Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16/09/2024, 06:01
General
-
Target
2024-09-16_fa362e07e41eb20f8c15f7cfbfcbafa9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
fa362e07e41eb20f8c15f7cfbfcbafa9
-
SHA1
4c22e4f9d3bdacc5e1f37294d51c59f2781399f9
-
SHA256
718c8366faa8561539cc06a4984793307e8184fb4393d4ace483f79ba504c165
-
SHA512
e915d7ce3671532349e6ff62f5a09e0c19658d20d2647562ca38d79a48b0f7c1fd621d5a56f62b891a68c77d5badc5f7982b1912b9527cc761c512af2fcaa347
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibf56utgpPFotBER/mQ32lUn
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_fa362e07e41eb20f8c15f7cfbfcbafa9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_fa362e07e41eb20f8c15f7cfbfcbafa9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AZgzlyE.exeC:\Windows\System\AZgzlyE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\urwhuxd.exeC:\Windows\System\urwhuxd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VzxSpjc.exeC:\Windows\System\VzxSpjc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XJOLEEZ.exeC:\Windows\System\XJOLEEZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FKMWxaC.exeC:\Windows\System\FKMWxaC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FPTFoHd.exeC:\Windows\System\FPTFoHd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ELcbYqu.exeC:\Windows\System\ELcbYqu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eyhNagg.exeC:\Windows\System\eyhNagg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\raSxTty.exeC:\Windows\System\raSxTty.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GCBVPsp.exeC:\Windows\System\GCBVPsp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TTBtaoa.exeC:\Windows\System\TTBtaoa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TmoSIZj.exeC:\Windows\System\TmoSIZj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WVfeaUO.exeC:\Windows\System\WVfeaUO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Tvgmvhz.exeC:\Windows\System\Tvgmvhz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VzJlNVX.exeC:\Windows\System\VzJlNVX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ScMstrB.exeC:\Windows\System\ScMstrB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\StSARXL.exeC:\Windows\System\StSARXL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tQhjMsy.exeC:\Windows\System\tQhjMsy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tLCJelF.exeC:\Windows\System\tLCJelF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wktPvUM.exeC:\Windows\System\wktPvUM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LphbUUX.exeC:\Windows\System\LphbUUX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD528ee840e2f79a3531ade024d7e6a17d7
SHA105f1f8fd1091135a5f9c7b3f871221eecabf193f
SHA256a0c31249e7c61acbbdd9622d91ecb345e89362f443676ebb7ae03d20ff683f04
SHA51235deb7f395329abfcfb790fe8ba735f55a168278b4d8e13ca0e26b97b0759f46829ec02c1ecf3a72affc9cdec117bee7733d5d2b379c6b8da76db93353ba8f8b
-
Filesize
5.2MB
MD572f1e95ea9fd1b32b5d725658f7cd920
SHA19b79a504728a2a818dc7dcd833c26e20718bbd76
SHA2568e691896f21bb6f202c5b8fcc6e40c38711d28fe12cef7c66a4576d824ea2bdb
SHA512f5fd95ef558f25584fea711ad05e1c2d1c941f63c006ed0d463387178bd703998f489df42c2df1c2d7088ba1bc48935a8fb269555b1735bb82278d3b6bc21702
-
Filesize
5.2MB
MD5e705dca8d6c11ee383c5d5edf051f706
SHA11b5bf86d77aae7bbc634a3f2e482289ab5ba9a77
SHA256a44bb8a0358f54ad98c2edf14c3e578db95067ec7507794cd8b53b0c64d9161b
SHA5121affc2cbeb9f1ec1cbf988e71ade2e0186bb774e9b0e6a78490cf5595594c235bcf902b772f8f620cdfa97bb1e44a796865635a3ee05326a4c2825b220eb9292
-
Filesize
5.2MB
MD554c7e283b3ec67174495ea2da0c41e8c
SHA1b4dac9f530115098facb328d366084ff50bda06c
SHA2565daa744ef3a0227e675a0e58f4956124070c7f05305aebbe3c871018fe7105ad
SHA51269f785b3e7d2ede7e64cbe4a245b4b1c023f9b7747a1d8a8e959e8594a4039e4fbf75a2bab95be8afb9919486503a2ed1538cabb0d919f6b5f7dbb15a1fd0f93
-
Filesize
5.2MB
MD51efa7aef636b21aace10aca07e47d833
SHA1bb974b0f69c31e697b522c298aaca05024db94d5
SHA256d9252bdfecc4528cca993a20c1041f675858dbcdef45fe45190e4ce8cef79c4d
SHA512680e927499cd1da6ef6c454224f7d2b8aa99760010f9f263c4b1f5435977b9a9ae04bab747fdc860424e90bda3ff2893060d8e6bb43b9fb5bd7547a4bee9de0c
-
Filesize
5.2MB
MD5407134c14844d973a28e86979c65378e
SHA1264bcebdf4ed62e7ff285ac1c8ab5243d39f9ee7
SHA256fe2051089ea269f60da13fc8fe53ab91c4455f6520187c9ff8ae23a9492faa7d
SHA512b38e3071815f1e007d7334308526c863411cb0c20e52ebc4e5606e2e2f701f67706db97b7293cb2cc20dda4fcd82332e50cda06a7320683e55cd8b4f89a69d98
-
Filesize
5.2MB
MD54cfdc596d145c0dc311dedc487e8b37d
SHA1ecfd699ce2cc43577ea2cac133b6cb358c0e0365
SHA2562191b35819ddfaba62f7975e33920c8e60768b56c9c72ddaeb2e9b4e3714155c
SHA512dbe3d7b5169cbadd18de3149f90c1632205284e7b83a32463018d62e0cdd15e6b5bd3c8733ee208e2796aa5fc5da4e74d4490a4d26cb76a33d35e90ca4efcce6
-
Filesize
5.2MB
MD506177eccd9e134835e810eea93c64b6f
SHA1f79189eaa9fd98ffad5208d82e1846803ea06bd2
SHA256825e0fc0fc62255670a716d0775f05ac6a2a91a1d4b281a3b9fc1904370313d0
SHA512621f816b8a69c47281265743911da16eed93686624554a3a6806defd8c2372f61f80cfd11dbbbe58c7f05799b38126db458472696d087ad7327deb71f1be6022
-
Filesize
5.2MB
MD5d35ff67f43c54e559cfa7f4474a9a878
SHA1c3ecae4f230e03a8263a53347f856b42ee6140d7
SHA256c0d115a0fd808a90b9168bb6f082a98141bde59b8cab4739074d084a20758eaf
SHA512d9d4f065611e39485245d5d41ebef313f02a92342dcf9e88cf098b9f771beb9a2e703e4bb576798f9876e989694c92ae20e464a15e7fa891197aca1ab3a374a9
-
Filesize
5.2MB
MD5c363cfb14254dc42315c1ba4903a215a
SHA19764eac3a09e61ee1bab8183c48364e6eb08b104
SHA256ecdf1d5d4be9adab1236662126df673c7de1c4c4745c302b7ea10664319303d1
SHA5122994c526b1424344c2110792b406bad2da3547eaee1ddd675bafb328e130a9678995ea771a75a2ace3ea29c9086e147a8cc288901149016bf519a339a8d0d233
-
Filesize
5.2MB
MD55bf61fec302b1a1d72068f26d4147795
SHA17a04ba7058b9b38eb8098b4909a84afb6acd33ea
SHA25653074dc736ce1016e7efcd24955b3cfa4df2df67c14f999f39f8f014d3068928
SHA512b5472609de56ca07c9e9bc12230a3177e9928956dd51e4d509791c9846e89d87043f9c6ee652b6479eb62fc95b3c97cd23be00d1a1ebaf446b4c6ca23f8b78e6
-
Filesize
5.2MB
MD5934acf535e991ea5c07b38ea0611a85c
SHA1c069756504f81da7b6cb4ef857a5d07c209d4463
SHA256365533af1e208edd1968c11c5896405ef82e5b5221b61df958db18d2219c8b2a
SHA512fe86eac3602ac72da80d273eb3241916237f1e0d3947ed9ba69d96b8d69cf248c669073b3eef1f24f10ca443752966acaebfda238fe7e2e1b0fe530eb8fc2e4e
-
Filesize
5.2MB
MD566658c2783d5d3ed0ba311281851c0f3
SHA135639804825673c80fee7beb6eb6ae0e0cb8c8ca
SHA256f7babcaab0ef9ffa84c992c46657be9dfc210c9d77eba8c3ed5eb1401f0c08f1
SHA512f2d3671710431240952f8d9373af767d52d024483e034e4bcd37569a0193f58a680cf31455c63f7f9706beb8471adcae6cca90d47e473ab2495abda71c919b88
-
Filesize
5.2MB
MD5b41937d1aae9014e185be8e2ce7424c7
SHA1db91c83e1edebd4c8195a8b14836a14b7af294db
SHA256f587b3c9781c4c330f5f9fda7a840a26315af92904d1adbea177f28783695ae8
SHA512eac0508083fbfd4d7ce66a5a6e9290e752c13b7280a4e586d674e678897846895aade4c8b7971e866a5a15a20323704f34434b0d1d1897ffb2119841844e8e97
-
Filesize
5.2MB
MD52302f84929ae86cd854c4b473734c15e
SHA1f39eb0b3dc1ab9a4a02a3841ce2bef2e2f055c13
SHA2568921629d445510d3dfd067929ea918ef27dc9aaee6ac95eb1b54407b63a24093
SHA512c34d80c1d1399db5588aa3e6e39efd18d1400dcfaaca2b8b8f5cbba776ea464369a394ca587b6ec8b23aa4d588960cc4a14ca6b0ba96342d8212e27650fdf88d
-
Filesize
5.2MB
MD5ed651e088b010a46df61c0b2c60d7d95
SHA12ed02be76f95b6e451e676e569369c573bdad0df
SHA256348bfa2d92563526a756172e1cf3088708e5b84909681a0638afbbb889462060
SHA51234850028b6030a0b0e0fbfdd63f7b7bde4b69a18f898f735fcd625dacce4c80e243d2dc9af4d8f2ce5096633065786870537763766844c0c81f6b22b5520dfef
-
Filesize
5.2MB
MD5e6c26978c35a4cbf88950528044bba83
SHA18a44679b5ae628ceda8c463484934c1c25b1fe66
SHA256b5150723c08ef178a05439a5b57d0c0549ad9e63c921f23febb19ac5bf948a17
SHA5124f6b395801f7aa14ee05180b394d9f2f5ea6def54b0d0cc30489f9ee287a908631b81dcbbc1f4784344fe5f76dadfd1d586f9d7734d23ed8464e2e68ff0ee0ea
-
Filesize
5.2MB
MD501b8e8910532fe4d28218c8bdfcb2fe4
SHA13d131cef537983159504f5990ba49701261a65fd
SHA2566da62e7d295dab20e21de6cdbdde7a0127b61692b62094095103936a221016d4
SHA512cc43aa99e26d72918863e2bb94a8875dab0d288c4d798c78d81df479597465db7864c586cd4d73106ff90924eecbaccb89b96d305a90cdd5cfc407c1bfe4a13c
-
Filesize
5.2MB
MD5c599bcae33ac86cc3b59310b4841dc5e
SHA187a3fa1fe6eaef9176111984c1d1dc82bb5317ca
SHA256cb31e5b82cb645ef5cdd573cee0ebc69cda5a375c46ec88ff745659a259cac09
SHA512106cc4ea7fe9c6eedd525e6b75f69fd1728a28cac38b183fcc66476909040db8cc88c7eb937e4472f2677a5b103c2a8964bc060c029e3a2d4281ca5e9bb679da
-
Filesize
5.2MB
MD586852c0e846be36a8422222873872099
SHA10af5f2dc96b1cf5d27993e24330ea0c83b852411
SHA256730b73ad1834b69859d11d009071d26ae266edb48398ae038c593342563e9f1c
SHA512f15a06f0ce621ffc80304067eeed3657ca399e655395a65dc36b7b6e732f1dd4922abd7344889c331aed2e534db94192979b270e9d9ce71caf463ee67654e901
-
Filesize
5.2MB
MD5a8a485cda400cc2da678cc11f9b9bc0d
SHA1b3ff35a071f72b49ee9d2a17bf31605bb754cd37
SHA256397690f5487667fe955eefada6528f3c8b659d2c47c230a5eb96b069c48f4d7d
SHA5121c44836b20aed2fc649f17f643f218ad1c3de906ca80385e2ad7d02bd04022ee65f8e395f15bbc492c78ea212af631b372073a63945d0885d4048473998490d8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB