Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
24/08/2024, 23:24
General
-
Target
2024-08-24_56508c13918cefc286aecc444f585dd4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
56508c13918cefc286aecc444f585dd4
-
SHA1
292b0d7de073ec24c4f46ec2003bb1b24706d339
-
SHA256
9662d9fc8205c5b0a0577fe9e81c132b0db20ca6024d75da7e9f74098de7eec3
-
SHA512
458691f84d45f657bb674be0cd505d960e0cff7cb3f81d96625868c0c974001b6f13a179f51e304251eadbdd00f5308f63c54822078d00401d03bbbbcaf6929b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUr
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-24_56508c13918cefc286aecc444f585dd4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-24_56508c13918cefc286aecc444f585dd4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jDxvvKE.exeC:\Windows\System\jDxvvKE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tzxDHSS.exeC:\Windows\System\tzxDHSS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yIrQjDA.exeC:\Windows\System\yIrQjDA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ndHSJRN.exeC:\Windows\System\ndHSJRN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FgitJSE.exeC:\Windows\System\FgitJSE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tNTpFGE.exeC:\Windows\System\tNTpFGE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DpogILw.exeC:\Windows\System\DpogILw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Qnkiesn.exeC:\Windows\System\Qnkiesn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hyUELgB.exeC:\Windows\System\hyUELgB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MVnJfdF.exeC:\Windows\System\MVnJfdF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aWIgFDd.exeC:\Windows\System\aWIgFDd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JsTHgDC.exeC:\Windows\System\JsTHgDC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pZtOSum.exeC:\Windows\System\pZtOSum.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yxCZQHo.exeC:\Windows\System\yxCZQHo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UwdNvyr.exeC:\Windows\System\UwdNvyr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ycWxmlc.exeC:\Windows\System\ycWxmlc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gyeaSNG.exeC:\Windows\System\gyeaSNG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zyZareE.exeC:\Windows\System\zyZareE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QmxQkit.exeC:\Windows\System\QmxQkit.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gXcINHc.exeC:\Windows\System\gXcINHc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rIqmDOy.exeC:\Windows\System\rIqmDOy.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5350d6c868f745b4034793e2a64bfb21d
SHA134dbf364171d1755adcc09e2f3b7f4667a666a90
SHA25697dd20ecec36e1fc9fd1fa3b64d983fd2afef8688afe01fee1aef90c9d58296e
SHA51249f0b600524a5f650c7d2a07cf94a705a90e9fe735cea646308620b911c65406fb8e41f53d16c9afa684da2fcd7938ce7b37d616bf83540758fdf9d923ae13c4
-
Filesize
5.2MB
MD5d3d2b5e519d8c1ec2084dd5a9af46a1a
SHA1b8d40694e418836a8b76971df666376d76090f27
SHA2564ae8886b99bbf6587a05e0c70a135335c5f397209742a21bfd9c585b01456c70
SHA512f9520509a5227945c94e4336bcfacbb169e794dfb8ec98c2cf1ce5f93247b9695415962723ecafea5e270e9c06c324bb1ee31baa588223ba2d7f0ffffc10afb2
-
Filesize
5.2MB
MD50b39dd9526ad020ad899f6134a21d023
SHA197e4df4d40f02ab21df88a9887ab01adc448e709
SHA256824146bb60d330824f2fee8b773e56e264d5955a7ecc462b69edc3993400cc1b
SHA5125acab5fe4cd10e2b7b9d5edf4aa15a305a9e3c31e7f920bf361b16607f4a7edd927b2817d6c88eaec42b8b382d692eb3a3f2d85f71c40c865e892c38c0ba0574
-
Filesize
5.2MB
MD5f768d3b40c6b175f5dc1ba0327dfdf6b
SHA110c90491d9970c4c0835ac4ca90b8a819477300a
SHA2566d447a53c17681a33facf66d143685e70aff8a412ef323c497c8104e679a06e5
SHA512b8aca380fb31662741204b1a1d6443b4035afdee325723c9acc548a65540ea1a5e825f7d004b135169c4785b91e656c7c55c6a0b84783ee62ab03e200db3b07d
-
Filesize
5.2MB
MD5279295a289aca91c581f7c44e5c4742c
SHA1d97e325b33c1db6782dce416e9c3b8694697ed4d
SHA2567a7949a8b9cd4c6345ae28fc539a9c271af095cc26c361660e853342cebb81cf
SHA512cf31b558a53bbc93ce737eda49cfb5017464822db53df9ade7f3c89126e13bf4936a89f15a2e151a2075ea35f2ae3c00587a4060beb7764b8f83d0f00ddd48be
-
Filesize
5.2MB
MD57ccba724d2f74ecd8a012592e4532592
SHA1c8cc7f0b269586d17dc802f7e76e5bc51aea3a76
SHA2562cc84bac16abc1f0186e51af3f3e59c61ca616a756ffc5d1de1b00ce6bcff9b2
SHA51298b6215940a58f7bd32c2765dbf50c035bf88783e73007184df806a1ee6ee249317bd9b31abe9cf4a711d4f5cb8bdbfffa42641109d1f6d682fe5df4333ca253
-
Filesize
5.2MB
MD58969fd42a2661800426b699ccaa585a7
SHA162a669247651e1c4f1def78c379ce87b7231c25e
SHA256b30db0203a9d9ac69a7227d64a46329c347e955bc058d3c7c3099341dccff1ec
SHA512e93ed9495e10931d0b6ebdcf738a004ec2130e9e76ecca54df729b9c06ad5d244a022e3adc7d6a348a9f57be90ecb5d451c8f04817f3363d01244f7371188535
-
Filesize
5.2MB
MD581185d522c559217617979e287258ee5
SHA12cb0429ce430449dc10acbe27f8e89f6f449effa
SHA2563c2f9e1c7643d93988416c9526c746fece0904c110a05f8b143dc53ced9ccf1f
SHA512055543f5efd8c0a30750b4dfef4d1e5859f341f348ac2ff1bc87ba6640d30e39d87e1eeae954b53f8332ea45dde935305e318239e8c8b9ea41c0345bab6a3467
-
Filesize
5.2MB
MD5216908a0448243d7929841653627c1cc
SHA123b08b82bbcb94418f2c19a7f127a9d9c043dddb
SHA256314167d3562d6511834cb9de7d319dc3cfa23afa317c0c143a48ea10417a1e98
SHA512c051fae75c4c66a6a08aa17e2dbd9f7bcf285e8cbad27745c66f2b33ed65b79737b61a78dfe13e658b420a50c12250d1363d3ab5a64241981fb66498a1b33e2c
-
Filesize
5.2MB
MD5e616765dd9cea03511f6b7bc5c801559
SHA110f2b95d77fdc2183f411afcac4769d154f86f63
SHA256934e9159671c05062b472bb002a4962608ba58600144a026a503efc7535e671d
SHA51204f0e285e885eb7c69ed3f9d14fff163a361f2ea357239393a28412142d603de80d88254a576b09a97d3dd43342b662314ce1cde852920d150102f86cc8d1b61
-
Filesize
5.2MB
MD550dc314ffe2b86363938df6bb2346ef8
SHA1d0f7cf858b1185ef2fd787b1edad816d322c5a9f
SHA256451825311c8e00fd7a7ef9ea1bb30a3702c57ff9c8453ca44b608e8114f760b5
SHA5128bf9d95d6b8879d7132614122475107b555e42be7d8ba2bd80ab1b118dfaaabc555fb4a9acde2c7ce3699a751d7ac12378119a3afc75c2de4a79b4aa6e9d9bd9
-
Filesize
5.2MB
MD5fea46a7b58ee34df6ab98d9a1d3d4ad5
SHA17b7fb24c973079223622079cc3a29b7f588abb30
SHA2560350d6cb22dc06d069f54166e87ff5c81b0c535a59497b5d01a3e6568370b23f
SHA51203f863d8dc2f52699e177c05b6d978c6836e7a0a230441e07112f0b2b9d12445d7b4c8e179c4e3efbba09f615f641b2d38ab41f40fbcb81b38fb02863cb70434
-
Filesize
5.2MB
MD57a61ee43f2027452859b200642409a98
SHA11622834e96ab8d26159470752ca045c421dd0646
SHA2566446d09f20f280ea8fa5d7d425cd89a37e69387380bf61a386adc569e9569a27
SHA51248e9aa2c80a667032ec4e47e42834e7c51223a21f6a9268e77ed5fbbdb40a08bf9967e8c25a7652a82bd97569e68e4cf83faaebc58f7dbbfa70fe92c83a6a66d
-
Filesize
5.2MB
MD541776e2e6d48b6a1acf65e821ff611b7
SHA1cdbfc947e78834ad5f252fa5e6ebbe3d7c971738
SHA256b7d66e97d26caa62b15d524ede2ba1cb3c4a7c8fbd3e7a763177cb3a9b869a54
SHA512ee01e7ccef3780bbc75ed28127f29203e9cb45840a99d9ef5b27dd911579f3be2e077de33b24c6277739330630aca9784529f0433986ef25b1f2887a7e07cff7
-
Filesize
5.2MB
MD58300be7ca46c7916ce5140476dcfb3a4
SHA18041e21b5728732f9b23e850955dec0c238aa8a3
SHA256e29280090b0a58f877c23809c0fc82abdb84c3c9007e66864d0ca4e448404f27
SHA5125c97d4b3ba4fa203a53e1b7a9ea4d0f2e8fbca3216a3d706a91e0bf03dce551fceac212b47061ca3484c5e1273fe9cf0c67de9d843cb297744637e518ada6757
-
Filesize
5.2MB
MD599487ea19cce949756c3219007c9809a
SHA139532e75043941249943324a40a00fa3a3533b23
SHA256e384bac8b3f5812ccda1cada1ce8a7e14a8fd2aca3268a7d52707281bb5af7cd
SHA5127660268613c4ff065ffc8ce88c24369d302838b3043a88db037f53e2b537192062af4f397a3f8269e22746cb2fe45303a17116111a699ec3b5f8f6d627577ca5
-
Filesize
5.2MB
MD540e9c938e893b12aea06342b8cb956d3
SHA11ebe3d58a67582c1d9e15cda0ee90e196b0250a8
SHA25627d018f38b4b4128d7de32b173de143d6fe1be6aa7bc836eab5007829b8fa56c
SHA5127186bee393add51d2f5dfe8dcdd0099dc93f59d5077f4f7f6e7d6f73d068d3e38583627e5a462bb02b07548b8aec9dcc99791733c7b398c107c569916b83b57a
-
Filesize
5.2MB
MD5d0be0645feda6458a46c77fb67a72fc3
SHA172d40a2fc77c4ce33f0750065531e61fe04feaa8
SHA2566c53e32d57dc0a0145ff1bd32b212359211871b2f09a86a722086c616c6fcff8
SHA51243f1a5489b2c9f2dbeefeca2cdc50a105146029ea9ce578c0cce159d96ee0f66124fd2f89c91e21304fa1459061f4f691b58f3685f6db2284f7af6d6dc7df143
-
Filesize
5.2MB
MD536b2c771c3b116903c808f2989dc7c19
SHA17f5ded80baa8dee5e3d3177e41299fae2d750651
SHA25624dfb54baec66d3dd58e27d392b21271b145ac75c327e34194204f9af6618ff9
SHA512c9c493ffbef10682f949e534a5ee19ab68c33a9d7ca861b2f40ffec54276c78df40d7e03dc20a3c40c13092a67c087442f388bd253fd57debd2a352aefba6a9d
-
Filesize
5.2MB
MD51fa528b178f45fb19571090d1566a577
SHA1272f6dd93c0eded8f96400a5b26892df1713846d
SHA2561d617239a935a7c3e13dbf40b828f1b7da85ad0b8a0d52b492c1975afeb1b98e
SHA512a7dfe850a48fc6eb86f8a7c77528138bde9ab94ce8f47e8aea131763fcbacdae93894b41b75d9241933121c67ad491fc290ce995a26ab4df269dbe9f15079653
-
Filesize
5.2MB
MD5f5710cfab8393d3b97b2adf50e389c5d
SHA1e1a766ef0cd57ca694137dbf0e14c25f1ca47c0c
SHA256dbc64b68dd4d2051b33154de58bd772a833c747a89de7a6fd983b52496e33812
SHA5120b42b800393b1b2dd1114635c7681560d4b23fe745e8ecef2816b1766e6f5e8a530441e54e0a13731db410eae01a61f1212d2d56ff133940ec016baf6ec68610
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB