Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22/09/2024, 10:52
General
-
Target
2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
3906479d6009f30b05e81ecb3569c02b
-
SHA1
c44ee5f2618cde1831bc173b59daffcbfdc277f9
-
SHA256
9be8b62085a4070a54db7507f884fdb6be2bc8acc373a0fa281e14e1c8a31a77
-
SHA512
2d99e9dbf2d001322db0441c271fa02cfeda53ec34d2ff4bc92e2c025b57f06bc72ddaae8bc895ccbc376376c469cfaac81fd63d79dbbcebc255f21c1cc3afac
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:T+856utgpPF8u/7o
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_3906479d6009f30b05e81ecb3569c02b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rdBrsgg.exeC:\Windows\System\rdBrsgg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tveXXzZ.exeC:\Windows\System\tveXXzZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UmOLydy.exeC:\Windows\System\UmOLydy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rYuAQMx.exeC:\Windows\System\rYuAQMx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\peGALeh.exeC:\Windows\System\peGALeh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\exAeyFo.exeC:\Windows\System\exAeyFo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wqKEzyO.exeC:\Windows\System\wqKEzyO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZnKdbsq.exeC:\Windows\System\ZnKdbsq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AAlkcFq.exeC:\Windows\System\AAlkcFq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EIwPLFB.exeC:\Windows\System\EIwPLFB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bshKZsq.exeC:\Windows\System\bshKZsq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QyiiUJq.exeC:\Windows\System\QyiiUJq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SfWITYd.exeC:\Windows\System\SfWITYd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vaZvAae.exeC:\Windows\System\vaZvAae.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\glONpBB.exeC:\Windows\System\glONpBB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sbBUQeD.exeC:\Windows\System\sbBUQeD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yLfvMmF.exeC:\Windows\System\yLfvMmF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ttstGyH.exeC:\Windows\System\ttstGyH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PfcRAxL.exeC:\Windows\System\PfcRAxL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YQgUTEq.exeC:\Windows\System\YQgUTEq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LakLfVJ.exeC:\Windows\System\LakLfVJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD563ffaab42de1499931bdff9a339bfde0
SHA13db1728926f6eec24d31f5666a491454453d3c35
SHA256858708ac1d03c9f9696d00f1ebb3c3dbe9a6806538b349771db25788b14e0cc2
SHA512c3eb429959c7ac277d0585a2ccb0533f9276e61a155643343624184740b377c55f2f2cb6d50cfcf61d37a515f4c978b6c7b207e625bb14f678df4182dd0204c4
-
Filesize
5.9MB
MD5f17981111eb31c8fa1e54717307fbcbf
SHA1e7da0808bb3a61303abaa39728d5fcc5378dafff
SHA2568854854000eba116249ff715136bb2876bf3bdf74c3d7df2fd2374c5716d46b0
SHA512115429c5c2236a63cd381a60bb71ed6cac77e76c62e92076ea01ad1016e9972500953f01a8511bd978c2bf2b46a2f5341c54a281bfac8c3dd715109409e08e56
-
Filesize
5.9MB
MD5960a571f022fb02dad9c73ecc66e9d20
SHA1ce91cf83b527e115e49361c716d42360b3aa53ef
SHA2566748a85cfc5425bc65e092b01686865008b7752d277793418c21ae5bcf71658c
SHA5124fac40a5001015b37d628c5f6227a76bf9b20f87b302f926aa5be7c3b695fc247d081316555f19edde42c0643556bdab59c1d83d741081eeadd8c1b8461fd9ff
-
Filesize
5.9MB
MD5e1966c4aae61f64ca058273bb165d9a5
SHA1f9da8167aaceea2e9dc1333263183490f28ba180
SHA256a6fe9a69752d9f564be8f426235e230149f42bb44f442bebd6f5bf7ec1cf65f2
SHA5124e3217fcdab5179854d8c38b48035c53b2415d691bfdf22609430a35cca2a5de0d41672c94f1fd7cd99e80fb17692b90155130b05411ba0f578a59630a728c72
-
Filesize
5.9MB
MD506d41e6c65f64fac2c455aa87d507d30
SHA1736a5fdf9b2d9d09055e31ab2621d8ccf0d87cd1
SHA2567c1653690da6045ce92538b660951d6972d1766c088d6bfcef634a65e121b091
SHA51243a9c3cc9a3d7a88b158f71c28f4b4c94b0eed764f734adc311cdd6fb08d4aedfe8c06349cd09b2bae184f4524e974ed6c05fd918a1d9d206f7a36659b050643
-
Filesize
5.9MB
MD5cd721e0525ff7fdc95e22d5f25e06bd2
SHA131a8cd9512802bced6a2a13260cb39d703583397
SHA2560f9283d6372b3b4f59ea497ee23b114c9326a928f91442e373b104d4370b3149
SHA512bee38051d2c73d7f6badf884cbef55f324158bb2a4af23e8b445c5fda3aecbe12439f011c3c3626bd743ffd829f3880f308be810ddd5102865688023188ade4a
-
Filesize
5.9MB
MD51579c6c94b616b2e071de6499bea9a12
SHA186ff28008f372a903da888563de199328fff73f2
SHA25640a8b49e70664ee650f0e69c20f6a698766e36b6d4be247f4038c47a28c82a4d
SHA5129d9eb0e78945e475e8c9934c403dad4d6ce7a5ee105c009dfd0f29dcc9cd000378f789d7b4bb8f985090939fb3c81d9b4fd191bc1798764b50ce17a9ca719c96
-
Filesize
5.9MB
MD50409235c15c1acfa647dd1753fe0564c
SHA1ee6593a615004cfaff7824464256eade253ff034
SHA2567d4b68f80cc106c02c1c3ee72256da6f80cee523e3b6a5bb0094d6dc0ae82ebd
SHA512d2f875da5204e53767b9c1fcaa396f65554935388c8e2ed7d11025cc8d544ef5ba2c7ce365f0771eadd1ae14b41ff0585b95caa8993e5321cebfc86764c1b8ae
-
Filesize
5.9MB
MD5d61daadf09d8303d8af9eb2dcbe4431a
SHA11454d60dd692f26300eb487ed67bcdfb87c4afae
SHA2566e1d1d3558af1da34cccda00db7f50839b247662d5cc3910cfa491aae42c4273
SHA5124d0b4b8047ac7e0b23c75e7df018ed325cc16d4d1e0a32c66cac971463d986342705c6eb272931938e49e1fbb683ad114a20f8163c753d19cc9db4c3085bda94
-
Filesize
5.9MB
MD5c197342d9aa6395fe0423c27676df88e
SHA1f03af92cf5fbfe48921dcec9268d4f647d2e64be
SHA25645625eb5311ff9703d6befedf0a7ed307ceaa80dc6a29b69e23206cb5c64b071
SHA512905d74510a6db25a75abb6103661be7ebcdef6c478255b88a42121b588b6c942b7e916566c77d2b8d1a2d4351e0ea8a2e1bf4a193e57b9b78d04d4cbf448beb0
-
Filesize
5.9MB
MD59495ae27073532b3742ce032eaccc94c
SHA13a72fcf243ced8c6583c236e909f4281f5b7bdda
SHA256b78756cbe7541deb05b1f5d93d9301361a997dad5dda100bb2e20a72db565046
SHA51214a88ff7c4014810f84c76f1c866282518a34131a213dc8e47e877bf78992bf3337afa7ec391c80eb4a86f0719dfca3d55fb239e0e77aaa90c86323520572c82
-
Filesize
5.9MB
MD532d7de3f572854a1bbcd1b1c7bb17405
SHA1ac8c5ddde64378bc06a9852dfbf367d9ab622a17
SHA25644627906b1b6bd5715e106ebfc3ab34f2cd7e0224fa65a661a6dccf8e7ce4f0a
SHA5129263f075606aa960facb282bf4eba3374a2ec1664546f9a402c9d6ca7e976e69f9ea5ba1ed6bcedf2a79b95065844529c217d003777fd17428005d87d9704ad1
-
Filesize
5.9MB
MD5cfac48c27fbe9a763dfd296c1f172d23
SHA163b4ae252bf281d57a70ce71a8f47c040766e2ed
SHA25614e8d88db9b180e21737f71e72967fb4cc0dae51488e5f975c222f3d2bd00fac
SHA5124672bc67a33b66e15af30bf7721e42eeb703ecf27fbbfd45b372ad1130196d171c86ed9f6d402c85657eeb1cd3d34ab6c6b65b77c6692dfba4fb7057a952a2eb
-
Filesize
5.9MB
MD5962f0eb39dc43b7053e83c5a160d7260
SHA1e418023fd0f876f3608e692308ef2f76cf01d320
SHA256170a928cf5040efeb51cd5aa21eac887b54d86b93bf6314526336ed64c87281b
SHA51203d2873f3d768711fd4de9b6c9c55a3aa44edd055accbd07e3d63641af4c6ba2f569656046177bc3a4ea16a6a33db3d8b6b6e82d07b19afa316d35474765de07
-
Filesize
5.9MB
MD53c535043715ecc14a53239203e00a551
SHA1118daa3b81022f947827f72632a4130e1effb0bb
SHA2560398a31c00b529a376c9c9215ffda0c66f456858a2fe9c4ad85e0bd5e15e1ae2
SHA512e8c32f961b9430473cf3e37239eaa0b663dff3dea658600eb52e35ea038076162bbaac94578440151bbbc041f6493cef4fc31ac9afeb2bfb50e5b65757203094
-
Filesize
5.9MB
MD595897696cc65d394d79d5767fb9d4166
SHA18e3354409a37d998be88a45199751ddffa8d9ea2
SHA2567343519c5cd7ceef2447ebc502bbba9d887f4c9d9d735fd74387ef138be4a0b0
SHA512d8caa5fae4c888f450cec2a0b9f8b299564245ec6c57ac1580cb2b10877ec933a30e80d63fdb6d345b4ef3d7e69dd171a9cb93d2abbc3476c72c3625ed4268fe
-
Filesize
5.9MB
MD5445cb630c426a540671a0de6045f37e6
SHA14b14fb35062d36aad2024529f63971f1cb281f3f
SHA256976bfc3c6b39fd7e1ad99a83a4180064fc6d2bf82c39471a0e587d4eb9501d1c
SHA512253b0c96e93ef0b7ccd9a08efda5133c2cb2c68c5788d71921a20a4768f5a538e826db1abd2e4694688f973a9c086d59d512da5a75d9feb9dee464003e9dc58f
-
Filesize
5.9MB
MD58e51d9e754ce9ef86aee2e6938d3061e
SHA185d57b51c4a5e0319c8a3c079c09354450a779c2
SHA2563f4207650a1e8504282a255d76e3f5b9df2a22243d44b5a33cec4e8080a1064d
SHA5125cc217fcd89d91abfdf807262a017cd6af739264d444bdb2d9a4a85cd3929749540e78e38d85e7d78dad7ba465fee64de0e030328e4212a1214d6a9230f1acea
-
Filesize
5.9MB
MD53cb9b8591515582b2ee440c57cffbfc7
SHA1061fa621aec5fd8b7a28b5022e7b1326b892a1ed
SHA256b8925cc692a5912457435d3c229050fe55cfa0631f0c3cd0d1872e247cf1e948
SHA51250aa4b7f530928092caaf3eaa2dd18b455c0ceb61ba61195c9897863199fea0246a41b4d7fa8a0905a93d51d43771df7e014d779dac25b1a03de057074d97d92
-
Filesize
5.9MB
MD5442a0965104a2c1981ef4f9623109a94
SHA1e0cb248ee1ff46453555c57d0d09a97bdca81731
SHA256bbab66215496de260c446d865e389cdfa82ca7980411227b4c7afdb0db3133c9
SHA51269dfa40b32f3ad612e17305be2134d65404b9b4a253a5aafa9e9154c68504cba9d086ae87407f8074313387844a63ac0dbb62c5d7aff0e41cec4e032ebb94538
-
Filesize
5.9MB
MD5adeeb84f771ddc8ce44ad89a1e22c43e
SHA102f2b118eae6e663e7030705d1edda9ea51d0c75
SHA256518903fdd72f667eba9e02a3f7f779170afc564e59e03733e84a05ca7fdb30ba
SHA512eba06f581530f1b132a2507a0544741a0ea932b1174e5cf6e3390b3b122e2b2e013f3c0e83cb6b6f162dbf9e7ee050346837be66870cc2d9f4342009a942a226
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB