000016c80-12.dat xmrig behavioral1/memory/904-17-0x000000013F360000-0x000000013F6AD000-memory.dmp xmrig behavioral1/memory/2000-14-0x000000013FBB0000-0x000000013FEFD000-memory.dmp xmrig behavioral1/files/0x0007000000016c88-21.dat xmrig behavioral1/memory/2440-25-0x000000013F5B0000-0x000000013F8FD000-memory.dmp xmrig behavioral1/files/0x00090000000165c7-27.dat xmrig behavioral1/files/0x0007000000016cd7-31.dat xmrig behavioral1/files/0x0007000000016cf5-39.dat xmrig behavioral1/memory/2788-36-0x000000013FD00000-0x000000014004D000-memory.dmp xmrig behavioral1/memory/2132-35-0x000000013F240000-0x000000013F58D000-memory.dmp xmrig behavioral1/memory/2884-47-0x000000013F960000-0x000000013FCAD000-memory.dmp xmrig behavioral1/memory/2628-53-0x000000013F580000-0x000000013F8CD000-memory.dmp xmrig behavioral1/files/0x0006000000017497-57.dat xmrig behavioral1/memory/2768-59-0x000000013F270000-0x000000013F5BD000-memory.dmp xmrig behavioral1/memory/2604-65-0x000000013FB40000-0x000000013FE8D000-memory.dmp xmrig behavioral1/files/0x000600000001755b-69.dat xmrig behavioral1/memory/2652-77-0x000000013F8E0000-0x000000013FC2D000-memory.dmp xmrig behavioral1/files/0x0005000000018704-97.dat xmrig behavioral1/memory/1980-101-0x000000013FB80000-0x000000013FECD000-memory.dmp xmrig behavioral1/files/0x00050000000187a8-123.dat xmrig behavioral1/memory/1236-124-0x000000013F970000-0x000000013FCBD000-memory.dmp xmrig behavioral1/memory/1016-119-0x000000013F310000-0x000000013F65D000-memory.dmp xmrig behavioral1/files/0x000500000001878e-117.dat xmrig behavioral1/memory/236-113-0x000000013F090000-0x000000013F3DD000-memory.dmp xmrig behavioral1/files/0x0005000000018744-111.dat xmrig behavioral1/memory/1144-107-0x000000013FCD0000-0x000000014001D000-memory.dmp xmrig behavioral1/files/0x0005000000018739-105.dat xmrig behavioral1/memory/560-95-0x000000013F080000-0x000000013F3CD000-memory.dmp xmrig behavioral1/files/0x00050000000186f1-93.dat xmrig behavioral1/memory/1224-89-0x000000013F440000-0x000000013F78D000-memory.dmp xmrig behavioral1/files/0x00050000000186ed-87.dat xmrig behavioral1/memory/2616-83-0x000000013F630000-0x000000013F97D000-memory.dmp xmrig behavioral1/files/0x00050000000186e7-81.dat xmrig behavioral1/files/0x0005000000018686-75.dat xmrig behavioral1/files/0x000600000001749c-63.dat xmrig behavioral1/files/0x0007000000017049-51.dat xmrig behavioral1/files/0x0009000000016d3a-46.dat xmrig behavioral1/memory/2728-126-0x000000013FBD0000-0x000000013FF1D000-memory.dmp xmrig -
Executes dropped EXE 21 IoCs
pid Process 2056 JHgxkhc.exe 2000 CKbaBPz.exe 904 njHXYeC.exe 2440 WFHFNVt.exe 2132 URnSQTz.exe 2788 YgEFayI.exe 2728 PbigRky.exe 2884 BoYVhIv.exe 2628 UFlRloZ.exe 2768 hYnAkdU.exe 2604 ugniuec.exe 2676 RQQtyjg.exe 2652 oXLarMa.exe 2616 wffAbmk.exe 1224 ZsHVdoA.exe 560 aHliCjA.exe 1980 VZprGAw.exe 1144 kRVqKzG.exe 236 gowoRDC.exe 1016 nTFzuRE.exe 1236 DHZJpOM.exe -
Loads dropped DLL 21 IoCs
pid Process 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\System\YgEFayI.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\BoYVhIv.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\wffAbmk.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\ZsHVdoA.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\kRVqKzG.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\CKbaBPz.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\njHXYeC.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\URnSQTz.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\aHliCjA.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\UFlRloZ.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\ugniuec.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\RQQtyjg.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\DHZJpOM.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\JHgxkhc.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\WFHFNVt.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\oXLarMa.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\VZprGAw.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\gowoRDC.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\nTFzuRE.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\PbigRky.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe File created C:\Windows\System\hYnAkdU.exe 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe Token: SeLockMemoryPrivilege 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2056 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 31 PID 2988 wrote to memory of 2056 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 31 PID 2988 wrote to memory of 2056 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 31 PID 2988 wrote to memory of 2000 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 32 PID 2988 wrote to memory of 2000 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 32 PID 2988 wrote to memory of 2000 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 32 PID 2988 wrote to memory of 904 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 33 PID 2988 wrote to memory of 904 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 33 PID 2988 wrote to memory of 904 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 33 PID 2988 wrote to memory of 2440 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 34 PID 2988 wrote to memory of 2440 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 34 PID 2988 wrote to memory of 2440 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 34 PID 2988 wrote to memory of 2132 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 36 PID 2988 wrote to memory of 2132 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 36 PID 2988 wrote to memory of 2132 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 36 PID 2988 wrote to memory of 2788 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 37 PID 2988 wrote to memory of 2788 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 37 PID 2988 wrote to memory of 2788 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 37 PID 2988 wrote to memory of 2728 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 38 PID 2988 wrote to memory of 2728 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 38 PID 2988 wrote to memory of 2728 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 38 PID 2988 wrote to memory of 2884 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 39 PID 2988 wrote to memory of 2884 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 39 PID 2988 wrote to memory of 2884 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 39 PID 2988 wrote to memory of 2628 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 40 PID 2988 wrote to memory of 2628 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 40 PID 2988 wrote to memory of 2628 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 40 PID 2988 wrote to memory of 2768 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 41 PID 2988 wrote to memory of 2768 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 41 PID 2988 wrote to memory of 2768 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 41 PID 2988 wrote to memory of 2604 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 42 PID 2988 wrote to memory of 2604 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 42 PID 2988 wrote to memory of 2604 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 42 PID 2988 wrote to memory of 2676 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 43 PID 2988 wrote to memory of 2676 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 43 PID 2988 wrote to memory of 2676 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 43 PID 2988 wrote to memory of 2652 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 44 PID 2988 wrote to memory of 2652 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 44 PID 2988 wrote to memory of 2652 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 44 PID 2988 wrote to memory of 2616 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 45 PID 2988 wrote to memory of 2616 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 45 PID 2988 wrote to memory of 2616 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 45 PID 2988 wrote to memory of 1224 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 46 PID 2988 wrote to memory of 1224 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 46 PID 2988 wrote to memory of 1224 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 46 PID 2988 wrote to memory of 560 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 47 PID 2988 wrote to memory of 560 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 47 PID 2988 wrote to memory of 560 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 47 PID 2988 wrote to memory of 1980 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 48 PID 2988 wrote to memory of 1980 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 48 PID 2988 wrote to memory of 1980 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 48 PID 2988 wrote to memory of 1144 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 49 PID 2988 wrote to memory of 1144 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 49 PID 2988 wrote to memory of 1144 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 49 PID 2988 wrote to memory of 236 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 50 PID 2988 wrote to memory of 236 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 50 PID 2988 wrote to memory of 236 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 50 PID 2988 wrote to memory of 1016 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 51 PID 2988 wrote to memory of 1016 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 51 PID 2988 wrote to memory of 1016 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 51 PID 2988 wrote to memory of 1236 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 52 PID 2988 wrote to memory of 1236 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 52 PID 2988 wrote to memory of 1236 2988 2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\System\JHgxkhc.exeC:\Windows\System\JHgxkhc.exe2⤵
- Executes dropped EXE
PID:2056
-
-
C:\Windows\System\CKbaBPz.exeC:\Windows\System\CKbaBPz.exe2⤵
- Executes dropped EXE
PID:2000
-
-
C:\Windows\System\njHXYeC.exeC:\Windows\System\njHXYeC.exe2⤵
- Executes dropped EXE
PID:904
-
-
C:\Windows\System\WFHFNVt.exeC:\Windows\System\WFHFNVt.exe2⤵
- Executes dropped EXE
PID:2440
-
-
C:\Windows\System\URnSQTz.exeC:\Windows\System\URnSQTz.exe2⤵
- Executes dropped EXE
PID:2132
-
-
C:\Windows\System\YgEFayI.exeC:\Windows\System\YgEFayI.exe2⤵
- Executes dropped EXE
PID:2788
-
-
C:\Windows\System\PbigRky.exeC:\Windows\System\PbigRky.exe2⤵
- Executes dropped EXE
PID:2728
-
-
C:\Windows\System\BoYVhIv.exeC:\Windows\System\BoYVhIv.exe2⤵
- Executes dropped EXE
PID:2884
-
-
C:\Windows\System\UFlRloZ.exeC:\Windows\System\UFlRloZ.exe2⤵
- Executes dropped EXE
PID:2628
-
-
C:\Windows\System\hYnAkdU.exeC:\Windows\System\hYnAkdU.exe2⤵
- Executes dropped EXE
PID:2768
-
-
C:\Windows\System\ugniuec.exeC:\Windows\System\ugniuec.exe2⤵
- Executes dropped EXE
PID:2604
-
-
C:\Windows\System\RQQtyjg.exeC:\Windows\System\RQQtyjg.exe2⤵
- Executes dropped EXE
PID:2676
-
-
C:\Windows\System\oXLarMa.exeC:\Windows\System\oXLarMa.exe2⤵
- Executes dropped EXE
PID:2652
-
-
C:\Windows\System\wffAbmk.exeC:\Windows\System\wffAbmk.exe2⤵
- Executes dropped EXE
PID:2616
-
-
C:\Windows\System\ZsHVdoA.exeC:\Windows\System\ZsHVdoA.exe2⤵
- Executes dropped EXE
PID:1224
-
-
C:\Windows\System\aHliCjA.exeC:\Windows\System\aHliCjA.exe2⤵
- Executes dropped EXE
PID:560
-
-
C:\Windows\System\VZprGAw.exeC:\Windows\System\VZprGAw.exe2⤵
- Executes dropped EXE
PID:1980
-
-
C:\Windows\System\kRVqKzG.exeC:\Windows\System\kRVqKzG.exe2⤵
- Executes dropped EXE
PID:1144
-
-
C:\Windows\System\gowoRDC.exeC:\Windows\System\gowoRDC.exe2⤵
- Executes dropped EXE
PID:236
-
-
C:\Windows\System\nTFzuRE.exeC:\Windows\System\nTFzuRE.exe2⤵
- Executes dropped EXE
PID:1016
-
-
C:\Windows\System\DHZJpOM.exeC:\Windows\System\DHZJpOM.exe2⤵
- Executes dropped EXE
PID:1236
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
MD5cccff9b380a789c07abf5597ddbfceb7
SHA1ee79e8f7ffee199de46fe958214195a90f50ae93
SHA25699b7d9e6c780a6813a1188a9e8cf7b48d445cc64bb58018d8da9f9596b781242
SHA51289bbf6c88cfb0c7753a239a64be1b93ef125af915d9704e1269e0cf3cd9bac187b5a6fe8952cc992adf13b1ad3c8300bc107de27730a25de518f8077dfbfcb6b
-
Filesize
5.7MB
MD5f212ec35b4287ce14d7a805b87459f52
SHA171a930c8b1c5b3d97882b01dd07d6dd500f3da00
SHA2560f3abe2c1c5fd7fc3c7624a9770dceca02444fc485a1a29fc917a0b5ca69b576
SHA5121b1ef44405b548a262b5363a152c702ec1afc8a6f1beca461724b5892adfabbd7c92afd2489e7d1db0615513992db848ac32a35158ab16b00e8211ccda1f00fe
-
Filesize
5.7MB
MD56e3b49419743e57c79e6a78272ab1dd9
SHA134c73ab4c0ac6233490d2aca6e1d06e1e505f79c
SHA25663f1a5e5d8deed4bcd0a720e0fa4f1046498dd86e84c307c87b096363884534a
SHA512df9630df5f6da81bad18bf5eb29314f672f0f43f1f509172b0646b19de744d6ae25e67b4c40ccb6d49e78b2047f14c30247425a2ab304be60bb6f9ae73532067
-
Filesize
5.7MB
MD5029219a372c2023cba36796007a4d7cc
SHA12b7217ed27071a73e5b65b562b6ee04d63d4a3bc
SHA2560b47503333e1aa73da15d645631e88b318d7f720f096e3296811ae3ea1d48635
SHA512f77fde97b5440f5c8690236de74d39ed9d0642e09d3c6b21c85f156e5b9472f830939744659dda7427a70a3a829050f11a1452d3489c4afeac4a12ab76bfa71c
-
Filesize
5.7MB
MD573ea9cce71bd26c3c6ee9c860d7db56a
SHA1cf8f5c70f08ebd00badada9a5f890a6ef820b797
SHA2560aafbd62d859f5cb23e6485e3673b3588e8066f95b7941de8368512b340253e1
SHA512fa9e7d28989969f8882955603649a5bb1151460115d0c865de56c8b62bfe6208e7189394974b72fd0b31c730b58d07c4f11cb8ca85ecda388f0051f77dc71d1d
-
Filesize
5.7MB
MD554b227c416d27c1316456f46c6cb3ff4
SHA161bbb0bd4dd34d6270050ade1970a4447ace9fc0
SHA2564495d7298f2a39da6f894aabbadfa44dc215fa8055060c96122e5971fd0354ab
SHA51234f02275832864630542f79cac35d8d5dae58d0ea7b26a7d95e48112b045fbbb67862cbf59db5eae7b31afd0f219ea8aadf5d3e05e5acd0b4364ce25cebcc95c
-
Filesize
5.7MB
MD50702563ab6c39e700736496fd306c3cf
SHA1ee2239be7fdfc283e3760ce8e3fc87957d7004cf
SHA256e524806eac4f055789e0fe525d03958ae748d9f31e3f38bb313f277253ce6258
SHA5129d2e8039049dde35b7e98234f00c83df0948a521afb5404222b3b9eda8f83155ac684002c9fdd3900b1c5cc53510ad11281cd7335ce49f0cc8b3e38f1491673d
-
Filesize
5.7MB
MD584986cdb647ee26dbd2a144b6f746e7d
SHA1ec13b663c8b340c9daf14c22cb4f12ae46cd6b12
SHA256d09fb2678a83b601b8081da5bf4fa6fd1d3363c3726c584d103caad2db837d72
SHA51241e14010aa25e454f1717da57ae8a411e77b7acbc323c3ff5da2c7476ace33f593f9b4c1b75204d4193e9d72631a66a703bf81e81d4f6d306310ede0ac2b5a9e
-
Filesize
5.7MB
MD5fca02f90a068b770ab6513c30b73e355
SHA177cf5bfd0edbea7337b32f96502a02bc280ea80a
SHA256c33ab110d65fe5aa44dd92c38224c7a7b45aae51878ea6d82b14f219571af56c
SHA512cd848ca3a3e7807f304a7a60d5da964270f212b271accd63bc8fd6790d6da77e728715a54c183cd41078e69f6c80f4c32ae98a4727f6ad18a4ba0ef26d301ea9
-
Filesize
5.7MB
MD551493903e98fa094aec034beb0edc87b
SHA196b6507cae901533f02022b9c52d33453727b20c
SHA25622d8e483e640fbcce1ee222e3bacceb710093d9544310efbd3317085ff341bbf
SHA5128e63842b6a937fb82ab3bef0c73b5661430b4bf95fad5e836e803a1aa0bafec5bb141290c4b8c99f088a26c4b564c1ebad3c0b1102ad9564545279dabff4887b
-
Filesize
5.7MB
MD5c2f04857c113eee9ce2afa54f0bca488
SHA173b0a496d1336f2a070446959cd6ccf09d9ad568
SHA25699d830bfa0b8d7093f021d85e82b958d0cb8d0374ed9ff1dff7a7642cc03a013
SHA512df78af1595a1dfeaeaaf20fbcd6ecf3c126e9c2919905a19847e5edabc3f52ad27c4fa3966156454e44e7913fe632cbabc32a808a30e0f8323ed930a439ade11
-
Filesize
5.7MB
MD5cad38a987ee7793fd6a8526294a8234d
SHA16564e10b29e7f999b9a6aca02485578690cbfd3b
SHA256e87453b1cdbebc8f89a6f95ea3b28ea0eab2d85d98706b65e0fa4121b3e5974d
SHA512d534684fa45b41186bc8bf83742f6a3448e1931ce38ec985b4722e80ec37d62a63af37d776e4c38d31b98b4a59f311e3e553dbf4533dcaa405b34360f2a6038e
-
Filesize
5.7MB
MD5d5fa9e91f768342eafde9ef2251a55d7
SHA1699131c68d4663d705fb36f3433d7dfaa7f6ccfe
SHA256ea0bc42f3d0e420fec09850faebc35b555960d5db721175bc8cfc85d61ef6003
SHA5126386501d62c74978fe84acd629c2b058b4dce7604f3f214615f36b99a8660430ff5e6b34caeb38495df2601eeb595bc7ce8d59dd88a681a15f98617de9fec61b
-
Filesize
5.7MB
MD55b1fd07b30538f09bfe1c1fd60039f96
SHA16c6b6f2a62d7a366208bb2c446274ef21c13f30f
SHA256ade0139561f5461078b19964627c9642e7abf1257b994d2ffd6baa6dcb25f449
SHA51211667395bea8381c34362754b92692998c5722dcabac99664d2dbf3998b698f5b46b79c9182608dfbc830de1cbbb634529854dd648e67298d2b1bd47e75030f7
-
Filesize
5.7MB
MD5cc2c42f33c5c74cb6cfeb3e27fdf95ff
SHA1df64e3c53d146502abc99cfdf46f8cbcba35783b
SHA2564dfa32d762d1384a3804efaf641e478a2c6b528f6837ec16e69ce5ddbc1f70a2
SHA512f248e998a889a1bc882c3695a5993f35929bdfaa98ee5b8df017581c4e0df4cd513c81adc6f8c9af05a159f731b8123603d21d5a4c3df689efa9a11adf782e77
-
Filesize
5.7MB
MD53f20f49d7e80960640d51a36681300b7
SHA13e9356d63172e5f59266d2ef52e27aaa4e54206f
SHA256afb996c0b5f26f2c61716bd13dd3c76c10f06fe9653bf3313f99cf28ed63ad7b
SHA512e2e1afc39083a0d17c59e7be8a5e0b2923465f58861e5a8357847bf01b8fd6b0f968d6daed1a52ea6b27aea2f327fc25855022dd489cbf8e4a0e0334e7c08d2e
-
Filesize
5.7MB
MD52e1174464d9c3dfe641f5de81f931768
SHA1f163c64b6a9bbc8d1ed1e42686d1a0f77314a92a
SHA2561fef1238179c32397814df5d1590928f4018a2f9250b7d7f17800aee903cfd0f
SHA5121a4e5d9eb5402a1ec7c5b89e279757f35498daa2d36449203e2e498e3b7b1c2025aaec61cfe46b518dbfd74529b6ad03b1e318821d784e62ac6a4f98ad92b8d2
-
Filesize
5.7MB
MD5530bbd91054a1a1939db48aa0dbe4a33
SHA16e0a279a76cf984afa7826f9addc43ceb2a777f9
SHA256698e6e7fb76ff38066031abbd693ee40cb29dfdd45b9f06d0c00cf2df6106ba5
SHA51252f9c611d88aa610c1729f2b6aa2f5dcdee040c5f16f8e66b87cb18022c3ac5d09dc0417f5e5dafab092aeb15fcf15de1de0903c6439c08b2d5fbb3afea0c3bd
-
Filesize
5.7MB
MD53c511338895f8c9279fea096ffc0144e
SHA1a1cfb479a8eec487ad8869abfce9c2512b39d9c8
SHA256d0195703343f09e4f393a695d8e94f06738de4760164b9a249ecd6c505fb0892
SHA512da5317d6d24bf5f6c736f339640ac870992852c847e4dd693f36be507bf9eb54efe21166f6f50c5952a39779d1788513481e8c4bdca494c80c66fb0c63a00d5c
-
Filesize
5.7MB
MD56d7017ad2256310658489d5cca854be2
SHA194446a50bcfdc28549872a1a6979302ce19c5bc7
SHA256fcfdda7e8f65f484aea04537b92aa6efa69151963ae10dc9f7bbcfdd9f834f49
SHA51208959b943e7da2dd1a2ad072aae0c02c9cb8f38d4f9c405946471d26b63078995f974e61725cac404472d4db2a704f190e0b23f95ded264a0c566121a3d9df9f
-
Filesize
5.7MB
MD58d382fc84fba1ca20c58de487b27742e
SHA192be67deea5b55f9bf797fab09f07ebd12d48de9
SHA256f6e3db2a65e579cfb67469bc1cb0bcd9dea3f600e6d6e25b880f664d2a39648d
SHA51202064d1e091ef5be44bcfd589bfaf2ad747f6af649ae9aa0df5b9138efd06d12a0f065cec875085547167ba330ef157443beeb2e9758ecaa382f9b9fab148bf5