Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24/08/2024, 19:33
General
-
Target
2024-08-24_5d94a4a5df29d18f1dcf742580811a0f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5d94a4a5df29d18f1dcf742580811a0f
-
SHA1
4fea2a64d73a7d3d82252632d5584c184868af24
-
SHA256
360fd2071b07a821a8b42de61ff1b5ecead26cc203a4a25063be33f88779f1a7
-
SHA512
4e611494fa1fef9468094f825269af2c7875a5108ba111441ffd39ce41cd686701c2c13606d41e4956fae0aa685ce4b8303e3f55ade5c9a78ddffcbc0f65b287
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lUE
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-24_5d94a4a5df29d18f1dcf742580811a0f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-24_5d94a4a5df29d18f1dcf742580811a0f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ztASKrX.exeC:\Windows\System\ztASKrX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qcfuXkH.exeC:\Windows\System\qcfuXkH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dOsdvHh.exeC:\Windows\System\dOsdvHh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HWFrGdT.exeC:\Windows\System\HWFrGdT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DlqIJUD.exeC:\Windows\System\DlqIJUD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JNShUVP.exeC:\Windows\System\JNShUVP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VcViwpi.exeC:\Windows\System\VcViwpi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXDMPFW.exeC:\Windows\System\bXDMPFW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eyxjKau.exeC:\Windows\System\eyxjKau.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lxwQaQs.exeC:\Windows\System\lxwQaQs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ArzbwPU.exeC:\Windows\System\ArzbwPU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RBkTCnI.exeC:\Windows\System\RBkTCnI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nGEtNOr.exeC:\Windows\System\nGEtNOr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FEHAtFY.exeC:\Windows\System\FEHAtFY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KUFNATw.exeC:\Windows\System\KUFNATw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YlRbFcP.exeC:\Windows\System\YlRbFcP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CyXgjXq.exeC:\Windows\System\CyXgjXq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wTiDTGc.exeC:\Windows\System\wTiDTGc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HBYNGWE.exeC:\Windows\System\HBYNGWE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rgPdRAS.exeC:\Windows\System\rgPdRAS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SfrFayE.exeC:\Windows\System\SfrFayE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59fe37fe7db79d7d69c328dfa8b4cea8b
SHA1f31479fbcfe2d8cea91d0cd0d6577d055452e38b
SHA256331dce205565a45150c2b7b8bfa223624b53041ad067d13548f04519759e6bb5
SHA5122509a5e3f9feb6d1791cd7c736e96f35e480c5c5365f18e48972b370f14f9468ee2c55c5293e7ed1a3f702d15c1df26c540b052f92eb625df84a6743b09b0c7e
-
Filesize
5.2MB
MD5493d2a4a42c69fef30e4ed79b57cec6f
SHA174e84456a95557c6109af377d41c4f23825e15e1
SHA2563aa542b551ab287dd703afd9b89147ccb40df108bba37fcb54d5fdf1089996e1
SHA51210eb0067eb55d6515ef37f0644ac968d94b21db22f7745f58eff6ad1633d4b67dc17b8044e85074e4c75cdfe87e2e06d246c427c538063028506af1f80aa020b
-
Filesize
5.2MB
MD59cc8319358ae1dfee933c9cd23ca3903
SHA15a4603ca16adf77a0c2659b86108d0b35ce3fd1b
SHA25628b68427bd0374eba12dce4fea508e56bdd7d4f49abb65176ad7af187c99def4
SHA51293d225d8bb6da2b7c8492ac308ed45a7f56f7f5f6292a07c962a0b15419fac096fc580ce3476fb9f5f79e07946dcce14578efaf710802862d14f92b7c6abc329
-
Filesize
5.2MB
MD579ec01e0739a8dd76733d5cbf68a0664
SHA105c8347adb56c7c612c49344d0b180888ddc0c00
SHA2561eb67e120cecbd4d66641a1b8ab7f4bf675d1f691947622414334e345984853b
SHA51242e2f5be872e5122ecbe5816d3fe1a2b0b8af9b2c1983b7f6dea156b576ea7e5f4a234716ca7e9bed6327be4389c55e0b4701d34a63d17c33ba26219ccca55a7
-
Filesize
5.2MB
MD5f70d1fb36ce9d370ee282db44f45a512
SHA101538a378171f68b4c8954621206a0e69298b092
SHA256a66d6fe4b59e6f2dcdcfca76b70d8fb2a8bd12836bde0e829f2068729cb687db
SHA512e57d7ec3fd1f1ddcd0d7feeac436a560101e42280b6fba26a7f96a96ed34320a83b6b686392122c74a800c8a42edb43b2e24302cf68186aca78de24926c5ce91
-
Filesize
5.2MB
MD54889a7f076a2650c098deaaf96852e72
SHA1663644dbf9a9289e7cb34075267ce87449b94131
SHA256f70df68d2200b5d476db40db9f6946e1d10d19b8c53277500c21da3c096ed163
SHA5127fad7997887cea692b135e7b18b6d5305355c9aeacf11122b7082c2e465ebdaf9652bffe634b8d2bf42801476f9944e4db28f608f963c8c62158902d7577b313
-
Filesize
5.2MB
MD58be6d0d4cf005b51fffe88850a60f644
SHA1d5d48978f7e0091ed6d6a0727235a596beb991f6
SHA2560e4003df151fe9ff1429d1bfa80633c1fd6939f93e3e3c2b3f2088ef30094a94
SHA5120e16a8e5dea6c81c9b067e585766fd63026ea4b3d7ea78d8ee938555e6b74d8f8f71bcab543c51e51d1c8212ec3e2bd99981f2b2815a5c1cffc390c1f9fa6092
-
Filesize
5.2MB
MD503e700f9bb803e0224a1cbe1392e7d92
SHA1398b3e5b84d40d1aaec27e8c75f7de28743591b8
SHA256605eeb5c9d2d1a63e7c0ef21c224cf4af8be25edb4dfd3261e76f248fcb1112f
SHA512c308d87a5b9b9140b43ef3bcc84a1b4bcd9595169688ea62379c60cee6205a7f6f40e20221c77f866db1d02a5df4cb4218ec0b4d396d0dab1026f1bf6d2e0300
-
Filesize
5.2MB
MD5a30a8600f2a0408ca531af9540832607
SHA123540d95209ac4ae30ae6e170fa68e4596b24442
SHA2562426afe404d3abcfa540f9ad0e429c3de91a8eb5c4f7f5f0a36c12fdd2223021
SHA512a1a6c920d1f8a355edc1637c3971d9b6f11daafe95987257cc8d3eab69876c328188e8379d9ec20ca6e5d7b84e8cf6b05ea8682e894dace761f538c5b47cb669
-
Filesize
5.2MB
MD533552af028a0804295cbf3ee620f34c8
SHA1a7d5803e56052c698e7b96e67333770602936aa9
SHA256783903dc696893ff946da62be2ec7f5f1316ebbc80ff27c6f6f213e6924b64f0
SHA5128100660554c942f1243147e919d39aaa51e766eb8b73e55d551f195bf8ab11ac8e1fe9d563a1a2081e6121783267ec4e56673d0bbe068003b31828a9cdddc10f
-
Filesize
5.2MB
MD58256192ec4ef3b7c7ad13fc7d3fd0482
SHA15667f9c237fb9cce7b1981fc11a3e3b3cfc1f7a5
SHA256d6047d603690d3c500c396f06d7aa75ba46364c658f631a5c76c841625a90ed1
SHA5123dda9576f64b3268647e37c7f800f8fd2bfa5020dca151b9d2bc9fa9a123f6d4e276a8c89e137e2c8e3778cb1d07a8c5e71102d5a3090f8849915cdf242150d9
-
Filesize
5.2MB
MD56d1ebe0115f24b71ec2378351793eed3
SHA1f0a7f15068e02ff9becb7e5e7b3d016ec7def453
SHA2568542fde81050e7fceafb08757342eaee61b8ce30adf7e131e98217c88eb465c3
SHA512ea99e738291b73f03469b7358489a1ec4343addb25c29a991939dacf1e8ae5d71c98ee5bcae3dbc5a136200f19f08cff44599967c7f06b95ee5a7c02c487321f
-
Filesize
5.2MB
MD585ea1ee886e72dfe208d74a699fefef1
SHA1544952f4e082dd9479720d4fe8a6377c6f124746
SHA256ad81bead7c5e630a55dae72c7d3839c86b24f59a64fea6b9762c8b55e2f1da7e
SHA5124ff3ddb5749fbfcfe89ace2d0fdf05c768f3334992d9359ccfb772fe1f5757867daacd0cc3fee5c1342a32a6ef28ec8738df9d9c95bb07d8e953b16d25038a35
-
Filesize
5.2MB
MD51b419b4a7c021c33f1b8225a472217ec
SHA15b52d0b052c24a0882bc82714b79eebaeb760b38
SHA2566e2afed7d341e7c38144c495332e85b717c7a64511d4b4c8277d2fe2e7bed43c
SHA5123aed70dc79ff26db381456932ef58aa5755ce5d91c14f8ef0ac0d91c105abd11a5694496992ccc552e567aaebe56e837e9f47f9fde682fa0e892395498c220aa
-
Filesize
5.2MB
MD57a74e130786fe8d3dd3b8bfc7e821c23
SHA167fed9bfe2cee06714d582413a71c9af1602b472
SHA25663b36971a14605b3123057950ff35d623dab1803d6800b5fc56127485577f0ee
SHA512e875e9ffb209f15338ee6e264924b1c9b556fbe95bd916dfaf82654387cdcc963ff1588e2f4fb180b5fd079a14293001b4930a15209a46f7bd0ef7ebd0ba4b63
-
Filesize
5.2MB
MD5b9e66cc6f919f2398f3299b8d1a09cd5
SHA1f5a752837a5ade8976edb9f74b042f339e5e2977
SHA2563dc8de925e56c925d56711b1698423ad73d5e3a436152bb493b450e1d2a9c298
SHA5123ead80fe63c64652e54e44a6c8ecd772d3a17db03d61fc1732fe41c59cf03b3fa0f8f8c7298bf903852084eae2b8c04b7f64365c9a8d1e2ebdb77cca0720985e
-
Filesize
5.2MB
MD5f9a9d51cb64785e00961d77c2ba14953
SHA196dffe27fa1f0c2c5b406a70234fc5da8d1da756
SHA25609201b95e50ed265481505502a9f41d3c4b9a20ebdd201f1c08e2e6e0331c554
SHA512e545f8b0b5e2ca25b8038cc9bc779754cd4a0a3d88ce6484cb5bf3823366a01042a4ef872dfb80b5ee66a7a945913dbb075e03350d716c677dc744b6832089ee
-
Filesize
5.2MB
MD5c953d8973a242fce4970476492e54d60
SHA1a8bbe8ee3764ea4ca9e7aa0d1c29689b1e5a98ef
SHA25660a61ee391f0dfa5d01c73023039991d6cfda1a10f9f56246b0e044c780ef7f0
SHA5129e91c7f779143231678964013a7f00bc3aa232a823e220855303073fd55aa83aca5dc15b43381ae905254e9c0138cb2125b1d2b4a7dbc58daa97ce75619a1172
-
Filesize
5.2MB
MD508ee51aa7f5a9a2b28327b77907200ab
SHA1fb5262f825a7d7fe0a1d7149dd59c9124e95d5d0
SHA2567f93149b9b461a88ae932ba793397ad46e76074c966f6dd46bddfbaa9b7b9765
SHA512f901037f5dbe9e84f58fde9e5229c2f86d215786bf36c567dabf0eb07aeef405d40c3eddd34e3a88d10786ddd695756f6ed311fea1e6bce19b33f0dc6fa910ff
-
Filesize
5.2MB
MD5788e1f4a0f4a57d02039bae3a86fafd3
SHA1f8eb4ad6729fce413179225ad740036e5c51f589
SHA25679ff3d8d77cc48fae2eb0a3e8417da4cb069aaf3110c755987c67fae214d48df
SHA512f04e86607f54bd541863e8312441b4388952b3eb3efb0e6c9628274f5a32565d767c0fd023b27fc47f622c9618d1bb6540af65b99e079dcbe15214b99bb9ee3b
-
Filesize
5.2MB
MD56550590f5725a140e59d3351bf01bd63
SHA179a730142a7c42d30fd7a211adf911cfadacc492
SHA256f7a768098e13f7305184ef8fb79e6241bceeb957d80e6efc78f6ea6949de418e
SHA5122b61ca58f8ade1c42a0aea68de0110d11f61ff03efebe331085c9f38386ddecea126a614fe4fad742d67a8efa23802077387b58b50b0bce6a5c67e570fa75612
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB