Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
29/08/2024, 16:26
General
-
Target
2024-08-29_42caf276ea16047308a3ab558f2e3b63_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
42caf276ea16047308a3ab558f2e3b63
-
SHA1
71242578289d232270728ee988999a98c819e56f
-
SHA256
32015a889671dae053521b9c35923950c13038c742edbc940e3f94c30f4d0cd0
-
SHA512
bcee8e0e2592e22fc0c25879a090e75e2a13a4314ace257fe701e949712b79321cc85509c9520ad37b1060b1af96d024899edd7df70b46f027592ccaedd33033
-
SSDEEP
98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lU2:T+q56utgpPF8u/72
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 58 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_42caf276ea16047308a3ab558f2e3b63_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_42caf276ea16047308a3ab558f2e3b63_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VxADEuZ.exeC:\Windows\System\VxADEuZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nlYQACE.exeC:\Windows\System\nlYQACE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WrPXvkE.exeC:\Windows\System\WrPXvkE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lDpNRjy.exeC:\Windows\System\lDpNRjy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vBIDDrW.exeC:\Windows\System\vBIDDrW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PSackjY.exeC:\Windows\System\PSackjY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fxLYCiu.exeC:\Windows\System\fxLYCiu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mFElQZf.exeC:\Windows\System\mFElQZf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BkWVokj.exeC:\Windows\System\BkWVokj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nHpgbho.exeC:\Windows\System\nHpgbho.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KWceVej.exeC:\Windows\System\KWceVej.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sFRYFFV.exeC:\Windows\System\sFRYFFV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fHzsxlh.exeC:\Windows\System\fHzsxlh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NlvYKTF.exeC:\Windows\System\NlvYKTF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pINFTGH.exeC:\Windows\System\pINFTGH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pPxGwWW.exeC:\Windows\System\pPxGwWW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dENTMdc.exeC:\Windows\System\dENTMdc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OnwuAHn.exeC:\Windows\System\OnwuAHn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ygmzYJX.exeC:\Windows\System\ygmzYJX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kFgxFbb.exeC:\Windows\System\kFgxFbb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BtpLSFo.exeC:\Windows\System\BtpLSFo.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD54b1aabeca014c625ea3e620466921d16
SHA12c8fe5e20fa8447fbfac26e4edb32a41c4d48964
SHA25674bded9b1956ec235a0c1f6739ad2947d37f067a96f2e4214d67778ba8c18eae
SHA5129a5d24316f24ebed569d5dcd565efafcc39c7557a3e37294fe59828bb32e506f87b75a8dbc8ff5961f228fa6efcb3901acdac2dc7353656e76223dea0ffcae1c
-
Filesize
5.9MB
MD5786f81c191a64564e69fbdffb9a6d6e8
SHA13bfe3c16860b75b27299f1bd08ac0d5861099a8b
SHA256558cfdf9be18711fdbbfb61341bff5226d7043bb2a33ad4e9d7ea68eac4dbca8
SHA51204b7626509f19a8819f5911711757f99df2c0bac6d439751926ebdaa140d10bb5dd44b465469f607e9cb939ef85b9136acfe2c86578763eef06d768a2f955488
-
Filesize
5.9MB
MD5f5e5b866fb20b41b8790df941f0ca4ca
SHA1023a3da7fd57ecef18acd3e5bda23de8085a7250
SHA256d8544592c21607a3c95caf952a4eaf9ae571df7488d1b71ac4885e502f24ba53
SHA512403a3c0b5ea7cd95503d72aa91ae57dc7629dbeeb5f404f9f2af4490ad676c1a28a87914e76cdbf474818ce8c07a8ea1de103fedde27abc43d76b33df5c6d4a5
-
Filesize
5.9MB
MD556da5d08c8a81351500df63a96d5b2ac
SHA1ffd86411974bae98f2551d3797c5c53c007d5f26
SHA2568e1b277cbebfbfd120aadc65a8cdc0d186e639e35a135d74083fb01515dcc9ec
SHA512de034ffd07ff613b927220cdbcaf268dea5869e012f6a9540646c91f328b2f031d0fb91503741b7212a1ca1ff34c601c16c624422b3732d65b5b19194ebe4e49
-
Filesize
5.9MB
MD561c2fc53ed320fad66eb5e3748526729
SHA1cf1138da43170ac72183993744a49e3bc332f25c
SHA25637af92d1813b20c9871e7a1603be2b96c18b216d3b54a80b5ac20dc682154384
SHA5127fc2f5539311caaab2f9a04bb37589dde0b0cbc0d76b39cfe81ec2267ab0f4bc94064465eeffeff11808724b5fc09e775689b3bc985ffdfb6f5b6ddd539e46bc
-
Filesize
5.9MB
MD5f57c697700646345bf4b85b7868423a4
SHA12a66bbb79f5c4c1de3465e247b9ac35e9ea74c63
SHA256dd63a3391871f98b69daa394fbd152ce10a162cf62bc7481206e124f61a96855
SHA512bc43181aa4bd3aaa0587090e0aa201e845864fa70dcb8b10932796ad4dd3a56919bfd49b61ae08912c1f68fca691cb5f92cc5ff323c9d1d9ceeab419c3f9673f
-
Filesize
5.9MB
MD52c4b0834088f233d3800e2fa7e66b3f1
SHA174c33b67a6fcf43961e3e5d224823752683bfc9a
SHA25659fde4779d556469f1005c6d66e50352ad0155a7e90373fcda452ef5510ef8e5
SHA51222778452d84d2400dd37d3968833fc3ce99d7602e754ee78606818daa10b97fcd041c7542b4aa29d1c450b7278fdc099a73743674127bbbd9630bd3233ace2eb
-
Filesize
5.9MB
MD546853726f84211a2cb866610f1f60ebe
SHA14619318938acd8599d714b62d3b6ac75701abefb
SHA25696b7dfea5a5c3ccfb29530332667f724ac48841cc5ff689bafde417d75387e19
SHA5126503337ff6da76a701ecf5d1c665e9fa6d4126c071b70ad6878768909015b5335e723ce02e5c4082935dee158f305c96bc8c4818719417157213e8a938245c6b
-
Filesize
5.9MB
MD53ac2a279172ac1df515d40f057874bb0
SHA12db8402ea12212ed9a252ee8669a64cd503610e5
SHA2563c0feb95fa412f0b3929b480e896adb1864ca2f3a4abdc2b0803a2b65d01ed85
SHA5127a217816a0ca836841ed139eb9b6195b78fcfeb3486381963c05619cb91325e4b617de72c33c706eab4f8c93d4d8259a5dc418236e34d4bd3045760dc820f619
-
Filesize
5.9MB
MD56a5443e1233d9b603734795f5ac19143
SHA103319e2130518cc64f138d5f0cbb3e599dca04b6
SHA256cb02613c76a1a15ac13392d3ec05935d4de824e8f1c1763121451b315a99343a
SHA51251e03e15ecc1b02daa3e8c39d7933fcd3c570230271547533f55deb4f24510877e9d2f9cea11a4db9d9cedd30a7b398bef9a77d1cfc567ac89cd405428786b86
-
Filesize
5.9MB
MD562459fed5a360950ae5664e2de655c04
SHA10bf980435af868a1e6170d3d42344f73e9260355
SHA25691fdbea426c6ecf203ff83b6c0acc375c2b77aef6a3db62a595e3b7af19679a0
SHA512a47db81a2b382727760233665a5dffe3ce283c8619dec47dea69e54f07b924c66472937255fa621aee22501fe780880e592744d712741612ec01bbbe3aa207eb
-
Filesize
5.9MB
MD5f686cb6bd179c51838ae9e7822a630e3
SHA10b49bdd5d97994918f7ffec691fa66a4391fa0b9
SHA25672066e18635000772b76f46929566ea8cd20a223c9aa1759e3bd2ea9d36c7295
SHA512ca685a1388c152e1139513dff48d2f5134fe09dcd6354b2893edfd104cea057872752602f303951f62b32dbf3d864761618e11a1e7eb01aa7c1ff9e56e9d5491
-
Filesize
5.9MB
MD56bf43188062edb2e6b99a2cf05d2bdb9
SHA1caf2492b17c768f564a32d2567887511d3ece5ca
SHA2566ade5cac8d917120a46bc055a3c84df24186cda598213f625ab58eb5bfa5dd28
SHA512f1a111f460b63a48b68c3f4dcf74980f63f138579b295a9bab8588a4cc987ad5f11ae8b9f0e6cdd48e4776eeff79b052b05cd0b9ebc4423cf7117b67f2ac4f76
-
Filesize
5.9MB
MD5bba465393ffec2868e32bde3ae7b9807
SHA1b197c7f92466a24717a399796ca2608ef8c3d13f
SHA2569ea02e4ce445c2ef4fb8e0ebb0286daf7ee797e45174b050c6f4cd10e1b0725d
SHA512c774eeca406a9e8ef82d912e74e79e39393284dc4b7490a1983f71100a938d99bfb85bf6521396f1b931f6adf0e4558d78aa61bfd71ab32df8c77c9a5ce01757
-
Filesize
5.9MB
MD5db93705a74e8b27b80e83c5b1f57936a
SHA1564992b0fe8ea0f447747e4d667d0e906528d7e9
SHA2569184258d29928e310ec3a6f7605cb25fd5cda0397b66f9d464a0456a0dc557a3
SHA5128434e92ec26c78f8e58a94ebc1b992ce04db5907a6dae0e90bdc58a8289f3a5e8698cc7577e9331cfae7209e148b4a444e9ca2f98cdefb877b4bdf338f173831
-
Filesize
5.9MB
MD5ec537d33340e95993ebeb250b5fefbc1
SHA194f069505c6d9206ae32cbf4f99f19156d335511
SHA256304b6ad53bb9531d18c1b05c96e9f49bb2b142efebdbe930478e29312c18b13d
SHA5122988718d43d98e8e1811ecbde403f401ecd6bd0812df6cb006d9f9ad6ed702b27260f3c4b55e49d855fa352942fd290ee85aa542d0e75d51361f2ed9d90a7aa9
-
Filesize
5.9MB
MD586b14f5158f2a3a89b34eea7e33bc254
SHA10e97f44791146e4b94a90d2efac4725caa44c6b2
SHA256a97011b49faf8e498906fd786610cbee6e78688b805a2e638398ba91437e5c69
SHA51255747658b655dab5e92b7973dfa5f26136b2537c096d06aec8321f272904dbd89b6e85e6aaa30c1bc6a75cc42e9d111f235f69dcf1e4940d2be0de1c50a8e4cf
-
Filesize
5.9MB
MD58314ff33ac2e9a23a3d9af4152a5e75b
SHA1859386bce0adc2cff7b1c2c84322a274d30165f9
SHA256e71bbaeade2ba68918f40cb57db31a04d03ccba7fd13deae805ab1e4f6b4a8b9
SHA5122e0c78d650f73e35e74be24143bbb7a86eecbb5022f354c868c4f23a6a93c8a4fb7d1e2360c6a4a068feb789d718e62efd32c6bbc1184845a67f66ec3f4db0ec
-
Filesize
5.9MB
MD50c850e652c2507094ad630fa41ef8f98
SHA1b2613f8d2d8f41536ed84ac739f2e3941d213121
SHA256cf27ad170476f114a7ddbc1bf3e0e2b07d5a0a42b3eb09701ba9af545ba37815
SHA5125a0091652d174bd70a3d8d409d2bcfeef645d67d31644b5d9ac2199988da925cc18f4cac38acccea5d275896c3a4313b419c8c348d99fe79920ba3b509e6adfa
-
Filesize
5.9MB
MD5d2379bb063bf860ec8ce0c9d178a0b72
SHA16dd77f71c42976399bc030c3cacfcb743670c27d
SHA256bcab9f49a249dc95c3a6bfc0a055bf3fa13becf7ba39ce06e708fc3d2ba4829d
SHA51227ec481349724e8d94e7c0be8910646a1a40dc18bce9112009c43fd041eb1a3e21e72eadce54e787fbd7ca8f97c7a86d9bfb9824535b1e6ad368ca010cc38b8b
-
Filesize
5.9MB
MD504ee371e2f05190ee53caf53a83f4f2f
SHA15bf920063618e0e5caad1d5f89fe441ed781bcc7
SHA256cb47bf0456555759f92d9d77a6336219c5f0f55adab181966e8c95dc5cb79ee4
SHA512fa5a9146d0adebb1333799e97e4fff292c988a2842c2c7aebf73fffbedd74e030aee01a1c6b67ff12609b27bd6d70395fd12d2de52a89a382406782736886b3e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB