Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15/09/2024, 09:24
General
-
Target
2024-09-15_0acf746e921e6f10dd2e97bb627fc790_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
0acf746e921e6f10dd2e97bb627fc790
-
SHA1
6d2248c8b68465f0b5338a5c678d0b4a855c2350
-
SHA256
aa45431839ab8c6bb84e20cb64b767f1b01827b1dbbec44992633f09c58eaf69
-
SHA512
0d73b4cea5e3cde7e9a2a7d80d57dba25338476a029a0efbb1748a49f56d8e12e6089998d129f6037992794f53e202bb5f8c9e4f2efe938d87d198805cb5aa30
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUP:E+b56utgpPF8u/7P
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 52 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 52 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-15_0acf746e921e6f10dd2e97bb627fc790_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-15_0acf746e921e6f10dd2e97bb627fc790_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bZqOnGT.exeC:\Windows\System\bZqOnGT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EnOSfyF.exeC:\Windows\System\EnOSfyF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CfPVbnI.exeC:\Windows\System\CfPVbnI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kvrOLkq.exeC:\Windows\System\kvrOLkq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bagfsBE.exeC:\Windows\System\bagfsBE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KjJhyhW.exeC:\Windows\System\KjJhyhW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eVKMVlq.exeC:\Windows\System\eVKMVlq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cNlVpaP.exeC:\Windows\System\cNlVpaP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OEfSNCI.exeC:\Windows\System\OEfSNCI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yilrSpA.exeC:\Windows\System\yilrSpA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZofnquZ.exeC:\Windows\System\ZofnquZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lrbRLzh.exeC:\Windows\System\lrbRLzh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JPWWlSV.exeC:\Windows\System\JPWWlSV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nIpJcdl.exeC:\Windows\System\nIpJcdl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IckVgxi.exeC:\Windows\System\IckVgxi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AwuIrMd.exeC:\Windows\System\AwuIrMd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aApTLEa.exeC:\Windows\System\aApTLEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tbCRNmX.exeC:\Windows\System\tbCRNmX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VJDEuEr.exeC:\Windows\System\VJDEuEr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pAscUEn.exeC:\Windows\System\pAscUEn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tOBOPVQ.exeC:\Windows\System\tOBOPVQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD58515b78cb980a8f6d6c788d5146b3c1a
SHA1c6cf6833c76b297e5989b8f456afb4a9b36a2e46
SHA256a56ad88d590ba8598f6c8bd8e20f0d018c285814f82f6cd8234cd747bf9e5f23
SHA5122885fd3ffb76a56c241376d76e33a7190f86fc805930ee919327c115dd382be92ba92c0cba93fe115f3558599a0097e6c12c44115f3fc3f50f20a303790bd533
-
Filesize
5.9MB
MD5ad76736523eaf8dca2dc175f6f9e185c
SHA162cfbe80b90c4dd07357d22f92e2ff196bdc8eea
SHA256e82be1b498cd1dfda4411ffe3d23a31d68c6a28b0212654570e402790810e809
SHA51255d018b620c5bc152e1a406d2416e4bd5d8a3689d5346808c6b65af08b4b60897979111ea26f2fcf01072ebc2c1bcfef05430570477317cfc253ea33e2f7c8ff
-
Filesize
5.9MB
MD596f69b1d414fa4e1417e03348df76c95
SHA1f98495ab9c59de30b58c6a5b68d580f2ae7c2e75
SHA25636a4a02ad30a4a0db90df507a303e1fd6e1492135db0a29133d4610482811936
SHA512a7a01399b21c0919f885e98a3e01fd3654a20e140f9cf01c0236d3b3e0b63928ef6f7430be101311b44cea502733b009e5fef4c238473e204fdaf2eba2b57d3c
-
Filesize
5.9MB
MD51348d57ece7ac135e160b3dd9640eee9
SHA135716c74ed2e21a14bd7df1a86726e91eefccad3
SHA2567e10ae3c72dc325f0e389549259f0296a3a6ea3d8fed3322b7ab854036f92b95
SHA5122303e26492e5f79cce803d491f1a8d16ed16907ee2c92699d0f29552ec0afdb29b2571e3f13b09d0bdf77f0a1fb1741706f5fb94abc6e13a128b4626fe3a012b
-
Filesize
5.9MB
MD5450f82687f7de3dcfc1d702b0284adb2
SHA1238c63bdb8c5b624d60b3617b38e02d704a70c5a
SHA256104c0c7fca5563f4ae904d3400a606991bbed24477f1f9278fced527a97c0a4b
SHA5125d2e9ec1ff08b5851ffb6a6dc4b9a1b286cff91d0402d07c62039161083b34528ac8d1f1744b6277dac5f1f7a32935a355ddec28b631ea980d8d3c417c402045
-
Filesize
5.9MB
MD5a843a2f4c710131d61ad65b903607270
SHA144a681c2113ee66e2a649cfb9a425bb690792ab4
SHA2565c0da25ffabfc61484e788868ea1d843f784d89ecd2568019831df2a9b52b7d1
SHA512be1ed5920d96315db7e82cb3c32184513c363de2bd5e82429fae1087d7b800e008a2d5f4e332e919ef392d8eb5026315601ca2856830339eb59b847057a99ef2
-
Filesize
5.9MB
MD50b60640a760c7f62b272f0d07829640b
SHA1330dd16f64703b0435fd80f3e35685482e7a8125
SHA25650b186e62ca47d4129bfab85b713bddb568622b334ad65025e0c5499001552d9
SHA51263a6b5964fe4c1ece022a945ff06ed6b8b8321b88371e07b63b704bb372b9267502d757b4dabdd2c6494af9d3dfb7dfe473ac27f03e01e58430693a10e3f3a5f
-
Filesize
5.9MB
MD5b41061a3ae8bc476673d7b44ca2c04e6
SHA145ae73d9f665a461a6c294584c74cd1cb869c30e
SHA2563dc73ca63988530251df41dddbefcf1146915a4758f4a185381ae3e279f06856
SHA512922b3a627bcc601e090dd48ff2dc31577ed83af938c377d083397a69cbda0f5d945d1a6884340ea570b49f9f6f5e9e0b27ce6db32e6664d0b8fab6a63632e7d1
-
Filesize
5.9MB
MD53679964b48214ad35018b0a0e6d8b001
SHA1321f766dce7214f49ef5ecb703f8aebcc9f05dfb
SHA256f3585088516c3f01632f0140fb300239982b560c54f8ecd8c0f297d4bcbbff68
SHA512a6d8586f60cf261f3004d1104f05af8b221dfc1adcda305d4d72a885ec0b27861b7a9b8d91a503f6ac55a46cb88812dacd28974054ddb78d01d6cf98a2c9e2b4
-
Filesize
5.9MB
MD50df878b71b33a6d6a23bbe613d8ec9e8
SHA1822c92030bbea8f9aa8ed20bd2fd24003ca16275
SHA25622f9b54826a40c68e83d1d255eb5a69273aed0524493d469fa52e9119f93dadf
SHA5120dec35c8d7ec6eb7615236d6d556415b72547c2f028ef9fe832978b4b7c325b5c437d4e1c337f6e4b0743673489d09d52d6becaa5646529edd0fb40c01ca29d6
-
Filesize
5.9MB
MD5bcad57c41db50d3b5786df37f298745c
SHA107f07f5bdf275746f65deba6255bf2401621d6de
SHA256f3e3a90362fc020eeb8049ad6d442b933902f40ceaeb1154584d55a16edd079f
SHA512e81f9e94719d628c410dcf5665b64a1b7589a74492bf51e814ec0e0ec35502ca179466762c49ff4ec5d2f69176b154fcc2e3b9e4a518403db06bba9589e57225
-
Filesize
5.9MB
MD5fe797319bf6262b9109c95a2748a35e8
SHA1c7f7f16cc98821b99688f2bfda50df6de4b305d3
SHA256084551cd72a1e201bdacc8fa4533c8d0b8984a150fa5c583ccba9cf37fbc077f
SHA512e3dc8879a486ada02fd5e0add6836667625ee4224b49775cf7d49a4116515fdf6ce75e14a6c0e6dc94a4c4316f9558ed0a8111c7a2c3d7d64abe4f92c2016274
-
Filesize
5.9MB
MD52e7e864bd8a968a3287a6438275d46c4
SHA11874def57347bfc5ca1552069e22b67d038bb2fa
SHA256ef5e212a2c39de987eea0ead6e677f0b5bab0c2eebf0bd82a42e43f413873e4b
SHA512dca7699a2b3dde1aa07d09c9439c15efab241789b871971bd41c5deeda812dbf69654c48e2f1943696f9d8abc6e14c1bb0c16441a5bbf3444bc12443db9158aa
-
Filesize
5.9MB
MD59010eea10d14ae0a5cd4d8dc2377c4b1
SHA1f487c5d1df12fa768ffaa7f8fa9e841cda2f9569
SHA256ce41687763d334b9dcd547c836223cfe22a395430a2a0d0c8871b8f30df99267
SHA51257a604d2001e7690977b49752683307ec09aef6f46acf8a44c232ad9a38ea13e3afeda26dd6e3c7ff90c9c3d74ed04680d0c7816a40c67fbd19abbcf46cfd521
-
Filesize
5.9MB
MD50f334d2951849fdd600d0d9b51fae54e
SHA1c5c05108d87903efd03db78ef536e441e4b418e6
SHA256ccfb74555f6cadc42bf309c511cfd530fce91a0713feab4a8401d922c921534b
SHA512d7bf3954936b8392d6f47e7833e69f1a32d75dfe99c74c971d24c184246bc9dd234452f7d21079eaecac32de918635732b69e102664c95c4af84bdd11025c38f
-
Filesize
5.9MB
MD5b50c426657a5dcbbf534c529a86c3969
SHA1282d72cee581d3380bb9856cebe22b9c39a8cccc
SHA256061087d23c248269fc24e5298803f34baf8fffdaaacb271ad8516b7452d99e7d
SHA51240dc2cd3f74daaa207862803b7a35304e4d0b076fd93007a5469fdb995c8185f818fe43683ecea0a7de54f7e23a30aa1a70ac98bbcf399aaf5f9d1c9a29ccf7b
-
Filesize
5.9MB
MD543d7ab07cad8152e43263b76b98e7218
SHA1b1c1d298c00d511496b899ac062e10c789376b69
SHA256fe9cc3b19d42d26ae570304b561bd8c478bc3d94a29c0ea808f05eece1644cf8
SHA512b1bf5d15046e06836c333a4f267df1a0920f6bea8422592a1ef02c60064a636de2e0b26fda60dc2ba26b1375d49c4a81587be5ca3fa9bbeb70db57fb29373e2f
-
Filesize
5.9MB
MD5abef8a26f0d8597faf075a6d4d668752
SHA11c60a0957c5aa31286abceb9e3ffb9505d354bf8
SHA256c0699aa98b7052db5289b55e148ce808371c5279dc7c5a2a6861ffe3e1f58987
SHA5129a31ef29cd1870653fc035029f02b6b8fe768ad324cb06aa4285133d03852aa88bf9a09dc682daf1cf6642362041d6febf89dfe01cac13105b13ae572ea2e0fb
-
Filesize
5.9MB
MD507f45d5914bc68febb95954c96ae7f42
SHA1cf7bda8434185162fa122219c5d75c3082381d9b
SHA256161c6b1587795a238fd4c470039425180947fc44f489946d1c1bf953ca53f0a9
SHA51247440b5d29cacf2c110aa8007f27eb4246228f64719773622916a05a3c94e764184a229425e6b62ab7619740b84534de6fe3dccd26b4236555cfec4e42a29b96
-
Filesize
5.9MB
MD538491d2184598ab5eace2f89ef43481c
SHA17742497d73b8c4e681ae77e497ce0d0cb3bb3aeb
SHA256bcf58b21bec41be04c4d952813e79a6cf2d887ff53a15d45b5cea255e024ba17
SHA512295735743062446726e3c8b2ed2324d10494d3e7fbd991322d094fd9b93894944fcb7914d716904350c42e61de8f7d1faff53cc60fbb9d99bd1c35a3e8cdcb28
-
Filesize
5.9MB
MD55714b7b26238b6d442289598e481a8a5
SHA13503bc7f89d025e32bd3ebde8ae1bb51d4d8503f
SHA256b83b39e8e9109f43ef77a54e57438178f3a5b26cd6ccf7cdd98f5d671b499314
SHA5121f8213ebfe9577383ff19948ac86339b5be97524f5b559c0dcb23d38e02e95c1aaa7c0e170478eef13b72391d81ba1eba54e92c59430e9f5f030040ebdb715b7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB