Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23/09/2024, 00:58
General
-
Target
2024-09-23_c2995e5e00acd026c8e39af1770d7f58_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
c2995e5e00acd026c8e39af1770d7f58
-
SHA1
fd6ca1fb6430050ab7a5184aceb8bd5d3a680d94
-
SHA256
e26942aee186587a1aeed9257a91dc8f5d3f7a6f908cc8008794661d426bc889
-
SHA512
edf80d1bb95ff36e90aee4dee0cb9ec96e7d1dd4cb45e679b551e9680faa56838a8f965287e6e4bf6bb797692e6f3787a359054972dbf7394e77a28dabe28e9f
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibf56utgpPFotBER/mQ32lUX
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_c2995e5e00acd026c8e39af1770d7f58_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_c2995e5e00acd026c8e39af1770d7f58_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\eCdFQoB.exeC:\Windows\System\eCdFQoB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HgshhmF.exeC:\Windows\System\HgshhmF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tloGanM.exeC:\Windows\System\tloGanM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AobpxAE.exeC:\Windows\System\AobpxAE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hGcXiUc.exeC:\Windows\System\hGcXiUc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZGfblei.exeC:\Windows\System\ZGfblei.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZqMFulk.exeC:\Windows\System\ZqMFulk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tfMytSE.exeC:\Windows\System\tfMytSE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OjoArmc.exeC:\Windows\System\OjoArmc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UvBtrTr.exeC:\Windows\System\UvBtrTr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yUVkgIG.exeC:\Windows\System\yUVkgIG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ujnrUJl.exeC:\Windows\System\ujnrUJl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CVEgMBY.exeC:\Windows\System\CVEgMBY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nMkWbWt.exeC:\Windows\System\nMkWbWt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lbQytQV.exeC:\Windows\System\lbQytQV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NmDLvSo.exeC:\Windows\System\NmDLvSo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\flOjtkt.exeC:\Windows\System\flOjtkt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FmDqZjP.exeC:\Windows\System\FmDqZjP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wDJoAwP.exeC:\Windows\System\wDJoAwP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iEqtRVO.exeC:\Windows\System\iEqtRVO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LvbdkJW.exeC:\Windows\System\LvbdkJW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56aa1655e49ee6b6fa358ffa577b850f7
SHA1de77d92f78e940458982420f9efbea8d1f886ec4
SHA25640a36d891b8d4c974a047c4fa9d7dd8281821af0d8f02bcac4d6b049b9a99365
SHA5123b8d922179bde4fd6f95efb6c39e2c6f1b847796c0999fd3898ce7ac6f27816fd5fdbd942841a888f43c71c1ecb11518c2ebc8624b6880c1bc343517c78ff734
-
Filesize
5.2MB
MD5da9c1e17fa90641309a1f7dc43e058bd
SHA19d37ab8a369ff806e0432a3ebc5218cbfa089270
SHA256cac6c477df350ff1993460c25804fb21c25836c3941ae48be5056061a2f928c7
SHA512a3a07724f7519a6c892127b3c56deb53df187d08b646165fe635906a3f8ad20c5b494244417eb99d4c73521f34ae6b902ba00111be656217fe6dbf1172109c62
-
Filesize
5.2MB
MD5346d31b6d4e45f4c02ffb564d1219822
SHA14db1940cff7482c7b568b5a061d478b2ca83715a
SHA2565ab96dea9d4e22c01ac58ddb8283d80c137b53ce0fe4b52e2bbc57f19613eca2
SHA512918404d132ff8c0db54011db5939197d51888dfec61e1c1ecf6a4fcca24d32749619f5b335d90b4585874558629aa3ca565e4182717e959876244f89d9466f29
-
Filesize
5.2MB
MD58763ab9641d3632014cf1114fe85dd05
SHA1ee36b7aa60fd7439cc9821153c3e89d4a2bd300a
SHA256facb2ba5efa722535ded46779c390d99a767f3045aecc5343f125c4570b0764f
SHA512b82dc1b5c535bfc058dd95f9be1d887cf8ac9c78cf983816e85987a1e98a49a34ed262ffbf22e07b5931d3578dd652e1651a911d990bfceb1b13c11f48f53c63
-
Filesize
5.2MB
MD5342b29a6cba25cd895ebc4b5355446ab
SHA17effe6e633223991642bd8ad66163d042d1ca573
SHA25658371f01dd0e1fd2eeb72c3a8927dedb396f839271a889087496d5f756ebaa82
SHA512c845c1db433e97580388eeb8a3de705c25f30105cc9239d4040761bc086ee99518f1ce616534f1178f27c4d0cb0468a3a5b1c2a94a00bb2b5c57820557c268f5
-
Filesize
5.2MB
MD5417073f421b0c39167830f3be50f3a62
SHA1e7d5367a377fc412548a60973357ec8eec80993f
SHA25656f154f6e8d08f65c71ae17a0dcbbb79345516ff40544b84e0e488be3c7bb395
SHA512cc19dc8a4afb301059f7d06134f0b9dbc82648b165eb2ecc20819bf093cdaf330078fa027146853c2aec07257fab7755d35ec65cda3bd52061bbdf6a1c4e89a2
-
Filesize
5.2MB
MD5bd9726c17f3f038171b2b7d255ff595b
SHA15517fc87b44b88a245f80df80c5b728b22fd8574
SHA256128c4545c6d481ec9d2ee1fd2737bb4659ad0efed527ee6b151ba9ae20a71cbe
SHA51237d6f8f6918928081bb6213f61cfbec3bd246b6ed58298e6301147d5cb7f4079e5181118732cd3bd36e3bf68298f2e59163ce540212e74cc52d408d69188d516
-
Filesize
5.2MB
MD5f2adc61a7527ea3da350b195e3ae509a
SHA18570c8144e2d959898c55d0c86f79c7a92b63cb0
SHA25610961578bfd5a1a24c6d2eccc5b112d6abb7f553d9fb869d56cd73c489e90241
SHA51249f3cb00e46a778c2941e774e8da48b4a4073c8be1cbf0386f9d937d753482390e7d6e88767a07af40677a5a04281056388796c5c44c9d83c442ef60564a9529
-
Filesize
5.2MB
MD579fdda3d56967c9c64ddf6647fe9a981
SHA1ec3d05ec5affd6cc4102ca1aee354d6601b998f5
SHA256c29b2706d4c95bfa7cbcf8123faefa95bbf87d21a58c01fa08f270a78d1e67d8
SHA51211b7e070af566d63e4127f113a92deb058ca62683bc475d6eeb25a02936a686943b94a0bd9d07487ff42b7296edadeb46133eef9ca5e40da2bf3434cd74a0167
-
Filesize
5.2MB
MD5683697cbb7014a24e745d4958d064326
SHA1d2176625c51ea632509885edff6e44e1363f657c
SHA256046c7f908183e92bde100847387d9a20678a347b94110903e78ee9d965276866
SHA51289a2c88a093a573a584cb3df78e2e5b071ae46250bcb2a8e390f646e210d23522270a2b6952fc40e3097a2483525a0ecea02000ad36b14c9c56320e9a55b2e84
-
Filesize
5.2MB
MD57d6a3723e74141ce6d0e807ac0efd71b
SHA13da5e65e89f6a2f2caccfa4efaae0988171a877b
SHA2566ea7f5bf6d63d294cd26a0d2e227ccfdbcd5174eda3f7b6f00d7cd9722666457
SHA512183c2658cc028d803e347724474188c6d573c455470637c50161d5de7950a325487b25c94c76b9da3d2370016597a884acc6b44a3e971a3753063c6ff778a6ef
-
Filesize
5.2MB
MD5f918ca8d7836ea7f00399acdee7e6bda
SHA1fd590323b87943badac6f707c29bf0352bc3486a
SHA256d884eb91597c2c2623e0a0e8903210b6e7cd600d12b2270a466dad58eddeff25
SHA512ef0581d33fe6a0ce4c62b978491c151a4af61403a9cb619588f3270a7d06167baa782208f5d91e68020934b7c329702b23e7db8cd240516a65ecddb6eea5c8ef
-
Filesize
5.2MB
MD5031a398a683e5a740abfa164e30e066d
SHA1b86d5dd966eec80ce277df0e40e6a3fa719fab80
SHA25633ebff30b034b51cc42b93ffaca3c3b62b14c2da8b34177803923f26c99ee8b5
SHA512080d6a36b1e7094391b66c92319e2b86239ada3ade2149d4f00cc28416553f9e39702257664ed5f4ad5628ec0cd57afc2f740b6e1466e13b8bc9c4fd2bf0ea85
-
Filesize
5.2MB
MD55867454115ffa2b059df89f362c05d0c
SHA1354daeba1e4d8c193060da0d0d8d0ee4a040cd1a
SHA256baf9f7174495240684178452a31e336a950c929c3d2db017a48a747fa0aad63a
SHA5120661feeb703ac44afa90f4ea9d6337fe68f5a477044ea97d95df831272854a9454081cefdf43e63c290b931e97437666dc578cb8a2ade205ecf82c5cc5397fa6
-
Filesize
5.2MB
MD585ab22fb5ae1d423fdc3e3d40c592f8c
SHA15b7dcd2e1c001bca3de69ccba13c9c8261f4544d
SHA256af7fcdb0fd8a1626d76793780759510540979319499bfbb9c064881dcd20868b
SHA512c76309a26ec322fb2293f95c8ee993fd2633dece0b66c468d205ffdd0c32b04939ac7c87aca13793ec2057f5a84edb9b0541ba9ead78633e4dedabcae05395d5
-
Filesize
5.2MB
MD546985f042ecc02f43f6049fbb4ed89f7
SHA1b49e20f8e1e0dd8c6b7e5cc9db91c9dad56d3287
SHA256d015d8d855eeec3ab28d46694a65b77305fddf890e98169ac79b8c979761d83a
SHA512883de4cab062d4a44ca7c049e664ed874af63b963565ec7d452e862257eb98f226ca32ce57a9414068a47c231c63999acc9407abfe6cdf79d107f8f2e6464f02
-
Filesize
5.2MB
MD52e6f20353e34c7e83a7c2da769dd3e2b
SHA1bd14841046d7c6eafdf2553300a69b698c971e38
SHA2569b88757208d98622cd3476b639b959616c5ae1d6426f5b06c058fa6c681ddb2f
SHA512cf2e70e36b031fa96e55c6b00a9ad0679274af34a7c851a00bfd51eb206f1a4bab3a45ec027bf13cb87747bd330b93e1e1f1d647b2b9a3e0aacd178c0cc2399e
-
Filesize
5.2MB
MD521cf1fd8219574bbb4a9e6f460ce49e5
SHA16a523f0b7a5726ef0e371b0d90204a69a6156119
SHA256c4de87a1984fb651840c3b7c9baeb47358cae259f438e5a9f15d944f52570750
SHA5123c4096cf84323eaf4ec6f409d905e8061e2fbb8eb6da559d30b405e84b217c262958f8f700a62b5448b4eae45f37632b1007dc4d5cab0b7a325a1e6e57719fdd
-
Filesize
5.2MB
MD5aa06c3e3926b95ce44e656fcd4784040
SHA10a6aa2efcb0d7057fc7a6e9c83f7eae1f57f5bc6
SHA25692c99e9684f0110264300dffb3f9f0b626a913b67549ca6c5d33040374ae8a2d
SHA5129428bb52c419c8f3a8b89fe3326db6cc5a67d0d1f361397f0dda4a05ba21abdf8c0621ed5a39cd7a07dbba595245557b36c0d7d37d53ddac9e96c6074f04b12b
-
Filesize
5.2MB
MD51e63db439544cf60f7c8ab58e1111422
SHA126654a180cfd3acb103a20819bc77dcc48c67811
SHA256fef56d7adcd95487b37a9a5227646e458dd5555e04b1bb9984790c463a55d3f4
SHA5128798c9130494950a4e0b3cba803e0e368267b9c2402262527cd201987bfe1c9c1fadbc22d5a8ca90d3acd578119b22e3952e504c8a0a272b0575248a63ed6a46
-
Filesize
5.2MB
MD5129047bdffe9736f6570b3cf5ac50e12
SHA10971092cb249081efa6c3409d48a1d22bd5c66cb
SHA256bee5258553652ef3917ee829458fda663924332e28483c38eebba6b8c1cad4cb
SHA5127be34bfcbd5594a2e7b78c635ebb498d319e7d29b183fca6eb6456047791c31f76e7a8348b18dffb5b2331c0ff8ffb8cfb66b050b469b0d53fdd94d65d000131
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB