Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/08/2024, 12:00
General
-
Target
2024-08-25_70c0fcc3e6b9e7776053dd8629df4819_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
70c0fcc3e6b9e7776053dd8629df4819
-
SHA1
29b0d5ea141435a957bb6b0fb4c754a46467feaa
-
SHA256
acbd2553e6314dcf335f70360905998be592d211e68c79dfc58790a262950e6c
-
SHA512
308fb13e1ba392e59e37a695c08ab0dae1651b07861140ee9fc7c73a7d96f4140f1abbf87f64bc4e30a0902b1a8a8d66e4f9a11003b4b267516e3a8e3b135937
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lUO
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_70c0fcc3e6b9e7776053dd8629df4819_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_70c0fcc3e6b9e7776053dd8629df4819_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NhbHjnZ.exeC:\Windows\System\NhbHjnZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UmViAUF.exeC:\Windows\System\UmViAUF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UxZkpYz.exeC:\Windows\System\UxZkpYz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ggqBKII.exeC:\Windows\System\ggqBKII.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wOXErWF.exeC:\Windows\System\wOXErWF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bmIasnr.exeC:\Windows\System\bmIasnr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SXDcSKe.exeC:\Windows\System\SXDcSKe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZDwYtyn.exeC:\Windows\System\ZDwYtyn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VSIQDeb.exeC:\Windows\System\VSIQDeb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hBTRuPn.exeC:\Windows\System\hBTRuPn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EmrLwel.exeC:\Windows\System\EmrLwel.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qzFSbzt.exeC:\Windows\System\qzFSbzt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mYBlXgR.exeC:\Windows\System\mYBlXgR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QQXgyZM.exeC:\Windows\System\QQXgyZM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KFxjNWX.exeC:\Windows\System\KFxjNWX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NIgfkcW.exeC:\Windows\System\NIgfkcW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EXyQhTJ.exeC:\Windows\System\EXyQhTJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MsJfUqy.exeC:\Windows\System\MsJfUqy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BEQIWrI.exeC:\Windows\System\BEQIWrI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VIcDtNK.exeC:\Windows\System\VIcDtNK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EwVyzWQ.exeC:\Windows\System\EwVyzWQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55ff7ed89a8350856cee67cbcba20414d
SHA154eb41f9ac35c6a14b7c6a79dbb890f008cd2334
SHA256dadef51d9282d048257b1d5ad455175051fe845db5237783a4903d10d5585281
SHA512d609030f002fc6b5233ba5a3ce8fb9acad07671d14c035ee840558c46c8718821e51ef3bf310c25a8a5e939dc8227f34231e41d794686323e04a500882f6e090
-
Filesize
5.2MB
MD5c2c301a5fc3b1f89b6f333fbc7c6a664
SHA16e5b8ef86afe09598da17d36151ee4d06ce5b5fc
SHA2563bf943e54434434beb7f8a59f9d9c2f62338de9b43d786c61041e36325d8b66a
SHA512af7786f51b35d8eadcb5730ccbcb242fe5cecdc9286fe354453b290d36597f865315d2172dfaa935f690740e6705afa90498a872518781577230ad3ed1616a0d
-
Filesize
5.2MB
MD50a0656a4e1a114887d0de11928dbc610
SHA17891b9908e6214fcadf662deaad2a7588067708c
SHA2565ea73f697fbbe7cb5147133fba9c923aa98c2fc83da4a85ef2c14eb1afccb644
SHA51280067c12391afc15c143783ac395f2e61a5f82c9d8bd65e0260477a91a899553042618eda42836fea737a3ed68b12396a0b6c4e93538f873265c860aeff4b578
-
Filesize
5.2MB
MD504102140fdac6d7d2b49f9fa3d5824bd
SHA156fc055b39b5ce3ff067ab088644ac7c9778ac11
SHA2563d9bb231d4553611192d64923a539444be23d0f9a964dc13a9911cf9c12716c6
SHA5123da96040fe5718c77ad367b479ca560a2c389d37a47f41c6d2c136ca583dcadf334802e2f26b0e161a9be0aea9caea71c11ee478eb5e77b6cd5adb9d0a5cd197
-
Filesize
5.2MB
MD529b25d66ff7e60a4586516cade2c8e4b
SHA144ee04c34a4cd850418d7ebc2429c266a678d591
SHA256c7b028a29282f2db3724ece94866dbc79eca9e141af3a982a10eee277118f8c4
SHA5123964ff217f67620a6d446f4edfa6ab1837b9e941d065e772944982064e1afdb1441fc432519005b395c115f2318d132386481cd53107e83a35797b9307b0a613
-
Filesize
5.2MB
MD52b43f1bae5424a79dcd52d5e3b252840
SHA12c57b6ee7becf9de6be293e4b8f99b652f320ab5
SHA256675ed57aa20678bc08d0f4e46a49a62176b64de4e95b8c6a60dac5df5d7c272f
SHA512d0060977d6fc55713ce2bdf08f2c9d6076783864d3097590024ad40597f8c7aecc6989f89577cd0b386f2b9ab378252d79ddcc1ead559f1d2df19ec979664899
-
Filesize
5.2MB
MD561af32b69d7962e561cf9597f0c8e176
SHA121b4fb1594ebf436c49849844d490a06b31a4baf
SHA2561e09c7740646fe566ef495e44af6e0ee18b2299f62f440f9953ae8d12ef517d4
SHA51223a034206e612225fd8538117ccde5b9115786d2a44afdb0251832090ce226a9f159d00caf479841a6526bcdccb3f0892cd311d67400ae82f6e2951aa500cd61
-
Filesize
5.2MB
MD54a39d086b4a39d1f7c3d76645e9ee75e
SHA1cb15f148527a8eef0d42f08281b4f416715e2cb9
SHA256e8e1233900c9b748bd2c68cad24ed6aece043e1fb61f229703d2fe37046dd36c
SHA5121b0b2d248499c96c9fc9d060ce385d431a4eb7912384e9479ec791b81c34b4e06fa057c32f2f1b34d13722b57c41709793d1ac2dfaabc7214e884b0b770ca877
-
Filesize
5.2MB
MD5fe1d5d3ace78578d6378fb03c5190c67
SHA130972279fedebb5fe1c0af0205bf0c6080c7199a
SHA2566398d727f05e76ed83a91fc7a323f6ed9d4c66d5d7b274a6ae0d1a01802f1fd4
SHA512c7f07689498f590ee9c5ddce3debf5d0a2d4e057f55aa9a0c091c1197cf59e0993fd7d2298761b70b3f6710696d205d6aaa1494f0de8eb32d7756961c063491c
-
Filesize
5.2MB
MD5da449fb13547ac3d3ec4edc5a4bb4185
SHA1a0994e5db3806e6540471204dcdaabf427b455d0
SHA2560db2fd9a8aace14eabc1c0a79e64e6242058dff0968dc0c1e542752ac2d5dc95
SHA5121dd50e26a8a5ec86b5fa66951e8c72d0a521d97825cd153fddcda38b6c23fab82ab2ade9c8d277a0da513bbe4ec2192ce767a175d21723b95fd1abde3da4acd0
-
Filesize
5.2MB
MD56f197a959ff7d0807f2c23888cb38a38
SHA1e7e6f9849f3a0485dc02a558b9ff79d7dbf1b31e
SHA2568e8d9c21684f82f2cab68edfb437ef639883134fb7d7e60c758df800cdec2114
SHA512e4adbc081032f7bf0ca8df62ec1e091225c002525dcb5fc625706163c4c621c3ed01ce23c78f6c13b878c6466ae9a16e347f79951b94b31895c6c3ee703dc21c
-
Filesize
5.2MB
MD54fd825f9351193718fb2e4dcd825c8c6
SHA14cc1355cd01fb00e0d0526aa6c733e410ba9b594
SHA256831822689e0e1900bc52294763eec86dc18cad3d7037dbe2da7b7be3fd0e7bf1
SHA512753d3404ade714a8fd6b52c69677c3999c3a9a9c05dfe41ed6976d3c72484fb140bcd1f5b1ba1933ad1153e6b409ffef59b44627412b12b48c299a2c7705bd1d
-
Filesize
5.2MB
MD5b40730e22676e9d548035d7cf89be5fe
SHA1f59978b196ec7ca5ea1b97fdf54b5d685e18f586
SHA25609cbfe5a1a37ea2720727523e57396a49129eea5ae1b48dc4d0b1dc5cc6bfdd6
SHA5129e9c4f4f337255d402d123cbb6ca38adb7c03bf2563338b2811cfcb106b8cb6e0619b71072345e6a0e0870cd5f32e338c19a707998d4b539d160199d838aa2d6
-
Filesize
5.2MB
MD5cb0b9d1d00c86582eddc65533eed0569
SHA10ecd60ced89793c57d10e8ef1249bcf6cf8ed2cd
SHA2562b521d25937d1ac9f62b1de3e24b83b7b3aebb596fa51cc40aa0f14590b72ef7
SHA5121560e20cac96c2f031592a47dddf6c6e65ea4041971252135fca4ea944bd066f9221a334b22cacf90b6cae874e6b93bd9a98eb64a0ea014b2bb49c5b355f727d
-
Filesize
5.2MB
MD5f341ea7a07140623ca0147623cdd2022
SHA11c3cf65c99a8288b08f40289020a6b8c072dc372
SHA25687066e5a9beb98ba5e7e60437239c563ea8c314a19de18c4d7ef54486a49fdad
SHA512259104f628f9174bf33d3fba288d870c5dfebfa70ec916ca1088082ff98124613c49cda25613e8c97b0f82435a40f05f2febc0b5f7e8f4a96da8f3f45466c9ea
-
Filesize
5.2MB
MD5cb27e8d79a3db0a35daa9c4dd7d077d9
SHA15707adcb1131242bc13114f3e5552ca65dad4462
SHA256a30a062efc165ff07b1d581adcd3f3d83cf65f9d55292e864fd2d9f9c91f3762
SHA512985d3ddc33b8945e5759c3eb7390e0a4b8e3638e4093017e33b5b15065a6fca2bc3df4608ac4f1dd46274d1076df0b1fed25ef8fa97303973fc3f0884f57df4d
-
Filesize
5.2MB
MD5847822a9347ea6dcaaf5fb0705a6aec5
SHA1a94de215b39170bc15060a87cddca04224a19249
SHA256c5f5653cd7da731d161a11b765edaaefa1090eb6aa7f7dcf97ebfe90a819a927
SHA512e7e39d2680448ebec58f2d3cc762a1fc7f80343e7927721dbc162e51d7d5fb7e7aabed5193d9dd6fc2c7fd93dd262c1c67e109132c4da200b67b1a025cdc4c61
-
Filesize
5.2MB
MD5d57b9d5fc9c0412bdf3634a0fe5a34b7
SHA140eb55d0b3cd5c4b57e99818e65c41a5b68a1490
SHA256c37057427298fd7dbdbd6e683c98b7bb3a4677c811e9865b383f30b3c7708bb4
SHA512fa1c6ab1c4164f775176a95780ebb6705643b1f81af30d51fc52ed6b45d0dc05cbc5bcb566451900350e58f873e2ecdf734b707492ac3b9ae9ab4dd0e3c5fd5d
-
Filesize
5.2MB
MD55fdc3f3c0ea975f861ffffa68ad91ae9
SHA139826ac7f869b7e812033de291ec5e20cd3c41ac
SHA256c1b8907e2d2368dbdf179eb21ca8a005d3371267729e935be9a428bdf8f1d51d
SHA512fdf07af6499f60479fbff8d939a1e12175af280739b45d62b89a86402653346713b4cd0938ab465df9aa1bacd73ee41e51f0e99f9f1eb7deb02c33c133f4a50c
-
Filesize
5.2MB
MD577e767869b471e7e6a25270a806ea60f
SHA1255dd611c226dcaab5c68c688b1053507771a4a1
SHA2567b2f5149149b40e9655b8329161dcbad859495450fdd3c5c6fd2b01fe83c20d8
SHA5124eddb9ad256f3a8ac35994f6b548bf4c7d6534c48f213f8edc26ef2062608a4d3f4aa3732c62d2f8af2b63600bcc789a6989d1dad6bbafafa48f8b141573869a
-
Filesize
5.2MB
MD592d4a31bae0b76ae14e6224756cc09b2
SHA1321366fc0eabdf9edccb7c104bbd1f9507568cd3
SHA2562e0f5573cc2f7d05029a8e522dc2c2dc1b2ed958ac6cd5b99c020eb13e537002
SHA5120ed3909fda653dad401bdde8a14108209f03009d4021b9f4c346d3da9fbcf5f588d00fa0e75248e8bbe789f37a0082c14bc8e8a399c30e04d543daa0f87d11e0
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB