Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14/09/2024, 07:01
General
-
Target
2024-09-14_68b4132d1e2e2b98aed36809e0f11f63_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
68b4132d1e2e2b98aed36809e0f11f63
-
SHA1
f2683351d9f2106684633aad787d1db3373a49c6
-
SHA256
86655fdb9e86e0d5677265760f33a422ce714c702afd3f5060282dc4eea293a2
-
SHA512
163761685c43dd8cc51d98a52da47d66db6dbd0bcfd981737de7d635af0135fa71c57d1bcb3a3b5bd76ca27c9157a288bae8f383956c2b11000e85d2a549ae94
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUx
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_68b4132d1e2e2b98aed36809e0f11f63_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_68b4132d1e2e2b98aed36809e0f11f63_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\pDfyqeT.exeC:\Windows\System\pDfyqeT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ctmYWNR.exeC:\Windows\System\ctmYWNR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rvZjREo.exeC:\Windows\System\rvZjREo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pYvUzPk.exeC:\Windows\System\pYvUzPk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vvYRcUW.exeC:\Windows\System\vvYRcUW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mwkzQax.exeC:\Windows\System\mwkzQax.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RTaApRL.exeC:\Windows\System\RTaApRL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xpqiicD.exeC:\Windows\System\xpqiicD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fjNEGwL.exeC:\Windows\System\fjNEGwL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HuGvfsa.exeC:\Windows\System\HuGvfsa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TiVLFhF.exeC:\Windows\System\TiVLFhF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FAuKqDN.exeC:\Windows\System\FAuKqDN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vWQKLSo.exeC:\Windows\System\vWQKLSo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QNBcFJt.exeC:\Windows\System\QNBcFJt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IalBqsy.exeC:\Windows\System\IalBqsy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OhTCvaJ.exeC:\Windows\System\OhTCvaJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RvaVsKM.exeC:\Windows\System\RvaVsKM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IIgpcIa.exeC:\Windows\System\IIgpcIa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\STHvgOR.exeC:\Windows\System\STHvgOR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tVHIkTv.exeC:\Windows\System\tVHIkTv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LUTfAaS.exeC:\Windows\System\LUTfAaS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56ff85a2f7f3df29360818a38a8c2d0f2
SHA1d0dcc9a0b9288b59d0cb9537a30363f8538b4627
SHA256a87d29e7d5ba604be9d21edcdbc59a51d370b936c39f9161e2fd4f21e60f943a
SHA5126ed1a660c35425505a79663f2ea4ba6018818d21fb7c9a81ab9e47aae1266db0bfc01844caa59be5bd82c6729eab27d12b604f4e24546b4671cbfdb7a7a41556
-
Filesize
5.2MB
MD599e6e0494f4d22298896ac3dc27c459d
SHA14863cc70bc910ececd9470bd47c7d6a843662a29
SHA256d38a3604b8cbe5fcd182ef466b78c4ab54b8a954b037230563f94da6dbd119e5
SHA512a58dc5b3afaa2e2b89e63a33921cba4004f763d530fd801b0e746d1b7d4ca1aeff7cb879a5d01026e936513a7c8e320f485beef594b34dca458303cb0c864311
-
Filesize
5.2MB
MD5d71f73dabec4747e019d654e587857bd
SHA1ce0e3a53d8e0cb412341efb67fd84ec91510ff57
SHA2563024d61808ce36d08f00ae9e496e6f5726d34792620119c73c1300d6d113d347
SHA5121b07d49330a4e5c8db6038dbcb7d308ebafc42f96d88ad53c86a37163b443ee30ab3ee0ade1fa473e54345af6ce8ee7b749c2eb5c6ef3b0d4ce4a5ba81d79d84
-
Filesize
5.2MB
MD58e6b2ebeb24c8c4eb45e5194eddde2a4
SHA1077ae05fa8ef647b2cfd279da89fddfafa1522ce
SHA25620c3831db1f38b1ed481cdc5718f49a8ac298e1a3c23948e7852f225d822ce27
SHA5121b1e176f86738307dfe92e867404fd21df335ea2c6ce44968c2d97abd64e56796b097039ec17bf10e250a8c74e018da6c2008369953a87477e6e4570ceee90cc
-
Filesize
5.2MB
MD57d4a8d6d2261cd2a9553d3d45cec8e74
SHA190948c598b7491657388c2e7a02b2072c966f68c
SHA2568962f00aab98a643129230594e4b66dc73230326b8386e1e88acabce151ed456
SHA512ac6a192a04de3ad7549ec716b17e5ad847ac90c08dcc5b1d6b8523ca0ef74248e13525772c42c47dd8945b50e24c6b19a6d83de4e20fbe8ddaeb4f25fc813e88
-
Filesize
5.2MB
MD51573b959cebf01fa39721ee7a349876f
SHA1df47a314af83630d47da924ef305386c14a33807
SHA25681b9c1b827f151d09fd6fcb4abaf077797da117b9f4178172111013c56190c73
SHA5128e7b6689e50117a36279ae214e2d8cd71ae1398048d89737f291f521ad7c511a85222620f292f2d01a3aec70fb34b2c7b63ba88de2b123ba4d9146b88232e252
-
Filesize
5.2MB
MD5a0b8f1028c38944b2bc51519ac6894a0
SHA17fcaee39bbe23ccde32e265886a26aa861245fef
SHA256dbc19a9df130f843a29396ef890d476b1406d12cd7b3ec67606cc385e868ca3f
SHA5128290425a3442b575ede52d29b38c74efd6535a14f71becfc8f5f8c18e477af0e6b99a376610abf0db00467a6938d877b5d062fee9ce004c46957eaddf7fafb93
-
Filesize
5.2MB
MD58afed502a0f4eb7003aa1b1cf5779289
SHA1a9e60cecad34ba2e00f67e39d05d464a66455d84
SHA256e24744e78bf332a5f9b5f7840e1ca01a109cc69bee701a3f5490d9f7aa071d1b
SHA5125b6c8f9488b05e232b544ad17c11ef6c97209702179a0b52158c500a84106fda6034586fc8f6f2c2e09f3072267edca83c9a62cee91bab57dc03ad59ee8c1887
-
Filesize
5.2MB
MD5dcbf7d7f4952873db9c391ab18b48fbf
SHA1059600dc9eb5be7756ca4c0b592ef17b55f00eb1
SHA256d4de9dd46c50540b53d6ba1428f47b9573cd4719527704f7327d6f25e53c4b8d
SHA512c64ce66564b136be528f2ac8f82fbe4e76969a5f67e6a940745d75e364880d3cfaa39c1dd1f04be32dd2dc04e60a8dbd2a590f316444ecede86b7863789823fe
-
Filesize
5.2MB
MD56269124e10d10a070addd82589ca7f47
SHA1a47f92c6b86dc3e05cd2bea75c79d033bf39c78d
SHA256595c015a0be45f4ae43686bfebe9349aa9d9fdac9d5463686a447ae389db7852
SHA5120caa1b3808dd71a77247e624875b732cae819a6532b7466ee0d732707bbd89ce321dde6bdb8499f5c8302363af4930998ba993ce209cbcc4afc1ac3742d47797
-
Filesize
5.2MB
MD57716c9a109982136384c549b98e3efa0
SHA14fb800ff21c72fba9456ee3b56d7bbaaa186c303
SHA2560d618bbeac9d89939c584fea30a13fc0875ec527d613d9ea035312605978239a
SHA51263d9b0cddc1c59dc5b0b11daa688f14da7d0e585ad781d0222a6e026bc67b04bcbaca5bc8c665c8354ce7efee522e6676d86ce08519a966737b4096180b678e2
-
Filesize
5.2MB
MD51fa12d06ba1b8add94d220b2ed88cc84
SHA1b0b2f8db2bd3dd6792033e4e81793bc5bd6ee098
SHA2566d34b97e72318f73a56d015e09713bdbd5d0d45689c2b3aebc31d78f4a825aa9
SHA51231ec60db88708cb28dedd501d7ce7d3bdcd8a134d2e6e55480e51e7a69c993692df442a567a409d21b3cc795bb31ddb77e76889121f98a2466f9861e52738503
-
Filesize
5.2MB
MD573193544d522acd9b67fd53754722056
SHA19eb2df1ffbef301494195a0529401165a3526747
SHA2567ed39c0bd1cd1edd45f0e6af92c882a0337b91de5540afa56230812c5ffeab85
SHA5123c0a1056515f88c15184004144ba6c9a1907f615db134accccf5982713e58c60aa848a454ab722e4650dd003a4f27940c6e2582d9e389a326dff7cca32d02fcc
-
Filesize
5.2MB
MD54e0906fab90814595ae5041a831fa2f0
SHA13e04370a080455afc71f9f52b861aac1437143f2
SHA256887da923362d7be74d78acc08e4cc770b2cbb8af3b996f4907b96e0cbcb68152
SHA512ea66f66f260da1847d19818ee710c52e75ba6fa469b3c4bbabd66be3d9465ba5e79626f81ae2042547d5b35f7eef2f087a9bdfc6f52d5d7214f3db8cd4f7d10f
-
Filesize
5.2MB
MD57e27e911ea9759d7b76c2aba94ba2531
SHA1be51ae4a02ec3160a821e05f6f68ef08756fe982
SHA256e0da94e9fd0b86b3ac6fc8d517225dd0af7a33bfd6a38a5c150552e9548c9030
SHA512904eba71c2ab0c9038fb8e31289fa539da027f153f9655334d9a93c9ec813878875d42afa345c987fc0cde9ee79b6e9b2c269cb405beba43b328dc730ee66b34
-
Filesize
5.2MB
MD5041133048f2bb2ae0e614436b4f91cec
SHA136532290ce897e5ce826f28bd0b5e9293a6dfdc4
SHA2567ece78945605b5dc4fea81b76569d0640de4973de366d38e4b4407104d5d8832
SHA5125563cc60b90a13cd11544f3bae81fee61ccbfde9359f84a3d676cf8d86fbca136d367ab0132280d5b17e6d03a5bfeea4d353261ef74e8eda430e0448543b8002
-
Filesize
5.2MB
MD5efd0af337e397af5aba3be596be967c7
SHA1298053cc1d27149e3fb9338efc7a50f2dcec2dfe
SHA2565ab1fa3a05983370d9e723da92ba6797711fa2e9bff23ca9d1d524590bede4ef
SHA5125df2e012ed644d0f43378ec677a0a8889dfee1f8f13f63820fbb9ab3d6a51c67693ab8a9489a7f8d7c9aff3d9a767c3035b8d1ee64ad5f8e40f06a2ac8c96435
-
Filesize
5.2MB
MD5c9717a3e5eb3bb3f13d472c070b7e06d
SHA1d6cf7571c1da82e8756acaa5f1f49a9023973bff
SHA2566d6df76982574b119653ab49369313493d5bdd09dacc0202f242a324214bd72f
SHA51281ae486394e49aa45eaf5eabc5865bc05bbe1f26b2f03727d475a776b68de80c806a0cd832d827e9f5dd8702b2441fcecb358e893c3e884e373d8dfd7d091242
-
Filesize
5.2MB
MD5a81872fb8ea247efe9de52be4b0808b2
SHA1b611be5ba94ccb86efed4a1a8291358bf55c2b61
SHA256fb4ea8b81099e7b75e09e06a52804a87645c6b543cb8ad3816a3e21f450a5ccf
SHA512c7d8be52cc20f23eb0ff21c8935e1096af3d79b1f9cf37f7897252e235b8e22b159cf9043920b40800d672fd5a553f60189931b5251ef37df783f69ab580365e
-
Filesize
5.2MB
MD5cb2339747778bb6fa5ae60f39bc414b7
SHA18d4c4d63df6b99f76d027f0a37a473908e3ad653
SHA256ae9933fad315e33fcfdf0e56ac06168141f9c95699634cda30acc697888efbb1
SHA512cee544a390d8c7679e318cab9fcd062635a3b58609e05bfbb0b04318be8ec997f25be50c956f8b7557047031fbe4fe1e65bd3cbdf0aaf60cb646e94a3dfe99a8
-
Filesize
5.2MB
MD5008e4a4ba097e54bd1622c0b88e2a167
SHA1d46b2713c27f1f73179e089fe2c9464fd48d8898
SHA256e6f780876f69a79e197c479c41ee90dc3ef13541b54efdad7fcbef1b1404ec97
SHA512ff6b2834159c2dc84730440c8814d1c74cbd79d3fc550ac57083f470b42b7d3916e88d0ca6d43f408ac905693c7353b5039a32a117c1a6b8715b8120e9d54862
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB