cobaltstrike | 283544ccaeb8547fc78ac6e287074cd1928a6415c6ecebee11d123bc9dcf8f39

Analysis

max time kernel
140s
max time network
151s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/01/2025, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

7f4d659cd45dcdab09d655024f070793
SHA1

c93efe2fd41309a6b94fa9a3e3611c6158e139fd
SHA256

283544ccaeb8547fc78ac6e287074cd1928a6415c6ecebee11d123bc9dcf8f39
SHA512

3c7f9b3d8feede68f4d2e055cdf993621713196dd90e146528373c6e9a4da47b8438459b610b2afdac25519776ad50988798efd354bf2f842e61922cc1843a02
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUt:j+R56utgpPF8u/7t

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000c00000001202c-3.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016c66-8.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016c80-12.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016c88-21.dat	cobalt_reflective_dll
behavioral1/files/0x00090000000165c7-27.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016cd7-31.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016cf5-39.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000017497-57.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001755b-69.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000018704-97.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000187a8-123.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001878e-117.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000018744-111.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000018739-105.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000186f1-93.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000186ed-87.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000186e7-81.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000018686-75.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001749c-63.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000017049-51.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000016d3a-46.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral1/memory/2988-0-0x000000013FE60000-0x00000001401AD000-memory.dmp	xmrig
behavioral1/files/0x000c00000001202c-3.dat	xmrig
behavioral1/memory/2056-7-0x000000013FA70000-0x000000013FDBD000-memory.dmp	xmrig
behavioral1/files/0x0008000000016c66-8.dat	xmrig
behavioral1/files/0x0007000000016c80-12.dat	xmrig
behavioral1/memory/904-17-0x000000013F360000-0x000000013F6AD000-memory.dmp	xmrig
behavioral1/memory/2000-14-0x000000013FBB0000-0x000000013FEFD000-memory.dmp	xmrig
behavioral1/files/0x0007000000016c88-21.dat	xmrig
behavioral1/memory/2440-25-0x000000013F5B0000-0x000000013F8FD000-memory.dmp	xmrig
behavioral1/files/0x00090000000165c7-27.dat	xmrig
behavioral1/files/0x0007000000016cd7-31.dat	xmrig
behavioral1/files/0x0007000000016cf5-39.dat	xmrig
behavioral1/memory/2788-36-0x000000013FD00000-0x000000014004D000-memory.dmp	xmrig
behavioral1/memory/2132-35-0x000000013F240000-0x000000013F58D000-memory.dmp	xmrig
behavioral1/memory/2884-47-0x000000013F960000-0x000000013FCAD000-memory.dmp	xmrig
behavioral1/memory/2628-53-0x000000013F580000-0x000000013F8CD000-memory.dmp	xmrig
behavioral1/files/0x0006000000017497-57.dat	xmrig
behavioral1/memory/2768-59-0x000000013F270000-0x000000013F5BD000-memory.dmp	xmrig
behavioral1/memory/2604-65-0x000000013FB40000-0x000000013FE8D000-memory.dmp	xmrig
behavioral1/files/0x000600000001755b-69.dat	xmrig
behavioral1/memory/2652-77-0x000000013F8E0000-0x000000013FC2D000-memory.dmp	xmrig
behavioral1/files/0x0005000000018704-97.dat	xmrig
behavioral1/memory/1980-101-0x000000013FB80000-0x000000013FECD000-memory.dmp	xmrig
behavioral1/files/0x00050000000187a8-123.dat	xmrig
behavioral1/memory/1236-124-0x000000013F970000-0x000000013FCBD000-memory.dmp	xmrig
behavioral1/memory/1016-119-0x000000013F310000-0x000000013F65D000-memory.dmp	xmrig
behavioral1/files/0x000500000001878e-117.dat	xmrig
behavioral1/memory/236-113-0x000000013F090000-0x000000013F3DD000-memory.dmp	xmrig
behavioral1/files/0x0005000000018744-111.dat	xmrig
behavioral1/memory/1144-107-0x000000013FCD0000-0x000000014001D000-memory.dmp	xmrig
behavioral1/files/0x0005000000018739-105.dat	xmrig
behavioral1/memory/560-95-0x000000013F080000-0x000000013F3CD000-memory.dmp	xmrig
behavioral1/files/0x00050000000186f1-93.dat	xmrig
behavioral1/memory/1224-89-0x000000013F440000-0x000000013F78D000-memory.dmp	xmrig
behavioral1/files/0x00050000000186ed-87.dat	xmrig
behavioral1/memory/2616-83-0x000000013F630000-0x000000013F97D000-memory.dmp	xmrig
behavioral1/files/0x00050000000186e7-81.dat	xmrig
behavioral1/files/0x0005000000018686-75.dat	xmrig
behavioral1/files/0x000600000001749c-63.dat	xmrig
behavioral1/files/0x0007000000017049-51.dat	xmrig
behavioral1/files/0x0009000000016d3a-46.dat	xmrig
behavioral1/memory/2728-126-0x000000013FBD0000-0x000000013FF1D000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2056	JHgxkhc.exe
2000	CKbaBPz.exe
904	njHXYeC.exe
2440	WFHFNVt.exe
2132	URnSQTz.exe
2788	YgEFayI.exe
2728	PbigRky.exe
2884	BoYVhIv.exe
2628	UFlRloZ.exe
2768	hYnAkdU.exe
2604	ugniuec.exe
2676	RQQtyjg.exe
2652	oXLarMa.exe
2616	wffAbmk.exe
1224	ZsHVdoA.exe
560	aHliCjA.exe
1980	VZprGAw.exe
1144	kRVqKzG.exe
236	gowoRDC.exe
1016	nTFzuRE.exe
1236	DHZJpOM.exe

Loads dropped DLL 21 IoCs

pid	Process
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\YgEFayI.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\BoYVhIv.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\wffAbmk.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZsHVdoA.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\kRVqKzG.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\CKbaBPz.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\njHXYeC.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\URnSQTz.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\aHliCjA.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\UFlRloZ.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ugniuec.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\RQQtyjg.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\DHZJpOM.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\JHgxkhc.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\WFHFNVt.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\oXLarMa.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\VZprGAw.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\gowoRDC.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nTFzuRE.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\PbigRky.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\hYnAkdU.exe	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2056	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2988 wrote to memory of 2056	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2988 wrote to memory of 2056	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2988 wrote to memory of 2000	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2988 wrote to memory of 2000	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2988 wrote to memory of 2000	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2988 wrote to memory of 904	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2988 wrote to memory of 904	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2988 wrote to memory of 904	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2988 wrote to memory of 2440	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2988 wrote to memory of 2440	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2988 wrote to memory of 2440	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2988 wrote to memory of 2132	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2988 wrote to memory of 2132	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2988 wrote to memory of 2132	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2988 wrote to memory of 2788	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2988 wrote to memory of 2788	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2988 wrote to memory of 2788	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2988 wrote to memory of 2728	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2988 wrote to memory of 2728	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2988 wrote to memory of 2728	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2988 wrote to memory of 2884	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2988 wrote to memory of 2884	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2988 wrote to memory of 2884	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2988 wrote to memory of 2628	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2988 wrote to memory of 2628	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2988 wrote to memory of 2628	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2988 wrote to memory of 2768	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2988 wrote to memory of 2768	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2988 wrote to memory of 2768	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2988 wrote to memory of 2604	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2988 wrote to memory of 2604	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2988 wrote to memory of 2604	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2988 wrote to memory of 2676	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2988 wrote to memory of 2676	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2988 wrote to memory of 2676	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2988 wrote to memory of 2652	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2988 wrote to memory of 2652	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2988 wrote to memory of 2652	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2988 wrote to memory of 2616	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2988 wrote to memory of 2616	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2988 wrote to memory of 2616	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2988 wrote to memory of 1224	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2988 wrote to memory of 1224	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2988 wrote to memory of 1224	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2988 wrote to memory of 560	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2988 wrote to memory of 560	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2988 wrote to memory of 560	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2988 wrote to memory of 1980	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2988 wrote to memory of 1980	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2988 wrote to memory of 1980	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2988 wrote to memory of 1144	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2988 wrote to memory of 1144	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2988 wrote to memory of 1144	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2988 wrote to memory of 236	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2988 wrote to memory of 236	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2988 wrote to memory of 236	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2988 wrote to memory of 1016	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2988 wrote to memory of 1016	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2988 wrote to memory of 1016	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2988 wrote to memory of 1236	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	52
PID 2988 wrote to memory of 1236	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	52
PID 2988 wrote to memory of 1236	2988	2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe	52

C:\Users\Admin\AppData\Local\Temp\2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\System\JHgxkhc.exe
  C:\Windows\System\JHgxkhc.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\CKbaBPz.exe
  C:\Windows\System\CKbaBPz.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\njHXYeC.exe
  C:\Windows\System\njHXYeC.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\WFHFNVt.exe
  C:\Windows\System\WFHFNVt.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\URnSQTz.exe
  C:\Windows\System\URnSQTz.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\YgEFayI.exe
  C:\Windows\System\YgEFayI.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\PbigRky.exe
  C:\Windows\System\PbigRky.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\BoYVhIv.exe
  C:\Windows\System\BoYVhIv.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\UFlRloZ.exe
  C:\Windows\System\UFlRloZ.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\hYnAkdU.exe
  C:\Windows\System\hYnAkdU.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\ugniuec.exe
  C:\Windows\System\ugniuec.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\RQQtyjg.exe
  C:\Windows\System\RQQtyjg.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\oXLarMa.exe
  C:\Windows\System\oXLarMa.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\wffAbmk.exe
  C:\Windows\System\wffAbmk.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\ZsHVdoA.exe
  C:\Windows\System\ZsHVdoA.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\aHliCjA.exe
  C:\Windows\System\aHliCjA.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\VZprGAw.exe
  C:\Windows\System\VZprGAw.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\kRVqKzG.exe
  C:\Windows\System\kRVqKzG.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\gowoRDC.exe
  C:\Windows\System\gowoRDC.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\nTFzuRE.exe
  C:\Windows\System\nTFzuRE.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\DHZJpOM.exe
  C:\Windows\System\DHZJpOM.exe
  2⤵
  - Executes dropped EXE
  PID:1236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BoYVhIv.exe

Filesize
5.7MB

MD5
cccff9b380a789c07abf5597ddbfceb7

SHA1
ee79e8f7ffee199de46fe958214195a90f50ae93

SHA256
99b7d9e6c780a6813a1188a9e8cf7b48d445cc64bb58018d8da9f9596b781242

SHA512
89bbf6c88cfb0c7753a239a64be1b93ef125af915d9704e1269e0cf3cd9bac187b5a6fe8952cc992adf13b1ad3c8300bc107de27730a25de518f8077dfbfcb6b

Download Submit
C:\Windows\system\DHZJpOM.exe

Filesize
5.7MB

MD5
f212ec35b4287ce14d7a805b87459f52

SHA1
71a930c8b1c5b3d97882b01dd07d6dd500f3da00

SHA256
0f3abe2c1c5fd7fc3c7624a9770dceca02444fc485a1a29fc917a0b5ca69b576

SHA512
1b1ef44405b548a262b5363a152c702ec1afc8a6f1beca461724b5892adfabbd7c92afd2489e7d1db0615513992db848ac32a35158ab16b00e8211ccda1f00fe

Download Submit
C:\Windows\system\RQQtyjg.exe

Filesize
5.7MB

MD5
6e3b49419743e57c79e6a78272ab1dd9

SHA1
34c73ab4c0ac6233490d2aca6e1d06e1e505f79c

SHA256
63f1a5e5d8deed4bcd0a720e0fa4f1046498dd86e84c307c87b096363884534a

SHA512
df9630df5f6da81bad18bf5eb29314f672f0f43f1f509172b0646b19de744d6ae25e67b4c40ccb6d49e78b2047f14c30247425a2ab304be60bb6f9ae73532067

Download Submit
C:\Windows\system\UFlRloZ.exe

Filesize
5.7MB

MD5
029219a372c2023cba36796007a4d7cc

SHA1
2b7217ed27071a73e5b65b562b6ee04d63d4a3bc

SHA256
0b47503333e1aa73da15d645631e88b318d7f720f096e3296811ae3ea1d48635

SHA512
f77fde97b5440f5c8690236de74d39ed9d0642e09d3c6b21c85f156e5b9472f830939744659dda7427a70a3a829050f11a1452d3489c4afeac4a12ab76bfa71c

Download Submit
C:\Windows\system\ZsHVdoA.exe

Filesize
5.7MB

MD5
73ea9cce71bd26c3c6ee9c860d7db56a

SHA1
cf8f5c70f08ebd00badada9a5f890a6ef820b797

SHA256
0aafbd62d859f5cb23e6485e3673b3588e8066f95b7941de8368512b340253e1

SHA512
fa9e7d28989969f8882955603649a5bb1151460115d0c865de56c8b62bfe6208e7189394974b72fd0b31c730b58d07c4f11cb8ca85ecda388f0051f77dc71d1d

Download Submit
C:\Windows\system\aHliCjA.exe

Filesize
5.7MB

MD5
54b227c416d27c1316456f46c6cb3ff4

SHA1
61bbb0bd4dd34d6270050ade1970a4447ace9fc0

SHA256
4495d7298f2a39da6f894aabbadfa44dc215fa8055060c96122e5971fd0354ab

SHA512
34f02275832864630542f79cac35d8d5dae58d0ea7b26a7d95e48112b045fbbb67862cbf59db5eae7b31afd0f219ea8aadf5d3e05e5acd0b4364ce25cebcc95c

Download Submit
C:\Windows\system\gowoRDC.exe

Filesize
5.7MB

MD5
0702563ab6c39e700736496fd306c3cf

SHA1
ee2239be7fdfc283e3760ce8e3fc87957d7004cf

SHA256
e524806eac4f055789e0fe525d03958ae748d9f31e3f38bb313f277253ce6258

SHA512
9d2e8039049dde35b7e98234f00c83df0948a521afb5404222b3b9eda8f83155ac684002c9fdd3900b1c5cc53510ad11281cd7335ce49f0cc8b3e38f1491673d

Download Submit
C:\Windows\system\hYnAkdU.exe

Filesize
5.7MB

MD5
84986cdb647ee26dbd2a144b6f746e7d

SHA1
ec13b663c8b340c9daf14c22cb4f12ae46cd6b12

SHA256
d09fb2678a83b601b8081da5bf4fa6fd1d3363c3726c584d103caad2db837d72

SHA512
41e14010aa25e454f1717da57ae8a411e77b7acbc323c3ff5da2c7476ace33f593f9b4c1b75204d4193e9d72631a66a703bf81e81d4f6d306310ede0ac2b5a9e

Download Submit
C:\Windows\system\kRVqKzG.exe

Filesize
5.7MB

MD5
fca02f90a068b770ab6513c30b73e355

SHA1
77cf5bfd0edbea7337b32f96502a02bc280ea80a

SHA256
c33ab110d65fe5aa44dd92c38224c7a7b45aae51878ea6d82b14f219571af56c

SHA512
cd848ca3a3e7807f304a7a60d5da964270f212b271accd63bc8fd6790d6da77e728715a54c183cd41078e69f6c80f4c32ae98a4727f6ad18a4ba0ef26d301ea9

Download Submit
C:\Windows\system\nTFzuRE.exe

Filesize
5.7MB

MD5
51493903e98fa094aec034beb0edc87b

SHA1
96b6507cae901533f02022b9c52d33453727b20c

SHA256
22d8e483e640fbcce1ee222e3bacceb710093d9544310efbd3317085ff341bbf

SHA512
8e63842b6a937fb82ab3bef0c73b5661430b4bf95fad5e836e803a1aa0bafec5bb141290c4b8c99f088a26c4b564c1ebad3c0b1102ad9564545279dabff4887b

Download Submit
C:\Windows\system\oXLarMa.exe

Filesize
5.7MB

MD5
c2f04857c113eee9ce2afa54f0bca488

SHA1
73b0a496d1336f2a070446959cd6ccf09d9ad568

SHA256
99d830bfa0b8d7093f021d85e82b958d0cb8d0374ed9ff1dff7a7642cc03a013

SHA512
df78af1595a1dfeaeaaf20fbcd6ecf3c126e9c2919905a19847e5edabc3f52ad27c4fa3966156454e44e7913fe632cbabc32a808a30e0f8323ed930a439ade11

Download Submit
C:\Windows\system\ugniuec.exe

Filesize
5.7MB

MD5
cad38a987ee7793fd6a8526294a8234d

SHA1
6564e10b29e7f999b9a6aca02485578690cbfd3b

SHA256
e87453b1cdbebc8f89a6f95ea3b28ea0eab2d85d98706b65e0fa4121b3e5974d

SHA512
d534684fa45b41186bc8bf83742f6a3448e1931ce38ec985b4722e80ec37d62a63af37d776e4c38d31b98b4a59f311e3e553dbf4533dcaa405b34360f2a6038e

Download Submit
C:\Windows\system\wffAbmk.exe

Filesize
5.7MB

MD5
d5fa9e91f768342eafde9ef2251a55d7

SHA1
699131c68d4663d705fb36f3433d7dfaa7f6ccfe

SHA256
ea0bc42f3d0e420fec09850faebc35b555960d5db721175bc8cfc85d61ef6003

SHA512
6386501d62c74978fe84acd629c2b058b4dce7604f3f214615f36b99a8660430ff5e6b34caeb38495df2601eeb595bc7ce8d59dd88a681a15f98617de9fec61b

Download Submit
\Windows\system\CKbaBPz.exe

Filesize
5.7MB

MD5
5b1fd07b30538f09bfe1c1fd60039f96

SHA1
6c6b6f2a62d7a366208bb2c446274ef21c13f30f

SHA256
ade0139561f5461078b19964627c9642e7abf1257b994d2ffd6baa6dcb25f449

SHA512
11667395bea8381c34362754b92692998c5722dcabac99664d2dbf3998b698f5b46b79c9182608dfbc830de1cbbb634529854dd648e67298d2b1bd47e75030f7

Download Submit
\Windows\system\JHgxkhc.exe

Filesize
5.7MB

MD5
cc2c42f33c5c74cb6cfeb3e27fdf95ff

SHA1
df64e3c53d146502abc99cfdf46f8cbcba35783b

SHA256
4dfa32d762d1384a3804efaf641e478a2c6b528f6837ec16e69ce5ddbc1f70a2

SHA512
f248e998a889a1bc882c3695a5993f35929bdfaa98ee5b8df017581c4e0df4cd513c81adc6f8c9af05a159f731b8123603d21d5a4c3df689efa9a11adf782e77

Download Submit
\Windows\system\PbigRky.exe

Filesize
5.7MB

MD5
3f20f49d7e80960640d51a36681300b7

SHA1
3e9356d63172e5f59266d2ef52e27aaa4e54206f

SHA256
afb996c0b5f26f2c61716bd13dd3c76c10f06fe9653bf3313f99cf28ed63ad7b

SHA512
e2e1afc39083a0d17c59e7be8a5e0b2923465f58861e5a8357847bf01b8fd6b0f968d6daed1a52ea6b27aea2f327fc25855022dd489cbf8e4a0e0334e7c08d2e

Download Submit
\Windows\system\URnSQTz.exe

Filesize
5.7MB

MD5
2e1174464d9c3dfe641f5de81f931768

SHA1
f163c64b6a9bbc8d1ed1e42686d1a0f77314a92a

SHA256
1fef1238179c32397814df5d1590928f4018a2f9250b7d7f17800aee903cfd0f

SHA512
1a4e5d9eb5402a1ec7c5b89e279757f35498daa2d36449203e2e498e3b7b1c2025aaec61cfe46b518dbfd74529b6ad03b1e318821d784e62ac6a4f98ad92b8d2

Download Submit
\Windows\system\VZprGAw.exe

Filesize
5.7MB

MD5
530bbd91054a1a1939db48aa0dbe4a33

SHA1
6e0a279a76cf984afa7826f9addc43ceb2a777f9

SHA256
698e6e7fb76ff38066031abbd693ee40cb29dfdd45b9f06d0c00cf2df6106ba5

SHA512
52f9c611d88aa610c1729f2b6aa2f5dcdee040c5f16f8e66b87cb18022c3ac5d09dc0417f5e5dafab092aeb15fcf15de1de0903c6439c08b2d5fbb3afea0c3bd

Download Submit
\Windows\system\WFHFNVt.exe

Filesize
5.7MB

MD5
3c511338895f8c9279fea096ffc0144e

SHA1
a1cfb479a8eec487ad8869abfce9c2512b39d9c8

SHA256
d0195703343f09e4f393a695d8e94f06738de4760164b9a249ecd6c505fb0892

SHA512
da5317d6d24bf5f6c736f339640ac870992852c847e4dd693f36be507bf9eb54efe21166f6f50c5952a39779d1788513481e8c4bdca494c80c66fb0c63a00d5c

Download Submit
\Windows\system\YgEFayI.exe

Filesize
5.7MB

MD5
6d7017ad2256310658489d5cca854be2

SHA1
94446a50bcfdc28549872a1a6979302ce19c5bc7

SHA256
fcfdda7e8f65f484aea04537b92aa6efa69151963ae10dc9f7bbcfdd9f834f49

SHA512
08959b943e7da2dd1a2ad072aae0c02c9cb8f38d4f9c405946471d26b63078995f974e61725cac404472d4db2a704f190e0b23f95ded264a0c566121a3d9df9f

Download Submit
\Windows\system\njHXYeC.exe

Filesize
5.7MB

MD5
8d382fc84fba1ca20c58de487b27742e

SHA1
92be67deea5b55f9bf797fab09f07ebd12d48de9

SHA256
f6e3db2a65e579cfb67469bc1cb0bcd9dea3f600e6d6e25b880f664d2a39648d

SHA512
02064d1e091ef5be44bcfd589bfaf2ad747f6af649ae9aa0df5b9138efd06d12a0f065cec875085547167ba330ef157443beeb2e9758ecaa382f9b9fab148bf5

Download Submit
memory/236-113-0x000000013F090000-0x000000013F3DD000-memory.dmp

Filesize
3.3MB

Download
memory/560-95-0x000000013F080000-0x000000013F3CD000-memory.dmp

Filesize
3.3MB

Download
memory/904-17-0x000000013F360000-0x000000013F6AD000-memory.dmp

Filesize
3.3MB

Download
memory/1016-119-0x000000013F310000-0x000000013F65D000-memory.dmp

Filesize
3.3MB

Download
memory/1144-107-0x000000013FCD0000-0x000000014001D000-memory.dmp

Filesize
3.3MB

Download
memory/1224-89-0x000000013F440000-0x000000013F78D000-memory.dmp

Filesize
3.3MB

Download
memory/1236-124-0x000000013F970000-0x000000013FCBD000-memory.dmp

Filesize
3.3MB

Download
memory/1980-101-0x000000013FB80000-0x000000013FECD000-memory.dmp

Filesize
3.3MB

Download
memory/2000-14-0x000000013FBB0000-0x000000013FEFD000-memory.dmp

Filesize
3.3MB

Download
memory/2056-7-0x000000013FA70000-0x000000013FDBD000-memory.dmp

Filesize
3.3MB

Download
memory/2132-35-0x000000013F240000-0x000000013F58D000-memory.dmp

Filesize
3.3MB

Download
memory/2440-25-0x000000013F5B0000-0x000000013F8FD000-memory.dmp

Filesize
3.3MB

Download
memory/2604-65-0x000000013FB40000-0x000000013FE8D000-memory.dmp

Filesize
3.3MB

Download
memory/2616-83-0x000000013F630000-0x000000013F97D000-memory.dmp

Filesize
3.3MB

Download
memory/2628-53-0x000000013F580000-0x000000013F8CD000-memory.dmp

Filesize
3.3MB

Download
memory/2652-77-0x000000013F8E0000-0x000000013FC2D000-memory.dmp

Filesize
3.3MB

Download
memory/2728-126-0x000000013FBD0000-0x000000013FF1D000-memory.dmp

Filesize
3.3MB

Download
memory/2768-59-0x000000013F270000-0x000000013F5BD000-memory.dmp

Filesize
3.3MB

Download
memory/2788-36-0x000000013FD00000-0x000000014004D000-memory.dmp

Filesize
3.3MB

Download
memory/2884-47-0x000000013F960000-0x000000013FCAD000-memory.dmp

Filesize
3.3MB

Download
memory/2988-0-0x000000013FE60000-0x00000001401AD000-memory.dmp

Filesize
3.3MB

Download
memory/2988-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download