Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/09/2024, 21:44
General
-
Target
2024-09-20_1e704c5a02c28daf09f6b372a21b8b0a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1e704c5a02c28daf09f6b372a21b8b0a
-
SHA1
4bf1d901a18d71211f3a9d58f30220f7def73998
-
SHA256
371dad4a401af27bf5a2892f82b7188dd6cb6699eab4d52f4a63488f057c257a
-
SHA512
a942d73362a0c76583c2ffa1a9aec29847a753dd21e26197459c32f2f4e22aeaaa128ab5ab0d849f517839814837ec5fd65c1a3a308f8d3d619da6c049712ccb
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lc:RWWBibf56utgpPFotBER/mQ32lUQ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_1e704c5a02c28daf09f6b372a21b8b0a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_1e704c5a02c28daf09f6b372a21b8b0a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\sObvQJG.exeC:\Windows\System\sObvQJG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rfHrhNd.exeC:\Windows\System\rfHrhNd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EVcxaOj.exeC:\Windows\System\EVcxaOj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jleRTjt.exeC:\Windows\System\jleRTjt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CAJNudg.exeC:\Windows\System\CAJNudg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\omkSKYP.exeC:\Windows\System\omkSKYP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\soAGJQY.exeC:\Windows\System\soAGJQY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\igtfgYq.exeC:\Windows\System\igtfgYq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ypRRlpN.exeC:\Windows\System\ypRRlpN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YRQtefS.exeC:\Windows\System\YRQtefS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dIrRSpC.exeC:\Windows\System\dIrRSpC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hDsNXdN.exeC:\Windows\System\hDsNXdN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lPYWcYS.exeC:\Windows\System\lPYWcYS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UrWDjRc.exeC:\Windows\System\UrWDjRc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lXjqhJC.exeC:\Windows\System\lXjqhJC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NUNKyMf.exeC:\Windows\System\NUNKyMf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mjAKQbc.exeC:\Windows\System\mjAKQbc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCRSzlo.exeC:\Windows\System\uCRSzlo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PGsHFrq.exeC:\Windows\System\PGsHFrq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bPuREFd.exeC:\Windows\System\bPuREFd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MMdYAyW.exeC:\Windows\System\MMdYAyW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57da21c36aa1290020ab0d78914a9fce4
SHA159e8ab283a63eb17859d8bcf755b0a39387d022b
SHA25615967319378c51eeef7c765a44cdb4d262a7aebfcd1bf70ce2b371ea1dda42e9
SHA5125b5a130210e83a3bf923be1e40fca8180cb9c0929411e25a55ea23052dd46e187f2cc15b5c426a555c1da06620d9d306b7f09016f0275ebd26bf1c681e076f02
-
Filesize
5.2MB
MD5ffb1249de3e7a131069b6728e1de07f6
SHA129d6a808a096657604d3c2008c50c03b2791563a
SHA2569d72ec9baa9a3b3feaed930691a3d72af16e2090057a16ebe2fa79483acbdd41
SHA5121b2d287faf107a9b43519158e5452d83aede55329394ef4cda3b031ccb44ca9c4583df8683019474521ef8ab5c7fc4fcd5200c4d8df74592497dd90536d7d6d6
-
Filesize
5.2MB
MD50e4a10bbbd4b6eb56c5c72cb54209511
SHA165c05211bf8a833dd3b3bee44a93bb929b96a40b
SHA2561fae44e4ad68fd32a662b027a794df66f7a2cfe2c26cd0106bc371a2401cfb0c
SHA512429bfc1aa552bde1a52f14151153f38180ea55428061b83153be43f80851b033848b5da6010396e8e2aa9a6a51214f532b0e44b6f15f495666e7943d6146cb32
-
Filesize
5.2MB
MD536c60676d900fac5ff74887602f0fd76
SHA14051df57662c278e2940c44e72d99ace6ffd7fab
SHA25666fc9c480401c4da650842a778342b58981cc2f037dbf0e0befa080158746186
SHA512c90560cbb73c94da16ba93a44464328b0676654419669c3cf579c59a85ad5f3d98fca55b1c9dd5872ea047a19d6dd4356e49adbb3aa4e63a789aea0edc4c1395
-
Filesize
5.2MB
MD51ec510b88a621a3d1cd77f7eef43640b
SHA196b9ab7656322748e608f2c48009cd36f63967dc
SHA2562666e52f1f86db962fdbe9c0aa9256e0eb5d79e3a36f8234a2275a71b751230b
SHA512ccc53bee5ae26d469b5db4ffdd1469b3d0226490bc3496aa2e1bfce6211f5874a5fd4cb16fc660c9116c7f9d95bc21baee6bc65a78e12ea5d732e6653bd45c67
-
Filesize
5.2MB
MD5a12fff004a5de632db8d001122bc3b52
SHA1197047a85eb8b0963c44bb4033673590f3db1202
SHA256ae87b668ce938b81b020bacbccaa2eae458fe3133fd187b0b9c8a84073186af3
SHA512e045530cceba39c9aa73d9daa621a09a0bdb2276b77a05202beee709d8d8314d11e09fbd7b286c51c7dda62e680a883021564c806735f6e2b75f9be48c745558
-
Filesize
5.2MB
MD5c80eca0cb37529a6e8e96628e7287874
SHA167d290df4182ec91303bc41a58fc95f3cc438a81
SHA256e701f7a81a2fd3962d5521120797283086060e096c74d4d46d477e6e7907c87b
SHA5120f270d5f35c1c9b44d3adf079cc3aed1e22dd8fab98a674b26f8a05a6797579d9f72f8038f8412130497d2439dab47b29f5719d7eb4b356ca624ce0d17fd7356
-
Filesize
5.2MB
MD5ce79c2a754457fe5315aefc3d1f336a0
SHA1a881be315d8b4d69dbd9dfa3be16f9e0a233cc74
SHA25680c7da224a2b5eb40b2cf7e609345392e1a3cd9c6016913b0a10bdf92fc146ea
SHA512a3a422405f5fdf0a4c4f98aeeaabdff2e3c2736d8722adf44e8543d3a0fd0f79918f45b595fcd62ff29d4b0ab40da94d78d2b3775fa301994995d925d4d77816
-
Filesize
5.2MB
MD5de970e7fb4d03ca6bcf7f0df3ef93a33
SHA1df7669c602a8e7f6703f1043ef5d712fc4723fbf
SHA2563c689e2418f93387ca89a010a908cf3a571a83fb57c1f930be94c28bad8e6445
SHA51256826abbb7036d6da3a77ee62176cdfaae9ae7ce6c2b59dbe13904017ace4b1ee609168777b23b5cd6753a4cddcd73ee94722b22045af96ddcf0aa9c6d31166e
-
Filesize
5.2MB
MD5fe8faa717fd4edc701a7c9a5de8437df
SHA1af8ac99bb3f8ac2470b837c5ca9c58e2cfbe2fa5
SHA2568d6d3715493e9051a2b1c3e6eb721f9bd80b99dbea2b3f93505221adc4a32dac
SHA51271f3005758237d8145407c50b8493de9f11662c7f382a2f615718029f1e5e5bbd05c2d14cfbad9b9bafce34fe1fdeb3de5a70875e4311d44120152c541679c3f
-
Filesize
5.2MB
MD55ec639f7ca8bfbc9125775affd536853
SHA1e0bd905662e18f247792ae622982da883e50f211
SHA25694c3a341d2b7885811360335be7f5bdf4fcb421e36cca871eb8365ec4eeb071f
SHA512ca3e7fd75093b179458aff9a350dbceb5615bc886881ac1fa18db35edc27aaa3349828cbd95e6261874d34e84f5c0150df7b96f8df81e725db4d56119a982279
-
Filesize
5.2MB
MD56d95b84c8fa02c4879c19960b6de5807
SHA1cb0d5cc1dd51a9a4f6fbb6575f782d4617eceb3b
SHA256dc6376ae8f7b4b4dda03a59267b0445f75ba50e87964ced371c80eb14352c080
SHA512a832187d19e684f8fd3ea8f2c491ee47a6f4ae20dd041e725f4a840864c9938b4ce7ed0b8ea6f7e31d078dfc5f4a62c7c22bccbe05a498dcbe7df897edf9adc3
-
Filesize
5.2MB
MD58fd5119acb9b040842c4849e8c250ebe
SHA1d74d73213ec9bdea16a545750c5a9c9193dfdddc
SHA25669651762572f603eb736a1eb46242987a00437eb7b7445a39f9fbe64bdacdb93
SHA5128dd2e7ed9343917e10263a9cd64da5dc3a82a49bf361e5a93bd8aeb79dba61b23c9e80ce6f6b0302815fb8faf8691c945d4513ad5e367d5efed7b0330e95be55
-
Filesize
5.2MB
MD5746289c6a641f91611092c51c8dca565
SHA11f65aac4c7f50f2c4abc1d379d7460ba3ba651c6
SHA256cf53dd798731ed383c1a1932775bfa6800b09988a27a4b7c9daf631cd137ef4f
SHA5128897f7644dd42325d691f0d2ab78f9987188f885a1c0c4bd702544fa1e9ea008c4fdf4cf9ab338b3a182e797fd363ba21407a73a76b7fc2f6db28e8ee210bd9d
-
Filesize
5.2MB
MD59f2d6de56614079023b1543182f76f1b
SHA1b7881e5dc234cdf1d896e8a3a72b0894e99dc5c8
SHA256d205e98a12bb41c9bcac0b9205da3bfe1988d9916902a62f7a4a9d3f5df67cd3
SHA512521c770dd70714fb3c1c1fa0a27c3de994cb506c10d6b7787eece4be5ceb57e3a2f3f43606a9bf76c3b7b3d8137ef42eec3db205cc2dc8a7a8674219ee04a2bc
-
Filesize
5.2MB
MD5d591ad2550276169c3d8f9fd0b114634
SHA1c9fd6a565f9276de050ff81634d5b13857a43b44
SHA256ab4ed547e725de5193ce4594f8d22931c8e6a5b643382a92781632328160d24c
SHA5120447852c284c2e46f82fd5ba3594f90e93f3161e1281efb180ab860063009e058d8eb3c59db215b1b84ce9a1a24bb1209d690281d6b25580f0cc336542cc503d
-
Filesize
5.2MB
MD5d2fdba93e8a90c995c775fb9dd2aafba
SHA13da2eb4a6e11519d1988aeb815179e1167e1be77
SHA25695502941f90991effde48f77d561c8d5815c2d64434b391baf9e3d2c69fafeca
SHA512cf6b543ca3648413aac93386a3a1fbe01950022af0c6931aba6f93665e3be8db8dc8c1f0cf3a0ad417d4e98a40e83231452477c363654170d29298c81a4cfb15
-
Filesize
5.2MB
MD5c97e0d03a971aa5ce05ea3eadc286646
SHA180f6e7a66a533d3fde52330be121bd8b47918adc
SHA256eaaa61fc41c0fd759ffa4ed600b20f80e3487e7e3b39694564f0bc78b8d54f8f
SHA5126cd5364aef2fb83021cae1ec586e015d5f3de51991eba1e28539694391ae98d4fa69417e89fd3a03ce3070bf7c987daf593c8aca1dc3e1ec28cbd7a90af5a520
-
Filesize
5.2MB
MD5de64bd087cab8ed71b8832fb078d3d61
SHA16b0b792d8233458eb02d8cf8dd310bb19cff24ce
SHA2568ed47a284de4ea5a9a7c30a985b7f6546bfeb380e81c72561177ed7cf7a8a79f
SHA512b7db3d12e286ff0306d17f2c0ec1910c5ad7b5636ce66265ba0ec33d49e49907825a80257bf0fc85432ae30044942c54922ba87415e4d4edb81fe928dbbdaf8d
-
Filesize
5.2MB
MD5e26fb9c6c8cb2ed4b83e641862833bef
SHA13580fbbb2ac20d2b6f677e5321994ab16e69e707
SHA2564dcf85ae7a79548268f637e88b165042037a655e968d7689ceccbdf69c662444
SHA512b661766c16235edb4ec697a85719784963a7efc129348e3aa301eb7dabb3314c401ed17134d3884d28a08a9bd390cd59f2bb64342f346ed4c69013f49e6ff7ae
-
Filesize
5.2MB
MD564450ad37449af22fd7a88a5c43a5bc8
SHA16b209e8c0a7c351f4e64f23c2532abffeb04e0bc
SHA2561e1e0d768cfafb67957f08ccae47877ad94a4ae84df650dbe87176b77b017679
SHA512777d994a8518713b64b6a79e63fce472ba94f14f8f1e566ef21020b061a132511264f69fc535d24c5cb4b8e84394179c119370fd8216501d44bbf101840aae60
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB