Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16/09/2024, 05:59
General
-
Target
2024-09-16_e7e2c0d564d5532abfb755f1787d0f35_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e7e2c0d564d5532abfb755f1787d0f35
-
SHA1
b296ea056e62a4fef43b415a9778928e3e19e527
-
SHA256
748589d907016383d985edb79df8a3955a85d2aa7e4af5e50e2640e8e6a160ff
-
SHA512
9da4c98f45625b218c214db91a0958f6bf874b3035d69982fab3af2d78aea6856a0cfb04ed80d6e850dc69fccaead8a4f0f196096b41548229a6a29c2cc25295
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lUE
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_e7e2c0d564d5532abfb755f1787d0f35_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_e7e2c0d564d5532abfb755f1787d0f35_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cmlHxBj.exeC:\Windows\System\cmlHxBj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sbiNopt.exeC:\Windows\System\sbiNopt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\adDOXIk.exeC:\Windows\System\adDOXIk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aSPdYdE.exeC:\Windows\System\aSPdYdE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CAkrKjy.exeC:\Windows\System\CAkrKjy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DbQNBgQ.exeC:\Windows\System\DbQNBgQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NNQCEUQ.exeC:\Windows\System\NNQCEUQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KqoApcj.exeC:\Windows\System\KqoApcj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sFogGnp.exeC:\Windows\System\sFogGnp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XBxoVad.exeC:\Windows\System\XBxoVad.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iOosdzE.exeC:\Windows\System\iOosdzE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EBSyniM.exeC:\Windows\System\EBSyniM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uzzKZNX.exeC:\Windows\System\uzzKZNX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EorQyQv.exeC:\Windows\System\EorQyQv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IEMvmOl.exeC:\Windows\System\IEMvmOl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VqdfDAF.exeC:\Windows\System\VqdfDAF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gqsdbZa.exeC:\Windows\System\gqsdbZa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qTGYAnu.exeC:\Windows\System\qTGYAnu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TniBkXW.exeC:\Windows\System\TniBkXW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wFWYSQN.exeC:\Windows\System\wFWYSQN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VeolIKN.exeC:\Windows\System\VeolIKN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD568f490682a010987ee213afb2ad1c1fb
SHA152231a377910f407045896cb9fcb5c95309083e3
SHA256cd843e6c176ad0a5268c042511c88836eb6457863592f3ce11cd85bcc3046ed9
SHA5129e53ae50c4bb0c2216a7db6288c9b06c547c2df8a8b5c595ae08645716c4b8115b0c2d214939add1180de441e683b7e76b414474b7dedac9b88376fc5083b28c
-
Filesize
5.2MB
MD51086cccec7bf71560de2b5917896ee7b
SHA1bdf64d83d6a745ae73b6b898c0a4ef3a567af081
SHA25627fedd651a56b89110f7a39e14aebb7bef3483145b950e66122d130b27b17f31
SHA512cc611ea75c571cc8fa5cfa0a2609d135c5830b6b6375962961dc785ca339bae156590f191c93754c9fa8592858c90dcec29c8c08b8a15c306d0ec4a5d74a934f
-
Filesize
5.2MB
MD5c7ffd26fec3859d2c906e21159852ac9
SHA1dd34105f055e479d25b24ebffb0b2ead4019e7f7
SHA256b9f510944e63739f278d917b7c7ad542889f0cdd815ed5d8d8836dfe3e0df486
SHA51211f9fb54ab41d0341db58a14aeaa573499d80013f65fbe3af9204c4525c296eaaf36488d0e315a6a48a0b949785a03cb7f030167351e65444bff6f13ff3e1342
-
Filesize
5.2MB
MD599593d966805d48545a810818d597750
SHA1789af616c67d8ba5568aa722d8b8462401d4ca98
SHA2567bbb28f5c013575c41bd715e8325a486400898a813ea060a6650bac1b67aa7f3
SHA51242c66538c481da75f99a7f264fdd1ac9dd23761fb57ff7c1be7a2a7fd9a6959ea0adab96a2058f0d1102683da44cd8d041080f293d2453b765952e12a527ef2d
-
Filesize
5.2MB
MD5e5f976224390f756a6415e053aa03a52
SHA13641d71626bb963fba314ff9d828235cb6fb27b1
SHA25626e28608c40aa9c706c2239dfc3556f167a59edd4c543ca3c5f3538ce0652fb4
SHA512bc4c59bf8fd98b71e45d707be695252250e74f712ba5e24360effc5c6c2ef7732f61d7cbc873f989ca0e440d1ecc36b917253bd8e9ef01ec5b6720488273d82c
-
Filesize
5.2MB
MD5a137e3c2c5f33316d68ca41951b9b72e
SHA173194dfcc3673ebb2e474da10aec1faddbdcd42c
SHA2560b3705b94c83897b0a8729fa7dc6ea6b9311adc8719a19d1a0923b288c382f69
SHA5129bb36a6ea283048dd38f89a2b4f2953aeca48865f0dc2d84d7fda4ad64a6bb5c97030ebed8e9bf0659484daba63648b5118b14cb8326350a96c6c0d9fab7b795
-
Filesize
5.2MB
MD5b7bf2fe193002c0c68653deac9cdc246
SHA1c65b2bc70517c8bc6c578668ba0d62527e3a31f4
SHA256b7f08ef14a05fa5cd28e731c9e9a97f8530dbe1288dd863479c8edb1f5c21435
SHA51298fe6d5d87f43caee7c7bf9c30459091f3a25722d6478192d29d5ce965288f5f45c2beb6e7274eab231010c8fe4ce761b305cfdc0b454b7a996b8f0d8970351c
-
Filesize
5.2MB
MD57d1bc34bb509b2ac277378daca1abd76
SHA1ea4e08326a4e7648e4a9eac3d9ec5a08a12c44ef
SHA25614bc8cc98aea5da7b24e598611f62a34435e53019d1387bda461d5ec4b3025b8
SHA512ae9dc50906df094453260a797f884462cbe791f3ecada325fa34b6524548cfdfb03e0bc164d3b292ed5927e3e15a46fc3b166bbb9ed94f8bbf82e3fafa6b12fc
-
Filesize
5.2MB
MD5af7aad6db998e68052c0fabe53ce899f
SHA10244b9a063476b3708ee992d0f4043c331c8325e
SHA25634f026474b6f8844274cacf01edf6865a8ea4c5ba7e545f7ee6525cdc0304cfe
SHA5129ef079e156893396db38d078507697064f94d37e3f0d71c6ad2c463a3ba88663cf3a5ecbf1462b66cdc505b76f9f78f249f5ef39ac9a263cfbacea5cb3ca559b
-
Filesize
5.2MB
MD589d0b2a0765d2cebe0e0b32c239307db
SHA13c48dfe7aace6d57e0add7fc78a5c14fd21086db
SHA256e97efa98b518f650974a9935983c5f790457daa32e1a68a6a2c6868ca8324f04
SHA512031e2c276fb44a4ce944a3616160f063c7a01a7a83447bf8f4f69cc91e494bd9151b37a7a16c6e0cfa488abfcf0f9afd2a515b16623c019c883c255fe7b3eed8
-
Filesize
5.2MB
MD53558202f14eafd27feb144e6e370bfd3
SHA13004cdbd3feb5b75b2c9adc7a1b3803a85597ad3
SHA256439f4c2a8d8f8a24cda524d93e2f702e258cd8df9b12ce1f6e3ac216a774876b
SHA512d444081f01f3d4b270a247da66e02035b2266cb194f112840a70f3c1e771e81e552173f69833e6b2f553f4e8e06b690f186fb713595513ced18ee6b23ae3bd4a
-
Filesize
5.2MB
MD5770fb5d5ea2e18a842f125a092c52696
SHA113b14c3114b8a75f9029cb4e82bf369ac8013fd6
SHA2568fd890f3393745f56a22ac90e5a1220d55638012818230891e77de75a56ffdf0
SHA512f223e480dceb99229ac0cb82149b4d779bc035095315ba23bd622dbdccb3c0c51c8f3acede393b948b50190abb9eb3e251f8148f9182266a06c6442d728b4cc0
-
Filesize
5.2MB
MD5397218151b896893dccf1085cf0ca415
SHA1a98a9f9dea238c5895b97d356c7c91f945491f28
SHA2563d86041e98a14334af716a5fa44174eba67eefa5f052da7917bb021ff48c8cfd
SHA5129248c9f9a27ef59487b6e4bb1a0addaf4f0f61cd0a6f94619a55562a0fd90c4f78cfc75328054602e6614098b2c0736464e60d3c79ae404477340d85126ed0c4
-
Filesize
5.2MB
MD5769a73294d1dfa178d0b9cc1fb2aa60a
SHA125d5fe9842452de629e1e1d061ea0a1c513dad03
SHA2562489687be16518490ac1b2072ef9a095097f14382856e0363d3e88936f3d0bf5
SHA512fb5bd8b50658bbc1b4a98969d8fb63643491799d8707695defb5ac9e32fe99e5b1c74b084477c16a685d357bec28392b5f4d7455eac932832893a0585319a843
-
Filesize
5.2MB
MD5d8e3b8a096939d6c725da5987b06e220
SHA1d08acd97987e7ba71a4103ef0a6d021ca5fba4ee
SHA25639dd907ebaa11fded07be876eb0e8f83e0730239e38d3676127553a084d67323
SHA512a606823da06b656bc7dfcfecea22121d0bba9bc07908c7a5111614a0c75fc2cc30e5f6e18e118a9d57db738720f447dde88ba0ddae2d1460befe975cd5c8b884
-
Filesize
5.2MB
MD52fb04bac627704c31f6b384cd5025ee4
SHA1ba51eea0e3b1de955b29f3b86ba1a69a1dc57443
SHA2564f0f2435917580d52cd1449826e7f5d65763fc019dfffb1ae62ead16b1103333
SHA512dd6bc31b4778a3b05205d31e4ae4552f70ab70cba371137673eb57fe3317c2af4f240b411f98fb016102ae971ec118e0649a3bd46df6f9b95454b4065f4fc324
-
Filesize
5.2MB
MD5dee3b466b19bb392c715ac00a889443d
SHA13925b4c7221d2b9db9ed8040d31042f1b40e2095
SHA256b5cf1e1652505be9cc2260193dcd18f164adbe685a2a26bc18a1c02188cc7837
SHA51204373f90e01036879c709efc0a6e25e40da18dc7b64b5f28f8996cf90c2cb04f237faa20cdd4fd99cf4c638b5f82943d1cc1d39aefe8c2f7839c00ef25f8e0c6
-
Filesize
5.2MB
MD5db0623adf15d2e291f6e2e2ea1d99909
SHA104997d71e647a70fb5c04c71bd9a6018f6192265
SHA256adc42ef40e614a38fda999711e6d032f898b92453356ab226c4e574bdaf5574d
SHA512bf4d4158f8ccc302f342d231468d6b262e2bd1f4fba8b2e89362f3c75b5e7625ccaf4a0f79056fbfed250597456fb313a4c1e443a41cf60704d297433f3df79d
-
Filesize
5.2MB
MD584089794d10c4dda9e3091a1d9714059
SHA17fde85835dbbcc116adf736a203a1038b0ec1964
SHA25691af0004578445bd2306407a798def35cc93ff1ee56a9d8f4ebd1b1ac6d00af3
SHA512ccc1c25643878241fb1d322e030cfffe194ea2a24ec959791074bd1fa1e76e6801c313b4b06eb0cc1a04bd14171c8497a143bc8f72715b034f21beae9de9f301
-
Filesize
5.2MB
MD592c377a4f9e3803cacb3daaa7051f643
SHA14cd530251d487ca482f05e4371f651912640de77
SHA2569386e4d6649dcdeb10d5d335f1e349f3a4035aba9678092defd40748289dc916
SHA512880d5d1a4d32ade1a370e3dd45b4cfb9542de3acec3e2be798f6b463ab32ee403c93033347a4146805f8bd3ddfce666748add0a1b14b4fb52bb6c86532452404
-
Filesize
5.2MB
MD5d4520693f871cbca56fe6c2786fe4b6b
SHA161aacb8d9a01ec1a16e71ac2d2199c2886653bf7
SHA256399d92a677a5ad7d4e6786b85ac834b001179817dc8bc35865b6d066307c26fc
SHA512771acda5728e09e545b798f029947e583ad16ec57b01eb46d6cd7fab0cc00f873dc3b633f3522d3a9d1e8825a96e4052a8969f7ac1d96d6a5737bc130030d34e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB