Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/09/2024, 09:32
General
-
Target
2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
7afe1a0d6dd1daf9ed8813fea7f617c1
-
SHA1
59c09d8e2c1e6cfe7776a9fab3fc78e9d56ac7c7
-
SHA256
f63662c02c281cf3702245c163c3d0855a4bb8151d7225d42949eabd53b70a0d
-
SHA512
052c581669cbb34c7861745be6cfa0acf131c92bb5b7205b25908ccecd582851d6c2a01824df31704242c7df10a825d7f37c8832f9de74770c6ba981c51d440a
-
SSDEEP
98304:oemTLkNdfE0pZrx56utgpPFotBER/mQ32lUB:T+o56utgpPF8u/7B
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ERljoUL.exeC:\Windows\System\ERljoUL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AJMmLmI.exeC:\Windows\System\AJMmLmI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfxNHTT.exeC:\Windows\System\qfxNHTT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ARshnRw.exeC:\Windows\System\ARshnRw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ihKfdDj.exeC:\Windows\System\ihKfdDj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QiDMTeV.exeC:\Windows\System\QiDMTeV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vrkmpar.exeC:\Windows\System\vrkmpar.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qywFOaV.exeC:\Windows\System\qywFOaV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZcOHhuM.exeC:\Windows\System\ZcOHhuM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pmeCKCE.exeC:\Windows\System\pmeCKCE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hPmymiy.exeC:\Windows\System\hPmymiy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\seGxmei.exeC:\Windows\System\seGxmei.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IDAYKTV.exeC:\Windows\System\IDAYKTV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TACzvNx.exeC:\Windows\System\TACzvNx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xYbjKLr.exeC:\Windows\System\xYbjKLr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uXatdik.exeC:\Windows\System\uXatdik.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CRoCYyS.exeC:\Windows\System\CRoCYyS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EPdHMIX.exeC:\Windows\System\EPdHMIX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KrGPpAf.exeC:\Windows\System\KrGPpAf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UrtdGRL.exeC:\Windows\System\UrtdGRL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BxAYQUY.exeC:\Windows\System\BxAYQUY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD596239c037a08dcebc6bc6b96b7be8c98
SHA10bcd336afcc79806d8cd700d390323a11ba495ad
SHA2564b31fa55f9d9b58037836ed94bf7ce978f92487afa9beb122d2664605152a1e7
SHA51214368277ac37c331a0b96506fb8cb5642af62fc11694158bd7a12b14290085ab1b576ae23599818f025a0d466dbc79cbb2d092f07806fbf8ec9569efebf4b530
-
Filesize
5.9MB
MD583eb58ee61fae7431b41d498c26c0874
SHA1e6d1c3904d4c5445249b03014abd40f2edd70dc4
SHA256b4cf8715dedfab42622a1f7d0f45b9d29d38127f7def4abd3f0aea8f65b4f3bd
SHA512951da4c990d66154fbd8824a41435669def16542e5551b4433fd1959dab063a7355e1104bedeec1dd6259b168f9f309ca7a4eb81ae3888e6037792bc905827b8
-
Filesize
5.9MB
MD562cfa6c79fc5dd76a175c4c3c8e37552
SHA19ae7221ade1bcc105789601c6c2d4e0d8a466715
SHA256a96855e21014c6cf669b2e4f7639ac86a56333def138ad4fd5fc055a18895f1b
SHA512a200298c787175b58229d33f4364dd6adca7c54341cfc7163a18dbfb7913644226e8da52411da314aa796783e71365256efdd683ac608d63e4517a92f9bc2f15
-
Filesize
5.9MB
MD5896e604682816f866198032f59f837bf
SHA14a425124fc887a3b5533116cb319f45a31155f92
SHA25686e24f7935ed71b1dcee1cf40699fef75f6e33aae33069a0afc4999aaf4eeb2a
SHA51294fbddb5afe168ecbbb2464956e6e843cbf922474a5164e03d2a2c2f274fdd2ebd9975d85616ebdba04822c221cd5c0e90e57d51bfb2b2c893aed044dc044ff4
-
Filesize
5.9MB
MD5b13e6f6b1c6cf354c78f9d9c1329c27b
SHA1c3b54dfe90f2c18c6ad56f315bc6cc6b27a6d783
SHA256c95eb204e607e34bc6b0fec1d5e594057b9eaf7ade6f08787580192630d8351a
SHA51288e898b4cdf8a039d6eae2dc644a4022fb1611408688e9ae654b98880fcdc49bd3688ff23e73737f4c11aa6629ced8ad2cdd69bd3da6e1650bc7a735a141bbfe
-
Filesize
5.9MB
MD5df8e391a0fbdd01d2f59990c52f1ab51
SHA15e5cb872faba1e64c91b31db7529b9d55875c24f
SHA256d78f64b9adae8ea9740512892818bcf823413650e7bf4d99d64b7789800bc097
SHA51261868762ac8676eaae7fc82b9f099c55f90d7b5a950e142d6ce77cdb35aa9ca4889e30e78b947c0a7592b7ec1f7012047e7d7f0188b21ab8ee7ca9c1d3805e53
-
Filesize
5.9MB
MD5b25a5265269bd0b4b74b16de42ca054f
SHA16df44764ab62a267ac2c568e9a55a3760bfb9ffe
SHA25609fa7dfcdc4407451220ed8b9fb4f85e3d112242db20532e66792c53dc16a3de
SHA5120364dd4b6ddacd07ea854242fbcfd0e5a549609a1b35aad1390762e93da5f0454b81eebcfe718d3c3a11a397d2825c295db6ef3e79f8c7f581327f50584f2d1e
-
Filesize
5.9MB
MD551c762e28bb583589ff87530f0d5a0e8
SHA157cf87b0d6425a0ff473ad2758a722d80eddaa2f
SHA256e61e3eddc0e9b4c9fca2e1693c4183545fdc75bb858e01feed04382670b38e10
SHA51251fa08d0c7222bbfc35a9d5b4fdd833ef287d349ffc29d034f14a8333db409ba299096e0e8176ca1c86f8247cdb54a024c046dcda72bfcc2936ee80fe90631cc
-
Filesize
5.9MB
MD5ee6fbc1d016ce249900d245d59c3c0cc
SHA10625f9aaddefb613e274a20c9ed9ab9828f19bcf
SHA2560f63594e237c72257f7108d474ebb3d80a9c0bef08e7dd5f0edca7ea61a3b75c
SHA512a42601d8c3223e38ea262149288b19da3d2dec1185e1bb0f305a7f69a755cd15a0b68e924f5a8dafb702bc65a717208af8673a8ac9dcf4d03eba25f5c453df84
-
Filesize
5.9MB
MD502989f6953ddd853fbfebbab651af0e2
SHA1d02cfe08c0beced1673eac3c01c98dfaf2cad44a
SHA256f5b881c79e86cd7c2c98f03a46e416f9f2b1ae7f5be18de5986a8e2acf6d7dda
SHA512b251906fe78b1cd08c286be77c3ae60dd24b6b69a9ada32219bed5be5dc4715c997c9458cbf2aadcaf9b492b32138fb1666f690215d99e91fc8c6e5601ebc5fd
-
Filesize
5.9MB
MD52226691e5b312ebc9964521d9450caee
SHA1bbc27b846fb12907f63969addc5170949205a510
SHA2562584b88da987a707ef56e8e44834336d950741a12c9503619d502e2c68b40f89
SHA512e12cdf6d2eec6254ecedeff979a6bdcbcaf720dfd1da65b1580c9552a9261d749037a701e833aaa097f08bb3d61d8e14245fed624acf5c51eb13378c831b8433
-
Filesize
5.9MB
MD5d2321d6ad827f84c0e25a0355205c341
SHA1ea16b2f68cee8f5fcbcc42628a09e6e6e277f33b
SHA25661c2a5c13429ca91cd7aeccf234f4bfeee946774ca24bcebb5f0178fe91815e7
SHA51235432de8506a6cb3ea7403e2fd4f07306e04efd2bf88048b2ffb1ffcf3f8d0558368e208524d2b1ed1a5d03bf7de826acbb21776a359f293970460a61a5ca031
-
Filesize
5.9MB
MD57a8a406cea7d728fdbef1dc176210af4
SHA165a9d40e6c3d9ec1f201f854757d32ba1d6c072a
SHA2561fd90f29cb3891c8ae08017ca2c5a6cf7aad6d4f2a704cb2b42149c74b861398
SHA51261d4154db89b0da73914842fa82153cfd8f400c85c5a50e367bd5549c0e05b8f429b5a372ea92a802e507bec043138f338531cfa95f29616598df09d79b4d559
-
Filesize
5.9MB
MD57112e9db146f8597737feefd00a5cca5
SHA1f801d13c8eec2e389e4dd284ac897048bc133290
SHA25688c163d52f61c65852d7d6d09dc8b3bbf5a67ee5a7abdb7c7dd22bdc8e674d13
SHA51263e0558df208314177835d6320b95e6d023afcf1c4e07bdf951ac62d6de471e2f165bb54d8fb695e44bc889e74af4fcc04e4fd3cc5e5e4e77d6e9c22a9cdfa1a
-
Filesize
5.9MB
MD5c9c100f88c441d7c55ef2d99583dd93a
SHA1291f55ccb87a583ae03d92a56587f1dd46631096
SHA2562b4c602b6fd2ce19e9a15cd8a84a0bc4b3c6b8a0aaf0c44a4e8a83208f6720e2
SHA51268ad62ed955369b4bbc6245d2ecc4db1d7bccf2cc840d65bdaed1a6f1277fa436b7b41954e7a0be4caea41eda42abceafb0e896e6af6eb666d2e8b2c35514329
-
Filesize
5.9MB
MD55cd79630eaf5efbb761c3792ac8083d7
SHA149417db1f0063ee5b4c6bfa9fcbbec360c062f39
SHA2566f3575b3b7bec234a627317a48d643ac1fcf40a3c96889f972c880cf39a55cd9
SHA5127b12ba18a12f6f2eed3b51b011efa8c3c1ca2db97075eb91148c8214cb13a42d2bb5c06772fb32045d6bdea735792c4aa1678fc694f3fdf0cb974696b95b0edd
-
Filesize
5.9MB
MD50674639156f6f360f78f229d27ffb959
SHA1115427ffc97e4f17fa9c5a3a2484de30c9e8f13f
SHA256782166ed587084260148b39afb8806375f9a8c1f04ab7c0a666138cb3a903ff7
SHA5128d07348e13ba84e2c73140bbc1ffd5d132242dffffa4b5062f9b32d25110d799a31a7b31aef266c9691f7d5bce7f7bcd4e437c8e17db663987bfd1fab28962b1
-
Filesize
5.9MB
MD5bb5c37d288c14d46d5e1c36391edf134
SHA1c719f1b161101edab685da0e08908a5b335ff1fb
SHA256034d07f8c9f5640fa89ecb198f66618f32057d67e64a878b0ceb71621484e4af
SHA512f0cec7f5a8f9bf16db0c041e0cb254931319123266a3e5e4f95551704d9c485e07035ef35ad758d5530d3e4af535f0d1d3695e6514a49207ca723b027eb01d13
-
Filesize
5.9MB
MD550baaa22cda1d2c5fa4a763809864b88
SHA1ad33ba5e3bba14cfab717bd47c834116141b2120
SHA256eaf965c5bf162742b5f7f5c60119db2044f6f2e242d6bbfc1a0b89c50284b0f8
SHA5127938031a5af05623342150528a535f67212ab184380a4708062fdfd0b4e70f3e0381890a037ea46276a9ab9ed4b7930dbf803b6756fec58ee6849607e19a7963
-
Filesize
5.9MB
MD56358d03daf882b463af2c2bdebdba80b
SHA18c07bb0f100c08af08a7be56ebb55b24108d4471
SHA2569b5500872dde8bcf0407bd149ef5279945ac55de832c3827111fbf18ae736b56
SHA512ce7516a4ece1b152df3934325a53973c52e5cc7c1294659254fb1316ddf92e215ea8738bcbaf8a551010442ed1e5ab562d7461da42520b0bbf68ec9f37b0609c
-
Filesize
5.9MB
MD5807c7a9e6aa691482a8ee19fce008ff8
SHA15153a15937eec48e35cd64ead626d8e447859064
SHA2561fdbf31144803688b31fd068287af8e5f9ed67b4796f1b08987a23dd0575804e
SHA512fbda428ae02c506dcd00032eceeaf969872b4ff426d62d37670042fbae3ba7a7634644f2edfceb632d269ce6a6d64bdd909e39c93cd9b97187336f103ed3f847
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB