Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
20/08/2024, 11:45
General
-
Target
2024-08-20_fbeb61416871ffda29d67003fca8938a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
fbeb61416871ffda29d67003fca8938a
-
SHA1
34c532df207202150d0c8f0236c863f6fa4f3dda
-
SHA256
62f4b60da8059c5df0e44613beb6b98157b0cef32ed1e90408ba3e8ab20f00af
-
SHA512
6f632f82e824b740e168eb5c3b1e594d0b89e35c7e1c7069cdb4e4f96ae95c2cb518b758b34f63f705f8c6ce6595479865538ba407cf046cc6b6da62f2a1c288
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibj56utgpPFotBER/mQ32lU4
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-20_fbeb61416871ffda29d67003fca8938a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-20_fbeb61416871ffda29d67003fca8938a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CdRaTaW.exeC:\Windows\System\CdRaTaW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kdSIhlp.exeC:\Windows\System\kdSIhlp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zeEIVHL.exeC:\Windows\System\zeEIVHL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vpdJelz.exeC:\Windows\System\vpdJelz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pvkcPkz.exeC:\Windows\System\pvkcPkz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NIjgWFc.exeC:\Windows\System\NIjgWFc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iJJRfrC.exeC:\Windows\System\iJJRfrC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eVvzPUN.exeC:\Windows\System\eVvzPUN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZVamhWl.exeC:\Windows\System\ZVamhWl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qMacHLv.exeC:\Windows\System\qMacHLv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XztEwAj.exeC:\Windows\System\XztEwAj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cqjQRlQ.exeC:\Windows\System\cqjQRlQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gqEclMG.exeC:\Windows\System\gqEclMG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GqqPTSO.exeC:\Windows\System\GqqPTSO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IxiawPJ.exeC:\Windows\System\IxiawPJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ouxtjKg.exeC:\Windows\System\ouxtjKg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dmYgjvi.exeC:\Windows\System\dmYgjvi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vnTsndG.exeC:\Windows\System\vnTsndG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nvVPoUi.exeC:\Windows\System\nvVPoUi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wETTpqh.exeC:\Windows\System\wETTpqh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LSacmBi.exeC:\Windows\System\LSacmBi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54d82231a5ff1e9497f7f7d9b10c87e6a
SHA1eacfbe890c88d9c8a3cb0b0a56091ff72b97eafd
SHA256d3cc92cc4a4f50fb208ef093ce413e582189f4e96094764b0242ed7436748a2c
SHA51293a81e2735d7d540823757fb4654cdee4e8d02da66e7e8efd025bfa39f529cd747beb19e742a47d4cabdc6a22c1b5ab92dac2fa6bd7207fbe7badf116c642fe2
-
Filesize
5.2MB
MD590a18025554804b3be9dfab443cf9be3
SHA190376e2c105ca1411da083546baffbb31e28fafa
SHA2569f0d9e708ee8326372d868a69d2f776bc074b84649fcc2b5c7df8fa167a70672
SHA51237212a4cca2f5cd9f78b8e28c435f8fd2ac6661cafdbb7b2d0c3959ca3aa28dc350c190d8a8ed0606e34e559409228cd96a923a5178a01850abaeb7496d79f8e
-
Filesize
5.2MB
MD5b43579a0cf924c1e0458b7534538e5bb
SHA11fba3730d80ca2ee879c7f74ecd0a365510f2f9a
SHA256a702a4d4c55cc176d256e3ec1d8e90af6dd17ced0c91929c413673a93021d7cf
SHA512157114439881837730bbf358770564a2c4c2e99f77f83bafa8c8d705c306b4cf56893486d142bb9b47776a8a598d904fb33b9898fab55871029cf272f88244cc
-
Filesize
5.2MB
MD5b504e840f8c1a4fdcf1fe918418ad188
SHA1cff0c84f61e711f9606d83dbaa121b3948559dbf
SHA25662fcaf25af569d25c4d03717c3308f6443e9fa5216897605e426d4382d63a08e
SHA5128f7c05091e25aaa1560f7b504c195493b536e833e210f973f937e6413aeb6ac0aa4c10e3d086b7e3a139ef345ed50294cd2d006e1d1c0d915ff4797b67f47c92
-
Filesize
5.2MB
MD525327706ede5f5dd01bf7700fe80caa0
SHA134220a785f645029e5469fc97a1c2be330576b66
SHA256cdff7270253eecfdd1ea283b84bff37c3cb6db31634549a1bce64ce595963d24
SHA51257756bceaf9dc9c1a969291277dd4cfe69292f67d78a3257f7345a75b01b51424e1abb1319991576c73a51a0c70874b5da37ee1941bf01e97a80bd31ee574055
-
Filesize
5.2MB
MD539d01e2966d3b86197ff06f692f9aba6
SHA1868b3de1c89c2d92c81f8305ebc5da3bde4cd701
SHA256b41683f1b1956dbdab091f72121982df321372ad0909b1aa19fc11dd08fac89a
SHA51285bd019e9633fca379dedb4fb691177b1cb089cff5d37b2cf741142f29fe6ab2a39dac7ca7cdbe83043f9c0db12afd07b75164b1f8aab032fb6850c0da682ff7
-
Filesize
5.2MB
MD5f08b74af1885167af80b8349d60ea7b9
SHA1324e0ff8039792f3d18d4512728c091545988522
SHA256a3db2ffe874016c9f000394f227f4ae10d08bf461ebcb095e3b447d1f05ed39c
SHA5124ec712c6ca346302bd3cf98e8746099e64021f1afafd8bf7e1f92f4c16651f5c45534d132c5befba26b8e688cdac78feef07158c0ce5271185119e90aa27b137
-
Filesize
5.2MB
MD50b9927e8c563128ff0a225c20b8d01ed
SHA134184771301458a3464f1ae9e52b572a06b6f603
SHA25636202acf624e88b8ffd5d344da0b875c9c2a761477d0a2851a26bb28f027285c
SHA5122fb03a2ee9b7c15b7a68883582f036ad297f2fd67bf17ccaa7313900eec2873dfe50025430dfa1a1d38fca15874bf049578fe4792f613cd185c6f3bc003ba582
-
Filesize
5.2MB
MD548fde9989ef281d47efade173a95db7e
SHA1c838f40cde68042500838799fb31dacf648eeecc
SHA25622f90d39e9069fdc15713fac2e3cf2827402a7e34f2d1903d1e961a8acdb05b4
SHA51259ece87b7843085e5500eb6e5ce0316fd5ee944eb91ea091e67e2647722a0cf67e7e8bb9a8798c5c24a0a1d8ee67fdeb841337bcbe87169d66f1c4c907760739
-
Filesize
5.2MB
MD50ebc8994772bd0005b1b5a082185242d
SHA1e66662e6c4c5f90926d19723f9b0e86aee36f6f6
SHA2568b71f7b047e273264c4cfa94ee3535014788f11355280420b596db96cda4caa3
SHA5123050c19250e3c97e6792cd2939a36a3852424efac7462a4527a344ea9197a67021c3b491e610e6e1d0f870c2c9bd3951b79717acc4c2a80e277c9f110f909451
-
Filesize
5.2MB
MD56659282d0ed8d75e7ba06936d87256c2
SHA1e74fcaea1e0bb75991c828c84384446a1d2c31c9
SHA2569cc4347f1f61d627c3d9de3e68c6edf3a7ac3351efc89a033f03df2658973bae
SHA5122a86dee9e1239664add6ffd492273c5101baaea22aae816ba20abd6a7e39d07c7cadf9e0a4854ca7a52d5c524f1847474a589e712cbb3314e96b8f58574d59e4
-
Filesize
5.2MB
MD53b0f396b623d3730c437701a8b37b2c0
SHA13889b2e456fe121bb1917703aa49bebbd501ae92
SHA2569947ca6f0f6bbbf520075da1a1655ffcffa0fa71caa76aa012437049c336551e
SHA512f10e9b4d16738963f512283658d1dbc9cf9bdeb0923e646e74791df47f82457b017ed17025b34f2a6134dddac91f47bf8e4ccd62b5f1b975f4d7cf0ed9e14abc
-
Filesize
5.2MB
MD59cf7f4ed8cc21a39482d4dfc24c378cf
SHA145c5055f50c9df1f2f9effabdb8894ae3db464da
SHA256324b314dd505b5df04e7fe4233d8abb132f3298c2ed4e6a4d78062c3db805080
SHA512b211ae78b85a828a659a8f8c52ffe9856e1ef92b4152a6c16de8ae1204c15104a0eab82f71ae128257bf7d646f7097ffc9c7e13b77a8c9d82f048ab00449b750
-
Filesize
5.2MB
MD5aef2d46bec4fbde8b27e6ae5a80bbbcf
SHA14a6b481766a8ce0ba2b93e2ffc3e146fd200b247
SHA256922f257d6f990bfaf1a7e99b05ed80c4ebf04a4a042822b63a24962a6f26d87a
SHA512478b9d1b15015fac57b7602d0a014a37c7d24c51b3092da21ba015a1b7e9ae8f04bb6e81e391aabb185a323d139e1575e7423f0c32e0fc9b3e38af8581fdac13
-
Filesize
5.2MB
MD5c80646cb074ed91d3398d902f07d97cb
SHA1cabc986ce1a9b1ecc60823a71925b94e76cccea2
SHA2562b1054fd673b8e3a67c856f7073d57a4052f3c7d46111485bad1641c314dd349
SHA512936499736a31fa7bdfd0f43c5295d8bc9b1400841a84ae6572f757472a72d1789ef21698d1d7a8c62d9cc6af9d574c837a48518ef34854165b0e02a174435d0e
-
Filesize
5.2MB
MD50a1258d6a2dfc33c06a98a750d495c0d
SHA1099c36e15731627e0612831a0d006ccafd6ec8dc
SHA25663c2fa3d213354fbefa87f5b56678eab1a34f5ee359b9aef8c11f4f15051b3f7
SHA5129fea8ecdb46478e442c48f946742b971dcd961b8b3a1a770200260ec8cd6be630dbf81aeecc0030daf18d3f747493c825e6f7dad73d66c40aa80e19802cc23f5
-
Filesize
5.2MB
MD5435db97b5c5e2b3d62cc9f8414d6d7f5
SHA1c71121b895a569ea442109caf5d9f1f633243525
SHA256db4dc2be48d1edfd6845e6173cde9c7768fabc647b5f9ad0733e70d4c34110ad
SHA512d7f87886c89765e903ce52488cda1c1c7450abbb0e6cc50f41ed6faf52a2205d2682bfc3a8b246887e8ce75088ce9883fa0d9ce05a9d2ddff9854a2a7fefe5a4
-
Filesize
5.2MB
MD5c797e2e908ca9d4574478837932ae1f8
SHA1b4fa990d4f9a28a7b65ae2bf81e4ab874298fcf6
SHA256bc81fc286708035e474f3082f165d83905a38c20832e3fa9152c202852df8e79
SHA5120c6d738e44793a8600bc72ac50036ee4b394032d46c3144cf33f22050d6fcaaed82b7f4a688ad689e5b0592145bcc7d1a98c3a5ae0911ee65915401b8b7736a4
-
Filesize
5.2MB
MD5c00a544ddde0395a2f24c28a12d52daf
SHA1cc021a43f32b739189bd025b4f01a40b513a950b
SHA256583ac7a01dbd91e10feefd468965faad5cbe9c333664cb809b3d8e1a1b86845f
SHA5120e6a77c8b8fe226e49f6cd8b378bdbc49e0bc9a813ad5f6b6b4ef231e3c9505969139da3938241b1ee6a028a1ab666804c14adb5e39521825dca19889bfe3729
-
Filesize
5.2MB
MD5272a963cdd2ef890f23fb5d6da453871
SHA1f7ec12ff6425ab8b9e18944df5ce9390c949854d
SHA25648c1b601a6a21cb23110e169b7cc44f3092e0d2af705062f4b06c101e224ea3b
SHA512f94e67298fe0eec4c5cd9a6a5020af7ad6bb857949a7216b644c5a1f1db3f7fef8395d91b300b11841b188634c7d8ca365e090be38b64071dafe61788443fd86
-
Filesize
5.2MB
MD5f5d65449d3c6e26a76a247c558ea52e1
SHA1501c8ca22a876fcd7a4afec04c9f04879800dee5
SHA2563e61389a33dd7edebd46535d4e6b98396b1534cc3bf4175de3081635b00e6aa3
SHA512d42d1076551635088106485197fbc3d9dfcd7ab5359db756ecf252c3de041ebf2bd78a5affd6e6462dcc9bb2f1be4e701a178b07db3e62648bf6b47e91cee114
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB