Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/09/2024, 07:31
General
-
Target
2024-09-17_4e0a28e11daa4483b7ba685f90f6cd73_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4e0a28e11daa4483b7ba685f90f6cd73
-
SHA1
374ba5af997d283e1e12ba55e4af76fecccf27ac
-
SHA256
cb72dde034b9f405b43c16ea86bf9ce7200db338faeacd1020163ecb5f88eb93
-
SHA512
923ff0c924d68cc4e146179e26854f7ac28853dba8b35aa8a7ba4d194dbadf1ce132271968e3498fafd2d1e56613194535d003d5863952212853e64cbe2d867e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUD
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_4e0a28e11daa4483b7ba685f90f6cd73_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_4e0a28e11daa4483b7ba685f90f6cd73_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\euXFnVR.exeC:\Windows\System\euXFnVR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GCIBhDm.exeC:\Windows\System\GCIBhDm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iYJhpth.exeC:\Windows\System\iYJhpth.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rFbryZM.exeC:\Windows\System\rFbryZM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZLZYLrM.exeC:\Windows\System\ZLZYLrM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GYxcrGg.exeC:\Windows\System\GYxcrGg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pjpSAGa.exeC:\Windows\System\pjpSAGa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EQQivrA.exeC:\Windows\System\EQQivrA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CHZgMeH.exeC:\Windows\System\CHZgMeH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dvFXYkV.exeC:\Windows\System\dvFXYkV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NIXjDCt.exeC:\Windows\System\NIXjDCt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GnVNEFz.exeC:\Windows\System\GnVNEFz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWoRail.exeC:\Windows\System\tWoRail.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VsVDNui.exeC:\Windows\System\VsVDNui.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OZPCZaW.exeC:\Windows\System\OZPCZaW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FiZuEQy.exeC:\Windows\System\FiZuEQy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dKVxVkx.exeC:\Windows\System\dKVxVkx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tGwvUTU.exeC:\Windows\System\tGwvUTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jCcDdgd.exeC:\Windows\System\jCcDdgd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AKeXgkX.exeC:\Windows\System\AKeXgkX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JgPMIcl.exeC:\Windows\System\JgPMIcl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f9b7b8db2b3d33c54a09904b04efd2fb
SHA1670b41a05e8f1b2eb8a49df7fb673e038838d159
SHA2566c2229ee93420f9006264f129c2776a36cc908ede732b92f8d32ee133561548f
SHA5123a136344b0e0228ec6905b30fc77f8d0cfa8caf40d135d31f07b42e819621d96db46c634ed055da8c7ac03c8ec6a18991dfba26566767a6b44f5c81a452454bd
-
Filesize
5.2MB
MD5b48eee4837bfebcde9e50318c4451dde
SHA196ef7d8d4900d73284bb22aea39f780e0175da4d
SHA25611a1fd0be194b48e92e0585d330a08a9785e71241af3fbeb33ae8bbceb3c3be8
SHA5125157079aae717efc3a185fdcb40747565fcd6b54a58c8ba18714d00bc17372e5ae99f8445cb6215a03587bde8d9f979ae4b165006143409e65fe458d5f624446
-
Filesize
5.2MB
MD5bcc9028c0706716d52c9010cd76fe910
SHA18a32d90aa420005318952906bc189a2a7f737475
SHA256b7c2ea9df747fdf346bd2e71231c95a3823800b6b9e34fa2fd93534dd5202ded
SHA5120b322cfe090b9158e1a0aed54c63c2c2820dee9947e064e179ccfd78d7ebc6995a9fc9c972a26681475be90b51df758b14c13c8390cd0aa7df6fec4bd440994a
-
Filesize
5.2MB
MD57734ca8133672255886f745f59b616b4
SHA19d38a69acc0970afc00194d7a73fbeb3837306cd
SHA25651b5ff67dc4aa01ee62ce82274651e03a6b91a357fbb0d7c52c5ec823fbece8a
SHA5129ca7e613e91f0c8a3c6fb00019745b30bafbd521c75a0e5c3b72b1ea6146a34f8336f9cdd2ad9c1506984daabc0d766f1e93e260eb9b8da524095b00ee03181b
-
Filesize
5.2MB
MD5697bd9e1b5aee36b105670f28cdee83e
SHA1bea3d09ae3daa513d4f211620f4aafc59f81acf1
SHA2567f3c44768a9db48122d32a3d4c743c4b68e44b6cb6d69644e9bb5530543248ea
SHA51230b34d51b263d53efbe969e990f9b854dc7f39a1c2f1e9e4228d9b9e6fad4a41fea138f32a80e9ae9fb5a2d41e7851c90a58f30e0a1fc1fd8b8c8948cba7baaa
-
Filesize
5.2MB
MD51b70bd482315a5c72e8c6698d5a11798
SHA1ec0340e3d80fd74e0efd1ab7d4bb43a7a2e9211e
SHA256a39944778b0bf5a416cfc4a285da9397e3b097e69c8a7a16232f4c53959b8ddb
SHA51254ad87ef0fc6df90fd8c9595d687e4ac0addc03d145d38d574a21d2cb4b4cd6368e24263b069ce969e5844f209db5f806bfa669dbbf0da96ec590b47c024b21f
-
Filesize
5.2MB
MD5725c1b5d381fa3dd02a0b201fc0050c8
SHA1743a6c66443c1dbb712e6b35a9c7d170b1500eed
SHA256aaf145870933d997bad3190352ad075e897b655d5cc7e57a5c7c1da00e65f48f
SHA512c7b27a51d39919105f4e914e18714d9d832925c549c80840c2dd0c494e78377202580c7640b378df217d263f239717875d9c3cfade2a983395980bd3cf8ebfd7
-
Filesize
5.2MB
MD5c8d3a058de93f787b1e818f90b64a843
SHA142dc8104a7188b04b3d16ab2c0d53b8795c5eafa
SHA256e6af2addbf4e3d35540fb8accb073c088c979205d21b6c3f5e3451f3907b005f
SHA512edfc924c4603742c5ec7f4889b440168b258229dd01745811afbfe36741dedd9a2f5ac452ca3e025f56fb32670e1958e69e20a57f59b62602c693637861825bb
-
Filesize
5.2MB
MD5cdcb3c9b21078dad0c5b98a2dbda5c44
SHA19f77fd29dc8df893efc2d11bb3f963b06f4f3363
SHA2567bbf09b1f7a062476bc176e708af60e2bc3c87510995b984a6ace7deec9323d5
SHA5120a51b9c2db8ea0ee8ff6bd8f0e9721fd289bb1b18078eb10690091ad3bd53a798affa61dfc6f4dc300658e39b8451571bdc0f41f25ade23084f8134447a2c4ad
-
Filesize
5.2MB
MD5d4686c1288e05e853966facf330d9efc
SHA1d17c15dbf64f004ce30feeaeaba8bf63ad6fe91c
SHA2569d848b9b387fd7f657fef8c046a6d43e93f30020e82f442eade673afe8333800
SHA512982a5adc899d83a5c0ab5f5b5a89d6ddf05e840fbd953622c5b2e5ec99714446e6eab04d8802edfd4cafe8b0b40fb8f4045dedce66a9c12544b0e027255abd71
-
Filesize
5.2MB
MD59ffd09930d60147eb5964f0b3d321d80
SHA1e7bf47012a1d1ef38663908c3fc17cccd62a382f
SHA256ff7e2b73e1359903d6014cbd38c3878a63fd9a71d709ff3c055bfb84e2fe9dc2
SHA5123ed11734987e0f0841ec1b3f8829257a56c5ea555ad7733c0480fe36ec11a45a0fc8d4a2d116b6b227043e090b9aa89d2a36c7ef0a04d4a1975dca173d196c2f
-
Filesize
5.2MB
MD515f0c15f7516069dcad89ad30650a4e5
SHA1e5c006937614282f9f829f7eb5f1d9945eaa61c5
SHA256776b85896c1fa2ae0a0b5302c29e8beff2e540eca954e3fb7003e59fdfcf2f45
SHA512c922f9de52e514714b7c0108d471590bf57bcd3e9e78bf955ad222015b1ffd75e0af4c795cb04fd4baf54838fa9bd6bd47f87484e0bcb326e2ad4d1ae255bc0a
-
Filesize
5.2MB
MD5efdd6fe5faa26e80991ccdce41ddbbf0
SHA1559ac26038285d43d512f3e04b02a9564952be61
SHA2563210e6b67f243d1742d26270d1c5933ebaae6e176f5a5d99a87268976920229c
SHA512d1e447ff65b0523e1b8c4f85e4ee8a042ba036cdb4e3c5e0e99268e022d5e6ac177c148b47b4a5d9d1ad9d0107f8b84226a50db62b5002e991fa4fae2ae868fe
-
Filesize
5.2MB
MD505f85fd2b5afbc44ffcc4a86e17bc23f
SHA182a675befcc9568b1d39fb8ac3f9d50ea31b6b2a
SHA2566f3e3ab2cc41dcf6bb5e9d9443e7d7cf9303eb6b1c30d45c50d641977eb360c4
SHA512c3854cde7b8e1c0168f085f630abe4e04ba2b7b077b28c781bc5e2be00a7c08493a03a4758f844792eda27a6117daadd550a6bf8c3ce7ed3672b2e1ea964d78e
-
Filesize
5.2MB
MD51cc59dc7c0687c47edd9ebfa1a4d5cf8
SHA16467287cf3f9be336798148226c9ffb9d11ef980
SHA2562b1c54c9487e0e4f98db7439aff96c3320449c22d0311683467cb8e98dfd981e
SHA512f1a4730d51a028444f0c397494f4bc03d3eb016c45a63e24e61aeefee4143698544983d51d3e37ebce609fa1940ea5bb2287d17aef723bcdd50355f9539aa06a
-
Filesize
5.2MB
MD5b1127a7aabeaaf24572d8591e3d0c3c9
SHA119ca0752861b3544b3d435c7b454a1ffcba6a398
SHA256682c52678a4b819463becc93145c144d52741f2ddfaf4498dfa131d78aa6796a
SHA5121af64bcc5b8c59a9cc24c480bd74bc8c3fcedc197e2bbc759b0e1f2d82150e31e6aefc8198bde673fba8506ca0b65401c441ef3ede9ee473bdce8685b58a6bf7
-
Filesize
5.2MB
MD569f6aa8f6d671e336d71d42cbdb49bbe
SHA1390888987a2ea4e6e5f09c970c83f6eaaca9b1ab
SHA2563ee9923723074b0851aa616d0430f7875e0edf4fcb6a13203451845c6eaf7104
SHA512ec33213c9fea35d701758a7406f0d93433faf45028e2739d31fb6275bb6f03ab8616d3a295edf58f83177865a969118bc18d805ce0846c7ecd1de0c34b781697
-
Filesize
5.2MB
MD5a7aa1d4989a6944b7661ca4674577476
SHA11e38439d7e76e101caf9d1b8a2cd87104abe5693
SHA256b5515b8b1bb2017ec8c9961ac369e215ec4ad287e50f61ea44ebff0b0ae0ad70
SHA5128752e7d72c68b419a7349690e30d95078d8d7affdc7c96c30782a97e0c1a0ffa517b515f4ca02c013f52c560c0427a78fc8e78aeaf61fa68a69b1719eb14b152
-
Filesize
5.2MB
MD51bf0ebea0e6f64b2befbc4053e624e5d
SHA1a03726516e5631520063b4080ceb96bea78ca662
SHA2565d141d01ba7d7e92c4f308e0f0fa678e5a9d0e83ac51b24e60e27a9142922835
SHA512cfb734af99f346d66ddb42ac633db0d3e6fa37551b4536a7d90bddb4cee37fc377f9e251583777edb77aaf8f25239fc9688d208b16623b37a349c62f38f0b211
-
Filesize
5.2MB
MD59118670bdb57f2b456f6ef3110c5af6c
SHA16a766854d43d07d667ba924a663a085f50db0612
SHA256253dff1b86c5d17645256aee7fd04f35776a3f98d039faaec7d4edff39633369
SHA512c346d7da733c68c2966af9d691f511becd8c4cb82243cf81e300df4b708919a48c5208fdc4641ba586021f4a2f210c0c2eeed484c88cadde39be30f244b64629
-
Filesize
5.2MB
MD53166514e41f5ec1cb23a7b65adac50bf
SHA1e012c3ead4a8b667ca6c5623d905310657dac937
SHA256f700055ba3f594b2e6185f5e65d4431d578cfae55452462a9e292fd0e7a8b5ad
SHA512c29559453bad8470235d09ae60ad120d5431d7b470df430b6a785ab9545c8f3c2fad88411b9d019acb2af74d95886eff3ff97d71e1cea141a053d7dbf036575e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB