Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/09/2024, 17:06
General
-
Target
2024-09-22_3bc076f23150dd1c91c97c26adc63f1a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3bc076f23150dd1c91c97c26adc63f1a
-
SHA1
201eb7569a7a9f4ccee9199ea7357548d4460259
-
SHA256
903740dbd2546990b15bc7846c34e6c3d220dc74bf084283e562a38983fe9757
-
SHA512
1f6472296a34095e73c4b4de633a0c960c0d0a9429994ec1a2a843de48269998cb6d0abe369eb607a2237d947c72f9892a3b8f072d8dbe39f757ae2614f6bef4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lU6
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_3bc076f23150dd1c91c97c26adc63f1a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_3bc076f23150dd1c91c97c26adc63f1a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SiaohAp.exeC:\Windows\System\SiaohAp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YInzQIN.exeC:\Windows\System\YInzQIN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZSefvgj.exeC:\Windows\System\ZSefvgj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gCWSLMi.exeC:\Windows\System\gCWSLMi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rSyEZRh.exeC:\Windows\System\rSyEZRh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jNzseyr.exeC:\Windows\System\jNzseyr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\weWEBBx.exeC:\Windows\System\weWEBBx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ITaHRsv.exeC:\Windows\System\ITaHRsv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\npeRceo.exeC:\Windows\System\npeRceo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ehrdzgf.exeC:\Windows\System\ehrdzgf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QuEliWM.exeC:\Windows\System\QuEliWM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GcXBmni.exeC:\Windows\System\GcXBmni.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lteFdij.exeC:\Windows\System\lteFdij.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eEVaRPE.exeC:\Windows\System\eEVaRPE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ULuqtfB.exeC:\Windows\System\ULuqtfB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PzsMUNq.exeC:\Windows\System\PzsMUNq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xFCBZLj.exeC:\Windows\System\xFCBZLj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IqUiFZF.exeC:\Windows\System\IqUiFZF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MgPMdVW.exeC:\Windows\System\MgPMdVW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JZhydox.exeC:\Windows\System\JZhydox.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JIqQZLj.exeC:\Windows\System\JIqQZLj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ab7986a375fa9d4eb39139e95e303968
SHA189c8458ddcd5231959710fe8ad4cc8c376c02bee
SHA25685d95a0bed9bfa984f149fdd33d29a0bc2b89d793235b738c5229035242d79b1
SHA5121dbe02d3aa43175378bf857ed243c647e50a0572b2301007c0da5097b0d43cc7471a02c004b8204bd4e4c89b1f9fa30512d92083a9fa1b9544b5a0e5e63344a6
-
Filesize
5.2MB
MD55eb3c7a0983092e8c186fc228c77b0b6
SHA1cfe8be75b608ef9edda1ca7042fa142c171ce14e
SHA2561cb8127ca8275817430f324d40b0dc1a318c618708064009cea6f63144139782
SHA512f44b16b1e7024a480f410362accc8c588fadd50c2cc7b15fb636912dd83146a44bc0c73dfa61bc440bdc7f9d41062bc678a7e65b0b8cc51d1d363e528fc2a840
-
Filesize
5.2MB
MD5ad07066b93fa58fb13f1a2ccd05abae9
SHA17dea0b5e5e5e9cf5a9bc57d64c9e633105b6c07a
SHA2565bf1b302798a2b94bcf944b3bd3805eddaeefe9b1938411d1af32905931d8ffc
SHA5125fa310c3eede804e8da2b1ff24f119ef5bed5235a74e819e8c7671c768b3089f122388ea93134d221f05047d64f229736be1fdc1544fd4b9facb764d4315e49d
-
Filesize
5.2MB
MD5cb80e329b4c0fa9dcef3dae3cf105dd7
SHA13a6b1a948735ee7f591b5422f89dfb3ad8f8de08
SHA2569d6a6991563d97fa54ac4b4e592d26963a8afbdf590b93de3bfaacd3bb3494df
SHA512a434cc09aa8447df3bc800b62fc85b8026aa675b28186a7b1fa611cab6db26488aee59dae4ced02b4daa080709d2cc183f1288461be64a6655a89c2929e23cbe
-
Filesize
5.2MB
MD5f13dce462b0ff7c8686676c1262a316f
SHA1a0469e2f602d2380c2ed53f4b96b36b7094662fd
SHA2567e434b2a95503c3905d43882e3115bff5973d6abf074866d7ca427154fadf8d9
SHA5122efd6ed7726ea5783fadea6b7e0c24f65646b602f6f148e969a9bc10cebcce085b6b1ba4556d9eb372f25a029189ff401875b98afb9f52b2a0f93c15488caa66
-
Filesize
5.2MB
MD5df665ed462e538a2309d8fc7c3c6b2aa
SHA19265614622040f60ec2eb62083c6284867556bc6
SHA25648d73bb631dc94aa98d2e8faa71c5a139ba13bb80825c9f58c905a9e273cb620
SHA51249bea2e55c7210bc0fea6c13078a562e493b72aabc7f9cd85e1cdfb6dc803944f54156f5da5b38297f07de3fc2be0c38a4e56abedac6f30c6dff5c3583880fda
-
Filesize
5.2MB
MD504e225c6783d0befbef3d1f6ba903f8f
SHA1747e1a0aeae29545e7b6974522614f5cc18b439a
SHA256ed61672dbfde71833dc4259bbc3477c2953c350ee9a5edba2743cfe80ad7f07b
SHA5129e19ca0e9099da02e22858b5338240d7285ed589cf0a817fe53ab9c3dae1f64dbcdb1d4b633ffc72adfcdc525e076f8741cdd2b8c34ffd3f18ee75e4cbc2475d
-
Filesize
5.2MB
MD5dc2b071bd2acd0d09443328c5068d5d5
SHA1266f93cf19eec8b85fb9e8236c32426045c6562f
SHA256c77ba96981f69c7fe6798ef7ec3bbcb207e84e84070cf41374e27e32bef0b1b3
SHA512d68c0986e7e73eb498bbbf7c185e800419585b57cb15ee505ef320b2d6a2f26987577fc876cae7da5aa292415e58e05dcdf441b54f09cca49ca64786333814fb
-
Filesize
5.2MB
MD5ebbce3aa5a866a2fd4716e82ee0cee22
SHA18b4eca85f4a80c26c0384ae9740ad0ebeacbfc82
SHA2569e00631a28acef4e997698fa0165aebafc12ea328baa56450924589032115413
SHA512d7d45dcd4fe7b166c8e559495047e6355315504f264a7cf7f0dbefb943b52aa6f47bbb4cb948e51145287bf9f3769ef6febfe665e9b101703537295103a4c015
-
Filesize
5.2MB
MD50b14886ae66d3f1579f4b34e3f7129df
SHA1ce2a96162efa1d21be7f79a6c93e208bfebbd8bb
SHA2565fab624aba27a8c85a39eeffd2276c7d2eb635664e8f8ad06c9513251257f986
SHA51225637a79500fb0053f0c808b759f9d7e43413db4c200726d3e2660ee185b60cc8cb7f3b4a18d1ae29913600ef587c05a2f1c6b8e1314d5cd2446c0f8a7492a28
-
Filesize
5.2MB
MD5ef174716f117aa87c865073953cd4bf5
SHA111816b0065a7a72b2a08ce6b376fc33671a1b297
SHA256400cfa227a7094dcfbf4d63dcda13dda7468cdccb5af2d669e73f30a54de38a8
SHA5124438605fcc2ae2c06ee802af8f7470fae484225e2f20b8fc65863b866dd3584dadc0c2034f1f3632552a94e804c50b86f0831bca8637375476c7d52fa4e71bfa
-
Filesize
5.2MB
MD51f07b2bcb4927fff85ed828c234e5c6c
SHA14d44601b53c885aca720060dedd95092b37c419a
SHA25672964f80c176433c7e558c5c26c169aec64d3f305323f8b8a0da24e91cf1d49c
SHA51227fc8b7a386f6cacb31fada5846cf07134b9be61f8bbe7a619911ddd2ba0f38af73a83a85d0df096724504f94da76d0dba70d884d0718ed938419b11ee6acb9d
-
Filesize
5.2MB
MD505e33eac6a06eaa06ee90f97ecddaf4c
SHA1540946f972196eac6bfa0c88ae57dfae62202db1
SHA2563c5fef614222faf54b2458ade8bb30fe23bae6c5598b149c3322405267cce783
SHA512ee0a142204748fdc4d3dbbe853a1cd696f40cf11809438b24d68dc81d685c1930cb9c83166ad4fd063948a788f893df61db7a9f35ecbf3b86f459519e7441bca
-
Filesize
5.2MB
MD5aa7233d02e4488d4c8a86b564ec5d2f1
SHA148c14d43edfd2446375a4db6a96d3e8ea9d5333b
SHA256d3d09599a843e8d84b092a4cd7f86ce359bc73a7b8c89d5843f2ad5f12ea0fc9
SHA512b8e8fe4ee14041e412ac7b2a2c05b99fd67d5044a6db2399a9a5de89e5165ff92bcf487598eed85c6f14fa168dee2f45cef27c90a0e49e38863836e7320e5dff
-
Filesize
5.2MB
MD5b1c69dfa29b3fa37b0f8e908e08094bb
SHA170d9757699f1ad94deb309d7581caaee22dd78dc
SHA25697e3b6767273203cd485d82c16f865dbcaa645197326c3b56f0863a67b34a2fc
SHA51264f448b92ba4035063aee04c3a015bb0a72ac87f80ee98df3a3f3e4e11e3b09e99c8a000740b808f09cc7d2db9f9273466590d32a9a1e05faf8a4da896836a05
-
Filesize
5.2MB
MD5117e4b44dcdc75a5409df4c85628203f
SHA14f3269ceaeca66354141b686136682d00db9ec56
SHA256c00aaf138819de9b3d28b77fd32be4585ee1de297f0bdb8afa3a693a44e079a1
SHA5123c465d9a768470da4bbc38c265b8fbe0bdc00b6e7bfb5c22a75c6db222a581c3ca191eb5526a7de05a380d53c619ed91f0e1d3fb22dd724639e5077bedfd7629
-
Filesize
5.2MB
MD5f84a7d240771b5ecaa6add1cca2fbb25
SHA19c8840c32fe6d9a015cfbdf7f492159daa6a3279
SHA25668cf0527bed0e0ada0c198e5a64383b97efa0aeef1dee1eb3f37df0043a3b7e3
SHA512981f9704a5fa29db525c3629a19951f0682498b8df51c0d7085c58531f2e7da742a99c22d939814b2e16f4063b0be4bda6886590dda84e5611e2ee8703e35e3e
-
Filesize
5.2MB
MD59a5a5c4fbcbc01d2f525a9c9614b1cf8
SHA1d5cefd90b48cf83549d56db2c0b0cd5b3a330895
SHA256f3de077f942559802756d592cd19d5e8c01d23985a22eaedd79be3a87437bd2b
SHA5121283dab9d516f2232e8eb9c06ff65c5a55daf7176a8aa71b181cd35b43cf26f706e18d2ac8a58d8c2afa6331abe50890152bbfdc1b798a3d2cfdabc135c88732
-
Filesize
5.2MB
MD53ce9dc648c508e8e68b6ded6a51f05e1
SHA18a38faa88491d3a4820505590981e6c5f7dff86f
SHA2566962b7bd18eafc9f6003fe0a9c2785bbcf93d3c3d9e7ca0c22613b19fe76e8de
SHA5120dd46becf54424f4c615167404d87e63d3d8dce624b9c86f9c7c8e6761ba1c7c0770fe7983263e7cdc26fe69121c7d32f3bb6ac63795a6c6e4e6c129854eee1a
-
Filesize
5.2MB
MD54287c0e08e421bf26212e61eff524ee6
SHA1ee906159b4cab04dd2039e2abeab6171fcf0c792
SHA2560628e5c130e9b13b6a7d7fd5efa1c2a7bae0d95d4a76e2155943b3fc4f2f7bbe
SHA512e46da4f40923104da57efb44d3e4959f87c5ae412f3386134b380e68f0baffa0aa827df4a21cbfd304721899a912481e12b7d59fc41f12cf7f5e02cf99915945
-
Filesize
5.2MB
MD505a16b5a91cf30be721f79a473e89ea3
SHA1dba0b7be302bac977c71d34b31fc442daadee425
SHA256f71b8b13932a56934fd2834bc6b537b6bf5ea76e6e08f594e7fe8459fb1428c7
SHA512a81809d68779861ffd8f8960c80d208f64091f75aaf6af92e1d1974c1b81b52ac42114a968ed5a973bb0f1519fef5248bfd34bd5b64825f666e7180e76293037
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB