Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14/09/2024, 06:53
General
-
Target
2024-09-14_f02eb19f775a3ee6688b8495d8a20184_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f02eb19f775a3ee6688b8495d8a20184
-
SHA1
af98811589dfb667b6b6382dfc47deed0af091c1
-
SHA256
96ea748e69195a60775f54341db948ce5d7c0f043013aa7f104e7fe986aa97bb
-
SHA512
656f302ec967d47af88345c9d5f61604991dc33eef7627bb9856aa0b0b67590bdee2d068b38505041243fd7fd3a99911ddb64721798443d3e9bd1c1b54259ba7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUB
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_f02eb19f775a3ee6688b8495d8a20184_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_f02eb19f775a3ee6688b8495d8a20184_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YScVjMV.exeC:\Windows\System\YScVjMV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qhNUSYN.exeC:\Windows\System\qhNUSYN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DpInBuz.exeC:\Windows\System\DpInBuz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KoDpsZC.exeC:\Windows\System\KoDpsZC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XYCtMAI.exeC:\Windows\System\XYCtMAI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sikYrbW.exeC:\Windows\System\sikYrbW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nlGRfzs.exeC:\Windows\System\nlGRfzs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZFJnKjS.exeC:\Windows\System\ZFJnKjS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uhpHtyi.exeC:\Windows\System\uhpHtyi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gZoKjGD.exeC:\Windows\System\gZoKjGD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gEHxazl.exeC:\Windows\System\gEHxazl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gqUMRNA.exeC:\Windows\System\gqUMRNA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jGtYfPm.exeC:\Windows\System\jGtYfPm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mcXEnSU.exeC:\Windows\System\mcXEnSU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AbWWpzq.exeC:\Windows\System\AbWWpzq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZyiDzjX.exeC:\Windows\System\ZyiDzjX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\olDvtaB.exeC:\Windows\System\olDvtaB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UiPwjcK.exeC:\Windows\System\UiPwjcK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EaBRzdF.exeC:\Windows\System\EaBRzdF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\juLaRsw.exeC:\Windows\System\juLaRsw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nZYQRps.exeC:\Windows\System\nZYQRps.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b25d2b4515f4fab6ad22c8a9ff039def
SHA1dfb50089f0c2bb502b1c264e914b77ec6ec64a0f
SHA256d93bb70b0d22dbb602dcc3d29cee5f7bc1b6d79138a8555d0762c343564fe1d8
SHA51270625440ddd99b8c629370eda4e045072db048654db46aa48200e09312d1c1c897087c1b125c9ac184fa8eb67f8565b37b7098eb1a5a91edfcd5075a785323ae
-
Filesize
5.2MB
MD5bb59134b9039288098c18fd7fe73aa58
SHA186c948a5bab15ab24be788d5f2c55a7c5751c760
SHA2569261f68277646f0b3f86d182b11a12bfaf98d4258405a5b3f75afd1dc6f13db5
SHA5122bcf548e30aa74ec7515dca0d662ae0043012348e0a59173fcec8afd5d45f9ae5dc493941082bf5347b934418a31e5d32ef65a84c7b20e346b34b0ed29be083b
-
Filesize
5.2MB
MD5e8adb7414b38ec1eb18f50cdc949b62e
SHA1ff9808dcf13c8c5aca94015f1816fd986d7af867
SHA256261289675c81512033822f9962726822df8a4fff7618c590386359be3ab28c92
SHA5123a87db1fb3ac99b268a5497088d13d83f81cfb57d589becb5d6ac9063118e80bfbeb73c882917ed73badf1cd509c4a1629e1bfaae04036cc2e584e3c0ee94990
-
Filesize
5.2MB
MD55421dbae2a63d9955b08dc1057fb65ff
SHA1fbae27763eac28aba0d7038c41e9668fbae978c1
SHA256df24feb5307d35742042dee2fde999b7b53ce4eb9f0ae6d0fd9f3bc2bbf86831
SHA512505566c5602c0a5cf09b4b6dd86c3a1810e541615766b78758f45823ef003aa950168ec2a9ca6a4b7bdbb8ad0719e49c253afcfa929791979e39e21673836ff0
-
Filesize
5.2MB
MD593a6e95f6597699deb97922fbcf1dc06
SHA18fa008c298c53124ede3f37cac96ff74f98afd9e
SHA25602834f147ce730a801cd11ee48cf9761c8fd10d32de9ff244860e07a17efd010
SHA5126d3023d22d1adafe659f4596a58ba8ed6bb5dd88cf6f5159d34d6cafab9ce718f1e4814e1714dbe34c5594cc8a221b078ff9dc3c42d3828518f8c9e8be766a99
-
Filesize
5.2MB
MD54910151fac4162d425fd80e4e3d4ce5a
SHA13e785959478ad95dc3f993892706cf4d8284420e
SHA256eb2d9f81abb9057c34ca6b8ca8aa5b2a591adc9de833c01982ec9c164bee2f0b
SHA512558949695971c9e73d7e512cf3d15cbb1b59580fb8d58a2a93390170c7e4f8a20302c9ef740e6008f4a6df20d911a9fe4bd577daca52deff1317acad50702529
-
Filesize
5.2MB
MD5edde4e3c051945c9ced59cd17bbfb103
SHA1946f6cbb564c94b89eaa0b9cd3b189ef6e2ea1d5
SHA256255e96a9b64a353c5c153c9218ac27225e9ef87c0ceb2caca720623c17513ded
SHA512a97e12aa6ef19b86a30975e1c484bdd3595ec50dfb5d71c1aed8cfc9b9702e59120f25805087ee303992ccc8e7f302f05e0f3f4c4428fd1825191bf2a4113abe
-
Filesize
5.2MB
MD5e283574ca34e22159f4f21a298f23c39
SHA101adf833769dd43b36414d80f43b7bfbde6887a8
SHA256235dcc8db268911f056450524bc52a64c8afd69d34e14a9aa7900b1459c21ed2
SHA51212b0d52910fd227f10ef5bd71779c2df06e5b2c5e730606b432c34e4fd663b7f740a2e5f5ed8ea735cdca3b1188a090ca92ef4b8bef5a683d36bab870388f000
-
Filesize
5.2MB
MD5354164bb12b5245a7255c719b06b2bd0
SHA1d500df53a0a37d702ddd77388d57bd960fa3e711
SHA256bf6f2e95983ba38144f2eee2958e7b348cc776f74bf2a918191d05eca7cb4068
SHA512da411477e6465bca1541ab72a18ee26412d5f1129ce3400f938a633dcb667a514b8ec8401074838ae3dd9d0899943fe496c660611044f6945a60be2b5170937f
-
Filesize
5.2MB
MD5dcbd8e1860a060e9f55444056d1778f2
SHA1d668945da11ebc079a6d06ab671ddd2bdd6f8a04
SHA256d655673e0d1fa173cd480a2de1a90722088d98727b5a80c55d122bfb10b1797e
SHA5123201c856ac8b22512b554aee860ad9eb422cf0c2897b84ede40561d4b95064cd0acef32d61f00446115f95671c0a6892d476c7cce03201b2aff02ac45879e131
-
Filesize
5.2MB
MD5f0b48b10e3938421aaaa39f21ecb9a36
SHA1422733c5a99d4abbc10ffb32587ccf6e4930213e
SHA256063aebc4882716ff7a45f498302949a22c2a2413d621ce5e0d0ed06230ae9063
SHA5126b205f75781d16fe7e2635bddcec8abaff884c4d0e98a87345d73c10d9e22b0e7cdaad38b5ad556e51ab797019e87f02b7bacdf2c44cd723490d0618539b78ac
-
Filesize
5.2MB
MD5f97e694511a69a0e341ff2ee83149b51
SHA194eeb00ac93b16d02351738a6854064841c2989a
SHA256dfd6a1292c73943484470ed9f990ddb70afbe42fbc94b3aa4dd606acd365c25f
SHA512615cc9b1b3b45192dd8c7a97cc9a55f3fa6a8887d7d21fcb7e2b0c0ad4dcca5166829a4321547918af9522eb7ff17f0056e07598834822696eccb26e7fa8f843
-
Filesize
5.2MB
MD5fcfde694875277e3e90ce9ff0af083df
SHA15b5c3f7c57146a797c06b06e2d91b77bf6908695
SHA2565fe4ebf5ade793c75f1de129ccafa8051faf85024cd8b974aae1756b5d585706
SHA512c7460382410e5e5151a9fa8caba06f16d679b01825f21e8ed62929d7e6e2c998526b3089efef4bfd0a50e13609af181f7f611c2d4702113828d843d7214f95e6
-
Filesize
5.2MB
MD5e703dc07b3dc634334ee0ea8b9415b0e
SHA1c66f1042a5fd2f70e4e791b6c1994619683e8424
SHA256e1acea667f2792f9735fdefb661e6c3d95371549fa7c8e77ba5aaaa8e66c7d09
SHA51282ed7fe169227d74e4bc01517a1b62f34b9fca31acd147c78e178f5c34b75d8027f6dae8714e15614c3aae208edbeff11d2e99bbb1daa6c8aa11893ba99bda59
-
Filesize
5.2MB
MD5b7b25f6a718b320d7683f4d9275dfe37
SHA1e5110bf74d59d297152e4cda789ceea93b041801
SHA2565ab0acf0096880d65a67c5c0bc9e511e60cf20b5143929ffb9582c3078db53fa
SHA512a8e4ad8133ca00857514475df9fa2042bd753f89020e2bfa0704d7028c4a16c9a4f908fd860f73c38a6a7932f19976ced7301de4652bfa713a3363508a68a26b
-
Filesize
5.2MB
MD55d3ebacf95a031a587f1c34bbfa4cca6
SHA1a58914d7fa051e92c3777b28d28e76ae41430787
SHA256e01d32187ddc9639c46602f01fac3d5917dd0caf5d91bf376f58ef9c4230e204
SHA512ba415e6932163313f79fee72bb098dff17b10484ea912153d51abf3334b849a06d5969424c4d04dd54b97a30c0560c274f53b63caf053cd6cb8e316771086a0c
-
Filesize
5.2MB
MD5bdd53ce2960ac704f2c1880694a10c9f
SHA10cea484863198d118ac62e3677fc92922ee20fdc
SHA256b3a2b374610658cc6fa21c94dcffcba3c417fd50bf1f11fda07d27b77e5a839f
SHA512fe578500771a8ca1d79d8bd379c4f061025c91b7270b20616c025d9525df96fe45fa817e5a81ea9be0cfd929a2aa42c29479cab91283549e7959e06cd1cc3299
-
Filesize
5.2MB
MD50fbb3ec725aaea72b5d7cc95578b68ba
SHA145ee2cd3e01e2e5a2e8ad81b39f1e9a705c9c58c
SHA256783a6db1987539243706c214131347efe5f82ffc8e3b4ee67a357b1cbcce6b61
SHA512ffeeb4cd044ef4902675fad9eda8ed82e77496a8277037a616168d11fa867b9a7263612b8781ebecc7f0adb50e4702c9fdf1f52ad952561965e42399feafb413
-
Filesize
5.2MB
MD5fa0b633aca484ce604dce3a779754960
SHA1bb2b4bfedc61f968f214b4c3d7591b9292d6aa27
SHA256f9d7e5ff6db4835a52e2cedc8bcd8eefe7d2d09753c7b170f2df35ad61005915
SHA51292817033aa57b3dec3c77242e878244c147b3d5a24196f6374319c428e841d04422194e110f8e62d1404e37063d5f4c7d7f117a5b86958da7bcfa786d8b48d63
-
Filesize
5.2MB
MD53e8fbe15497bb83ff8349d694ab32ea0
SHA12a06496c0841779a09f2d0d791a0923649a9b333
SHA25643200b579b540ddcabb5a70b06a536fd2abb40679214b056b1138c096bec4182
SHA512f5d4514f920991a3c2b826135a4b1796f0d09126e8ac450db854914030669957cdf39d5bcd555ebb5949d068c50a20642a91976acdf8ecfa6f835d5642e71b5e
-
Filesize
5.2MB
MD55d888868299603e4482f8f8cb9cb938b
SHA126daf2523f304287cc136b053a64f033dcf90d01
SHA256b9221291c91ab7399d5c3806362c7e44cd216c3929fd350b56a327b1a49cb5ea
SHA51259a8a9c02e77583743617fd5e709add1c5623956d6cd797ec9ac37e4c8ba0b9e80ac7a388eb2245bcdfd580ded7c84f63c0b5abec150b6966001977b487fba67
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB