Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16/09/2024, 05:46
General
-
Target
2024-09-16_213b0425d1fbb0f6559c270061da9ff6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
213b0425d1fbb0f6559c270061da9ff6
-
SHA1
0a184c3950eefbde3c0d43db34c8b848edf8a305
-
SHA256
b4289e222a8802a0f6075b7c51fd6324908996151d9daacf2d5fd4ea029a286c
-
SHA512
12c2d2389f2e1e67bfb43a7f70e67843bf7d5ae47728e69a6aa371d2b3d9bc69e7a42c425f61dda7b8d1480dfe0b9fd09b1c8219f887a1156d4cead832378297
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibf56utgpPFotBER/mQ32lUX
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_213b0425d1fbb0f6559c270061da9ff6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_213b0425d1fbb0f6559c270061da9ff6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CYjDkaF.exeC:\Windows\System\CYjDkaF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lzpssXs.exeC:\Windows\System\lzpssXs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gRXfrUC.exeC:\Windows\System\gRXfrUC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LqotSXC.exeC:\Windows\System\LqotSXC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HSSvyQy.exeC:\Windows\System\HSSvyQy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HhFmIsu.exeC:\Windows\System\HhFmIsu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gysDZMc.exeC:\Windows\System\gysDZMc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nAZdGSz.exeC:\Windows\System\nAZdGSz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kDJIbrx.exeC:\Windows\System\kDJIbrx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UXajtsv.exeC:\Windows\System\UXajtsv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TwMihJp.exeC:\Windows\System\TwMihJp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzaFSeS.exeC:\Windows\System\WzaFSeS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TbBcpXg.exeC:\Windows\System\TbBcpXg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NhhwkUZ.exeC:\Windows\System\NhhwkUZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\olhCtAu.exeC:\Windows\System\olhCtAu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wCPhYVo.exeC:\Windows\System\wCPhYVo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uvsuFnr.exeC:\Windows\System\uvsuFnr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zweMaek.exeC:\Windows\System\zweMaek.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AFHPFnn.exeC:\Windows\System\AFHPFnn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qxVRXbK.exeC:\Windows\System\qxVRXbK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DpFZxmm.exeC:\Windows\System\DpFZxmm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a712b3e10e693f490789de2361d04bd6
SHA1eb4c3f93c221b6b898810f5e5c9aca846c45b1d2
SHA256efbee3fa49638c88003c6b430dcc0ed631832b32f567048e794b5fdb1230b27f
SHA512905e2b8d02049cd37d09f350bc2163b0411c6c9f6d8c362343dba219d58f6414ee92e63941b9f7dc8dc51cdf725707299993636439bfef696a1f1b0c59071244
-
Filesize
5.2MB
MD58ffb582cc7bb1898710786fae2f4d20d
SHA160d3fa55e1a3cdae3784e000f664bce72cd33ace
SHA2567907c3b2b70f719fe1cec15e5e996621516872bd8d0946ea67b06bcc9217b3a1
SHA51275ef282bb11249c849a2006fe4fec4f6fa8af90fd6c255c50f050d3fd8e530fa7b9003969ef99f65a61917dd54bc5ea38c5df69536008ebe5c53ec90dd57886c
-
Filesize
5.2MB
MD52974bf446a278d48cef7507819dc2037
SHA178666c7945187e8a663f46e7191a9747091e5ed8
SHA2564c629b3491417d4bf56654f3d09d083fa30d49f4f6bbecbe1700bffa2d72ad5a
SHA51206369e52c44533ad5786c2234189c8dfdb4c45373e6a09123b4320102d6ae8c6f87da018464dce5705e9fc1aa3def3f03cae98e0266d9d7cd5ca7c5501315938
-
Filesize
5.2MB
MD50973221f796a797f97a22b4f02fd53da
SHA1a118ceaa3a5ede629962ad07833a447759e3c3f2
SHA256573e884695492f246b8f6438eeb2f06d938c6d51a7e2a4d3609dbb7f9bb277e3
SHA5124c1f0b702980eeb81b64f1437a77151465acb15963c34d1c33d93b2ac780bb7f8cd6c6e9b9022c4c3f280244a084d116e9331564f3aafd52df4d20043cf4d6c8
-
Filesize
5.2MB
MD54f8047b6060876070e933bb8d0072031
SHA11274b87c67a59fce030cd4b5d7c97405e7644fbe
SHA2562f455c3b3bef5d7146bbd8956a65096899bf30343c53fe662d8740533fedb526
SHA512d4e48608f881ed9ce7dcff5e5e0f2e80a177ad200175e8e4b4929e8e05e3a210b1cb096421c81c9f59a212f49daa5b496db8693f97f9ccf2db06ab1cca2df47a
-
Filesize
5.2MB
MD5a2b997df935e534b43923558fda317ce
SHA17f0c72d9b82da4636d802a7583d9d0cba4aba22a
SHA25623f996bfaf4482da7232e360f9a41bcd514387dbfccb3ed381ccec3618754540
SHA5127fe0b7ac90a3cd04d31e40577551a5f6d97720883f46e831f3cab99740117cf0f9de4e292402ab4996a7dc1a0a7faf282d6761b54f76c1dcdcbebd37939b3e5f
-
Filesize
5.2MB
MD5375138cf037304b323a7180f9746a755
SHA1ed568019ed251dea3947753a9b09f80a3807abd1
SHA256ffa94e73d8f44165c3f513a636a1b5da971a3f2796a29356de6d52b10eb8cabf
SHA512a1e8bef12c2e77e06e230e5700c1a49062c639bc260b30d1bff62a8d2ce042700ad26d8fe65480eb6d5ab86dd2edbe4cbdef701f27e94f0d51faf98256bd9e90
-
Filesize
5.2MB
MD5a620ec61a28752b0f8fecf51a4eb3ce4
SHA1dc51dd502961f12718e01995374c48c709554d88
SHA256c3e7657800044af7569040d3c61b65825b2210ffd4e057492cef23747745a356
SHA512d6f3dc30a64654066116c24798ac28fee4055010d7533609f327c7f64ddfac62db06a162e95e7df2765faecded4b0d010077b6a2043d4477deb4dba4df06e6ab
-
Filesize
5.2MB
MD58cc7d0fade38917ed1165fcd0fafb75e
SHA113b3b7e6fa042db6ac0f50becaf9cc8e268e1fd5
SHA256bd96d7217b3cfe038f4c60a0d2911119a951d128b78447ad5f46b335161db0b9
SHA51225d1b092385179110b242317f220208daef2d8d1ec8ab2d3a8a20c16363cd4f3b3e73177e684141a40c3ba4e758ddfb7a4b0f2e49f1dde5541676ef6c3b8e909
-
Filesize
5.2MB
MD555171d68bfad92d8e1f365203af42b6e
SHA12003568c5e50be7b385aefbaeba8f4d746d9da8f
SHA256e366f08d61760c178f5b217f917ca71b4f43ba126fea42ef20c715beb5103f78
SHA512f138840a64bb9a8c98383499d7503325a5dc10258299e8382cd74d0e43372a42ee2472a9a4f5850098a2437a03580c32047765749422d72ca997edc9f25739f9
-
Filesize
5.2MB
MD5b3acfe126775a34256edd723245ba0b4
SHA1c09eb2914234b3292fac25818320d91d6b1159c6
SHA2563aa3f2d08181b847f3286a485d452a6d55122794b11db9578790cbfc41dfe1be
SHA5126d2f509adad5d7930af76e3a15d05e76580fcf2c9a9b47b64b26026af625b9c9c04eddfce39c732c0b4c0e2861694a1642ebfa02b87de667b96d048100ed4e9e
-
Filesize
5.2MB
MD58451201bd9872b24c78ad241c16122e2
SHA1850864bd39e512290ec49d43cdd650dd74e30132
SHA2562a09e8f1d84507328024d9b5de1a2f96d3490725630a68ec8712fc3689b7edc5
SHA512be7454112e4a3fa6196938a5edb8df07708a5ece3611394431368520f76906bbf03d13501751d2b18c1ceff9fe9c9ee4d7f65342e81d439bf73ea05d86227b0b
-
Filesize
5.2MB
MD52fff1c66b3761f9545f48c9f6e65f8d5
SHA155bfb1173e03777ce793cb936892815bef307c3c
SHA256aae684e07979007e21e02170b72889bb0bba3710676e7058eda5688a086c2fb2
SHA512a21771d50cae77b67120ada1f7b9efa63d0109a386726f8655b99d12bb3cba7ad3905bc47b04c159ca237218e7ee41e84c101a7bbd60dfaee43a09fa74adb071
-
Filesize
5.2MB
MD5d850be2588f805585655eec23f3b8699
SHA1ad7274a789b2852f6b073e6e6714e6f8c87d41ab
SHA25604a50f3a089736136246665638a1a408d299c9660dbf526b269f5fa14b1cf288
SHA512cbd993b510421f360572af3388d9e0cd712a773a04d04847efc85ca1edc061dcb9333d80f67c69e8763cf6116a7e7f864fa43d7f35f35049825b07fe12c92ef3
-
Filesize
5.2MB
MD506b175c9a59ec789a2b251ed179abd33
SHA19de4ffb9d6d5014726e43140d798d2f220d5403a
SHA256ac74ff74e8cd132a62eefa14e2a478aa7836c869ed8efa85cbd9d4dc28d7cd1a
SHA5122278b3f383532969a166e372f1905c3c0af42ab7a1a2fea7cbcb97ffc1124620d7e74bba260c7fdcaa65c5c97239a1d6236f0d5804b733fdf162c1bec7573b39
-
Filesize
5.2MB
MD520ec6cb753f67402d52ff2d34f52d7c9
SHA118da604399c6ece0ef3f320cf96724062b0e5a1b
SHA25614272ec8b49d3ec10e7b8b74b76703b7c4c7fbb13eca72deb2a13aa6ef817abd
SHA51205ff8865a90fd7f9024d9397e8830af84b810fe9b80165271936f096081970a0edaa1006dc33b1fb862013937f4eda1734793818ed05ce5e946e5b6d319540ef
-
Filesize
5.2MB
MD5eba0f990be13826b8fd798ff48b43143
SHA1e551378179c1bdae96354b16e8370e4f79101dd6
SHA2567c09e59e9ca419a6237696de816d2a4558461e6ecd10995d54ad577df1413f4c
SHA51236bc7ac1443fd31d699c7ba6a8117901ca19f1850acd93ad090f25e851ba9f4708e84c4014d93aae033cea4a61091707b98168a67d8b63611e8515406eed0a47
-
Filesize
5.2MB
MD5a678ad6da75e8015c136f6b9d3b614a1
SHA17e890ec9c7e6178dffbb201800064871f96f72da
SHA256ab3d14fa5de078b6cf5c2283df6e688aa5cc5b090973f2edf4bb7c217c3c7ab2
SHA512e6efb881e648f07690a534f3ee8ec1848f4547b9b6487cf1dcf032f8caadf4fd52bf65973e2ad558f0df6214aa0098a0bbe686f7d2b450135ce152f2b323ac79
-
Filesize
5.2MB
MD59e73745cb95f9afc7b30ae100df39fea
SHA1268a1f1eac6efbea37ec9fabe7407e66e0d88ad7
SHA25635f4d0c5972d53e0633d4614819297d4974a1a5414824fe5f1af8f5eb32c172e
SHA512a46c88f2369a00e0e15aade4b68e3ec78a82aa99fa1b7280d3bf727a7cc39c48aac5ecbd2e1ac07225179036906a838b1ce7e57f171bfd6490c76deebe069d08
-
Filesize
5.2MB
MD57cf4a0b905e69c8c9b7701e34c69e3e7
SHA14b177eff42cc5d4c1f4df8008a57eee2d18b32d4
SHA25647b6acf365fe1ade5e475f4770551d32546484e75543bf611e12c0335b34d328
SHA5129cb23103db42977d7d9d017f9fec6101e41ecb18fbf9e2a027992a6399dc33ebeda903afac08fcd354165a603f6579dc689f69ed9eb5442b5f960aec5d8dd78b
-
Filesize
5.2MB
MD593fafd167e76ca4e06635226dc92184a
SHA15196f496be69e7baa30ba6db6ff7d72215c218d6
SHA2564dd26e8b4a1154e6e9a17ac13b0cb416f547eb546b83635e9c085786efb60c31
SHA512244daa9236dca4c967d2ff4a9f890ec8bed497db915f1bd643077d6d9a349c051ce603dbe3c07a1b12667bc81f89130b098608edc2d544c99c873c1e1ee86cdc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB