Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16/09/2024, 04:01
General
-
Target
2024-09-16_c7deb189b590b6dfbd20159649d7d524_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
c7deb189b590b6dfbd20159649d7d524
-
SHA1
93df31c752077e4bd0ebbf804cf6d175384d89e4
-
SHA256
160efbb14e2fec455da48d7c59189ccea37cf5997c395ca8fdef49d6f2e9bd19
-
SHA512
a6bb9422b527bdac3ba502e96eeaf4e84e4fd85199519eccfd2150bf76f2749594fdbcee2bf010e117c8440a8bf15626167ff93159efb3ad468c4dd04f4d6a81
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUN:E+b56utgpPF8u/7N
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 61 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_c7deb189b590b6dfbd20159649d7d524_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_c7deb189b590b6dfbd20159649d7d524_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NZiZodr.exeC:\Windows\System\NZiZodr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LOlVXfS.exeC:\Windows\System\LOlVXfS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KwLGJFt.exeC:\Windows\System\KwLGJFt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cjzvRhh.exeC:\Windows\System\cjzvRhh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AWlOKTY.exeC:\Windows\System\AWlOKTY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OppHHch.exeC:\Windows\System\OppHHch.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mujoCsb.exeC:\Windows\System\mujoCsb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lUPlRFU.exeC:\Windows\System\lUPlRFU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VJUelAm.exeC:\Windows\System\VJUelAm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\szIXqQM.exeC:\Windows\System\szIXqQM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SkOsNIv.exeC:\Windows\System\SkOsNIv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XMmexYa.exeC:\Windows\System\XMmexYa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vpNSFSh.exeC:\Windows\System\vpNSFSh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uAJmjQH.exeC:\Windows\System\uAJmjQH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CrdYEip.exeC:\Windows\System\CrdYEip.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LPKQFTg.exeC:\Windows\System\LPKQFTg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wHssAav.exeC:\Windows\System\wHssAav.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OBnBpDw.exeC:\Windows\System\OBnBpDw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dTfoaSj.exeC:\Windows\System\dTfoaSj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VfEpjqi.exeC:\Windows\System\VfEpjqi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HJYEgbA.exeC:\Windows\System\HJYEgbA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5f57c3741fa26ec1db3541cad54dfe813
SHA1810e3f1aa0931f2f9c2756eee3c7c4f402dd515e
SHA25611aea5594574283362aa8fd44d9822f931e0e84842ef4e723f099fc57c55ed7d
SHA512bf3c8a77d34a1eb3acd67c99a7e0878a5c2b2600ca49a7e14276c9d14696f9e355ecef0bcf6a8a0ecc880317834307821978cd24bb6141626056723526e9be47
-
Filesize
5.9MB
MD5bccc16b690a5bca6bf3eeeea1fb9aec1
SHA1848322e5061bd2f42d21897f8d9c6be0765eda4d
SHA25617da031c3f77202c7b379c85bd72529951d9d2ef980aab1ac776d08ed363766b
SHA5127aaebe14c49ff1037df05218281f904fb47446add98e5bbd54fdbeaa26e8e760ed3fb931db550c919b49162c12ed1c4de66682fbad74c55b7a6bdeeefbfbc48f
-
Filesize
5.9MB
MD54feeb2c5eb3f6fba53a9613615120d5e
SHA1aa21fd8a51d511626ceaa1fbf36406a73a5f0609
SHA256ee8c576644d6afa8ad685fa91d2c2cd4e0829e3bc59814e937350bbabe336251
SHA512374624f6fe35c86904f8ff7d58b85529fab935c058af73b437276d4c6bcaba81ace987e6856de535da35c482edb9a68d76c0fd47ece542f137ff41ba91fe6823
-
Filesize
5.9MB
MD505db0684bef74e4e3c45d206013f1992
SHA184e53dba7ff1e7cc6bf8ec5e690fe6803254024f
SHA2567f25540bcbf13799173330fb8285bb93b8618e6e3b49717cf2348be93cde4dfd
SHA512c6d1ae3af9d945f134717b2dda5ef1d8023a72c8c5a2e813502e5405adc545d93962d8e4234c9c53c62026a5f935230b16406622633b8fee94502ad22d3dbf33
-
Filesize
5.9MB
MD5e7956453474962b354e95c98a5fdfcff
SHA15c1fd2e8777a5e1c1df03fd76569d511390c8ba6
SHA256185c7bfdd6623b4e77ec4963009f0ba51b45d656255ba11661b4a99c8b5c1ad4
SHA5122606ba8282c09df1f7132a9e61ac997ea0d92baa92dafbf94aaa7cdb0fadf821db4dbe250a32b53b4e0977c5343a91e399dfbf5018eddb7aead5a15edd6b764b
-
Filesize
5.9MB
MD5d21ac624d6ab655320b2b50f611a6dcb
SHA1f8802c08b8fa07d109d80428aad965014e06d0c8
SHA256e5419ed1f2678a9b6e91dd3e55dd8f219681661bb28a99a5f86c7eeafab6f2f1
SHA5126214f1c4bef0b9e5098cba0e48c5f2b43fb045c87e9697a859a618d391c3506f58f696e4393e0976e1a53c26ba5b315fe0453a3485b4b0abf74ff2e42bb8c07b
-
Filesize
5.9MB
MD58c3552694d3a0266b7a01df31e33c45f
SHA1fbae630858af1d8efe59805409bdcc6586bc8bd6
SHA256a0ad161effb61653d4330eefece26e681f098ce070723b3003ec1642f3687598
SHA5125c6a89b114375ce3bb5bbb6dbfd8b5940c3e038e0e2a32db5b94eba9ef65d202cf48ec65eae446a3ae9b8389875552c75ede3745ace03eb50c2341591164de13
-
Filesize
5.9MB
MD5611637810873473f88076cb49e10d0d6
SHA16d4c65fb7c520522f75e22013a3fc76dc422be76
SHA256c3a6fa9393b660260da1b512c4587b672c0ed6544bef7cf23953906133897ba3
SHA5129474e539c3270ec90fe9991be1f8838fef160b4c6b20f2431be96c97c6e85244ed364635e7adc88f9e04fd20f058dbf3f526521e862201075744bd597aa20139
-
Filesize
5.9MB
MD5de6cfb84c653af4893943731c76c277d
SHA10766dd6096403da59bb96dae522a15878c674186
SHA25620198a40c2b0b2a9bd3d6f9604d8be77b6bd217b53760a3caa8a1799a0ff9679
SHA512ed440f906d2e240cf5ecac50f95af3ee58527c74604741b0e31785900450bf9a445ff90f2a2350e04b38f5c63e5388f91515760e6e826ab5e9e46cbc9097e19d
-
Filesize
5.9MB
MD51d17965f90c339e7fab95e94f4af3d0d
SHA135ae03078a34778f255dd5f1d0e8c87bf072b4ef
SHA2560b8e231f2ed79193d36f7d1f24ecba6e631e64266b6c76eb17b37965e238d3eb
SHA5128f79eeeffd20c08386755d29b66f212873f3f302ae46034fe374c35a630921583dbf8f613305ec3cdb454945119aed0d96216fa4808701f98ce3167c5493a30b
-
Filesize
5.9MB
MD5c103dcc4a24e75f675d8a91ce3b61a81
SHA16ccc55d6e8b8ed656f61fc89ded9e78496e7b55a
SHA256263f9ac8e10ccf7b6d8a24dc5b3a9482d8a2209be2a4fea6f89604a45096e8c4
SHA5127eb6cde48b0336fd5ceb641fe111cfafee1828d184e261ca6eaaaed04733be4ec9f9f1325e991ba1a42f1c303cd8ea61989ed15597832dc28df863c29e542be2
-
Filesize
5.9MB
MD59c569cabcd03da4d69a0615588ce41da
SHA152bc14691ef718a06aa877fc5280e3891e0813c4
SHA2569be8709878db841077d1dbbf498fa4d1b45115683ce17877e9a5927f82f08cd6
SHA512f92e6f5f93735f30d108076042b0d27b0cc41e1145c3ea41bebb5ec93823f90bf125924a46fba5b23532427fc9178d2959fb0bda484a4774dcc3cfb155d2ab2f
-
Filesize
5.9MB
MD5affdd1679f543fcdad9117de6923b13b
SHA17b26b5f7e81a21565652ef718ff4574c95cc188c
SHA256ac874eff13d108a1d3b3ec44b890e756d3821a5c9c9c0704272c5d6870b1cbc5
SHA5120b771139dee2d4f690d1940589e687beb0051f5bed6e8741907a4dff0f01db7024d22b37b4bf210c1888c57009bb134e9bba3ce855d9910fabdd5eee5de9f06e
-
Filesize
5.9MB
MD5e5fdb2438a0cade0646cd3f380d83fd2
SHA10b5473ad35d771c00b2ca3704ae1de3f5b3fcb44
SHA256e1bddc8b2c4f25f7b350c1bbd691abbea6505f25dc850489019e96972354bab3
SHA51218551b3f69c7ecafe241deeff70d10237dde2f0e18b74ae9dd1b26eacfe8b0d831b59117a09955d67d273395b57084ea0c4e3df69f4f1d2489a22a0e3f9b2869
-
Filesize
5.9MB
MD57098eb826cc6ffe235f6f36e8ad1e8ff
SHA171f9495410fd3a155eac0f0eaf081cd3cb875700
SHA25696074de210d7e60dea38a7a2deaabd66f7db650879627fc8d7fe5cc531fd7d92
SHA5120c6c6040cdae389371849f66d2def2d47ec5887d11f1c61b5f44a58eb4702638e191d768d85badd77e550a1530fc5b2cda2099750d01d879b73b07db5d9a262a
-
Filesize
5.9MB
MD56fc48a9f3ce3c0fdc644874596cb82b3
SHA1a774ec08cb80d2827bdade9679be14f7252506f6
SHA25661e562d885b4309677e7682c1107e16da3d20f79ff60db75d090d8ff8cda6b32
SHA5123295a307ab64748c719fab620128938be59f92f41772f6cc3c1e6d2557c08dbf0d798e2e6ba082215950c059d09594f47c95a61ff142a89d6819f745f9414b20
-
Filesize
5.9MB
MD520df8bba1854386abdfec7ad0b04f4bc
SHA1dd155b1e50674e24207f202bc4f2486189c79d55
SHA256cbf0b3268c0cb21c2687598ce86eec32ae5754442e4aa60f55bf220b55cff889
SHA5122066eb3067931db7f203806ccc615742b09a3f8b77bcbd0b9cc0f120f0e6826680e2dcb5097465ab531cddd7c5ee3ff16a9def9eb8d9b3d0f09c0f57d0ec9905
-
Filesize
5.9MB
MD5c031675e9e79f1ec46723281d220b1ec
SHA1546c5bcc07af1443f7639fd2f92479aa2cca6ae4
SHA25651949414a001efa63ae7530711527d0690b489101030211039c3595fd9f04629
SHA512d57b285a306eab90aab66197f4cd763be7946e7e1eaab253943c0d05cfe1822ea2f0a0bcfddf6bdbf4263458d4ea117162e63f53d06bbdb1102bf944f9b9123a
-
Filesize
5.9MB
MD5d6ded13dd161019064ad36f65aeeb8b2
SHA1974262b8401e418cc4f280f58c7fbc9317be2ef1
SHA256ed5ba1d3dcb9d59c0121ec567a5c6e5df8fe222e02a80c000b4471bac9509523
SHA512fbf0533a724553a8e801726fdaa97512a12586aa07e9bcc4f1503585d7dd4acf867d7628bbc76675ebd5131b1d5ce116d42ec13e906499fd96f7df09526b7461
-
Filesize
5.9MB
MD5762dd4b53bccbd7c4d6583f6bacb82bf
SHA1aab5b2e28e36f1877c3a261c602ab1146d2203f6
SHA2567967c96cd84e8711f3a8115a281642fa177840621c430f0af42a1a0e849598d4
SHA5122e0e4254025e01270fe77841f98864561c5f1a4866e4a652aeacd89b7b0739d34f6dc967c3d2c8d9612b91d8b28e0030cc34869cee72b4bf3ed8637fde57cd32
-
Filesize
5.9MB
MD515cf08fb3c2b03e85b6238b745a19803
SHA1d0fc111591a9f42431f06ad68c29c9aa92437542
SHA256668b8e4d53bc482a080f5a51c282af34ad21e80a9108486a1cb8f9942556eac2
SHA512a7e0ebffe33b6726f0e9e33e0ae0578ea942d591be12590a3bd1e8ec7356cd8cba766eceb34a3b0e3d65564d1a7198c932acba6187ded27e03319c1a1482e4d6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB