Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22/09/2024, 11:04
General
-
Target
2024-09-22_fa7220b45b4dfe8a0dd9422ef3bf3746_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
fa7220b45b4dfe8a0dd9422ef3bf3746
-
SHA1
0e59ec2631589e23ae0bd01b8b5231517400b4cc
-
SHA256
91447a35c1b34f07248deba36d39944e026b5c3868622904147cf4ff00aac751
-
SHA512
b14a3d72ba995504490f07e850c6d0017ceffccb58090ede72f02726d41896abb2d328a50f64e44660ab8e05f1a6d14bc8687060459bd4eeecb460850da9c2c8
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:T+856utgpPF8u/7C
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_fa7220b45b4dfe8a0dd9422ef3bf3746_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_fa7220b45b4dfe8a0dd9422ef3bf3746_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WFVqNjS.exeC:\Windows\System\WFVqNjS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DaCoYpC.exeC:\Windows\System\DaCoYpC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GqRHloh.exeC:\Windows\System\GqRHloh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JfnJXnd.exeC:\Windows\System\JfnJXnd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WKFfFRE.exeC:\Windows\System\WKFfFRE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BYIBqIM.exeC:\Windows\System\BYIBqIM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HoYVaPg.exeC:\Windows\System\HoYVaPg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oFSKWNu.exeC:\Windows\System\oFSKWNu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KPlooga.exeC:\Windows\System\KPlooga.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GpGkHIX.exeC:\Windows\System\GpGkHIX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NYfLaTh.exeC:\Windows\System\NYfLaTh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aaSBcnk.exeC:\Windows\System\aaSBcnk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OwtgqOe.exeC:\Windows\System\OwtgqOe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BwPCUBK.exeC:\Windows\System\BwPCUBK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PyymETs.exeC:\Windows\System\PyymETs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MOPFqAa.exeC:\Windows\System\MOPFqAa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sgdqEZp.exeC:\Windows\System\sgdqEZp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QDvRzul.exeC:\Windows\System\QDvRzul.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CAcNdva.exeC:\Windows\System\CAcNdva.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lgSAiId.exeC:\Windows\System\lgSAiId.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fqlPZGD.exeC:\Windows\System\fqlPZGD.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5dae92730349257bebe902b6487c7cc6e
SHA1a227fdc519d9834b56f31a01362b8627c26b6b20
SHA25696711b7e73b1140233c7015122f3f2ee8b75ab51bbf15d5039cedb32c43e572f
SHA512de14aa53ad8df72e8f7a690bff1cb4c1556fe9621b8cc2b133698b4855e7f76beba3df795904e861c7d2acea17022ef388fdcb08f3ef8b24bbb0ccae6ed06887
-
Filesize
5.9MB
MD551d9a3fed8317e07414af58dcb1289ac
SHA194c5c86cb554b0adb64133ff85e618b0add7cebf
SHA2566bd496ea7c56a24d8756775966425a2a9875ee20f9b280250ae99d8ead960fa6
SHA51230a4e4c823f6972a4cfef5e5bf2a549490c70ef8271af998720f84c84ffeac04c2dbd5e1410bcf8ca3849d614e21a63c146861259e4dcba2e747bd4b0f118e84
-
Filesize
6.0MB
MD5a711dbaf57702136589d6c89b3369765
SHA113ae6887e9be91539171f19a87ae7d21667f2eb7
SHA256b279560a772aaf776162de1dcb121195bbac0a51ae4c0c472f9d8d089e115b30
SHA512a25069a4f28e93c4c91d53788d1495fd0425dd877c108a81c7c7dfadccaa95cc64356df251206e0332c8c06ffe04344c7468d71a5f36da871240a05b7328aab2
-
Filesize
5.9MB
MD519ad791a197640ebeb022d9b346f11c5
SHA1d9b997f84b156dc83b16635aa358a92fe58a334a
SHA2565f99188dce7fbcabe4686c6a2e5b6bcd080e0fdeb7fed0176d6b7eda0c640439
SHA512c9dae39c626da1e5eeff18b03e9087587721f8898df8429a3738a2866fbce6463894cbfe341854e4e1b7bd35350c548ce954037902cf6be04592eb23f3f3a949
-
Filesize
5.9MB
MD514504a07aaea1088f332fdc482a30f13
SHA1d92c7e05f5323b744d50dd898c87ebd89c86b1b4
SHA2562b40a85669e5bdde577e67850abf6cf54aaf9ac75e5168c4c7bd39ba83535b7c
SHA512128cbc587bef10fcb52a6a5f1df83e0b44c0bfb2fe574715553e9b9a135102c33187ca1fe671c85fed3c6840f9201327fb8d58742aaf29b81d187ed188a5e79c
-
Filesize
5.9MB
MD58ac337c4bceeb8a315c2d4a7a0e0cee8
SHA19791e51e956ce4718d261c8b015625b779e8617e
SHA256617dfa2ecd1829ea17ea4cd4f1b99d67424ac4c7bfd9e46b8f5ded64f3174f2b
SHA512bab8454b0936a81e4f75a5eab0a2766d4087a18e8313f4cac6ca253ddbc39fca9e8bf99d006c292f4dba347b46a5b6684660d8284dbcfa58bc3296a3c9ed3f76
-
Filesize
5.9MB
MD58214c4cc8a50c6afcec74118646f9733
SHA17717bd14d8c793b16ac355b09ceb510850baf412
SHA2566bbb5d3c88fddc2a64ea29ef56b35df7b8a184cfbde3b24d611a10f8677ee73a
SHA512a1ea2cfb14bdda841737747e8242c23472c16934775c1aec764f0394e6de7afcbc8b637f683dac7476ef97755e66df145c57c884da0b4d9fcf2e85a5ad9014b9
-
Filesize
5.9MB
MD51964e7e5d4a80155d90e5175d7b41e6a
SHA1b5367d6ac27536c400746f8b5337c4e76090e9ae
SHA256e05fa1418f6c9c96103b4a1432f695126c3063d9b3fb25e662b0ae3ae80ad58a
SHA5129911405f33a7a525310440652f676821edd408e8ce92c4c5ca1adc4640fffea217b726d672f175b656e68a95c48c7cdef59f440f22633643d05793412bad69c4
-
Filesize
5.9MB
MD57fcfe0124f8f8c7dd9f78647cdf21250
SHA18964e4912fae4f31555a0da5e28a1cc480cb72df
SHA2560d1def540453298a982c00099de624fb63fb67850cbc54ff467dcf41090a3496
SHA5126e28a3f149549d7c23fc8e8e52e80209aa7c59859d9e865fc1f4509ce415b1599398ddf4da80e40c87e1f54cc297c9805bc569fd4eaa1e85c3693a2c96111c71
-
Filesize
6.0MB
MD592bb196ed9ae1928c17b27da993e5ed3
SHA119e06f3445219db5bf922118b4f5db5990eeec2a
SHA256ccd341fde1128e1bb6d19a1689d47acba540c0d7c0e322e907409656e375d828
SHA5120a25d65d579cfd433010724bf6ab5eeb996acabe3a4855273a2e37a5ecfe54067284f17a3a3b3a227bac3453693e583dd68db824f1c295c8aaab858985f54ed1
-
Filesize
5.9MB
MD5849b3b1747f7f21abc2f945a81433e41
SHA1d97c60bdc00288214bfb4c60687f93c15de881a2
SHA256a165b74a4515a598065cb7fe49d8de2ede78ef80d56d414411d93cadaec50f9d
SHA51241a783435a2c5d52e71fe7afac93a7ec9b3d96c6582d69cc79a9a4e3f6e2796cbe5c17ca74f53701ae2e56f86b247cc361bf2b56678ee23280718365f3449184
-
Filesize
5.9MB
MD5d0eb4917f582d2b32c7f51894d956895
SHA19d120bce71056a3cf50bd7b36e66e4b9dd99fb57
SHA25641b9832c5035207767e0066dadf9a896560eaefe7f41ba3fc9f13cfd75c7bfdc
SHA512d5533272d2bbc548ac8000919f3f72c32b299720f0129b7d4418d4a5dec45f0fd70537b61fc10a24241e56685d76d9bfdbb6c54fec7f633ce3ce9db5743f8be9
-
Filesize
5.9MB
MD506eaf906ee3ae0b32d512fffa88607ff
SHA14ee771d1fd1f30f1d64c3f745dd6918c63e40fe0
SHA2563ace90e13aedfcedde2d3bcb4f28ef2af01f34277e5cf7a52dd0cfd60c32eb88
SHA5123ee4b4ad4f446bd210d19747d49f564a8c21a44c6cce572d3a3624ecea23eedc64f17925453cd878403638b22e71dd4dd6b8a124de479819fe330229f9d5dfc3
-
Filesize
6.0MB
MD5f665796fb455e9f5eda75858e7c0f5d4
SHA1c02786b2961973fe2150f99182b1d0e512b52384
SHA2565096079b71a373e9fd14029753e5bdfd75ec06c4fbede034879e8119b6da10a9
SHA5124aa28e6b93be303e9aaf025e2541b87361cc7935437b3d315522d5025b8ca9ff0fc618480d1767e10b7d17cf44f3951ae37723e286f9369d67910777685ae884
-
Filesize
5.9MB
MD58b26e7dfd9cff898c6d6fd549bd3d12d
SHA1645482da3f31fe9eb0aa76aedca7feac90a80960
SHA2566570c790ff75b82436dc2f0cc2d8a85e4bc251e329b8bf5250c6324ae2e1876c
SHA5127ef9eaabd3e9f727a0a6eb57db357cef7ae58240e0813695f128fe18770ee4a22f743b44caf1cac0c22607cc817f183e58322bef59b480386ee5b07aaf20433b
-
Filesize
5.9MB
MD51a2706fa71af238c07b6363ca5433056
SHA1be663f5253a88a15b9aae94079e2f0b11f2ec29e
SHA25610ba5181f5a1223b65f31f31e5af89874535badb92405abb035282bb332cea41
SHA512e65c59fc5b85d0d713696331fb3d0267b94b023652f791c254c4377776a350f64def81ff2f13e7aef63ad5f25eb75de229bd7b070421622a2dfb5e790789e63a
-
Filesize
5.9MB
MD5523b2a3de31b0c5378c353228eb9d08f
SHA1a056ef5df058fb63118a98684730e056964c6c52
SHA2564b6d6b64c3314e1b01f00c596f43cddcaed02d849403d86496103c3f5e48fe1f
SHA512d206ce3fcded8f1dad1b9483c222f58c51909ae3afdb8a5624d20f3deb9b7ea0be932ac7538ad5ae211ac25d1f3e0e7e04ebb5631899151adefa84a5abda4c26
-
Filesize
6.0MB
MD5be4e74598de103a73ccb1d8de1f9b297
SHA17b4b4859d7a4bc8104ea4bee544ed356921c167c
SHA256a8f7996e2afc003200f4bf26f4ff9d80c1eb6b0a45ef89ed0956f9858d580436
SHA51226d2a776461bcd041a3fe65e7527ef23e656467355d16b09e6e5bebde9a70c85401129636752370f1924aedbc9ae7ae6aa2ad7ba207b9327a9d8141071f3708b
-
Filesize
6.0MB
MD55d515ad842388af0341b9a93ab1bed1e
SHA140f4fc531447c729bd39805b9d5141dadaa50a9c
SHA256deb06b00a476b988934719abd4c4c6d2f8e53c6e69e4e5cf92c2929ac2e3277e
SHA512dd1c64fd1dd25cf3022f884db6f5de6b76e60574f50b5cc7ffe34cc085b260a023e549b8485602ab3281f4404fab11f76de4beb358830be02a42fa4a8d13e537
-
Filesize
5.9MB
MD549257eb9f3ae7e1ee281436bc7e30473
SHA190af0364b3ee7211e66ae3d49919e4b6dce98ad9
SHA256d8ffda49bd7e12c069169724520f563eb4aacc773f0af943421a1198cd0083b6
SHA512e2b3f9ce0e19ee33b60d8ab138a7e9bcc90b3c3b4a787741634bdc71411ecd2d8d307c7a50587dfc0ab94d82cf9887d448774f25e8f54cdf7a57c197c6e0248e
-
Filesize
6.0MB
MD570ee705393ee49caa73091f1f91e34d8
SHA1d51ae94535074985d3cf06b125c50a1bd137df09
SHA256d47edda1b5f670ec390c470f1dfc354f7cc25beac43e18fc85479352c6c497a6
SHA512f65e4248aa3197ab243daca668fa2b81970ec3e59ee7da613d9d2c7ac1fa6db458e2c139d6291107f8dd74fd8cd95dd19685c9b39406fa3aae9944aeef1c3b91
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB