Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/09/2024, 09:30
General
-
Target
2024-09-21_714ce7a84a0266aa853092921adb2a9d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
714ce7a84a0266aa853092921adb2a9d
-
SHA1
9c3d326169e4ce4058e1050add26a966a5fa356d
-
SHA256
f75e53ab80039413c662ca87118e078038fd0cf2725e81ab058668adbf1763ee
-
SHA512
abda6c9e09c07fad09592d94b9833dce86be6f6a5744235db65bbc0958f74eccdb9cc4ee7287e74b51a557f0d77baa9199195c75187f94b92d59e2a1a441cf15
-
SSDEEP
98304:oemTLkNdfE0pZrx56utgpPFotBER/mQ32lUq:T+o56utgpPF8u/7q
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_714ce7a84a0266aa853092921adb2a9d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_714ce7a84a0266aa853092921adb2a9d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QceeTpy.exeC:\Windows\System\QceeTpy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hshRDkr.exeC:\Windows\System\hshRDkr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hfZFvgv.exeC:\Windows\System\hfZFvgv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OUlkzZl.exeC:\Windows\System\OUlkzZl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AcyZBCZ.exeC:\Windows\System\AcyZBCZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WDGZuFt.exeC:\Windows\System\WDGZuFt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hKMaDFW.exeC:\Windows\System\hKMaDFW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YCNCywx.exeC:\Windows\System\YCNCywx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\htovOUH.exeC:\Windows\System\htovOUH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JfNRvQe.exeC:\Windows\System\JfNRvQe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fSWrthL.exeC:\Windows\System\fSWrthL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VFISMFh.exeC:\Windows\System\VFISMFh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zxXWhnM.exeC:\Windows\System\zxXWhnM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXeqfgs.exeC:\Windows\System\bXeqfgs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NohRxOr.exeC:\Windows\System\NohRxOr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JMNFSTn.exeC:\Windows\System\JMNFSTn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hUSSnre.exeC:\Windows\System\hUSSnre.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FHqZjvD.exeC:\Windows\System\FHqZjvD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xUgYlFy.exeC:\Windows\System\xUgYlFy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfdMzmK.exeC:\Windows\System\qfdMzmK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KdkKHuT.exeC:\Windows\System\KdkKHuT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD577bcf600453fd8a744e058dd101359f4
SHA14dec99fd23b4ec686b6d2f4461fe41b01c098aee
SHA25667184dd48170d5a50845c4fd2808430ed1e14be846e68c54ef2e167c650b10d6
SHA5127370fba937bd1e58b01ed40529c168cb6e9961487c5bcbffe9387c531325b5b95ab0608f1a3e890bd68eb396c0d0659aac7c37303feeb58e098918c9d2b1c835
-
Filesize
5.9MB
MD561c69d87dd4a58f0c634814879382708
SHA145967426c6c0517f225ebbeb25bff9655f25884c
SHA256c64999931498d41ecb8287862a991018221f609d1f01c83f6a8af17b90b25c2f
SHA512a64ff2a5ad6f2be97212c1a578bfb95f609d82ab791772f2d7552f702a37a46e2cd2a9afb102eb4fc9eb418ece2d7b6b239ac551e4cd1ceb1222892cbcd4de81
-
Filesize
5.9MB
MD5a50f774039920b4bf0e0297c1a67dda4
SHA19853077c7146c32a92a3ba1d1427e545905c6130
SHA2567bad0ffec6c9fd20a69fdc247239710f3bcaf1096ca481a2b38827546d6cc06f
SHA51252d1ffb79c8fbf990777782ecafdcb74b61f6e15e9dd62b6d911e4c2667361f802b56bbf2588ae0fd7c7fb2bcfd5359109fd63d3deec99e440c21529217a98ec
-
Filesize
5.9MB
MD5c493774fe7a6264778c14bb07f91bd2f
SHA1d53027136a0e6c0a5b17aec033db998f5ec03a64
SHA25673b878115b35c01868d679d059ed8b1033594b353fb6b79e4d12e2422617227f
SHA51203bc6f23f68e61fb10c98702d1cb33b3f714274bfac6d9bae0fc51945db7a16b286a98f9f9dcc72c5e57e328e8a1ec0ab394ec197493b4450e23242a5aac6616
-
Filesize
5.9MB
MD5645112b7efcbbeed1bca1bd70baa3aca
SHA18d05273a7393ed29fea2854b7478f1d2ec1eed2d
SHA256cc7404ff854f22ec23d1513fe63c487c6645382fa5225ab8f856f6a3ad4a6675
SHA512b2769e33985de208473cbca96b34fe50689189887913c49b6d54e1284acd1dccf0faf65e4e60f5e3bab29b1899b34ef7452d653ed47b123bf49847c1b6e3a30d
-
Filesize
5.9MB
MD5f3734fb248c3d2b6554190b31cabce92
SHA1cf1d7ca8511d0b47e5ca3f1f1fecbcb03901ac31
SHA256e55aff44d32428eb85e86d8e83dc3ee271889072524d2ec14f558552af2089e8
SHA51216c5b2c400728f1e9a416142844937914526bbcec09b359a1a6eeeaa57298e4d50d71498efd48721677049e56089df2db1ca64d23467a6c5294ea6a85bba4b8a
-
Filesize
5.9MB
MD5b5cab19839f46c8fbe6a472173ff585f
SHA1a8a80807715b05167dcca1f8d4e7c2776fb2dd24
SHA25675ce6da19ed80ed1054e31db13ec49d69c740d3c00f32f9ee83469a5d4c1332d
SHA512e747ae6ff44a1869b17f660004dabce3171c519b646b2dcc126e46989d9d8cddfbec7bea3f3c7d11a283762d44f96dbd65fc3a39bb5fb85d22637ecc94d07e9e
-
Filesize
5.9MB
MD5cfeea40d7ebae5c7b9d22f3fc8e01362
SHA1d48e33cee9b33fd39d146c6bcce95802bac6a956
SHA2562bcc00369e30b05e65c23eb2cca6cabfec5b29360824abd8c68c6951f4e1600d
SHA512ec8f6a1ee1811894fb1ac946448ba63c73301a1565fae30990584f609bc60fe66f036d6a3ee83a045aa09a8c3970c320d8ff82f9a5f6bf4ac4e8d52fa04f4549
-
Filesize
5.9MB
MD5d4aed8408dacafb7aa5ec9d59b944460
SHA1024833b4d06d05ef653fcca309eb58ab0c29f219
SHA256099f5a8cec54e588243e74b7908ccbfa638e24447d4d0016ddb9055b0e433f92
SHA5120449f6416dc61d1e70221e6502f9fcd6d984224d8ca914c824510516e83fc0a71c476c6a163b55e6f345a864c9b3f9e8f18a8818d3ebf01a8f69033a68c5a000
-
Filesize
5.9MB
MD58cf17e12ed954e436c168605f7c8c595
SHA10abd97eb6b7e8aa4e0430a8e4e0855cd200fa29d
SHA2564969869c52047ee2e1df38e4c328cac2842e006b76462d4a0462cfbd141d5b38
SHA512cda4c14e860ff2dd826dc18696b3da1a71e1c1a614b555b090bdff527150dddd9325fdb260c80eb8787571616bf62545e961cf4fd04e5394d9c9174510c93864
-
Filesize
5.9MB
MD5b05a5b5f767b192df96a082fb8be301a
SHA19df686045a3a4e3806e4378ecfadd5be044560ed
SHA2560dafa11cc4dcbf62a09afc1564b887c156a4bb950d7d5636282f9c080788772c
SHA512a32dbf75cf91b4a66feacde8a9a42088a29fd0e7f993ee6eb1dc2c0535bd3e340827fd59a4adee0c4f360f3ec1f426f2b4436fbf6fe24b2fc56c4fec291dfe83
-
Filesize
5.9MB
MD576025d7febd35cf372409f769611d4af
SHA1e64c5ff6238a0aba819e509f8a97dd4b376747b8
SHA2564172949ce8112d1db918c14581e869f0e12643aaeb0d49137595db913ecc2994
SHA51294ca52c30b60d15f005cd17bef20295393a327671a5650c9654a24d19a347318fbf6890ef5ff7ef099e5410131f76a63d448800e5459a4e86e76659a28b8ce0a
-
Filesize
5.9MB
MD50c6bb130563a93dd9f3f55171b5b7a1d
SHA114b2f2ebb89295cfdf3875bc51757cc00b3a2a2b
SHA2567c04a2643218ef48d0aadafb33ad6f15e2b37c0fe046a6fae824ff22682b445a
SHA512bbe645aa13ef5fc5f052f56c8f17f0dbd01d805606a2feaa2c83053be4d5372869c1d9564af5c9b1d65d2f056fc9fee9e46ab145e32416be6f7cfaf95fc744e3
-
Filesize
5.9MB
MD5d7d07e4f66ea0787caa54130bf50d594
SHA1ae1fdb4e0f04ed44fbbc890dd44af7ea95a567a5
SHA256c94a6be83b8694854309da1f1b65741b6af11cc85ef66361f002e3269c487156
SHA5127a397735ff477400ddacd43b5fe046331363a822ceae972aa8f633bdbce2c639abf7f79e486059346ff9429f6dd066d1d53302360885927e84b011496c4119ab
-
Filesize
5.9MB
MD582e6ee16827bce75de1ed5b6b8c81d6e
SHA1866758bb9ea317cde49bfd4cf042a456ec69288e
SHA256e40d8206a1d11e68a4478b77b7613e7e22a0dff6292cb0aad754bd367b7f3dc3
SHA51230172cbc4b8ffe293d8b46a463de8ceabf4b35e546a67da82d95eaec7585faa7c74fa77133800067aeb6d471a73bab4bd739f1660b22160b51eed705e23b2e03
-
Filesize
5.9MB
MD51ed29e942a99c3fe127780e5411954ee
SHA13f354d3279d7b6a7459a41324c2a1ad3f3797740
SHA256766837a29b6801e170f9fa1de276cb063ca927678c0da502fd4de7fb432f560e
SHA5124f82e29b5d7990217edca74e06cd7367d81d11037de4d4820192779b0e3ed0b8de0fc0c0627a2075076c7f9237ccf90c4cd43e2103597d323c64e2aa929976c2
-
Filesize
5.9MB
MD55a1129a64a9dbc466335056257249022
SHA1c53cab7ead0f354cd6537c87c1b6b7297f50ab34
SHA256fc1e929fb6e49f54c89cd56148e61488157da5a16b29fce016f2ead5f7b99164
SHA5121f31f3ad72fdd7d40f4c316b9a25246bfe201024b646242c477e510fab9e7ae298be8e61b50cc75329a4640af5b112faf8bbad87aa74d0b7fe89c42d4dd002d2
-
Filesize
5.9MB
MD564ed971fd481089e1c2b1d6d3f8dbca6
SHA141333518ca0505d0e6f39f5d5dfa9c2984fa3244
SHA25699dfa0cbd0a7938c7144e8b4f580e00026ee62aaef1a90209a47e43a9c00c38a
SHA512faadd8b42f9fdd297cda168db89d8699656740fe9e313422d259a3d9036b6b31c6406fb72baed60c9fc84517b5b436bc1e26370caa17b99118e2bfaf1fe25123
-
Filesize
5.9MB
MD5b9f1134d94871127c9d1ff2aa4ba3c17
SHA106692ee29bdfd502a4d442d93e1dd40011ef5e0e
SHA2563abcf324fd935e4ade84bfad08881c06599e8e07029bd92932b42eea774016a8
SHA5120b77591bedd2176aea2e8cd2eecf7542ee71835539233c6acb08dd3665f1a994336b4cdee03f10ae7c482c1e1125fd2b1f8b1cf2820a6474c9a2f653e9a171e9
-
Filesize
5.9MB
MD5563ea6a876ff4465acdcc2d70f09f670
SHA1682948219d428b68ec98826be24cced41c47f467
SHA256e2b0ec37a42dc7ddf9dca9c52a454d6babc0f9f931a0c6c4b10c86498788457c
SHA51212603604c9d289d9b9833005867a29be9ff3d09239ff8d2575d3c1483fd06b52143e625e31dd1bc1e02637de21457b0e5bcc26f7ee90992bd81739b659cb1322
-
Filesize
5.9MB
MD528fb5956050594077e2249a7a9b383cc
SHA12e72d5c68c23b23fd1f4e91f85acbfb0072af05d
SHA256d0fb2a351fb856a0f135444a6a4f9d29017b03aaa602935b8bd6d5de2d485e2d
SHA5129b57ece0dbda5add351da4e1cf8ea31817d4297a50742319db87720b6b26807eb44c8d5aa35c4ecc1c7d6e021e20a085560904fc8c7c0aafa739e972be904b01
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB