Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20/09/2024, 21:58
General
-
Target
2024-09-20_9c8abc0453ea3eb688227730a489040f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9c8abc0453ea3eb688227730a489040f
-
SHA1
f2beda9e476cfac29d56f983f30bb0204b1a3ba7
-
SHA256
eaca714ec49c69d0d07ea0b5b6da619328df439b5317ef07ad566c8b315bef23
-
SHA512
d6741f6cd8b0c72975b56d99a50a7d3c8314815b17a730357c2167338ca29d61d9a7ccba10b4393bf77fbc48bd50c209714daba58f2036d5017af79ada127495
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_9c8abc0453ea3eb688227730a489040f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_9c8abc0453ea3eb688227730a489040f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lXSvVgj.exeC:\Windows\System\lXSvVgj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CRNcpSX.exeC:\Windows\System\CRNcpSX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kcfKpVs.exeC:\Windows\System\kcfKpVs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YckcvyU.exeC:\Windows\System\YckcvyU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xEBeWRQ.exeC:\Windows\System\xEBeWRQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yBPRryI.exeC:\Windows\System\yBPRryI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Ytzzkyz.exeC:\Windows\System\Ytzzkyz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NkfmNaW.exeC:\Windows\System\NkfmNaW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KkFkKFI.exeC:\Windows\System\KkFkKFI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SGfFAmR.exeC:\Windows\System\SGfFAmR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eJCEwce.exeC:\Windows\System\eJCEwce.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GqKlsOX.exeC:\Windows\System\GqKlsOX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qlXfkEs.exeC:\Windows\System\qlXfkEs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RvUAicF.exeC:\Windows\System\RvUAicF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rvKMdqk.exeC:\Windows\System\rvKMdqk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wSmokgy.exeC:\Windows\System\wSmokgy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UxzSdlz.exeC:\Windows\System\UxzSdlz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cMGuegw.exeC:\Windows\System\cMGuegw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VLTRvro.exeC:\Windows\System\VLTRvro.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LxpvOYJ.exeC:\Windows\System\LxpvOYJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nPzCiUK.exeC:\Windows\System\nPzCiUK.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD560ad6a3829b5c485ee58588fd63f8c77
SHA1ed06b1929b6f92f31cce04c32ccefc7d4def0e5d
SHA256fea7116bee800f85627fb60e86646c2a3fa06a25fe9773983dc5d441f184c956
SHA512b544ac7320c153a054f287ad246000ef8399836b5704092d70c0f08c7b517d01d3cf5008a5e005ec3916107865ace26770d932672021cc1e24c00d012ab17a33
-
Filesize
5.2MB
MD54eefdcd896b2f7753e76c8e6760b0963
SHA138aa4610b20820b16b8e733a4fc0972253caf256
SHA256003b172c43de4193625d4166fdb71334ba7c174c3d34587e7953db8aecf62683
SHA51240ec6fe51072c811829185f11b75e8c303b0aa3a1c3d1499a7d7f50a3218fa5355c772ef75d8d2aab89a5cde24ddef2b0e15377c4921ceb034c08216cab59cc1
-
Filesize
5.2MB
MD5c6d5671c0f41df42eb0ce987445f7d26
SHA1472a8acf85d77d3918dacbc1700b5b548ce62e78
SHA256ba9b110b18a45ed7e4801b9625947cde1d1a5988aab1c301f00923c5100841bd
SHA512cd04bdb7216bbd0893f44988991ed4b84302827a320592a6af281c54c4cf859c096984d33d0af006b3e1dbbd59b2cb55068248b7f0617038e17bbb4794a4b111
-
Filesize
5.2MB
MD5712110522824473cfa38dcdcd2a2b83b
SHA160fdfdb67689b5857dd33cc9b2a64f012c21d6d9
SHA25688134f8f6f95b7b0a7b981eb8ba6298f9e884a4175353cc69fdf38111cd45244
SHA5129fb9628a201dbc65a19cd29a031bc71b5b19a35d0c486d07e2673be744248b4c1bd20378ec0bec4205ae4f089f9b18ea1426eae8eb789ec4b4e5dd6d600b83a2
-
Filesize
5.2MB
MD5e5d5f116e520b0142ed6f5591f05c644
SHA15e6f618f6fdcb1c2978f16876c2e26d26e85300e
SHA256c91fd31a57386c2e1aa2b9131d527923b8a9faec10ebc75c8462f8a06cf9f201
SHA512972ba54766719e6cca08d8b9f60cb7c4a567d1c6be80a20fb5d587bf9725284b6a099ff2cd5727990ff8e26a44f2669a59e45024a07c8206632ee6274c9f66be
-
Filesize
5.2MB
MD5c419cb18debe4ca99e23e5ad3a889132
SHA1fe0125040a093af2864ee2b8eaa76941c900d7aa
SHA2563fd9470ccdacbccfb78930bea9b702e49da3a95dd2f71a969a10dcbe7c403eed
SHA5127c0e769ea917330bc3ce2b0230b7bfaf9ae7ce3c6971cfbbfab0e663c21498afbcc9dba79d7c398737f0f23831ebea64c923985f7f0d6b1b94c7829f6b3ce8b8
-
Filesize
5.2MB
MD53632df3ce9304c853c3aa5a0540d5455
SHA16dd7e6006678534ce9bfc9ffc34a5dd786d5b2e9
SHA256cbdeda3aade462d0bd7964fa4ea27dc396526845660fbcb8cb9ae49178103549
SHA51294ee3d7d219ba2d104c39efaea172d40a55b4c22b6cd38119b48988ccbecc43b74a1c11dab35ee7f02bc20b898d2d8c69ac834271760dca75c526a2e4457cce4
-
Filesize
5.2MB
MD5970c291de17ac4fd95b7b20ca9b83efa
SHA17646a9e1ea302e3eb6145b6a11a1fbf253d04d37
SHA256b5bdff7ba0584b2bd163412aea040bca6e4de84fa2339a603d8e62a204ec3fa8
SHA5122c2c320c27c1ba3fb0dfe753de6b0ce8317ebfa0fcc28d81371850e19460f3ba3ffbc6522508b5c2cd1c0fcde537803906999c8849d061757c462b72be44cab7
-
Filesize
5.2MB
MD571a4325196bb31d4a474c8d7db049bab
SHA191c7f9363be44317fed6ae7bf919842b530b2d66
SHA2566662802adb30c0cba25a7acd549bfbc875bb9a110c90f9e8e720d62052d280c2
SHA5126d2ba538be9bc55d0e5dcc0048f8499bb7e1d2aa853a60d38d0239aa9e3cbe4bf290bd1b7ef53273f0f76f7dc5b18c9e3c684b2a77ffc02f4941fb792ce7d240
-
Filesize
5.2MB
MD5121ac0f8b3bc248a67cc6b3aa9872aa0
SHA1153d30ef4bae97b4330b9b67be228bb9eb72e0d7
SHA2565b1d4f5c8a6061daa089c4bdf3291185f037d066c17a9d8fe80a994986d9da5a
SHA512ecc3781eac60a4c8d032e37a3e6f5e93cd49579a735a0aa628352c17aac5caadf22b82ea2fc6ebff843f6e4fcdaa695fdcd7365880ae5f9fa8727cfa48122cf6
-
Filesize
5.2MB
MD506b1cf578974998918d1cf051069c4a4
SHA10ab3c8c9d317301b3d31678ae1b8fa156ac3abb1
SHA256f950b35fb105bac0d810b94230927137473e20d9033f36bfd2563c116a6f6f95
SHA512804e955aee27e8cb2013260c8acc4d04c033d29d749ac31cb7ba6d9ecdb892a405fef80c9101f39fc5d8a7129343e64b4b7c208bb230e3058da1c5f566f2ba2e
-
Filesize
5.2MB
MD537ab159b6817136c9f45d4f1ce2e3982
SHA15d027bf4d616ba3311dc52633ad4fd89dadfaecb
SHA256f6ea151248e2382fc8508a36963d5434e0ea43d20a73164d9bcbbbad78f2c6d0
SHA5123620f71b9c98ee471324b5e6b4c153f4565197d5365f2a16ee4d3ccbb92d88cb3efc883d549c729ca8598d9dc6a94f82703916263bec35a48f4b6a23a0ebc133
-
Filesize
5.2MB
MD539e49b56e55ff1b0d947ee03e78f12ea
SHA1855ac08172917eec36b0a9f609c917d596fd13ad
SHA25639dd9c8ec6a550146f96d6cf8d07ebd27c72acfd6159153c47c8b331287c0bef
SHA5129687d55950fca4ca6e351fde6a7e109cf356ccd9fdabb7a6e87f2b18ddbd836ca9f5051d404a5284fc9208609206c4e8277f19c6b40353320c38d623610977c8
-
Filesize
5.2MB
MD50da9b15e921f1cbe7c1e023c1a2cc3f3
SHA180e03b0c5b7d8716ed1fcf851838383fc3bc0cf3
SHA256ead6ceb9d99cfbf3d942603671b4bbf22222fd389da1036da9aeacdafc1e03e8
SHA512856a9850dac4451ce7db928034c0885d431ed1524d6377e20972b5abb48756d088c983156479ae06931d8253c14b407ddf7a75fe3d632b990bdd6e0a6d87b19a
-
Filesize
5.2MB
MD5dafa46bbfc071e8ec255636e7b010277
SHA1df159206bb15619cb19c8917d91cb59ca8507c1c
SHA256ad6493ca0ac2126d56fd4b88a24041ab56297634071ee4c07461057e7e520bee
SHA512862dfcc4ed534c13aa8b03986c16a240d7e4a4e7466245e9974b1afa5d3e7036392cc1268c9f738d15940fc77bbfd6bbda2ef911ac6963293eb2acbc5faa1093
-
Filesize
5.2MB
MD507bb796267dbf77a5e200da11104cde9
SHA13d5b68982b79722c4e49354b7da0901bd1fd369c
SHA2568520676c00dcb0e2ab9137469a5c7a6d5bd14caabd91e5f264fa218f47cf830b
SHA512913c8dc377b2fe772a12cadbb38a50502251681422574a97dc634cc1f38c3e6080d96ede9f06e0faee35d0dc95188572b03ea92af2b0804eae192f62f2a700ae
-
Filesize
5.2MB
MD528d8228e30a0c843646e7e145b4f025d
SHA18f555a9f44ebf30d359bdc686ff01fc45c72df07
SHA25662378d590bb0771794027600bfabfcf2d28cd59408477920f183c2f515154154
SHA51260ceccbcdeb5d36e3b09152043d71edfd7580f4d88d122a7cbfb7132d3b2b48db0334732ebe39f256461108d8233a77a4127ebad2b893f404aab8d4371f1fdbe
-
Filesize
5.2MB
MD50ba83ff057e6a8894bb5f157bca434d5
SHA12e36238ecdb73fe6471a65468e63bc516a86827d
SHA2568d9a763463fac773b45f0be850e00e553a27c04bc2455f55d375fc8a416854ae
SHA512b61d00c4d215d4644b2d2be7882a514bbcdcaa493b4716337014e0919549fa348a647116bea9bdf0b0ff1a96dfa198c9dda17132d305339214f3a639720d151f
-
Filesize
5.2MB
MD50b3b762448d025cd57cba9426d59ed54
SHA1dda4ba7a19a43a64f382e2cde50d8879e556f023
SHA256b6382d94208d5012c02c52b9a7146b7100ca8d3c52b95a15293a2c4656e2dadf
SHA512f9577b8c784a0630dad4831e595c4856c75382bdb275a19e9648358cc11dfd3dcdd9a5b0a4a3b07acdb4eaa8ff9134e2ffbf8b990f472b38bc8754fbb1631db4
-
Filesize
5.2MB
MD56603b76f32ac1d8d53cf3799df4d3eb1
SHA19bdae75cf80c3cae59f10730fa70669cedf8f97b
SHA2568045e71564dd4a4879e2ac57c780fcfa215e1aed6388ee08f589dd4a03df67b6
SHA512e93b39a79a3940690da5c21ab5ed74b119e5cb82c755a1c0765827b89b3f096e58e0f94468e86d43d3a378aea3096be85ba95a918d6adc208df1e3f975969d53
-
Filesize
5.2MB
MD56d18d444d9dbe678b3c10db7f54a5d91
SHA19cdd5b1cc0772f870a2e1490fb1af7bf6d4ce0f9
SHA2562d29df7a28b990ace4de9feed39ceb9e8fa7f05c34009d5d596fb103f6587c49
SHA512372051d5723047e77e2f7a0ec17348e971f7aa1050703ff214c83b94fafb5c2c4f4a5db60329a28f892ceea36ccdf80b2a82543d377f634d8b690f0c6efab407
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB