Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
01/09/2024, 00:36
General
-
Target
2024-09-01_d25cba8d63e2a6142cbd7ea5f44be344_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d25cba8d63e2a6142cbd7ea5f44be344
-
SHA1
0c4118abd6911cd949af33b470c1002fbd1d0fe2
-
SHA256
f88a99ee9c4e057647a8e2bb172d8a4e60b3b0e255cb2f8824728078a8f61ea1
-
SHA512
af6082b393545bb37e51cf7734ae1f7d63053f6c5f3fb7a8b1c88dd42ef4bea6ef5d2c8c8d9a125c674d4a055fc525729e82803141581d04dcecb23d6451593d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lUw
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-01_d25cba8d63e2a6142cbd7ea5f44be344_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-01_d25cba8d63e2a6142cbd7ea5f44be344_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\iIIRYOh.exeC:\Windows\System\iIIRYOh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KRMVJhx.exeC:\Windows\System\KRMVJhx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EutXVxl.exeC:\Windows\System\EutXVxl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uFuwURt.exeC:\Windows\System\uFuwURt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kLBeWvm.exeC:\Windows\System\kLBeWvm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HcHjmQY.exeC:\Windows\System\HcHjmQY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TDxWZOp.exeC:\Windows\System\TDxWZOp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QMGacaT.exeC:\Windows\System\QMGacaT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XWqRBsX.exeC:\Windows\System\XWqRBsX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bFpAKCm.exeC:\Windows\System\bFpAKCm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aYbTOOl.exeC:\Windows\System\aYbTOOl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NyUhRCQ.exeC:\Windows\System\NyUhRCQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kwHFicM.exeC:\Windows\System\kwHFicM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dtlcgOR.exeC:\Windows\System\dtlcgOR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vEoTEvM.exeC:\Windows\System\vEoTEvM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VODKRzs.exeC:\Windows\System\VODKRzs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wjvoaDG.exeC:\Windows\System\wjvoaDG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wPabyOe.exeC:\Windows\System\wPabyOe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iofKECc.exeC:\Windows\System\iofKECc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CjcmlTD.exeC:\Windows\System\CjcmlTD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\suAmpmU.exeC:\Windows\System\suAmpmU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD529c652bafca545b03cd75d7feb6bf841
SHA1e25aab3ed71cf59386f302a4f03fd8a3469c900a
SHA256395ac9a57344f203273f7465dafe432a31da60ba6756ff2d8dbba099bab13f40
SHA51255234b38726ab0173628e632dc2f8104f440e0f12ffe1bfa4d976ad5f265dd92cda6a20affa8d632ca78fa57de751d8d65b540d996119236cbef07826e5bed37
-
Filesize
5.2MB
MD52a2980fc571ba768b63fe06959207f28
SHA16a729cf000eea3f8c0c2710692f18c831c8e21c9
SHA256d7e3688849ab8d1ef84c2370dad08f98f9d19c5435768e97b3ac9bf3802d5534
SHA512a67085a91fb922bf68472a1194443e75469150de4b249873fe54d6b3bfe3cd1e1be7b48549c1fc2067936663df16028e937d8fd34d159468c8aa06d0512cff6b
-
Filesize
5.2MB
MD5a6ddf851e0275fa0844f0c32f1aced49
SHA158a04fee71188ac2159387c59b3f952788a22651
SHA256b02b7084093388651ca4b402b7a9be2430d6e8baf171fd7d9d044f934761cdda
SHA512e18f1a45ca018df1f0c7e75c7e2f9a8755a0ccd9f2d8575473a7679b8eba83fac5c93e60509199e76fe100a62636c11d6ac823255acb3f2fa30b96114b298241
-
Filesize
5.2MB
MD53b1c308e0fcce1824442590599043d48
SHA1f3d68bba2813e054695c611b3fc280a664d21674
SHA25690973be8bc8e78711ca2f66d427294d680a5c16cb17bc75d2b6c40278a9168c2
SHA51211502eeedbf581687445fcf2a5cb7f643ae249cf2978a49c4dc754f4e0b5e58c400c7687c2667c404d0246d16acf83db2e67be915a51a48d12cc54dd6b136c78
-
Filesize
5.2MB
MD5e101bf28e515ebe48fed0af2b0879b12
SHA15158c001c0aa595371c8ecf0d0d090765265b5a1
SHA2569133212ed5c1d0bc21091007c4a3a832c4e4dee91f59684c95f16febdcb02e0f
SHA512d0901c66a215a28e126e9690a398a6958c3ff413b1c2033dc92d9e9d37d2bfb02afc2d23187813c64b8bdfccad5a81095994e725795be818006c0a4e73486b58
-
Filesize
5.2MB
MD5a556043406a8dfef529a103bbf749b30
SHA1c789abb591078edcc412d9cc21b4b1fd72ab67a6
SHA256018b036df9aec9cc65bab882dabb13eb03ecadfdd48745d98c3593996e420475
SHA512ccb5c85d013c9f0c357417107b0751fb0f4a49c5a77cdf51a37fb229b6f0b996f800e7b3cb822bd0f1183abe0ea9dc59a2f6cb0dc01743e0e7437e39cc784790
-
Filesize
5.2MB
MD551275282b0f739c299fc40e055d06f9b
SHA120616e4206103898d5003f8b379bcd1a9beeba4a
SHA25657ff5bca01c753410d1e29542fa0b3860595c31be1ef1da65f73f274f93f6ac0
SHA512fae87f3708b2f86cc73c670a871234b6168228a32f0033d38f5b5f40b90491d1b95a1e596458e4119688a0fd5a0d8256d76b20ac759006fc468e24e29b36cb18
-
Filesize
5.2MB
MD52dc75448a9658852bf362a7f094b43b3
SHA180d0e99b0917a8eafec650436b8ec060af002fff
SHA25602007b6e40349f9b5405a343192af48e14f94d751478c089f9f704f05e415888
SHA512d6ae67e9fd750c2f5487c09e15a522588e489e4f13e1b83ed1660369ed38f652e54d0c0e8c7605d34317191f07ae4c49818b6aca965be86d863a3fae6e7042ee
-
Filesize
5.2MB
MD5d7d0131fdd1479eeed6d3af3c875d108
SHA125b622bbb77542cd3dab64fa3f1d5c8eb952c2f5
SHA256a6ad05e2009f70886f5bcb4a6c89265f6abf3dd0a0c5cddf25dae02763c832d0
SHA51233cf4ccabb7200ab5f786abcf6a45d97f0d9c43e1680faa1e29c7691133361a03a7e32d2389de6335dcd1ce3f63a49e305e3d992c2418d4098e7efacf9e78eee
-
Filesize
5.2MB
MD532a866c2b85d12cbb843de9e0a93cdb4
SHA1b0e94a25a4423b90b2d5ce4ad58a4cf49195ac16
SHA2568407cd149e1cb4aa5438ab3d21dae78a4d781a95aedd779b1b2a401763bfeb24
SHA51289acf259d5c33aee2f1ab71e71f8655107e6309a2c92cccb4448aec484028ead014360b2fe6ee644cf128c3f26977ab49d922ac2d689119f33a372c0ed1193f2
-
Filesize
5.2MB
MD55b85bcac92b8e7f90388acc6fee91ba3
SHA1a390e209dbd44e592709677508744b2e9d977a4f
SHA25669420b1f47096c1dcdfd6716ae0160ad0c4b2f2eb503e0026831a01da297275f
SHA512dd8429cd3d3802c1e4dd817678f62fb5f47a13d14131236224dbd3fa433bd7835b56406e40a54d6abdbb6eee0dc3aa1f04958d8d14ee14727e7096fe56d049b6
-
Filesize
5.2MB
MD5d7671542d7d0df303e33fb6b3c48fcc1
SHA138b2c2d515be8cf5f872eeba0efe8c8128cb7f1b
SHA256ce23af9b60b044d61719c59dbc64b7420815868d1cc30e784b1c2ca38f6ac5df
SHA5122955c1b2da2310fb90731b47a502615e6dead30368a1acd27b4f2f5264d6a969b171d17da4e170b649f48caf950ded3fccd5002b0e37d7a82461fcc7a4e758c5
-
Filesize
5.2MB
MD5ce9fa710cad6737eeb9abfa80ced3717
SHA19199ff93728a035be5fd4d9a065682ebdb7da192
SHA2562b25c446240b4bc59edb1f24431e38cd08fe867eaad3ee0f0228911ab4b1d53c
SHA512e06844762110ff0a43c9a7db0398cccb09c2ca220adfcc83d743fe680876d6de72dc90efed66f8b0f40a75e4778f20485dff5347978f2b255b06202fca8574a6
-
Filesize
5.2MB
MD5545080fe68eabed21ae057008e6a947a
SHA1f9b6bf8745944d7150b352c2e785c40151d03a98
SHA256c28797a489bb78f04a5f405e4bac90479da8776742a8b074fd4234e6004f1124
SHA5123d2ca5bdde48aff02c18d7fb961bffe138b7d714266494a261eeb778e0e1bb803295041e6ba688f6fe0c1f4081d646a2281f054221040717744d65c8c2756d4e
-
Filesize
5.2MB
MD59354345cbf044b7cb3266c0ff871251a
SHA15f1424c1c7b4a3f9b0cce90f3d2ec3ce40624bd8
SHA256b1d19d4933e11deac67fc5750d6bed08ce92e02ed422a2a351a0cbfb3c9d624d
SHA5125a4c8bef9d282536df369acf3f53d90fb81cc6f9c848da388b1b6d90de860f45038af50f95ad97016fd7ba4e5075761b4bc8bf8d5815cafb7ab77140d1a45b81
-
Filesize
5.2MB
MD5de62d93b2a9e334a2a45572393586708
SHA1f7c0cef514b25eb3a8341fe4c89c02435b9cdf28
SHA2568a44cdd726df4e3d2db5fd4ecd25a6c0e5e8e390b6b15628b0ced87074de4fd0
SHA512c9ed1b4252b348727b5ed6c65208f387126b1c786c3ad4e6f8fdedb70ddb13d0a1315178b303223d21fd27fe3c55e6f56f0ac49c8e8421a7ca5ff2b56cc454fc
-
Filesize
5.2MB
MD590086c96a956c2ba307593fc12c431b5
SHA1ac1485c2aeaf2a56f4c382b849279938c4e74b59
SHA256ecde95ca3ede688323e3523e24f95c26ce8ec2d2da5ec70765787261fdbe8ab6
SHA512bbce49384dd6607224fafcead7421ae918013c163d5074143cb2a3cf1fb09a1d4875fad6a14bde0d483274bb4b03613456971a229b0d50c425edf843e5dd33d4
-
Filesize
5.2MB
MD5ad5b064795c65aeff4042b6643e2c62b
SHA1e9a57a82a6895b8222860308a14dc83df0f4de45
SHA2568a12a1d269dbff34c20ae6fabb6154b3b7e8a3fa65ef44ffd9fd97338f2f352d
SHA512c7d8b44ad01bb71ccc1a68547c5f80bd892d27678e818c54d332e7b17e7ba4c3cd4446fe0d9052d2b7d821160c42b58ff86640f5b10dd4e10096ff22e935f938
-
Filesize
5.2MB
MD557a6136008b156e587e15e72987634f0
SHA1c55639457c3a8cec8c57c00bf202140e6e2cc880
SHA2562075523328be68abf35fd294f075281db9a53fc1eb73513909e1266116989690
SHA5128d61582485e697c0eccd95977718ff1b71e13a46a626be8385a558c352540a016a6012f85ecc2329789798f817c2358b384aa65f4cb84420e6fbb9aa9dcf298c
-
Filesize
5.2MB
MD590ba2bea9a121d0d4cdce99cac0e08d3
SHA1acb75df7cf7763f35674ce005db70b1e7ee4d1b4
SHA256ef6e80a949a0f5af8ce62ab00cd79e314625c69640e8d4b8aa3d040686ef7c3f
SHA5121f0894d2f02241f092183873f132efffe8d81e11a9a775e52ea5669db96262199be71611f60e94c3e0564609551034bee94e42b52609f53da12acf428e71cda7
-
Filesize
5.2MB
MD548546a54f60bd30972b272266d61b131
SHA158b01832fb9a0fa25157054cc0c9ad4208c4c7f6
SHA256bfacca6dfd647ec290f3dfae7b796073822878dc6b28f7ad32844a54db67cd95
SHA51284c94b95507725f569f9e181b373778d5b0fc8f695884e8b771e17a0a6952a93188e0a1e80fdc9c05c56f4c1f13a84aacda60dba0a91e551e4e6024dbc2dbf3f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB