Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14/09/2024, 09:35
General
-
Target
2024-09-14_be5df2582264ed7682534c3cf46cfb85_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
be5df2582264ed7682534c3cf46cfb85
-
SHA1
db1d9f693cca0c4569e4a369fdbf4543e41cf417
-
SHA256
5fd0661a97763a341dff9992adab2a0bbea0dfb0ba125395fce21e0867936e97
-
SHA512
504c205a9340282581209ac48ceb69791135ed1b17d25c02d63a002e0c92482e836321d71c1c5d76ee92d906cc1a8ddf23fa5eb24c3f1b0db6d57fcdf6e6738d
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:T+856utgpPF8u/7t
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 55 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_be5df2582264ed7682534c3cf46cfb85_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_be5df2582264ed7682534c3cf46cfb85_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\csYftli.exeC:\Windows\System\csYftli.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Jzeblnn.exeC:\Windows\System\Jzeblnn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lIciSZy.exeC:\Windows\System\lIciSZy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OzYSrzt.exeC:\Windows\System\OzYSrzt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BioznZj.exeC:\Windows\System\BioznZj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nyKyljJ.exeC:\Windows\System\nyKyljJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kmydGJA.exeC:\Windows\System\kmydGJA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TTykwla.exeC:\Windows\System\TTykwla.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HaPFWHy.exeC:\Windows\System\HaPFWHy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cpKSleI.exeC:\Windows\System\cpKSleI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FlUPyma.exeC:\Windows\System\FlUPyma.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PrsfQGe.exeC:\Windows\System\PrsfQGe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lblNeUU.exeC:\Windows\System\lblNeUU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OpBDGut.exeC:\Windows\System\OpBDGut.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\awdYICa.exeC:\Windows\System\awdYICa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SIOCRjy.exeC:\Windows\System\SIOCRjy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KnDHVDI.exeC:\Windows\System\KnDHVDI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LPUqFcu.exeC:\Windows\System\LPUqFcu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DDddFnb.exeC:\Windows\System\DDddFnb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AVSBHID.exeC:\Windows\System\AVSBHID.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vOMnetY.exeC:\Windows\System\vOMnetY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD53c61e0f951df1f39eeb909debd8251d8
SHA18b8dc0d8bbd6082d85bfff5a06899ff96632268a
SHA256e05970d03e1f3b54d7416e1dc39627c6b1247e327565243ada1334d641ecdf72
SHA5120d138927b1abc93a865d3623741ee6c98b4db83bcc379d8cbc64d8bffc99440784f67d7e086ae0bb7a1aa793a0dc7535af4109a70bc0cce5c332ecc6c06fbe87
-
Filesize
5.9MB
MD5cf78977b907fcb06b3b8c35777ae30b6
SHA184ed21442dd5d20ac4aa87171e84100a4d198cd8
SHA256baed192a87e413db23aab3acf1d57c397b4151f15f7c10f736725f679b8a87c1
SHA512f76f788248c7619236b0efc78178b0e367ff7d4f908f0a10f086e458ad1b2dcf8fb928270cd81f9cfc78171abcfd5a7718c77f4786f67d696eaf18bc9f59ce3c
-
Filesize
5.9MB
MD5f8a1a63d1e97e2fb16249fd25fc40634
SHA198302da430d001722657ef56419084078cf12da7
SHA256df7091f3a8d31d967ee18e061aa5232e0576e7d95c00c686a83dac8febd08e56
SHA512c3cf01881dfe3f0c60c98482bd3fa51046a41782ed21f946797170edd768dde82e487561fd07862024026144abcc5c5e4a6ca41c30dd6002dad3ad89a0a89921
-
Filesize
5.9MB
MD58247e5dbb7f4352597dbbbff9b346aaa
SHA1d015104b5fedf4dab6ab8d9bd9b039f43851b64c
SHA2563508775f61e0e47f1d24166c09db3c88240b0aac542359c12d6bd56cb1da29e7
SHA512ea05798381038c589a307d025f4233a6389557459734aba4af5debe9f2fab89f46c8dddcf7f8ad3dd875e93c343b0e2d79df10fe6adf01c19f3486c232486621
-
Filesize
5.9MB
MD583f91dc21925ba8748c0b340107ed131
SHA167fe850301716de2354ebb7af1f415dd24ff3e2a
SHA256e4f122588b377e51513e546ae0a725ecb1e19117b9633d4ed0895bbc65448318
SHA51243d4546d40d44ae9164eba15e7970b0e6317364434178857570d4601aef75c64de0e476ebe64f261b1f391c2a4b45c537ba5e6a41b9bd0b29d6c6aa798b39da2
-
Filesize
5.9MB
MD578e59a306b0c59d898619f4c7b1038dc
SHA173143ab643309f7dbabfde3b78e0edeb5b8d3b38
SHA2563edffc72d18a1ce82eb965a80142f22b71b3c664f7b174b670639e4c4e1c1672
SHA512d04f84226b77d37324019e02c34ee37397a8151d29857a63183ac9b27188a116270091cc0c943f3b9c11dbba35aa24a47eb6acf7c0f1e2bd879c00f79266c6ed
-
Filesize
5.9MB
MD59d0095515ba525da7f162cd48b4ad037
SHA184e139d703f00c9b3adbc825c74727207950aabf
SHA256dc1d01a85ca324d1dd2f1753d53ae3459e23691bb621e321024a57cdb4704aac
SHA512cb441cf0bc9cf73a8930dced20dfceb9b29be89fe2997934a6cba3a0bc458b8df383cb19b579fa6813ab9150d64d18776359d5bd630d2ffb4cf21f25ffa36a28
-
Filesize
5.9MB
MD540af77b3388271339352247ca1c73bdc
SHA1cdbee1d911d2fb0b02af4841c22dcce5342374c8
SHA2568712b87635a18e3d02a3323a46496559af5b2987b67fdd413a1204afa259dee9
SHA512e0946d205ecae288d0e66c78acd64bc967bc71d7fef8c2dd347fa5deca71133dfd12288fe9992e9ab178ad318f09dff5171e2b74c25dcaa4bc7411a330986aea
-
Filesize
5.9MB
MD5e3a49e83c10298af3ee0d19efcaa0374
SHA1402d1f50bea75c7285af83c704e9357b47bde89b
SHA25671f8659699cdbbff57cfeda2b27ba8c82c37857cc948576d3a28ffbfa8a2c828
SHA5125f5ff53d9e9722d7e352e2c8e521332380eb25e0bfdd424b057d466c975396b50bbf9984faabda75adf4aea1f2be0df999b7552e7567e80290e42e6a5f6ad2e5
-
Filesize
5.9MB
MD5516d4e2955f574bef847078fcd1e7b08
SHA1cd5d1c0ada5c47a677586f5d1c25e04393402d9c
SHA2560acd4c75e7a139d0db341544548b6ef9c4507a3e9d24ec59f28b923f424e5d6d
SHA5122bb47e1bd447b969697a332f8efdc6913ccf0c7ed7eebce7375fcb13148f51c5117eceb52f9f05f19132f57a4d096671df658f8dbbfd532d5abe902c920f4266
-
Filesize
5.9MB
MD5970831ff2530af2778a13b32976cf9ee
SHA1dfaf90699b0c253a86c4ca118fce2b78f4ee5bfd
SHA256ce7450ed96804456a65c0c950a1beac91bf38f1fed7cfaf786b98aa913960b8d
SHA5122f8767c787a76e5155ce8d8bb0645b48782b9d862e84deb3d869e29f697c93d604b52f257e5f3543bb218a247f0b27b7666c65b689339a03ea3531806028ad74
-
Filesize
5.9MB
MD5554c0f08280ed160418a13c2a6937c73
SHA1c5d713d90ea014e3323ae82625a8ba4eb1b56f40
SHA256469c837bf927829e195d11d7ecf64612bde9dd6ed7b895435baa8d0024286257
SHA51236015d816da4ef0a7ffe33ee21d866437e9ef92b5075db9839ca94414bf393cfc922674bee95cf9a3b703ed83747bcc77deac463b43b4b1b08f2ca98f547d61e
-
Filesize
5.9MB
MD5bd8f446c728ddc00e49b3ad32685fda8
SHA1cb23cb03341ac5276c6bcb11023651776013b735
SHA2560d3d00343d722e7de4cd266c2549f6298bd67bd0d9686fc8d2347d2b6267d92c
SHA5126f073bdd6338298ec1d2e7da4a3a9258694d3ddca1648d0107a486fb805d8a2c5e4c8815d335a4d07f8270881e192f422166bd91761b2f1f2605117c4c918142
-
Filesize
5.9MB
MD58ef5c489080be52a05b0e535b99207b7
SHA1052afe5e7217be4ecf1ad133a7910c6194058a83
SHA2565a6cd3a14d49ccdc96e79ccc284ff9497403792d0243b6ede8ca702a66a68f2b
SHA512bd8d95f09cdd8bf2328545890687702ca3d5077058744717b5abdc6e3b7743038b655b7cd37d146af41d1841ecd58f81347dacd13c3bdbc489ffb6007fbabef4
-
Filesize
5.9MB
MD51653b3a20e86e765b34cf4321e4dbf57
SHA1e4122c1da008f572408aaaabf4d94346cac0ddf4
SHA256158ccab84c3991f7c821949a67e0370537452bca64a909279c768c46730be091
SHA5123d52d57ac5a039a606c529d626fbc894cce0f5b340c1a38cd97ddccaf18d5d6de6fa8f940d7034113be0381e4460f7b8bfe50a7e6426b8d06b05ba474530b332
-
Filesize
5.9MB
MD530760f3db4da6aeebee600eaa9643b8e
SHA11f21cfd8274eab053bb3f999d7182507df8efbb8
SHA256b7b1affed0a1ad7f14f7b7ef0b5fa5a228948336a0667c0a399182c47b7b39d1
SHA512ae34764966f3628762e481eb670497e4f4446facdaff409fb30112f0decfb586f5b68a4dac2fb1cf8350f45c5410438ccdb70575eebdb039dad35981abdac2d4
-
Filesize
5.9MB
MD56b51a1d7848de91f69686c5271c388ba
SHA1ff5d37757647b648ef5ad3b8e3011802035fb35d
SHA25665d1ce43d9b95cb66669fced825df6581d817d0ab1201aa6744ce8293071ebb2
SHA51211ef330958d8dbd6f80822ddd5d7dc6a205966d1f5107de9266bcc9aee5743214c84a1ef5111ae27603368d0ff1a111a0d597a04e67a01e487e86f83a42fd5f4
-
Filesize
5.9MB
MD5fd70a0f0645faf003ef480a3d51c4e7e
SHA1dd9696c3dd4ce9b44702256a11aaaed33a2e6df4
SHA256c2617a8a2959055f209098363d98ca0f43aeea510650bc461b81b0b980e99d8c
SHA51262288da5bdf78ec0ea3dade39740a806372ecbc7444ecb2067eba68827495f509165246f15ad8bb2e45cdaf3ad23d1ace3bef1dd9d62fc62ff5ecef878d8fa71
-
Filesize
5.9MB
MD54940a18f062ed6bcfd72300eb46e8416
SHA1e5c02335d0b67d8ead2c7ab5e06013494a35fee3
SHA256b41d873ee4e4cef394600d1f687b999c0c3279c1c22cdd08fe06310c4f36a5ed
SHA512ba650446a216ab273cab017faaeaa808d42c926b58ec008461a43ea591d3de0ef2429b8187a507880b77a1adde810b30dc834ffd82497881ad47f4e1eca35747
-
Filesize
5.9MB
MD58ce592cf8aaf0c4b4e7d6e2cee69231b
SHA19f951bce61e029d97b5d55903cea7eaddbbe6b42
SHA256b74601f1fe7bc69bfc90979cdb4222ec646fb77ce29108908769d2cb3ccfdde5
SHA5120332c7d705b831bc3fd4879f582e68ba71f41440eaa732caf9a10eef89486455cb2422681f0d8c8c3c7ac11c8328fe83572506dc311aa12f369a6062c2637c46
-
Filesize
5.9MB
MD5afbced9fe41ab7c65cb7b41cede35a89
SHA1258f645e11d9b2423b9f483120933024cc9533c8
SHA256fd3e1f46bf00f240cb99e556ca8bea9f798554933faf73859471fae4634953cb
SHA5124ac490eef9df8ef701a2314414446609de07b6351b103de800df2dedf5634d7a9e49ec165e4644f8809491bf621c0f4e4f9d17a19228a2e5653c51fa90c29a0e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB