Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
03/07/2024, 07:47
General
-
Target
2024-07-03_32749dea18a574efe9e6cb6825051e93_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
32749dea18a574efe9e6cb6825051e93
-
SHA1
d5f5344a2ddeecfd66e5c0fa005c8800ef785502
-
SHA256
17599344f8771ed8185b2ffc42c41a4a1867a7fa85db1aad55edf711880fafd1
-
SHA512
0879f5cefd71613718d30b8e9d7d7493e14128f0e7ca261e441e4a1991c01e445f3181efaa889223c335c1eaf36a5b0c657882e045a526fb1f330c6387477593
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_32749dea18a574efe9e6cb6825051e93_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_32749dea18a574efe9e6cb6825051e93_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QThtvZW.exeC:\Windows\System\QThtvZW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zWgIjsV.exeC:\Windows\System\zWgIjsV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OUPkzuy.exeC:\Windows\System\OUPkzuy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NjikMhV.exeC:\Windows\System\NjikMhV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZVmoiEj.exeC:\Windows\System\ZVmoiEj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yRVztiW.exeC:\Windows\System\yRVztiW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nTgxBfc.exeC:\Windows\System\nTgxBfc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QhxfcDq.exeC:\Windows\System\QhxfcDq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWmuQre.exeC:\Windows\System\tWmuQre.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wKgSIZq.exeC:\Windows\System\wKgSIZq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mcRaOUF.exeC:\Windows\System\mcRaOUF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xEGOuDM.exeC:\Windows\System\xEGOuDM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qBmBgvs.exeC:\Windows\System\qBmBgvs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gdFOECB.exeC:\Windows\System\gdFOECB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SuGkimT.exeC:\Windows\System\SuGkimT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NEsFXwQ.exeC:\Windows\System\NEsFXwQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HKFFCeQ.exeC:\Windows\System\HKFFCeQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gWWfsxz.exeC:\Windows\System\gWWfsxz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWqGCyC.exeC:\Windows\System\SWqGCyC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\plxoWmZ.exeC:\Windows\System\plxoWmZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CMukjJG.exeC:\Windows\System\CMukjJG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5a3aefbb27f91e76dffdd938ed2cd0a1b
SHA173fb9e94ba3b2212e5eb3090df941ed52648b3c7
SHA256e1ac8f9c99c692c158a9ec9998bafb8528ca7be80009b9452d9f85a23e96a80c
SHA512a6b7a54d8caa7f70053ecf76b3a495a25c45fe5521fa734aab70d0e0b772cd44142e502618e65bf26b49f8592dbfe9d4e1c2d5b6dffe91bcbdf27e432b5c5d9c
-
Filesize
5.9MB
MD5f015e8082a8637824239552820922e4e
SHA1467eb4c46414ee5dc28a6f03f50af84725ec633b
SHA2560ac6c7d0ed54948abca0114c9e651161c1711317fd56efb0c9e5d52b581ad463
SHA5128e3e8ff9da4d435a1ffd758fe8c5d21bbd43f9e789b92585a1dfe519e82ab4975d06dc7628e173bf88dcd1f3be25b224dd85b7b3a7f29dad11246aa34783f7d0
-
Filesize
5.9MB
MD5d79c2de6cc87d25a57f92839f338a8f0
SHA186f951fcbf4867162d0932436f478e6d41bced14
SHA256eb866b2ac337d9953fc703d2043c0d7b058898a56f9da9d2e63d0e09d99dda15
SHA5121b3afba2621a8387ff7d76bd9d5631e5b57211c94af0e71f38cb249c1d6c0536900382a6496c2f1c7099c1600b7f0322bb4e8edddd5a1f7b57fdc7e56df362b1
-
Filesize
5.9MB
MD5c2b804c695bfcf0655ec139688b87486
SHA115bddb640450bb821dc15ca1e4d8dee10ca9d41c
SHA256df2f3b4dc833f177fcfcd6c245acc0d95c071cbdfdd166ad89286cfe465e5535
SHA51210a1e5009051c70b5fe503d19cb145d44354266fb2eb703052a3d5e027c8d3d0e00479f1e7e802772a92d1cfe8fd6e90f6b114770dcefe1bc0c839f2e1a20f48
-
Filesize
5.9MB
MD5e6aa7b6d4263139c5039fa358cf69df1
SHA1e879250a3a4b36a5ade67754f789b2e9842cb3cb
SHA25664d3199285b4e50bde1a2dbc09b3d8593681e49c7460dc2c3b17d37836a8aa0c
SHA5127eb6e710e3b142c4e8a8219f7316deaca2fe4ffe6604d8ffd803e066e9696f97c1d199c0629ed198abc3bfaaf6000c6141e045cf1bd20cdecb9ad157055ef3b6
-
Filesize
5.9MB
MD5190d7fd5dc00594c8f80a7af9ac54941
SHA1e195ac5716a1270341652001daf0320f590ce560
SHA2568c48234f24be31e20939ac0a5ed07cc045b7074778002dac5c0440d4ed26121d
SHA512cdf55e2a66171e4a625f27a5e2a4b591d445fb0e9e07f9accd627d2aa13604ebea7c6682da8a8d4812344a6318f8921cde146f46a8fd5898754551c9fb104716
-
Filesize
5.9MB
MD500b46a7bcb621a24e5b3fd10d333f528
SHA1898b21029a2be06b30169626cb73f13c3342a135
SHA2564109fb99094ead9121de63e21cfea88b1d1e15dc231a49f59ca3a339b135dd79
SHA5126a99a6c7f1fc858bbf8c91bb5449ae3e5ca15b47abe33fc0a967c95affe39e8e013e587096bd29939f63fd7177f3d1a2ac2351af1fe80b3b215b5164b915e5c0
-
Filesize
5.9MB
MD5fe05f6c5121e08a44a55e0e22ab70292
SHA11bbf995f964c25a7be85b682f96143f6962629c7
SHA2560d1222d12bd1c4de9e5ab8a6ba016e2dbd7168ef99bbcf9433b5f8dcc4147e89
SHA512b10a8371a1af7f39b163a17396263fc43186becf6f60bba4cc5e69da47c5ab0b0faccb2206887c5ebb8767d95613e5b19eb5dbc3e96aad5d04712cdf328042e5
-
Filesize
5.9MB
MD5e010229b379a5ea212ba4a47b4a470e8
SHA1fbefb8a367aeef190eeb1352d115aa1fe589dc33
SHA256e05661eeaf217159f115e96ad7dded395a05442d1c4a7e24addf6163f44f63b4
SHA512b07018be34ac97bf6f5e434ea48c37fd0f801264bbdb8b4d0de38c15660b8636befa4192655fb0afd77f7cbf0b29401e02aa1369824e2780a9cee91e248d2d75
-
Filesize
5.9MB
MD52519d582e6d9ce792370a1687905ddbf
SHA12d6d96649a0c7a29c3834c1c7e5d1b6551c598ed
SHA256a287bbbed51ec630755b7ac44d90991a0a716954757b32bf6884a5c02cd0c6ed
SHA51278280fd1899eec3b2754b6d0c05e50f642f8640d7df7eff907c0f3843a276ed368ce34ef226fb23ff18695683e145477d1579b9fd2905c0b65ff70ab4006a7d4
-
Filesize
5.9MB
MD5410c9422c893a365bd12cf6f15e7bbb7
SHA10933aea042dc3c1387674c33df082a17ffee772b
SHA2561bca19b1c653d3c36c3973ccebc0839a43ad30b73ebe63494827cb3309cd27d8
SHA512f98717d4e0ebd235c064bc092109ca7074ea5640aa15ae785f91fd1bcdf2f9a6c002ead2c5415c73af7f39e38ee88ad0a843334a8cd6643f797c13c1cea7877c
-
Filesize
5.9MB
MD5d2f12625f0c38b01e8cb244ef7ead224
SHA1cff1ffc5b646099f3f184f87633d941ed387a91d
SHA256c6a4d7247d6dde8fde6a87a1100238b6f2c4ac1cf59f7f7ceb5a3162e3f4200e
SHA5129fc25f3535802c8aa833b6ff90a0de1e8ec830ec241b1c018307a14f6835ecdc615d6e4a609487950afcb3a3302b7d83f98d7c1c71abb7f0e2a56d397cfe1725
-
Filesize
5.9MB
MD5c4243dd70c9bdba63089b2b14762218e
SHA1e9297e65cbbf75f3126bd6a1cde739e6c73045fe
SHA256a1816344d13723f0bb167ec7f51084d5a277306c95530cff72ff6a79323bc04e
SHA512d0de182dc545ce1b7f563cb932c37056e1152cad560d8d3aa1132384e365958e834494beb8cd9fe0acb57c9ff409171a6fe505877e6f909e13784c4e2ef384b7
-
Filesize
5.9MB
MD5137c4b6825131d29de38052353f9fcaa
SHA176652edb8b529e46305bd165b90a8a8d05e0246c
SHA25611c762c5096d69fe59e5ff828aecc269864073d8f3e788f42cc99ea146ad9872
SHA51228838cedf3f93116feb6079ec550b8a29eb309bf262d0d5b5a65b2c3b38694f6738a274b636a54c810dd238ddba59e241179d4f1dab78ca934ae8f5213d2fb96
-
Filesize
5.9MB
MD5f055ce83d6b969fd284d4119eba5be8e
SHA172cb57d5940b9f1234f4a05cbb8697cb9f57c57e
SHA25696a224ec0a65185158c764112b0e9baad378e3f97fc7cdeb993e8d15e798a991
SHA51268c5e4cacd9da6f67c86874241be71c9cc487fa1c24a71d7c9bad22547b20fdb89130239dcb57d284e8defc9c69350998bf1be15cdb88237b392e13097b28033
-
Filesize
5.9MB
MD5a61b3d324dce946ebb3fc449339a8ea2
SHA182b02cde6abf28aad189696f76e4fcaf542349b8
SHA2568a9f454fad87d32643292eb4db2a2076b96ac852f6444d1f04d4613f6a37f95f
SHA512cd6e3a27f77f38d9e6b581ea3ae8bc11b5a07353139471fdf361908a5850adbe1c8d123e0877ccc208517c6e2cd188763c08390d515bdb9b15446ec7ac57aded
-
Filesize
5.9MB
MD5c1ffcd82a7d4fcffbd5c3b2b6182c463
SHA121f1e40af8b8b4b92b38c52d6c784fc8b4db62cc
SHA25683bfdd109c93253e0dc4d8f9f94d006e3d9fcced3d1968fa3a379c9c74369778
SHA51287cea5515f1d9e8bf3ba9ac7f0dddb5d7fdd187cf3426c57228972a340fb287a2517f5909757cacade60b62d96180dac81b761b9e3f076f19af04d99d28fc160
-
Filesize
5.9MB
MD591a3fcb8535c410ed2eea2cfce3a17c6
SHA142648239974ed8060345713cc390f581c7d4c72c
SHA256fb1137d8f5e3eb38e800939af19ec4a1ea85353d410d7a26c527b6e8faf3c88e
SHA5129c65418b8abc5c71330ac1f871df657024a91129f7d14b770399209549ccc87b442e8856f1e0041aec994f5ae970262261e823239622953bbfb4b0a9c76b7997
-
Filesize
5.9MB
MD5f908ae748c4bc070782463ee173809a1
SHA17f9f0d47ffff3c65c0dc6c19e26eb4bf7dbdaeed
SHA25629326e90204b4063f3dd1871267cd96741393fa526b886de51063e3ef3c24fa6
SHA5120cb913b6080eacd0554d93815a5a37d498dd4acc7446c111b1cca5d68fe0179ca63aff8f4d351c2076328e189078a0ff7510a6a00c46621140847683d51a3807
-
Filesize
5.9MB
MD500212c804afbc90c94d410ad62bcb6cb
SHA1364149eee857abecf060571a3598d6a36d3d4793
SHA256222aa0a80db3a0b3ba15686b4ec82d54175e36e5276287a141541eace5eb93d4
SHA5129ce17733acd0d5d5cf73d46bcb68027b8cf4449d3579329ff100912f55dc476f515ca523563cf6ee26ec36f37dd0f0b1a716744f1171506d4fa9ef285e77662f
-
Filesize
5.9MB
MD5ee1a8532e3e8e6b5ff25885f6ff9e8c2
SHA1c789937bcdfca2afa4f8f12ab323ea30be346065
SHA25682ec1fddcbf8ab8ea41097d271d3587776ec436c8a84d756d2e9a2e1033a929e
SHA51287fb60ad4af611ec140d4d22f5c77172868216052451d91c60145b733e6b4467b126cab05f6d25cbee39cb93a2e66762f2425d8356236288e9145392c1b219fc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB