cobaltstrike | 586fc747b5b6918aa0670236f070a330751402d1c911a3c3ab76f5032b57239e

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

5d0086a515c7ecf960c42648cfa9ff18
SHA1

94271bf8994e303b90c71978bf49107306c39893
SHA256

586fc747b5b6918aa0670236f070a330751402d1c911a3c3ab76f5032b57239e
SHA512

065a5fd063d36583b7dcf8557ffc8d05068f9a6b4f735a92c13129184dab1ea8edaf89007bb945e236fcc5e651d429d927c0a64ecad373325beb98af3e5577a3
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUz:j+R56utgpPF8u/7z

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023c8f-5.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023c93-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023c94-17.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023c95-24.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023c96-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023c97-35.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023c90-42.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023c98-48.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023c99-55.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023c9b-58.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023c9d-72.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023c9e-77.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023c9f-82.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023ca0-85.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023ca3-100.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023ca1-92.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023c9c-66.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023ca2-109.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023ca4-123.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023ca6-118.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023ca5-117.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/5076-0-0x00007FF651D00000-0x00007FF65204D000-memory.dmp	xmrig
behavioral2/files/0x0008000000023c8f-5.dat	xmrig
behavioral2/files/0x0007000000023c93-11.dat	xmrig
behavioral2/files/0x0007000000023c94-17.dat	xmrig
behavioral2/memory/2464-13-0x00007FF755790000-0x00007FF755ADD000-memory.dmp	xmrig
behavioral2/memory/356-25-0x00007FF7B4C70000-0x00007FF7B4FBD000-memory.dmp	xmrig
behavioral2/files/0x0007000000023c95-24.dat	xmrig
behavioral2/memory/3348-21-0x00007FF64E7A0000-0x00007FF64EAED000-memory.dmp	xmrig
behavioral2/memory/3056-7-0x00007FF6B2D60000-0x00007FF6B30AD000-memory.dmp	xmrig
behavioral2/files/0x0007000000023c96-28.dat	xmrig
behavioral2/memory/2788-31-0x00007FF7DAA00000-0x00007FF7DAD4D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023c97-35.dat	xmrig
behavioral2/memory/2112-37-0x00007FF731130000-0x00007FF73147D000-memory.dmp	xmrig
behavioral2/files/0x0008000000023c90-42.dat	xmrig
behavioral2/memory/3904-43-0x00007FF6904A0000-0x00007FF6907ED000-memory.dmp	xmrig
behavioral2/files/0x0007000000023c98-48.dat	xmrig
behavioral2/memory/2980-49-0x00007FF720320000-0x00007FF72066D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023c99-55.dat	xmrig
behavioral2/files/0x0007000000023c9b-58.dat	xmrig
behavioral2/memory/4960-67-0x00007FF6A9340000-0x00007FF6A968D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023c9d-72.dat	xmrig
behavioral2/memory/1916-73-0x00007FF708FA0000-0x00007FF7092ED000-memory.dmp	xmrig
behavioral2/files/0x0007000000023c9e-77.dat	xmrig
behavioral2/files/0x0007000000023c9f-82.dat	xmrig
behavioral2/files/0x0007000000023ca0-85.dat	xmrig
behavioral2/files/0x0007000000023ca3-100.dat	xmrig
behavioral2/memory/2032-94-0x00007FF761680000-0x00007FF7619CD000-memory.dmp	xmrig
behavioral2/files/0x0007000000023ca1-92.dat	xmrig
behavioral2/memory/304-90-0x00007FF6A9CE0000-0x00007FF6AA02D000-memory.dmp	xmrig
behavioral2/memory/5072-80-0x00007FF6EF7F0000-0x00007FF6EFB3D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023c9c-66.dat	xmrig
behavioral2/memory/4888-64-0x00007FF7DAE90000-0x00007FF7DB1DD000-memory.dmp	xmrig
behavioral2/memory/3388-57-0x00007FF739610000-0x00007FF73995D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023ca2-109.dat	xmrig
behavioral2/memory/1812-119-0x00007FF72F4D0000-0x00007FF72F81D000-memory.dmp	xmrig
behavioral2/memory/2372-120-0x00007FF6A8100000-0x00007FF6A844D000-memory.dmp	xmrig
behavioral2/memory/2096-126-0x00007FF6B7470000-0x00007FF6B77BD000-memory.dmp	xmrig
behavioral2/files/0x0007000000023ca4-123.dat	xmrig
behavioral2/files/0x0007000000023ca6-118.dat	xmrig
behavioral2/files/0x0007000000023ca5-117.dat	xmrig
behavioral2/memory/2604-111-0x00007FF7DF130000-0x00007FF7DF47D000-memory.dmp	xmrig
behavioral2/memory/3492-110-0x00007FF729930000-0x00007FF729C7D000-memory.dmp	xmrig
behavioral2/memory/4300-124-0x00007FF6585E0000-0x00007FF65892D000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3056	axXOUTR.exe
2464	BUVXGSD.exe
3348	LKJMoXY.exe
356	qptXZDX.exe
2788	RtqTHmj.exe
2112	hAHmQXR.exe
3904	mzZXYlb.exe
2980	QvvOdwD.exe
3388	FcnXLdc.exe
4888	uofnZCh.exe
4960	WUkoVJr.exe
1916	OvZBNck.exe
5072	WHtBDlE.exe
304	eYlLRjg.exe
2032	nECqiYr.exe
2604	PIZxdju.exe
2096	HayxWzY.exe
3492	KIwJrcV.exe
4300	iBJGaKw.exe
1812	LhwJAis.exe
2372	yhgMpNK.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\FcnXLdc.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uofnZCh.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\WUkoVJr.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\WHtBDlE.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\eYlLRjg.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nECqiYr.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KIwJrcV.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\RtqTHmj.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\qptXZDX.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\QvvOdwD.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\LhwJAis.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\LKJMoXY.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\hAHmQXR.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\mzZXYlb.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\iBJGaKw.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\axXOUTR.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\OvZBNck.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\PIZxdju.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HayxWzY.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\yhgMpNK.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\BUVXGSD.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3056	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	83
PID 5076 wrote to memory of 3056	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	83
PID 5076 wrote to memory of 2464	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 5076 wrote to memory of 2464	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 5076 wrote to memory of 3348	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 5076 wrote to memory of 3348	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 5076 wrote to memory of 356	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 5076 wrote to memory of 356	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 5076 wrote to memory of 2788	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 5076 wrote to memory of 2788	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 5076 wrote to memory of 2112	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 5076 wrote to memory of 2112	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 5076 wrote to memory of 3904	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 5076 wrote to memory of 3904	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 5076 wrote to memory of 2980	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 5076 wrote to memory of 2980	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 5076 wrote to memory of 3388	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 5076 wrote to memory of 3388	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 5076 wrote to memory of 4888	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 5076 wrote to memory of 4888	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 5076 wrote to memory of 4960	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 5076 wrote to memory of 4960	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 5076 wrote to memory of 1916	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 5076 wrote to memory of 1916	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 5076 wrote to memory of 5072	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 5076 wrote to memory of 5072	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 5076 wrote to memory of 304	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 5076 wrote to memory of 304	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 5076 wrote to memory of 2032	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 5076 wrote to memory of 2032	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 5076 wrote to memory of 2604	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 5076 wrote to memory of 2604	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 5076 wrote to memory of 3492	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 5076 wrote to memory of 3492	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 5076 wrote to memory of 2096	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 5076 wrote to memory of 2096	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 5076 wrote to memory of 4300	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 5076 wrote to memory of 4300	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 5076 wrote to memory of 1812	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 5076 wrote to memory of 1812	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 5076 wrote to memory of 2372	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 5076 wrote to memory of 2372	5076	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	103

C:\Users\Admin\AppData\Local\Temp\2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\System\axXOUTR.exe
  C:\Windows\System\axXOUTR.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\BUVXGSD.exe
  C:\Windows\System\BUVXGSD.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\LKJMoXY.exe
  C:\Windows\System\LKJMoXY.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\qptXZDX.exe
  C:\Windows\System\qptXZDX.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\RtqTHmj.exe
  C:\Windows\System\RtqTHmj.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\hAHmQXR.exe
  C:\Windows\System\hAHmQXR.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\mzZXYlb.exe
  C:\Windows\System\mzZXYlb.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\QvvOdwD.exe
  C:\Windows\System\QvvOdwD.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\FcnXLdc.exe
  C:\Windows\System\FcnXLdc.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\uofnZCh.exe
  C:\Windows\System\uofnZCh.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\WUkoVJr.exe
  C:\Windows\System\WUkoVJr.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\OvZBNck.exe
  C:\Windows\System\OvZBNck.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\WHtBDlE.exe
  C:\Windows\System\WHtBDlE.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\eYlLRjg.exe
  C:\Windows\System\eYlLRjg.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\nECqiYr.exe
  C:\Windows\System\nECqiYr.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\PIZxdju.exe
  C:\Windows\System\PIZxdju.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\KIwJrcV.exe
  C:\Windows\System\KIwJrcV.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\HayxWzY.exe
  C:\Windows\System\HayxWzY.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\iBJGaKw.exe
  C:\Windows\System\iBJGaKw.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\LhwJAis.exe
  C:\Windows\System\LhwJAis.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\yhgMpNK.exe
  C:\Windows\System\yhgMpNK.exe
  2⤵
  - Executes dropped EXE
  PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BUVXGSD.exe

Filesize
5.7MB

MD5
8de85ff525fb6789d1f1fc08141a7b21

SHA1
69de1be01334beec077a9ee5196c424d5dbfc30f

SHA256
e499c117b6fe2a4c63301adeea9f0d9af6593f1d12a9efa647276579a8207dc7

SHA512
7ee51f6663b0f1baa29098d1fd18d5a64311b96b73bf67430a292dc74fc84a112f8543deef1cc364fc5376e8fadb7eb8c65fe4098d7df9289b20cb9293476191

Download Submit
C:\Windows\System\FcnXLdc.exe

Filesize
5.7MB

MD5
39d0c6838ae16be15c536be5ab6025a3

SHA1
4057c67080f3982da63cd341a26aebbb6066e994

SHA256
d746b4924869835d95166bc0c1f6a950ddc69600589b2559857c4426264d2a9f

SHA512
ceeea82a989ebd6d7d31811898b8e3deb7128c96f372aad4c473e727aca22c39535a3ded141ea589a7adf29863206d14ea22724c423a80ebe14e6f1d3a28b5fd

Download Submit
C:\Windows\System\HayxWzY.exe

Filesize
5.7MB

MD5
60eab0b636c5451d8930dda59aed5d62

SHA1
52b19cbadc9d77cc1a6dc8396b813ed197ced1ec

SHA256
278ce8d136e7568b06508fabd5be7dac053ea797e7df1ce73097a53cc409cbfc

SHA512
e8d736340f10b0480bd8593109b9dc5c3d0a55224ee7f211d5bbfa9e03dffbaf1c3dfcb5279085196434eb7645963b86ba58abed4d9e125935580728429d5216

Download Submit
C:\Windows\System\KIwJrcV.exe

Filesize
5.7MB

MD5
d761a7596b12182fba572e2dfb93c478

SHA1
d50ed3745bcefd89a3f8d79f297b6209bc4ea5b0

SHA256
9c734f3cf2a858dac2520bd79972736b7f726ad2095f56d29b8579526efb04cf

SHA512
83787fa55d62d2defe49b2b2302b62286476fc32c7579db796d3d016c9577c22864744ea2fc05b992ed41e5425a696c5a058dddd2d697593a9017434718777bf

Download Submit
C:\Windows\System\LKJMoXY.exe

Filesize
5.7MB

MD5
fc1b637ae748082b8867dd15bddc91ef

SHA1
2b83032a6a54c5c1945eb6ab8ee0b4699db132ff

SHA256
225920bd202070fe808ffa5aebe9815b76249e0f99e2df99c79d5da02637308b

SHA512
174277b525f1e8d74a0c5b462f3e5b7e3d44c7fe88c28f566587a7f6f14e1a8b321b59178bad0a18b0fc1d9cca0f6bb0d7d6e22acc5bbd1a5925cfa01c2226d8

Download Submit
C:\Windows\System\LhwJAis.exe

Filesize
5.7MB

MD5
e8f0d6afa989a329407267dd021774ed

SHA1
1ecb8cf6da6ad267ffa3f3ac46bbc9154f1cd615

SHA256
5780ee5b45521f49eaa469cdcec0484a28d050a3a80ec96e8e7ee4d4f9f5ea36

SHA512
b9ba0e718a9638ef13e591c42b17aca648a0aa831dda13280a54270407e8357a083a578b7a012ef26df93c09ad8058f2d98d394f967e232d3c7b961744bb2274

Download Submit
C:\Windows\System\OvZBNck.exe

Filesize
5.7MB

MD5
0487b8c68b9a8c20cb87327fb07a55b1

SHA1
e4da8a1d6f4262a6aadc08e6fbcff4dfb1c5342a

SHA256
cfc807d62e0b9c7daa953a2e6ebae435950bb10dfc68b708b4ce5f6f708afac7

SHA512
f52620c17f12da3f63ee6373569a866eb58e1b1d69e0ea5d7ca16fe31bfb6a11f86083aefdd4e2e01984030be9fdd86ca1b17edae3641c82bf9fffd9d2b27c6b

Download Submit
C:\Windows\System\PIZxdju.exe

Filesize
5.7MB

MD5
0eab99c074681821077e158eb1db1200

SHA1
b487be0a0e10a0bb9f9cbfce47ae37b1bcee8f63

SHA256
7e1d667d2a7a2c6370ae3f28f67576261ee0da31f1b75e374a87b13aa07d18ea

SHA512
62c9e32c1024071344f98fcb6b59a2455b6ce959a6c758ac81ba63b5d0068fe35301687bb9568d59b279c3d43387baf42009036ec77d1cfaf731fb94b1e8380c

Download Submit
C:\Windows\System\QvvOdwD.exe

Filesize
5.7MB

MD5
0eba12abc4e3d3351d122a17ff60e9f1

SHA1
dc8c4b422cc235275005bf3baddc095fa03c9818

SHA256
49c1d64e9a06596ce530f0eada4100393e8b952c1d4298446959c684e3d21791

SHA512
7b175295d69452cda4da194b2e012d1fad664826e0bb780c22c6a5aeeaab113628bd6204ca829a244ce5db533787572fc52649d2b62b03cc00475ad167d3b3fb

Download Submit
C:\Windows\System\RtqTHmj.exe

Filesize
5.7MB

MD5
6b67792c95d9c97d96e9e80185c2678b

SHA1
77f714c576235dddcbafee07c21d6da86ffaed5e

SHA256
0f4df9524137ccb3a11e4df985299723e512ad7480b56253bcaa664d6b4c7234

SHA512
275a227689aba3b11fe329553b01bc0b615d226363826324de4d6d4aedcf67f015b14e2a74981e32f329ff8aa2ba54bff67e7dc96a2614ea8caeff5796b43a20

Download Submit
C:\Windows\System\WHtBDlE.exe

Filesize
5.7MB

MD5
9bc459398ca705b9f2a9313b98aa3225

SHA1
c7ee5588f03f94582a1526b83781383793818a87

SHA256
444abfe04818113f9a20b98f6e4eb945d9f42b2c52e2999eb0270bde8178fd7e

SHA512
b79bd7f4141bddb1b344082a5e63b059eb8b5d5a7c6f63f32b1b4439d982518bce7aaf8ed2226004dc96bb66967a99cb0e2d16255f93148ba1edaeff505ca20a

Download Submit
C:\Windows\System\WUkoVJr.exe

Filesize
5.7MB

MD5
2bc76c08bc5e631f711bcbe33b656c8d

SHA1
198546954abbf1c91398c34b74f518e12d88ec01

SHA256
233de0205a18bd707bc090bae2e856c63307728591d7dbc5b7c5c1511a97985e

SHA512
46feb7de746af88c5d9009333220680593ef2cfa0610a958b4e605b513eac7bea603f69ae6bf6414ad54d83357a4f678c42a8bb981eb0f48c971871d276062eb

Download Submit
C:\Windows\System\axXOUTR.exe

Filesize
5.7MB

MD5
1c65359c10a5d671b9a47d62d81c91db

SHA1
7cdde5be53dee67c5eedc38eae1c48b33c0b16e1

SHA256
4c37d7e0896a65fb2e52f2feb0146a3968c674a020b6ed921b4a184a55650e91

SHA512
b31f7f5376cd7e6d5fc0475b3e84504afa7518ee176c6ad3ce0439f0913996329de46fa491ea561090e298c95ffa14ffe3baf3c7bf12f00cb11f54e307372c85

Download Submit
C:\Windows\System\eYlLRjg.exe

Filesize
5.7MB

MD5
cd1adde8c2f493c35fcf61577a19b6cb

SHA1
d47aa5b8e76475624657bd7eb08043f77db65708

SHA256
7cdb13344dc8e3cbd148864416e8a58107e8de3ccefdfb0455c783bc2d2d0daf

SHA512
599564468ccac860472895c5ecbb84093604647644b0696076db4e607dee03dc6b7db6953753f7dc3f4d46174c946dfeb37c5a7d2e9364793743bdf17d21e0d4

Download Submit
C:\Windows\System\hAHmQXR.exe

Filesize
5.7MB

MD5
fb02ce6fcdd62f10b7e92ff0e51cd2c4

SHA1
d9b5ad4fd5ddd896aa6e4db0fe66e3bf0a6323da

SHA256
8a09186e8970c78a2567ed6224ecab7bd22fcb6438ab2e0254b4dc0c10b93e9b

SHA512
28ab3e0643bcbf34541b9cf2cb42dec8ba4e664ff7c750a18f2131b07adb131393ced088a357d83b3c9bc5b53806fb3a72d2d961c6627ff7c43f23d859923f3e

Download Submit
C:\Windows\System\iBJGaKw.exe

Filesize
5.7MB

MD5
db600bfab1eb4f4079dd0f2aba563896

SHA1
4f05c60caac40cf0f4d4b6f83376363ca01c2fe7

SHA256
5fac6e7164ceceb74e11033d52817f2ff2db213edb63e7086f7d53ec55d65d04

SHA512
00698d698e4922b599a7ef123515e061e79f1eaf0a141c1e0932316dfd96d05c8e2ebad6ba6d77185efba6aceb520485e1b9b7750f960dfc96274f92c097d3eb

Download Submit
C:\Windows\System\mzZXYlb.exe

Filesize
5.7MB

MD5
9b8d5aa5e1931f76514cab194b720d04

SHA1
bea1742823cb7ea7f8a0bb19cddb108043b3ed31

SHA256
c15e122a9cb2aebb80b58210d5d6f51c54f5636825267d38775184669626bb91

SHA512
c7b7ee97c2fe04d088f04d8fdf3a4f7bdcfd7440b12130746f048d6cf9a6914859976d4b9306ea448f1e40893b6147b0a5063a790040b1dde8dc122539e85344

Download Submit
C:\Windows\System\nECqiYr.exe

Filesize
5.7MB

MD5
b1cba1342a49491442abed7a8430b45b

SHA1
b8d675e8e05946b587a520221ff7ae5528ecf966

SHA256
f75c44f71257ca7e9ad33370c23fff1fbd3038658124ab3369aee5a94ab5bad7

SHA512
8a28c08eeac99cdf06cdede7210134a1f84bbe5aae011bcb41e9403b71dcf42da62762d9f8fa578103c3d5d3309e47891fa4e44db6b4159e0b1ddef3ac494dfa

Download Submit
C:\Windows\System\qptXZDX.exe

Filesize
5.7MB

MD5
4a0a440202fac01478771861476b7dcd

SHA1
343421b35ff5ad484c417950bc46a1895ca35659

SHA256
05d8b6ea6521516ddf22376dcf1acfdd26e5160690b2b49848a82aa22a233cf2

SHA512
d1aa7724c00ea0c5810df0e800c5777a4ee6921d6fc9ce4e53d8ac4910289d9c224190a6352fc26acd33f6d7338e8fb7ca1cc9b490c07177d32efe65b414b462

Download Submit
C:\Windows\System\uofnZCh.exe

Filesize
5.7MB

MD5
80511a58a178fb0acfa87df856b9186a

SHA1
0584bbe8b0ea22974b003e038611a39a706134e4

SHA256
0e016ddc05a659eb9f18798ce82b75700d1ad4546326a5d2d29e103dedcbdff9

SHA512
7d8cec57a4948d640e04ab7d3ac59e2f77b1073a8cf6b276243652dd849d5172b77f1956432f8862d346e04a897c90cb1695ab208acc8bfaace3719d5a847ada

Download Submit
C:\Windows\System\yhgMpNK.exe

Filesize
5.7MB

MD5
6cad4fd91603e43d55c752e1305e06e1

SHA1
bafe0dba4c0ca01c06ae2ccba242099e91e75589

SHA256
6a727c1cae24c7902329e2e128fa5764a908ca371d0811cd5d2100e3461a078a

SHA512
8a6e6adaa317dce80aad2e2e825efaf0d1b4d91c89d3c900245d521e011a678aee99eb81670081f911e394d530b39c477d7e7b8cdd3f05d60aa56180622bcda9

Download Submit
memory/304-90-0x00007FF6A9CE0000-0x00007FF6AA02D000-memory.dmp

Filesize
3.3MB

Download
memory/356-25-0x00007FF7B4C70000-0x00007FF7B4FBD000-memory.dmp

Filesize
3.3MB

Download
memory/1812-119-0x00007FF72F4D0000-0x00007FF72F81D000-memory.dmp

Filesize
3.3MB

Download
memory/1916-73-0x00007FF708FA0000-0x00007FF7092ED000-memory.dmp

Filesize
3.3MB

Download
memory/2032-94-0x00007FF761680000-0x00007FF7619CD000-memory.dmp

Filesize
3.3MB

Download
memory/2096-126-0x00007FF6B7470000-0x00007FF6B77BD000-memory.dmp

Filesize
3.3MB

Download
memory/2112-37-0x00007FF731130000-0x00007FF73147D000-memory.dmp

Filesize
3.3MB

Download
memory/2372-120-0x00007FF6A8100000-0x00007FF6A844D000-memory.dmp

Filesize
3.3MB

Download
memory/2464-13-0x00007FF755790000-0x00007FF755ADD000-memory.dmp

Filesize
3.3MB

Download
memory/2604-111-0x00007FF7DF130000-0x00007FF7DF47D000-memory.dmp

Filesize
3.3MB

Download
memory/2788-31-0x00007FF7DAA00000-0x00007FF7DAD4D000-memory.dmp

Filesize
3.3MB

Download
memory/2980-49-0x00007FF720320000-0x00007FF72066D000-memory.dmp

Filesize
3.3MB

Download
memory/3056-7-0x00007FF6B2D60000-0x00007FF6B30AD000-memory.dmp

Filesize
3.3MB

Download
memory/3348-21-0x00007FF64E7A0000-0x00007FF64EAED000-memory.dmp

Filesize
3.3MB

Download
memory/3388-57-0x00007FF739610000-0x00007FF73995D000-memory.dmp

Filesize
3.3MB

Download
memory/3492-110-0x00007FF729930000-0x00007FF729C7D000-memory.dmp

Filesize
3.3MB

Download
memory/3904-43-0x00007FF6904A0000-0x00007FF6907ED000-memory.dmp

Filesize
3.3MB

Download
memory/4300-124-0x00007FF6585E0000-0x00007FF65892D000-memory.dmp

Filesize
3.3MB

Download
memory/4888-64-0x00007FF7DAE90000-0x00007FF7DB1DD000-memory.dmp

Filesize
3.3MB

Download
memory/4960-67-0x00007FF6A9340000-0x00007FF6A968D000-memory.dmp

Filesize
3.3MB

Download
memory/5072-80-0x00007FF6EF7F0000-0x00007FF6EFB3D000-memory.dmp

Filesize
3.3MB

Download
memory/5076-1-0x00000137FAC90000-0x00000137FACA0000-memory.dmp

Filesize
64KB

Download
memory/5076-0-0x00007FF651D00000-0x00007FF65204D000-memory.dmp

Filesize
3.3MB

Download