Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/08/2024, 01:04
General
-
Target
2024-08-25_cf5f6f616b7eefcfc67b4abbcc76bb18_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
cf5f6f616b7eefcfc67b4abbcc76bb18
-
SHA1
56a092115100bfd01d322af3308160d3e3eb2ea9
-
SHA256
5f424e43ef0b5a411c0fee9be36cb2ec18d35e826f122a344ecafc4f0bcb256e
-
SHA512
dd2a58d7c3a234e546f2415efc4f4afdd22a0c913b927036ad2d1e6a454b6337ae6e1013cc6951516ca152a6bb18641836c65b4169a98713833ea453a7718a9d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUA
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_cf5f6f616b7eefcfc67b4abbcc76bb18_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_cf5f6f616b7eefcfc67b4abbcc76bb18_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\umTMdbh.exeC:\Windows\System\umTMdbh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WqcUDip.exeC:\Windows\System\WqcUDip.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jAbHHeQ.exeC:\Windows\System\jAbHHeQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xtSSygl.exeC:\Windows\System\xtSSygl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IzzGGmb.exeC:\Windows\System\IzzGGmb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fBPqULm.exeC:\Windows\System\fBPqULm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hHKnEgf.exeC:\Windows\System\hHKnEgf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jwwihjM.exeC:\Windows\System\jwwihjM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lxOShry.exeC:\Windows\System\lxOShry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iXNwxSI.exeC:\Windows\System\iXNwxSI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IzXkIsH.exeC:\Windows\System\IzXkIsH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlfvsIp.exeC:\Windows\System\TlfvsIp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mhGatab.exeC:\Windows\System\mhGatab.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EyAZwhy.exeC:\Windows\System\EyAZwhy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HvWZFrb.exeC:\Windows\System\HvWZFrb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWRDZLt.exeC:\Windows\System\qWRDZLt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xPIghYK.exeC:\Windows\System\xPIghYK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LYyJNUo.exeC:\Windows\System\LYyJNUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GONgPUj.exeC:\Windows\System\GONgPUj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uBEVmXX.exeC:\Windows\System\uBEVmXX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mGPdJNr.exeC:\Windows\System\mGPdJNr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5056f58b2672a6d8b51ca922681a44228
SHA1c1e2c31e93b9f73b50dfde8d06818ce6b52ed972
SHA25650c6bd3dca1a929edc0dafa48d649f50b16a84ca748b2a385846ce1a6406f7ed
SHA512ab539c91ba07f9c4f050a037454763fd2aba641098e8af0b3317b7a079036f479db2c7bda309806fb6b9d64b605b95746524abc337a6dc18e488d513cac0130b
-
Filesize
5.2MB
MD5b94ee50625a9ed63dc9379b18a43f114
SHA1510cf3143eaa3906c3508977c3ffdf39016cea5f
SHA256c673f10e2799d1799a34e5a68606ba5e6f234fadb4579c90cd3141c418fd43f5
SHA5125448f4b1936684e5c6803d63a673e342941b927bea5338a4fa7908005ee69c560713a40330087576579c602f4d64a4866f559a5786f695a972459820228d6f10
-
Filesize
5.2MB
MD541f4578c0ac16b09cda5062141c58646
SHA114cd4bec191a44487fb96b56b444832e9f9edcb3
SHA2561a87daba8647f72db4993c6e5ccfd7525e4f3d1b7caf0d4e77b62938979670d5
SHA51218825787b0dc2fa3ee12de1cdff55f7d0b83d5dcc2fd865f5716231f6d3d59d94acfa8695cbdc1ee5bbd18e86fbcb7c0135f936dab079017368277d24a5e5de2
-
Filesize
5.2MB
MD5dfea1ad705d127f51a62c498d853d126
SHA1da823b485507dbe4e89367033e98418292f69410
SHA256a392ad9d1b9b7ff0aa68fa429c47c7d2b78af46163077ff33ba118f759f3bb2a
SHA512cfaa7dde11488c7aade4c20cc66592d27972d7eb4fa4b94231af3d7c4f5da7e0a5f60b6118533898bb83c7b532d44e331f3d62a7e0cdf8f61d9eb96d7cddaf64
-
Filesize
5.2MB
MD53caa0d32a2c506a49f7d42cda6a5a0a2
SHA18eea96f60a01ddc0469aa586844144901047b347
SHA256e6de0bdd81ef5f1fca77dedfd5818adef188a61a92fdfff89fcf61e0b0db1883
SHA512a75b9e6de2dcd00bb8c7883239b8dcba0dde90b122310963da3415eec70fe766337acf00d80b29efcec6e8340856bfb1492fcd21cf2169178b4bae32e8436bc2
-
Filesize
5.2MB
MD5f20efe2a041e397f0f30fa13f7349d7c
SHA1ad5a81f6ec66bbadbc3ead6d61a35309f0644a8d
SHA2560a0cd049a95f810e33223c506b68db095d2b474e991afe23e050250ce40b272e
SHA5120632a500c9b5b4e4304f34886802d222c6cd1bc238d20afed76330d6e77ba6bc0cfee5708aeb9c40976a670337fc0adbd2409fa6b485bfe9153835ceb65a2bf1
-
Filesize
5.2MB
MD59f20ac07621e800f2db2a91c25b421b6
SHA17938cea2eb3e37effdae15b909b0053d43131892
SHA2563b9793a30a756c20b6fcb482014eecb1fd770e5c14e2e30feea190aa24f63294
SHA512637c8899b81484567d875539434526eebd0bbe821daa2e53135ddf484fa7d8797ea2ca441ceb6f02789eeba317e61e2c2a320be983d5886493bea53cb8fc0bae
-
Filesize
5.2MB
MD5a861dd69bae1d953475c6fea2e2c229a
SHA1af6e8aaad3698d0ef8bc0957e8b65dccb2333828
SHA25699ee4c88f22fc6de7c988ec32e6be35bc7030ecb5fc5ea5cd73fcfcc57674a2b
SHA512e22a6c8aedb21e7cd71aa6856e2b716f7973022bebf8f2ce18329e0eff3a53d797b16de2d638f50dc7f8d3e8cb9edb40870c78e0d057c5ee85c54b13004f13e7
-
Filesize
5.2MB
MD5522199116bd4b4205f149368439a5c42
SHA1d85b8e6e9f084754ae89ff9127ee378f72626bfc
SHA256ccc563b7b7940e72567173de5ae1ea9c5da20c60bfa76be7ad52f7a02cb814d5
SHA512c436537f88c3b737936ec00ba64c3944d8b034aae6dc1fa129e68e37c50da0c6cf654c0b206ce2ea8bd07cf4052edc4eb6630276ea634dd47a25e2da5fe88fcd
-
Filesize
5.2MB
MD5c63d39d19eb97f9e810f09201b1c336e
SHA19d3848549f2b8b3d72685d283c8641a33fcc80fb
SHA256cfd71f566f9488e9fa02a033c749bb5143942494ecc76f42a153fc6d7b3bba08
SHA512925bb0bdc6744df46a38bf847158a725b25375f13f50f6f0c4b0c2181653f08a373f7b6ce0c03168505e9fb81243a8f48c0d1d5f1bcb69745bf774a40ba9763e
-
Filesize
5.2MB
MD5c5cb111fa4a87ed9aff125b36ff9e351
SHA1050155c679227751e5a631349dcb697485a139fc
SHA256ffac5f67752f1044d08fa0c392a6ea881cf6bbf61b061be5bbcb911a2b3919e7
SHA5127299b86ad010332598c50a87be299aef2403ef6a4dcd584651ae86e52fbf6ae3b1ccae960c2eb72f0236c308cb24f325de348a11645bbf275bbeb22980b7c1eb
-
Filesize
5.2MB
MD5cbdd40f668b432af1aaf35c541569d3c
SHA16449d0a14517a0e278f16842a76c5bda33457ee7
SHA256948062e02e96dc601863225f1935edac9675e616018d99c82ba50e1444b0c18f
SHA5126e02a1bf3032b30cbb31fc7140954582add128ef33cb09e6a27dea0ab4c9e3bd5af1f30d44b97c8a0bee4fed99a8ec5b813d75276902b51b38c5b3c0114a51ae
-
Filesize
5.2MB
MD5350460de420534b56203044144ae59ff
SHA1efc0ed435d5a040ccd79098d520c597fc234e55a
SHA25612de0f6293e37bc0f231f3fddb5e16577a3b545ee82d438ae69160698d0e93b9
SHA5125ca38c5af03cdd8ebe0c59577c1b419f3dc4971f507933541f8954e8bbe4785a3954b727b5a01e5df7229eb552b42be79d3af90ee28ce9ec042623f5cb1e9522
-
Filesize
5.2MB
MD52343ad1d1a82d819f2cbc146c2d32da4
SHA13a48603786c82a16a19253c11cce6426299194a6
SHA256124f4a1684351931005a4050f9bc8f64b585642f4629b69704ddbce178b820d7
SHA512b591335c45f134de47405c669e9e22ffef72c61c5e9e88c87be8acf047c9d7f645211a8b6ddff09ef8fc8623c46c2504a1e5747eb7358776ffc629497cb46e50
-
Filesize
5.2MB
MD5743267ce535771475855e6e6e275068a
SHA180b1b76b11df6e8077cb8f7800137a09024a513f
SHA256f43bb32ae1b2c28eb73a1f0099fa9dd0048c6445225f053741747a9cac70e293
SHA512580412eac9b19c569fd157267eb51f82582bab77cea0b083aa4b83cbdfa87910f26aee32b1f7c58cf5c090d524db09aeff7a007147e9ce37fc99178189bac3fe
-
Filesize
5.2MB
MD5adfe01541877776ab7922146c506ef38
SHA112ab178c2addd6c1196b4dd21f54c4d36c65d388
SHA2563022e096777e0208b1e9ced6dd45c2cfa9330a628758bd25989b9507d91ef994
SHA5123bdf90ea15900151aa15e7592bf7d5187a256b3a63ecdb8209142309397a88967e5036b43f617c53d7f158f0e4edc868dc1c65d0a5ea77740e83be77e4df2379
-
Filesize
5.2MB
MD50a7ede190c25f121a3df3b8d7056189e
SHA1a7c0539eba6beb043db9fc1eeab34dad20680cad
SHA2562acc06d27f37d14eadc440520041768847158e19a5567c27d4e3a97561bcb298
SHA512b5b6fbb3ba88b91a7aaa184a7c80f2d88e04c936f3a33efd30e71998167e647d8c7f9628f59e9287a330e298f4d9a78f1cbf2d2de2c62eb1cfaed9840264367a
-
Filesize
5.2MB
MD537a138f516b8d79d4c91cd763941560f
SHA1025649e8a4a2b595042aab65ab41a51be4fa76ad
SHA2566ab034faaf460a67c35b6bfc9922a6e6797427e11c0706e0cbbd6f01a7c104a6
SHA512e5ec5142977aa1f8250cbd2eb6452d10b28ecc7a2b04b06afead378c9da64835494763510032d010b812779aeeda0aaac8a543ab9dbbe9c98ec667b48fe0c2fd
-
Filesize
5.2MB
MD5c48d86d8978e3f0d210653c5f542e7d6
SHA170785e4baf25ea884835d4ae7e4b95621a3eda9e
SHA2563ff4b27e103de9cd19e5ed8047689457cdf05d907f2bc06e5aadcdbdf3122b9c
SHA5129f5363b17f3545c1c3d8721de03698945fa8761d85837f8af8edc09da5a4567aa7a9999e6a7fb8a2b2edf9c4eb31fdd117de30cfe052471851cfc56fde3e5f48
-
Filesize
5.2MB
MD5706c4c77379d6b6f6d8a4054350d8c27
SHA195979b477ca8661f6afb2c3e5b386dd1f36b9e61
SHA256c93d0f59356bf2c947355cc4a1dcd36b4f113b1482bee45dab81f7b0d2fbb8af
SHA512a38ec9e6503c9a66f8f5ceb36502d0c65120b62e674a79a365847fced7afe89424295a2b25d48048b8959950506b2a9cb66bd761873d77ca9a0d098a56f4e00a
-
Filesize
5.2MB
MD5378303b5238a107d725a58491bb6caa3
SHA12bb8bac16327bed999d827374a7925d6170cdc00
SHA2562b1fbcebbda5ad49a60db29c71f24cd433022da7220201a7c0d6ad6c1982fdaa
SHA512f7df82201b5cfc322be6a0caed33d603a66445e6b3919cf12e83e325fd9214cdd995c4f6f5be1e97d6efece2b08e5a9df5a09ea20c42c2cae76d577187a01f47
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB