Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/08/2024, 12:12
General
-
Target
2024-08-25_d045adebce54b55b783c2bf616f6ad20_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d045adebce54b55b783c2bf616f6ad20
-
SHA1
db4df8f67b7f592aac6c6ffed15e5164468f53b2
-
SHA256
e6ea8c95a3cafebbd4066c0c901401bae7f9df558ffee9ce3e793e618d59bfd0
-
SHA512
8a540628418b67d4e16d7464d966b7df739118c85d35f2d6876f6986a02383d7d3b5ef5a436ae7bf4b7eca74160f72b3e7904d84888348059252330fe6871699
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUl
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_d045adebce54b55b783c2bf616f6ad20_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_d045adebce54b55b783c2bf616f6ad20_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\OCbuMIV.exeC:\Windows\System\OCbuMIV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WNBDHly.exeC:\Windows\System\WNBDHly.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZDziCyT.exeC:\Windows\System\ZDziCyT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DoYwONX.exeC:\Windows\System\DoYwONX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QbZzAXW.exeC:\Windows\System\QbZzAXW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oGrkyEA.exeC:\Windows\System\oGrkyEA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gDpyCmg.exeC:\Windows\System\gDpyCmg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RyRMVRk.exeC:\Windows\System\RyRMVRk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nhctCWQ.exeC:\Windows\System\nhctCWQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hSPXUKp.exeC:\Windows\System\hSPXUKp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XAGqPTQ.exeC:\Windows\System\XAGqPTQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SQmNvpz.exeC:\Windows\System\SQmNvpz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tBjklRK.exeC:\Windows\System\tBjklRK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YQAJRJo.exeC:\Windows\System\YQAJRJo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fmAIFHf.exeC:\Windows\System\fmAIFHf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yEdXprs.exeC:\Windows\System\yEdXprs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CFtFEHQ.exeC:\Windows\System\CFtFEHQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LnnwQpH.exeC:\Windows\System\LnnwQpH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zqeUJSG.exeC:\Windows\System\zqeUJSG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\unLlkCa.exeC:\Windows\System\unLlkCa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KcOrBLl.exeC:\Windows\System\KcOrBLl.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4188,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5774f0cb2cd4a23fa1d48d132c1c80181
SHA1aa48f9d3be44af2a67c6d3c1c1a59c7bd99499bb
SHA256a39bd1f11d603cbfc31575f60b2fc0a7011040ae0b63058ae75ffbcd79cd0fea
SHA512e198f9ad8889d4fb3dd22fd4eb0aa49845c6b9b0439ee2c7160ecfa3bc46e9c4ca1fdda7810f0cd98ad5f0b29e5fafe61070a3ce2b4618d9490bf8822a3329e6
-
Filesize
5.2MB
MD5fbf6496a361ab9ed1d5c9d97c11cef85
SHA103e463cfa4139792b86330911506cdbc34d6c5e5
SHA2560231d42acfe4dc7aa3e3ab0514e5af4a8c28e49d54d27f4f3017baca4b8ba781
SHA5128b2a4ef68c47243b3b8b5000f5286ce75508ba7bee7dd0ae22c3c8f1d5f50f011adfa0427673f517a4ca6564c7cb83cebb1fdca523bb306bd559a66475816c1b
-
Filesize
5.2MB
MD5f6c0a489c2cd4d6844ed80c9f748aed6
SHA1bfb806b6e8296fe5f0e9d7c875f18e0b87f00419
SHA2568dec85bdfa268d7b27c16b5a3fcd56917fa205c86640baad9cc26106d3a6e2bd
SHA5124fdef4f575cc00d8786d9fc4fe5e807ae3bf0bc33305f7c70ca85aefffca6d07bcbbf96360e08f74bb7803e0f88ee72788fb15a208eb83bcacc9744ed3228b6b
-
Filesize
5.2MB
MD537a515bc5aec496a1855f684643ba4be
SHA162f77d0f44f2a349b5ded62c9c088140de2ac8fe
SHA256cd8f498e886cd1bfc5bb0c60dd4fd9636efa52941a8dbe69b3fa769ca3817fa9
SHA5128a06bf53516553a8c7168864f71aa5c228c3d202c22b35651904b113594a2e3ba92c429b4ec3b43969dce77fafbdbdbe00edfe24c0603d787d258e7cf3896a58
-
Filesize
5.2MB
MD5fdd9016628fac2a5479f1eff14eaff3c
SHA146c1d2c85a9d3cf6ab0c75fed4eb8203dd3da7b3
SHA256599491e0f3e1f8f637956e3e1dd030f0af6ed0402314178f545f77ec6d928153
SHA5124057562e9526b7fd82e045d158baaa619c5620553b300feb81143e79dd5cd4142a786938ee0be63f90152b5731c6795c486441b1c9ec22d95c1830a5f3d2a8b4
-
Filesize
5.2MB
MD5ba5a92ea4c04fe953d0000cf056195e4
SHA1a021a62001b9d60ed4c8cb6b7ae94a2ea430a4e0
SHA2562003a6572d549fdd60238de4661530fde1b273a30146c7baf931c505828f9bff
SHA5126ede22ac42fdfcdc584d043509c37810af2cefd9834af00cf6ef60780de00016642749348332b5d9fd779f3e0e3be3e498a631cd14d3ca44b82f45f41099db64
-
Filesize
5.2MB
MD514c37eaba13768d17341d1acee2017d0
SHA1ef2f348a3a69a6fab10ce6deb40dcf0056e5afea
SHA25630be4eac52a598ab5d67c3bce77797ee7f13b7b3556541b1de4d4589fcb141de
SHA512b7e9c5e2f067140cd580fa02426d8e93f8dbffd69b738d768d39a85a5639d0bca49a13f0ad4dc609de8f17327d29e8a80b670c762ddadff08704e69ac843e8c2
-
Filesize
5.2MB
MD578630a2207402cfb5ec1cd09394e2353
SHA1aa365d1a6e588d380d9cd970e38657bab2bdf5b6
SHA25635cedbad4e69269cb444aa24be26f5d2460ab5f1ae3ba93a3ef5b5b921fbb11d
SHA512d6b9f8b62e5ba6ae943e51afc388dbd823e78a4187505c614026559e5fe907678d83c9523b1f5f864cbabb1b4b7de44f697e31d4350025e5c587ced03bb8e9a5
-
Filesize
5.2MB
MD5d711e1dc3975fff26675c67d4b23c3a7
SHA1145e5e3bc19076cde00edc9dc60e6d1a1d500919
SHA25687a9c2401c866d13010b83862d25fb0ff21812119fa657ec8d730689d3c5b14a
SHA512e8ceecbe45786a1e667059613c9ca4898bb27991f68915116a02106712086888262155a779b5b04f72f15b064f5d25af4a4d4fb6674e485fdf2ad361aef1683a
-
Filesize
5.2MB
MD5714be5a14d22b9557344a0792768d263
SHA15493fcc1da2e5bf17c2e6590797c46433c8f2df5
SHA256eb04daec749013e2542a16c746f7de3fa29fdd9e0ae4d96a4d49cfb9c67bae91
SHA512aae4f0d3a3242e4b9bfddba1d78238bbbc9c112450a0b7b4233d0682fa673dbe7712559a92b4a85c796c4da9291c4c23440fcde8576aca13e418390a1b1f9881
-
Filesize
5.2MB
MD53d2ecb9762069ace50e9c146e7ab9831
SHA10f764348857bec9a0267f144933a33d41afa98ec
SHA25648aa45d65e0fb5f9e4a39c27a1266ffee1cae0297b8bf743065742e1f49a97c3
SHA512f03362028b948bfb59dc6bc95ca2eeee2a3e70903b146b81bdc8ff9324c133a1a75f8f82380b5efbeb991b742cdd2e6db73c1c341f06f03501386ee2bcfb6e24
-
Filesize
5.2MB
MD57d15cf03de72f823f0ab2dd8d9690df2
SHA1e1d2b1525394dcdb93d0bbbbb1ada6f16ca0886c
SHA2568e2bc093652a45018b9b83a60d6dd4f88717d9b0ab6dc195ca83edfc3f525336
SHA512df14033bf615e1911a7c8ec064aad3b06d995c7b8469e27b8ad1d99874c194f760fab07afc4242e58a38e5abf7f67f7cdbc760cb985d1a15d9f30346badafd69
-
Filesize
5.2MB
MD5f26b8631aeaa7030c94a75447a3fcc51
SHA16c0d0f3e5771778215256ba8fe8b4e61797d5d29
SHA25608032053a9cb8f24ae6a680bc21bfa96948725966b97a7f0a73b670cb16c6730
SHA512b478509d4652559811673fd231f84b28d38e471b0ce2339041731bc29bfce52f9844f84b57ef4d34c3ee7c695f27ca77b198bf1eb9124172887ade519db486dc
-
Filesize
5.2MB
MD53d332a9bcf1e7b882f52c1880cbcc6a9
SHA1d53aee9205440d9406ccc4fa33649ff8718a82a5
SHA256b1553cf20e033151477c541e97254850efa2e9acbd2ec196932318888dbd373f
SHA512091cf22e38b11ea9fb2b2df6f5ef173c3fbcbf99861dcf0287ec09cfbe94576c00c8bf6c097c2192cfb2bd373d7c7c9761159f55cdff55fbaab9241ac9ad2ca7
-
Filesize
5.2MB
MD5e3e44d57526f4debf8034795fef81eb3
SHA11242c50b3221e0f256ecc12bd241271725ef3f10
SHA2565fc0d7b32df55b8d411518ea8b21f6de879e2d6036351dc41e12553c72540d67
SHA512b2c3b3de1e6c8f67286126f5082cc9f72a9a66c02f4b3dcdaecebf84fb4c846a053b06a0f95f79f11dd705a69447eb36a20f5aa7b55d33ef01f7fc9cd7915d17
-
Filesize
5.2MB
MD53d8ab0e37e857f795cb62b185b4f92e4
SHA13cc5cfef2c441d6b807eee434a295e225a20687b
SHA256711f326ea8354a2bcb7654f223461988e7591dbd4d6af6749b3030e827e8a0a4
SHA5128efa105fcf8ac39508172a207a28fdb0759f305f72a77d2c2e3a7670a2a6d66ea5c6362950cf6deffe812d766c8521b9fddaa48e7da354529fb21db095196123
-
Filesize
5.2MB
MD54ed767e69463471a06af1ce14d55bbb9
SHA1a0dd1717bc6e3cc278d9aaf1a4a82c140dc48d91
SHA256598b4421b1e045187513b42d1e571055f4eeec7e6d6ed7bcd23e53c81fde9441
SHA512e758e8de1583fc36082c08b1122ab6c19db8d4e65c0c83ca4a49e2084149790d92b91fbb728ef13a9a74902c57c77cb2ff83fbe0a9cc8e75629348fc7a71ff26
-
Filesize
5.2MB
MD5b8300393e9bd906d631ab53bd246f262
SHA1eb3668be27aa63a5ef498f46d24d33b4a3de3404
SHA2563c1f308176ceb6ee39c3e22fadfd16eebc12148ba2471c81fe2f81f3fc430d40
SHA5120b05bd56551e5a758ade22baa63a57b22e96dc399df5b09e1aa5f1e7bb10f25741cee9ebe4a576b63f5bcdfcc84d34398e12456cf0e3d7f0ad0eb3ad48862fcc
-
Filesize
5.2MB
MD52b7cc5ee09ec347c16972192e5e20f09
SHA1b33a757965a2e78ab86b6bfe729e8fcb2ecca09e
SHA2561ddf40629589016c14daba4d8f470d0ea8d7bd656d5fb1874780a5f2acda35da
SHA5122eb4b94d69158fabfe97e8711fd6dc7e67a930942c3d59230589302b0b33373562eb39259d06f50dc3bdadff63277815aa1713f2056c1a0a937757f9886c20ff
-
Filesize
5.2MB
MD5cb44b89d306eeed2012ee3e391320af1
SHA1929ac37e5539ca0c6e23a7c26eb3f424d8edaf7c
SHA25604aaa3a59f6dd6be70db225662647b237e856a49f70a2f4c637dd8a0e1a234bb
SHA5125aedade1edf6675df9b789648eef3a1100eb279d3cdc4b83160d63e96e515241e0ca4402572937b5370ab23df9b160b1c0d12c5277f2243202999a5fc575c04c
-
Filesize
5.2MB
MD596f0a336199b4e60f837222ace5e3315
SHA146ef08928371577607e93c31ca3d7eebb6e61573
SHA256c9b5c99ccfab7ac5c3053b71a3ede6c900b9ba5d1a1e5f8966a530aa409c09eb
SHA51289aba7aa1624935454db31abf89079be2b40b7dbbef8f02f298aca8298d4d2bcaadf7c1ac902aa57a7cf7d40f526f2eadb817e753dc842a2ff58b428526edf53
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB