Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/09/2024, 00:36
General
-
Target
2024-09-01_d25cba8d63e2a6142cbd7ea5f44be344_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d25cba8d63e2a6142cbd7ea5f44be344
-
SHA1
0c4118abd6911cd949af33b470c1002fbd1d0fe2
-
SHA256
f88a99ee9c4e057647a8e2bb172d8a4e60b3b0e255cb2f8824728078a8f61ea1
-
SHA512
af6082b393545bb37e51cf7734ae1f7d63053f6c5f3fb7a8b1c88dd42ef4bea6ef5d2c8c8d9a125c674d4a055fc525729e82803141581d04dcecb23d6451593d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lUw
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-01_d25cba8d63e2a6142cbd7ea5f44be344_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-01_d25cba8d63e2a6142cbd7ea5f44be344_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WqQbCyg.exeC:\Windows\System\WqQbCyg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NHxURPG.exeC:\Windows\System\NHxURPG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZPzqBoI.exeC:\Windows\System\ZPzqBoI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fzQrYjp.exeC:\Windows\System\fzQrYjp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UzWrtKb.exeC:\Windows\System\UzWrtKb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RuAbWsO.exeC:\Windows\System\RuAbWsO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HGpLIxP.exeC:\Windows\System\HGpLIxP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\knBgmDG.exeC:\Windows\System\knBgmDG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\otmtcrd.exeC:\Windows\System\otmtcrd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qZlxznt.exeC:\Windows\System\qZlxznt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eswlGyO.exeC:\Windows\System\eswlGyO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GkgUsKN.exeC:\Windows\System\GkgUsKN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BNhbiIo.exeC:\Windows\System\BNhbiIo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dtIbbcm.exeC:\Windows\System\dtIbbcm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XoTpVUa.exeC:\Windows\System\XoTpVUa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rMGvESm.exeC:\Windows\System\rMGvESm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eyMKuQp.exeC:\Windows\System\eyMKuQp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yslLwWU.exeC:\Windows\System\yslLwWU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oXZgroD.exeC:\Windows\System\oXZgroD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nvRqwqy.exeC:\Windows\System\nvRqwqy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\untlAgh.exeC:\Windows\System\untlAgh.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53211876bed8031e5ce417d8196bba65c
SHA120e90fd452932948d8b5aede6b648e49bc208a0b
SHA2566db438ab256a27a82874bb8ccc0f2e7aa44e233c67aa51c05d2f43b582f1a109
SHA512459f0b152dd98ba74b74b79ba3eab587c5d01d16bf889a9bffe1ffcbc899bf1ba96d8c82222ba70baafa66dc1f46bbe1acac7e62a8850efb4f5218c1f2ecd94d
-
Filesize
5.2MB
MD5eaef01c736133118187cc27d84d107a0
SHA1bd1e57e69b134fd1731a37d81f33ced62e4a8538
SHA256dd28aea4d199b3d59c59c12f5a4129c6ea98ffedcaa5e4fbaf2b6d08e288c932
SHA512d35b9b2e48ba67f136393328d4211312082bbc19f3c4ba2995cc834957b8c588a9b71773e3199128f26117f4dd11cb2859969f607d2666a39fffbc996f57f9a4
-
Filesize
5.2MB
MD5db9511003aec2824da432ab9e35d6c98
SHA1a1a11a8eac1f4674b980583683f1e8b3e2874a9a
SHA2563513be406ce62b4c2c834ae80b30c7c96f32e05314d513b3d08d4c906c3083ff
SHA5128be8e7a1c5ac3f9e89263120ae4ad54da2838e724b410a56a18a0d1614ea16a6460f277fcd094393cfe6887d93452e808f439950e49a1c51aab60490e64ec165
-
Filesize
5.2MB
MD5e6e21897db26b24eeb20aa0879a14037
SHA10329a25895cac331efc386ac4fb7480d9d0a11a6
SHA256f9aa8a5a17200e6bd903dbfa16c5f5e68ed4afd0cf6b48b409ce9eb986b1af90
SHA5129701fce223580577f18c902ab2d97da277fba670e7c9b07b3a10d92dcfb2d5dcda91b7a81f6996bf614e4d7f87d3b25b02475d17df9f54f471ee27adfd4a1c25
-
Filesize
5.2MB
MD5c520ca80e5f76b201b13c8fe4e05df8e
SHA120e511270f71aac3fad7a0b98cb1b7e0e805110d
SHA256299fbc5d389c54cfde3c5f2fc3ea268c2dcced79fe484dc7a3a3f1abb87b623b
SHA5121c19f56d6b6eefb6f6ab2c98b9333bf9c4d73bda18c9c00df7bad751c76598999b00acc810cdfe9795fd3c8e163e239aeadc0a880999d2e134dd76c9af2b9a18
-
Filesize
5.2MB
MD5d0dd4e3890a3cff38e7571c0ba1cd30f
SHA1a47fa91a481bb019582443bb4988bdd344da6edc
SHA2568bd8be6e53a7781adff9903aea4c0569cf0a1780c6e4375a634ab2baa7d6af7a
SHA5124611e8e1c222eeea0744b61c0087a0b8651d04a5513c51bee4f5e46bf3a15535946550fd6d853a4b1174419065c754eab7bf5b997122a0e898d466a7d9127a50
-
Filesize
5.2MB
MD586500c8e6031fe5cc034d012811de7c4
SHA1fabd1b4ac6a3e62ddeb8dee80eb3f88df0ec4afc
SHA256360037205edd17a1758307bdbc1e824da8224d7005b1fa20c247fc677a464063
SHA51235f109c4f01055c07eabe9cf4c30ca54dca72335dbb99f5da7511d47d1e90098cdff19983ce79ebd4c961b67b04734bd49c634d5b66d7d608806c7f33ad41a2e
-
Filesize
5.2MB
MD5300ed7ff7a1264b1c4a013b1aac8e2b0
SHA19dc95ed4e03d7a0b58f54cb9c769d3d4490fe3f6
SHA2560350faafe23b7756c80c7f4d3c71df7e73390141e06794ebb1b91014716ea837
SHA512493330d432f10c7ac05294f58500c1e6f49c688a4ee016820fe4ae103603945093ce15c6b62418368de0d08a4f76c5508dde875b74230ac3cc5bd1ae1c5b854e
-
Filesize
5.2MB
MD5ae0baca1447cc588d9cf890b7909a496
SHA1efc1ec6b67a0efb2500606362914e7b7f15b66cf
SHA256148cdf395d53209b0a59167e0365ad8378b29c339a51d1e981e6ae87a408c814
SHA512848e8d8e58c71c454f821149885cd6ec35603abf04c288703fc724ca6ea76c16fc2f0893b99bd212033483e574ad3ec04f4aae15460343a8af39bcb0d3722d2f
-
Filesize
5.2MB
MD5d81cf2a25798065dc9b5092b68433241
SHA1ee8c3f875690555ccd6709e03a14c00c273ceca6
SHA25644838df9e8d0e01113acd17cd7da993828f82fe68f1650e694fd6e9ca9ed35b6
SHA512b20ea68d1a23a7b55587159deaaac3956839b7b07c30b7e4366953e7cd78a9a97ebd74cda45aaf59a5a413b707bc2507d8ca0fbdc8c56e20591f57ec05a7454d
-
Filesize
5.2MB
MD55dcd8c3539b4e01d89fd1ecf0e05e563
SHA1817c42ed552bd9e6ec32d6766aa251dfd785af19
SHA256edd4fb2fcadfe81bab593240af2d0d9ff5b2735cdcb791fcc4947a27bd1f4a66
SHA512e6e4dee8e3dcdac9fc0dc4f0db199c0243e9218f992ef85746f25d1007571f5e43482febf3314448bb8f8291da12a430c2f44f9533c7dca6603ba0a6e064ab78
-
Filesize
5.2MB
MD5a0489ae820a001fcdc8e3c0fb1ee8029
SHA15b06d03299b7b83970c27f14e07cf11cc7a787df
SHA25690005b21e81271b670b34b6f7611d864edec416ead960294237569334abf0fa1
SHA5120e59a64761b755ebd43f770ac97f52af64b111de147bbcbad0ee02d9fa090e28b8f9167af0fd8e43646d5737853a67de7dcdf9bd0079a8ead5b31a8956793f7c
-
Filesize
5.2MB
MD57fa4cbecb956cfb072bde110059ff47f
SHA1958ec4db1ece170446b3088f49f856f24740a5f4
SHA25647d9b9a56f1d610bd3fb77273cbd1ce609b737b15f12e4812791e8a222eff3b0
SHA512e9fe421bfd3f7cd89e0f2b72b4e61eb5301c5e55ac26be29deb8bd506d400e772410f8da4567335cd005daf5179868d7703642219829efab4515cd0afd29f738
-
Filesize
5.2MB
MD5e4570e6a20ad363444a706e468e3c4f0
SHA13981ef8e97c1bca4f237ff70bd70a1c73d89ea4f
SHA2566f48c658ae4180c1721e903bbb2fdd471c60753ba9d1b951f980a72e83dbc0b9
SHA512a1eda23cb3b41ae672be55a2c6384b506ff0fd79acc01a7203c3caba7f0f7809cb4f90bb84317e9a55ca764b96b92c2a44edf1c8d2627bb7bdfbc371a2c28fa7
-
Filesize
5.2MB
MD5102a79cdf6864dc1df63bbea578a841e
SHA1283d599e4859c024ed544284e885859d44f04b4c
SHA256a357bced43563a56ccd04f8eaf4c64f4c382f3183d9e2cfdd33c2f0efcd27b51
SHA5121cbdb6676d90e68691d9fcd67b40a44c45e3a7331afdc780f3aa07967013bec88ec550947fa4a471967e371793568cfa9142b136c6cb60162fcce601ef85f449
-
Filesize
5.2MB
MD5c42cba69df7156c4943c6d678a7e229c
SHA1be4ab3531085c2c3c80f2ff10e2f92603da7a49a
SHA256a58cb6c882bfdb01ce9fb322c93a42e49af9e0e70103528c827b2dd6537563dd
SHA5121771e9c2fd30f5b79897367ba8406eb64998ccd64aedf887614faed7ac8686bd733ee6be14ce9a136a2239f87f97f59092d4e300d36bf0398fecfe060959392c
-
Filesize
5.2MB
MD51f45a543b291893a3902e367771855cc
SHA1c757799ee69b4c98491a7407bb2fcfcd0e9e50af
SHA256391a65ba04b3b29a01c2ca481bd897ea7120ce0750f375640d68b37d1c3bb13b
SHA512f39a00cfb19c2721269d58698fb36164eea1bde8f8a14a9d23f7a64293d702fe30d1d25192702f7d3f0768f0625be3c3d961eb7c8b7e6fdba1d97fd970f77c56
-
Filesize
5.2MB
MD5198d7ad27eb512f2673b752eb47889c8
SHA1d7b4d3f576df01c11f80446995f67f0d75d4ce56
SHA256687193d58593d4ca5d7d75b6afe93b83dcc68718d289df4fb9aca3d0bf85691a
SHA5126c754d9cf6a9dac39909fae005f5e619adacb2200788cc8407e87a2fa7d25f6cf6eafbc56bdd1e25a5d683ad901d3e688775c7514dd9bcea63a8c4c121fb719c
-
Filesize
5.2MB
MD54a156493b0065709ab463176f02171e1
SHA1320bb003f53ed3472b297e1cf6d96eb4187740a1
SHA25663995b5de282e5d329cd358fa8456814555a479ab2f14123d97128719f1e3f7e
SHA512736ab38d0a04c03d578eb3e5ea948eda5886503d323fd272f5c8183af86a60af65a980806a2c31daa0e53c7174c5de2f916a4b139cf3ff2316b6ee18663f79b8
-
Filesize
5.2MB
MD5c3ae495bf771ce272b5998385138797b
SHA18ce57ddf8163a15d2338365d16cae40937308135
SHA256d0f01943497b7f2d863a85c3b6ee98abf9e9ac44d524d91c650b6d904605e706
SHA512104ce37e669b3f1381a5519c43e27f747841d5b34b0ccda690dd8d78bfc495e236c64b7d253eef6f2c7112e9704d84767b25fcf55848a02df7ac6a31b34b60e0
-
Filesize
5.2MB
MD5c02ffeef0942623ef7927a688d7a9d85
SHA1244e105470e9a2493ae3851784b32c493049a33b
SHA256c00a027f16775af58ffae784925ddc589db55f1ba864539d384b2c35f3d01f9b
SHA5128f8bdb9af9cf9ce06a1d00da1c46b65c30dae4d42609b876b54b708a84732d84bc06074b9ac73ef5a8809d889da54210739fc139dd689362b17307575d11eeaf
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB