Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23/09/2024, 00:46
General
-
Target
2024-09-23_5eab5a8a110e8241c192ba499490e7cb_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5eab5a8a110e8241c192ba499490e7cb
-
SHA1
69c6889e05652f0d600565fa2f20905144c242dc
-
SHA256
c740aaa1e650b0d4454c72fb4c2f67a65ca55853d04cb3d8b1153ef56a567ecd
-
SHA512
61bb9bd14d2d23f1c98d9eb445c51fd3455c3fbe12f5b1ab55f4cd68cdef43841d5686b2b5ee5a0405d0aeec23a3aa5ec05ce48a36f0cebec8c26036f24aac3c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lUG
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_5eab5a8a110e8241c192ba499490e7cb_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_5eab5a8a110e8241c192ba499490e7cb_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QGHHnho.exeC:\Windows\System\QGHHnho.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uzsWAlc.exeC:\Windows\System\uzsWAlc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XorlzLC.exeC:\Windows\System\XorlzLC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SAKvsyx.exeC:\Windows\System\SAKvsyx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JtaLIgD.exeC:\Windows\System\JtaLIgD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cXfniem.exeC:\Windows\System\cXfniem.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rLDAHXG.exeC:\Windows\System\rLDAHXG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SlygAbI.exeC:\Windows\System\SlygAbI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fwZlYGg.exeC:\Windows\System\fwZlYGg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VWTXpOx.exeC:\Windows\System\VWTXpOx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NChNmPJ.exeC:\Windows\System\NChNmPJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RRENuRH.exeC:\Windows\System\RRENuRH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UakCTlS.exeC:\Windows\System\UakCTlS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pjkfREo.exeC:\Windows\System\pjkfREo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PUAUeCC.exeC:\Windows\System\PUAUeCC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ixiWiqX.exeC:\Windows\System\ixiWiqX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dKbQeMJ.exeC:\Windows\System\dKbQeMJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zdUMAua.exeC:\Windows\System\zdUMAua.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lUloSkg.exeC:\Windows\System\lUloSkg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZQckRob.exeC:\Windows\System\ZQckRob.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iXsxAsj.exeC:\Windows\System\iXsxAsj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59549dc46afd1dc7ad245b21f60844fed
SHA1b406fe06894ab4951b2c9ad2c2d1b5d128e14bca
SHA256b7f8dfc3c31aa3e0faf60cc3b2bfa32d06892cb8c44dc093a0ddd1c0f73420c2
SHA51288b168934f59666e10f5b71660dffdd759fb80d11dac1984e118d93fe76db6d1ea1be5e6e2e4ddc15e27498ad18654505b1487eece40294ecdf460005a1f8136
-
Filesize
5.2MB
MD524e916f41d86f4f6cc544b9a0c1921cd
SHA1235755216786c8f8942c895d6d395fba6246e03f
SHA25625b160ea703f530dc7fa44e3b2e0495627c936372d4675b1969fceda3e416287
SHA512e8a46f7d7589d64f47e855431cf18d6c3d9a8fa9ad38c384c3b97717ebd4b9af7f439f0f91ff975a501aa2b75a13042876418bc2ea310e3ad83a1d84582ffaaf
-
Filesize
5.2MB
MD54ec30b3e7e3fb06b3379e4b8e5a81134
SHA14e197822851f3cb12777fabac4b8e92d63817936
SHA2569f02c2481f9236378643eb08d2ed54cdcf96a63da7b15e10406f3d592716cda7
SHA512782ec901ee23a998208d95852cb1fea20c1e0248f830a9c760f0aaa5563ab796dc9463d59beb6b464af069c87a80032bcb6e37930a65c92617ab9b2bbafba9e0
-
Filesize
5.2MB
MD5b7dc5166d951469f467fbd4a9fa3d67b
SHA13f9c7c9ef81bacb2da106881a9518092f8b24699
SHA2569922d030ae2fdec4c7837e9dbac038c597a247c2b7caf244f2c2d9c2b8f450d5
SHA512706c2d8443d601097ef5b233ce8177e2e1414fd50201783426b2d37539d5bdbe1a006bcd40fb53234220419d706c8b4cf4166a7b448a57cd28e1235a0141e83f
-
Filesize
5.2MB
MD51a8c1b104cd3f6a271be86c1e0f4ab73
SHA10d26c558538159bc91a9f82d42f538173f3ebf95
SHA2561146c30c4c39182ee6bc2778a40bef43e6fe07a731e1c042b42448506ffcfd1a
SHA5124e120c3dc63d79f8ae064461e60902f64e6b3316362b738a22eff682d668606e74e8c07800497ac7e71ed687d105c4f6a86319ab043fb7da4217ad6999cd19f7
-
Filesize
5.2MB
MD5f96e6fe0aae8712315da4db0f1290e86
SHA193318fd22ce04dacaa5cf450fcaf7f24059f4d04
SHA25635dba55df2c794c363871e0ccdd0d82ff469796db3bb2408c14b7d52ab59f6c6
SHA5124dd984d634457523b0f242bc11dc85e653e4d42785c121b74697f769e304c3e69f8b1b5683acbbf7f4a312534ec4a1a42344f9f4b6f7c6d60a94d3941431abd8
-
Filesize
5.2MB
MD5b504a0ca59a2408e4a8ede56664b3aec
SHA1c6b51b734cc6576ad9ff49b832df6fca0a89e0b7
SHA256c4c6d1eb10c222c4afff820b9977f09c1e7b2462bcd4e05a54fcb49f082bc954
SHA5128b143a4370bf8f82d19a5fca342b0a4d06102a9d6c6718640388ba0f7a496a2513901d6f7814b4e610bec08b3f7f0061e7b0c71e73a37e05a234e54e4c8db5a5
-
Filesize
5.2MB
MD58134c66e3c9ac19f4d5736ba7719cbea
SHA10c8dc303eab54dfd2a2651f18550a66d82f83c10
SHA256a1d1c8f68daf5cfbc9f3754d01bf3f7d08d9fbb245b26a70a13fd801c539c590
SHA512e33d5c7820193404c3392d81018ef8ab0d7d8568dda94ebbec3c51998fec03cd9e54820af250421ce32aacc76382a9881fc153da95cef5afa958d12a90ac6f55
-
Filesize
5.2MB
MD55a260e99a762da54b7f5dd4737f04c0c
SHA1b22f8e6ef0217b4d55284c801d258424078d3dc5
SHA256249550f14ae8249d7b2816e3ee7227dbe8396cdb99814e9ff91ad23923565dec
SHA51294b20b1bd53140507578e82aa3c927f6e5debd8c3d53032fbe629a3429a67d1202c7624d8a16b641318214e54dd4624784e49aa63f3c8440940d97cce11078c5
-
Filesize
5.2MB
MD5c73878a9e418423f98c282f01a0bff9d
SHA19f2a87952d76da5562ca0eb1ade3ddd45f3e640f
SHA256b4af70adc41a49509a454fd9e3f14d75bb2219d7954ef1943f05450708fc563e
SHA5127dd9e59933e5dfee3c3c8532c06cc6027af479c87cf9c1d1b74a2242993dbd6e86a0ec452158bd10169880b67f714c21b7c88e05e6fbab72d24a12f3e78b3944
-
Filesize
5.2MB
MD55cd5c05b6d0940895143cb3b8f74f3b2
SHA19a0dc3535ee98aab0a1fbb3cf68ce63a09770ea8
SHA256a8ec42069cde121fbef8d77548caf8f5ac0fb25a1e6ae3784a35c5fbc0ece997
SHA5129bb7664cadb0194ec2a899bf2495c6b30342c3815061a06b9c49cd773af6b855b6bc5b9263c8b3c5cab038b5241d469e8b11cc72482c0c2734387a92d45d9db9
-
Filesize
5.2MB
MD5db28a460c046b5fb88a3c559af12ece9
SHA1161d6f36ed0dbb808d86f3c5826d225c3eb21e2b
SHA25653b8de1b0bc22aa4ea66cb139ef3934ba298b9eee23055b805ce929e84883675
SHA51225c9987e7cb174c33fc96ab75ea15a2bb8c33f79a07ccc89a416a78e0ef1c99200bfae78b783b6f412b4be6a079922bf4826d4d3ae2519274100a748b2d3ba45
-
Filesize
5.2MB
MD5f439bd280f18b3620273da082b583cc6
SHA1256487637b374fe764a93710adb322882c8248c3
SHA256eb16c9fab7493e6ccf398e543f26426bd74f1b3e426f4e681dbdc5c68f3fe62f
SHA512ac15b916bec297841d19759814a543266b60af66b191850e2d58d2be0e09a0d6078043a2b67113d00b285cb6b27fa3929d595ed16536b89d066c72b1a56d6bd0
-
Filesize
5.2MB
MD5f140fe1ee90d65bf15121e876088d16c
SHA17721867e2b8d9559baeca95825d73d560b75c075
SHA25612ead247e331b08b1ec558b7a746a67721dd8cd65e182d01f03b283566775aa1
SHA512838f8a4d2f0dd8c989134c54831f26079b072ccd8ea3de29251d1cea949539522ce7702f3fdc308ed91de8fd76c6e2bd20dda5ca8f6ab7298c0b4cbbb189da32
-
Filesize
5.2MB
MD5c211d1d54487a011b760c371451482f8
SHA1bb485a7388de00a398542d5fff19e27b05fd9358
SHA2569e89df6e6eb3df98f0f1a0b30816d99f74187311eae8520ec6babd05d1996ee1
SHA51242c9f0f20d1113cb7fbf5432fdb5ce071ceed5a26c634a4d23aab6045834e457739ac674df892c12da6059a0c0f6931d7b2068c3216131034a27f58c89aab537
-
Filesize
5.2MB
MD56c986d1c0a6bebbdb0fb8cefec249c99
SHA181109c152133f5ca27a95fe4b9a94205325e5016
SHA256c4f0eb62e13c5c87f61a6511486f5b28034d1e126a0dd24cdfd629dd85c6cfc4
SHA512ba1f4f0fb713eea66f9e6d6990271aac0b9fcf83f2ba8e35e1ae7fe6937d352728872961d162c402be23872eceb0180a6bb0cbefbab16c3df1f21a527c7fc361
-
Filesize
5.2MB
MD50218b05533c98eddff462410305de5ab
SHA1df64419be37576353330bf1a240f93b33584cf8e
SHA256e780ea677fd9eb1e823c266f24fd65f5da1c9730b9ee0d372e4d12daed9c76fe
SHA512ac60664692dad55bd4001ea9d5202623bafeb6067bb0c6207863a4342ddb7ddeab8c1643a600d35efdf5c111b54822dc2846a2ac0a07afb1af2c187e06db5738
-
Filesize
5.2MB
MD58165559e799e8b2ae6d3bb6db23eaf64
SHA12ce7f9a442433fa46196510242c5e7c5cccf2641
SHA256cdeb7ac10be2e1712ec9b6fa496f358a3db82a6971bf1125e9ddcac18468397b
SHA512e42d62887a8d808764a3bfe7756b29047ea3657defa776ba1c7b1cddec1876eca608c7a0b04e2a9ba8150ba9f195ef971fea8ddc5f61b930a4305c39c9729d6f
-
Filesize
5.2MB
MD50f742514f88bc9a41d3e5925610f35b6
SHA133118ec4048103d7e0389041eaf5df9554bd6189
SHA256745b73fb0bace02a8de3a8d9df782323dcae0c7af3f3b67e71e8a1f80171c71d
SHA512bf6bc9755a5c0ee86617acbe4289c196ca0c1c7f3e07ec0a10167e16da21bde992274c4b0dd59388d4fd6e859bba915ed3a33e3b9e043418057b51ef018f8cd2
-
Filesize
5.2MB
MD5f64f28f6f65fc9d2883c7054c5fe7e9b
SHA11c3f56b8dc292696eb4b13bca6d90d76c226c769
SHA256cca0860e6487ce87a0ffe79c57957488e437257f126de49e70564cd32932feb0
SHA512dc65a83b38dc171552b162080ce358bf0bff04093336329937a90688ce379192ba7d0ab11325d7ac0448894f7e07b5afd6cae2a4525924d0c52e11e8e5a2b795
-
Filesize
5.2MB
MD5aca3f3bb6278b6841392f412886ad9ff
SHA1f8c481c54167ff296f55810b0f8f35651c0a8c69
SHA25647d9ed8984051de7335ef15a746f33878e3beb473fb07a7d87e3b253d79d0940
SHA5122267551dabdfdf981aa46fca13f07dfa06b995b1ae447edf10fc41e07ab79f8baf6bc2a9f99710d3bce644056ab9ef6976d7b6fab78db26c761fff8f1849cba2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB