Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16/09/2024, 05:48
General
-
Target
2024-09-16_615a686480c1fc11ff80476c48f7a2c1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
615a686480c1fc11ff80476c48f7a2c1
-
SHA1
ec5db36d6c4c0d87ad52c9bb14266b4941028de5
-
SHA256
576d9a34f89e6f9edfbdbc7d119e5035598c7b9814ce56c92b56952b42dec065
-
SHA512
58844f3ff24ffa54702628b1d271662d13d0de48eba4ed98d5d03b14a0080ac9a4f874cc75ce53ea4d6d854466a3aaa7652454bf2bb038ccd64bd8ffabdc10a2
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibf56utgpPFotBER/mQ32lUb
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_615a686480c1fc11ff80476c48f7a2c1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_615a686480c1fc11ff80476c48f7a2c1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\iIwnvQF.exeC:\Windows\System\iIwnvQF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QEAvdFb.exeC:\Windows\System\QEAvdFb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aueGycd.exeC:\Windows\System\aueGycd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TFOxJsr.exeC:\Windows\System\TFOxJsr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iaAmSnN.exeC:\Windows\System\iaAmSnN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oJGnXWW.exeC:\Windows\System\oJGnXWW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ghorMEP.exeC:\Windows\System\ghorMEP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xkhUGhw.exeC:\Windows\System\xkhUGhw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xcsogsJ.exeC:\Windows\System\xcsogsJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PWhIEEm.exeC:\Windows\System\PWhIEEm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WhnlhVv.exeC:\Windows\System\WhnlhVv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntybaWp.exeC:\Windows\System\ntybaWp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RqmEaxN.exeC:\Windows\System\RqmEaxN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NFaVMQW.exeC:\Windows\System\NFaVMQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vCeulOY.exeC:\Windows\System\vCeulOY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VVlbBFh.exeC:\Windows\System\VVlbBFh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KjxNodv.exeC:\Windows\System\KjxNodv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XyrsqbB.exeC:\Windows\System\XyrsqbB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ATdWEBI.exeC:\Windows\System\ATdWEBI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FIzTReP.exeC:\Windows\System\FIzTReP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tFgQaJY.exeC:\Windows\System\tFgQaJY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5dbc03a755ea5383d54f48aa570bd37ac
SHA1e7603b1e5738843969e6c38479a5008923c676f3
SHA2565b1f962b3e0c4c476a8010793dffaebec4d766786e96c385e022fab217f04797
SHA51231b83717fe6f2a9ffaea3ecdd06dc02b28221422989b0a02794a588a001ec18ec30df871c4cf470f88ff7938afab134afce79c1af6af6a6b8790e27562d615c3
-
Filesize
5.2MB
MD5b4243b1f6f21c6acaa67aac9fff56ba6
SHA1bfde78f0c8a7c0e56be4ec01377e0f36b7012b2a
SHA2568362cdc125882c39432a9a7116f36fb0ec9ea6a6baddeecf2496085e47a856a4
SHA512589391866cc96fda9075439481353e1eed2004849b1199fc446a1bef776390cf2fcb01e2365019a42bc09ed6bdb5d81a60c2123456cc9c2fc752abbc9370cd6c
-
Filesize
5.2MB
MD500a3b3036f3ef835ce9e22036999b8f7
SHA18e3fe0aaa989ab3a52908d9fd160eecf585b5888
SHA256ef67f060efec8bf176fa87a44eafd7522d3c384e91d8fbcc4cab1b092c214d52
SHA512239ec52b51a8e41fea68a7237dc6827c31f95ac78e2d99f2cf4a274b33d888dfc996096a6407a482bba3142cb3f056e0a104c78d90577e3548261ee4c1e0a0f5
-
Filesize
5.2MB
MD568d5cc8cf9f1f8203347f4172a9e803c
SHA19b161d85194edd2cde140ae19b3b7248e974ddcd
SHA256be29698e189c6d82c9e439269106713c2074a604fc5d9aef53d3a0dcf0eac559
SHA51234c00808ea34c39b696eb13d42b29846b7db0f875b763aaf0e12e8c813f93568c070c6252166901b9646bcaaef7b02d4b5ecf3b74b0da48f05ac5ec17ece0cd4
-
Filesize
5.2MB
MD5fcf9998072d9af2026f82e71561286e8
SHA13d46864b61c231cf921de7bfdbd6f6048bc0c872
SHA256e474e36f9438467cc7bb9b196ec72b0ba54717bad08fedd4ecc2a07348db67d7
SHA512ba432e086dff1efb81601f7df1dd09647b1c05676587cfbac947b4559ad32a2b6eeee4e2a43ee34675cd00b6ce8dd93bc688c17b211f5b8e6de8b0f492cc13f5
-
Filesize
5.2MB
MD5227c1ce6c5ec645a0c694797351bcbdd
SHA1e02c6b9feba74f930bc884e3720bc7147ea4296c
SHA256eae24b198545392970b77a375ebb61048fc061e4cb77e70c0969d82861b5578f
SHA512e1590c451bdd009a1a74ca4ddcb437b9e17afe337fb08fc3214054bf7263b1c4049a9763564fcf15bea2c997d60ac84c4544d5dedf48efe98306bd596d5a11b6
-
Filesize
5.2MB
MD51fc71f0b50f021492170801b9cb9c370
SHA19496b85ccf4a420d25b1c4b778d01a44fd2c7509
SHA2563a2cf08c5361c0d904d3e4bf27e248360ad4867bce4c3147aa18de2f78ed7172
SHA51201a25d1fb647ba3d005a21c1275e676c18f0dc052714a80678b3b6dad4053b09f8644f5faccc973eba51f1761eb8da9ea3f3ba24e9f5d2ccf6d4dee78f3bf830
-
Filesize
5.2MB
MD5ea0915adffdd2aa9c1a4daaa1522a8ad
SHA1d2a65287ad965e94e0fbcc397e58bb9969e1b197
SHA256bb1e8572c66bed2592cfeaa80c09cc3ea02f212fa22b3be22324afb5cecfebf3
SHA512aea89220c3a709492e0cc90e4092d980dd623d81d6374c477580904285c37518497b4e8a4708f988ebb94d6a5d29c329b8bc0817c1dac4681edd5fdb79a7f7c7
-
Filesize
5.2MB
MD523afa68fdb62d781eb6d4e7fe29336dd
SHA1a827eab49490df096f137c0416c633604e7eeec4
SHA2563a66bc8d3cb17c6f59c9e22a89e036ca74526f9edf897771847f6023759e3ad5
SHA5125245b239575c1f38bead8dd34579b27bfc352fbd6fdf50292ba48163ea327c25ccdc2dc8291b1cfcf4282103fcabe39f84c8b35bc4016151be024515184e167b
-
Filesize
5.2MB
MD552ed49da1bad563eac483a68e281e015
SHA1ab8aff062a28b7609074f74e6c03331266d1e18a
SHA256b054f98dcaf97b65eeb7e1f0b18856f4c8200bae501e073e286f986da61e1227
SHA512d8e2b23162c9a04708c77cef6e9fbfd2118dfb119718b5493e98124798dcab5c7102565c3701e02ca21d6cf8a5a4a955b95d84beeb6bcc90c55daadcebee51b4
-
Filesize
5.2MB
MD5c8dc03a5de8050061d4ee734d109d0bd
SHA14630f1466faef3bc3b63a983f94c8d94a651d851
SHA256e7c57aebf77c89ff3f35943642295a552564fb4c148cb9161cb1dfe5f6156709
SHA512d5fadabba8c62e70e78cae69e1cfa7cf61a7e07d33cb1defa81d522ff588ffef0214cc7937d775892436493160f7bfffd1f65f8de2b4c198fc6bf887cf38df16
-
Filesize
5.2MB
MD50c4f01f65227e137d15f957cb3f72419
SHA1788414a70b1351f817148f2fb78676a814d253f5
SHA256e9d89ab935a891c37f5e2e2f469f9db23179421f3333eef4a01b1798ca4b2500
SHA51277e4db18c9e0cb4b550d23c08f4f910986b81e8e3e41fb45ea8f626b237300f0ed08c7679af16918a18df459b82f11f908fea0e8b32e74b9c3d73259f2e1a09b
-
Filesize
5.2MB
MD5f9b65c5877eadbd488744c302407a112
SHA1f06ce5e12b61f539e371f9966e7e3fc90200d570
SHA256afddcdc502bd49ec61a1a6ded7ff8102c4bfa994b05c2223bee92ff9427cb90e
SHA5129dd5bc56649052d073289b41b1b20207edd2175e2e17ab252b687ee87fc3e3d8a549d2fc3c16db9c692d9151b49026258658a2dde522dbee8580ef04140e4b1b
-
Filesize
5.2MB
MD58de21c585b2d96c2edb2b7aa431ee1fe
SHA1ca0653c287d07477e81fc538c9d8a4586c4d1151
SHA256bf5056750ab81d6926cf7293138a8556e3c4a1abd092a8a191d54ac0807d0693
SHA51225a52a255b4a680f5358328a561e5a48f7d0d39de09cfcaff197e12ad87d97886414340d3588d15d3a14bce6abc71670a8cc07765c11d6a1242c1299cad8116d
-
Filesize
5.2MB
MD5c804672c0dc88347f0fa717ee32cfdd4
SHA13a54dd07b39d2613637e24227510d88e6cd177ba
SHA256ca2b56a7777a92b3143b6943d8dd14e06be9c39683ff11cfd1c703cc11a2f56c
SHA512b6c45598fe547c13f60ddbc8133fe4419c18c775cb8fd8768803633dc30717eb99422bc45ba6f699845bb1d9fdf0f1ea65779b449e22b3960bb86dfd82d633d1
-
Filesize
5.2MB
MD53080a3ad4f810eeacc8cd7fbec529aa5
SHA1ce0395504277f8513afda6242cfe550656abc159
SHA256eabe6dfdf792e4a613f84778705b2d082a8a1ff5d0ca6b4cc4979cd9c0d2fadb
SHA512559147c2554cd8b51655b5a2d2aece064fd5d5ceb352b7194603ff3d7fdab89e629c3cdf5dafd09c77452419a6938f5bc28a884919235d71ac094d3f7975f19c
-
Filesize
5.2MB
MD575ceae12f2ed7e70d23d0161c3b07144
SHA1ffd5b2c485ec92ea5f452555d56ca78ff9ebb6af
SHA25662849b389ecdb38e16dac1c741880eb7c5c785f4a79239f61d1d5f3df0d0a013
SHA51276e27f48fea510dbb751d4a57ed9d0787e369455e4a85a9f5715ac33e7cace2f6fa43a869f80ea8005f2084176e9e1652884f75698467968157857de44387a7f
-
Filesize
5.2MB
MD56370cecfe2365ed5fc2671edfb32df59
SHA11bc6e6b51d03abce8130d009940582850adcfd59
SHA2565654731bb18600f5b3eb4fccd98db8c35332f4776156bc9c8b18347cc4514aeb
SHA512f95bba05351535781e984538e8f9cdf0b17e8f46d37fa1edb1cfc0e49e8792bc281e4606cd2aed8781bf973602ff6f5ed351b544ab804324103e1954e7e9d550
-
Filesize
5.2MB
MD5eecae3464a5c3da19cdea48965755c2d
SHA1271f499af2f51d6080944e92ff95235de7f5d44b
SHA256d46d8c283b9b1c9af9ded9463d15d7a502556771423ca5a050a0f6846afbb1da
SHA512ca7fefc0deb26be6285e922077823064c698a9a7af85eeca60da551290655c3f3ea5e3e3844a8ce01d8fae18013c583321d89d296d2eaa0b9c7a45846d4a3619
-
Filesize
5.2MB
MD556f328f1334f16b39dd504bf48fff6a7
SHA1c5e208ab315be149025be222b4921a5d82bdf786
SHA256f1b19cda02967077f5c62cde824c2e15cc66854bc2cbb4e82159ac4abee4d381
SHA5128978a7435ee3349bf303a8d82b07e1e8f4ee31a179ccf56fcbba294635bd0be2535bb6631a13323a6de1aa2bdf3dbb69f3a4558e04da895a502bf95314d237d0
-
Filesize
5.2MB
MD5b2a86fd38cc98cbc6885986700443830
SHA1c7427648fe2a21672f0136cd01e4c5f7cf3d3444
SHA256814476d051b0dfec33b40f8cadbce34cdd51a83fda90522c830e3706ebb55d97
SHA5123bf515f3b018dcfeeb744de53acf6c45f07bdf7559291e7116b38b6edd897fdf6d3fa4ea6c456f53e32aa26c5ba417b2c66bb6c10ca91e88cca429af7bb61198
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB