Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23/09/2024, 06:26
General
-
Target
2024-09-23_1e6406c39856aa567eac977d4c14e5af_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1e6406c39856aa567eac977d4c14e5af
-
SHA1
018527d327b551d95d2674c93ac75c736a827704
-
SHA256
4bfdc7ca6319b800421e2c402fc0df58280ba90a39282ba49cf2566cf4266d98
-
SHA512
11febe9160202a9ecab107bee1cf1e6751a4fb14e39580c312d2b410101a7979b9bcb1a46f05908b51e3ab44aa088b37419013750f128aad4d320c7352652347
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lS:RWWBibf56utgpPFotBER/mQ32lU2
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_1e6406c39856aa567eac977d4c14e5af_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_1e6406c39856aa567eac977d4c14e5af_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PKVVlSi.exeC:\Windows\System\PKVVlSi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DfshCWz.exeC:\Windows\System\DfshCWz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jPrqGvj.exeC:\Windows\System\jPrqGvj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\igFpRtb.exeC:\Windows\System\igFpRtb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GxmXiGA.exeC:\Windows\System\GxmXiGA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kxLpjGY.exeC:\Windows\System\kxLpjGY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Jxmhryn.exeC:\Windows\System\Jxmhryn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YkKpVao.exeC:\Windows\System\YkKpVao.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yKWPPXK.exeC:\Windows\System\yKWPPXK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nibThQQ.exeC:\Windows\System\nibThQQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nIqPqyo.exeC:\Windows\System\nIqPqyo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nGwCDFh.exeC:\Windows\System\nGwCDFh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NRIbTga.exeC:\Windows\System\NRIbTga.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HNXGryQ.exeC:\Windows\System\HNXGryQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AwpwKfs.exeC:\Windows\System\AwpwKfs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VSwAtTg.exeC:\Windows\System\VSwAtTg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XdVpvDg.exeC:\Windows\System\XdVpvDg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NFFJSAm.exeC:\Windows\System\NFFJSAm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JjrqLMD.exeC:\Windows\System\JjrqLMD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GZJSvNd.exeC:\Windows\System\GZJSvNd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GEWjoWv.exeC:\Windows\System\GEWjoWv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c4cab281bd6e76b88518f7eeb1b051ee
SHA14d9869034013f4784f834b401907dceaba7b88a5
SHA25650b388b77d2b06bef38d43adc4fced319f67ba5c4a2d5289ad5fd4ac8e560705
SHA51228bf5a059aeba5b794535bca592da56570c1a02c301a4f469f46e6308e528c98c1afaf414e3f9bba33ed8dfb1fb2206b900a3b361da0e41413762bfdd09b8495
-
Filesize
5.2MB
MD525e2f7f8c486a530e6df6b8905b5be98
SHA135fbd03ce7489605331aed52c6c874bc2983ea75
SHA25662a6ee533a45e1ee8a8a90cc01c825d9710e09b25f65fd68af07533548d5e159
SHA512df04a42021569a0b819bb1fd28c47535ca4bb9e6b04d0fb6afb3ceef46ed2970e08fac9fb69779da8d6753650af003e2d144d9a471c40c2977af110749834700
-
Filesize
5.2MB
MD53712b11b5575de95015f3a455734cc5a
SHA16f603fe02e1e07ed739f61fc18d3f89d95110d25
SHA256b230f0c87c9f40a12689ebdf7b26b50793e61163c43fb027c33433146baaca46
SHA5124ba1a4d12e85d599fab80f1c4ad30b4db5bed92426cb277ce74e46ab0405467161b759a297fd6dfa43e00a99cd91953925deb56e74f6c4937d616da94f17b75d
-
Filesize
5.2MB
MD50df2acc66610c8c60e4834b0919d2f47
SHA1c105037cc10fc3919eea3f09ab415e646738035c
SHA2567634dfad966d0ddecba2631641bde0b35bfbfbb2c2b1ca7f280bdf6eb38eb5b4
SHA51203f4e83a28ecd28cbe863daeea0519c333b9e1a20f3842efdc74bb045102c152fc012ce2b03fbcc4d34faecfa2c43f5bc954c298362321dfcca06dc81c372071
-
Filesize
5.2MB
MD52bb1230a160749e3086354604c1885a1
SHA102050d0e42df48b5aa7f9fbe0a849aaf6a02881d
SHA2563c9d1bba02990923749838a6c7cb2620b8ef8d1a5424fff435b467289ab6c5c6
SHA512e0a32447df15f4fd9ff8398180896e38dcbd95446a95bd9f1267475eeceefd5ee1c3ae78b00371a1297e1688629891c3c0a8625ff325e84065a96e774f51ecf8
-
Filesize
5.2MB
MD55f5bd3f3a5754742226b809780e77716
SHA17ca09a66633b73913a7d93dd93242b14b1218f28
SHA2566555236547fe699238f9687733762076a5ac2f85ba05da1219e66174e53879e8
SHA51234b69e94987b8584e113fa29a1df9df9bdfa2a6c5674fc4a47f88540f0f86ce89b689be5817402b1a868f89300023e54aa9eaaa161b13110f7d075507e3eec07
-
Filesize
5.2MB
MD5dd71ee0e2fd751ba72ae58648d7a9b75
SHA1f332996c09ea4defe74ed7edae53e82abb44756c
SHA2569a1daf5eb3980257e190a9cdc23bb2336a461ead66f50750a5bf6c3869e8f6f9
SHA512ce738b6711bf212b9563d8d50f60a3ba293363bfb7bb439ef4ea9b28127506a653b1ca72609b99c25166780b4fd9031454a4183660eecf6e56fa013e0fba54d6
-
Filesize
5.2MB
MD5ab71fcf28b63ff8471e3b9c99adae2e3
SHA1a75d1dc8cf8a8d5a5d92e9db2c2fc99e28baf291
SHA2561cd2bf60d4af9d9c4284634cf923f84abf03398a3baa5f577917c7beef8f17f6
SHA51267fb30c2e967572e9fd39cac9d57fb2014b9b86d33df7034629507db59e846f016898fb103592d1d49f947be3e1c67bf9cf8f4b2e0311f75df4feb5320f87be8
-
Filesize
5.2MB
MD510cabed676c7e406636635bd7b350009
SHA1d1a8942bcf1e38056ecb935a11befe3f244deff9
SHA256ae0ffdaf90cdc387de40f93684441f0024785e7efe17e4a7057b505a71811dab
SHA5129e7846fb4786b61ef395dce6152be4a9b5a46ddaa851eeea7a16781c1e555207aeb2bf8f86a6be9d543992e636577ce22864bf89c465cf6b0e7278394fdbed88
-
Filesize
5.2MB
MD54dfb2e2d5db175e4d1a2b7576a65acc1
SHA1f5039881226de5dbd7661c692c5fc043e28743a7
SHA2568518255f9416bd897c3255cdaaea6b4f6d670c62239a68819fa092f07c44a75d
SHA512f30c6bc981f445cbb0d30c83babc57cf95886626cfa8b0bbef395273a5948c626093699ab4eb9467b93d35e68873a66eb63d6705f1b4b511f65d49a2aac74be5
-
Filesize
5.2MB
MD53b7dad4e36e5bd22a8f08a102d10c819
SHA10cfaba8e5ec6943253b24eed64e1314195ad73c6
SHA256af2a3d69fdb7751afb4d38930bdf654304ddcc6e006bd73b5cb9d702deee7156
SHA51240e67dfab228061eb60dd6489e095d8355ee6a9985606b1ea3610c50b6e38d76e0d0cf444ce3c7a0847065c5b0c8c9c18ecac3a71f8427e12ebb37b25b4ffaca
-
Filesize
5.2MB
MD5cc01db1e80579d5eb0604b0ee7aee3a9
SHA10e164a5fb7eff1f5fa620f4ea0d336632024e156
SHA2567734305e07057b7a928ae55054f030ea1d46a72b7556bd93a696d0c4f083d8a0
SHA512ee9b700608b17f9641f49df37d8d4724e76d8b6f6fe9df3ce73f1c4cd4d8169e031aba6624a72428a7c720c73e253ae04cb0b17441d75c1c86b2d449f088ba86
-
Filesize
5.2MB
MD5157d7c422ec5691f75f410055a36e9aa
SHA1de943c4e3582daf91307cac7ceab489a7286e0fe
SHA256cc83da45e775dc542c1e10657dfa6c85bff7cd1184d0e72bf02672f113c9e564
SHA512f66fe03d00d94f7250e4de2cc65aceb60f1cdbd357d4aee570edb4d0957ddb901dfb7c89549c44d5fce23fe51d1bbe360b7a74e8538f5f6cf9ce596de187a42a
-
Filesize
5.2MB
MD537bbf9d134b0feb806418812e90dc7c9
SHA1c8c97c0888675ad3300ea1a572b2da8cf3c245c6
SHA256751178483dae998b9f4674253fa79b930db2514b77fda3458044075f0be2b0f2
SHA512d5fe108e77db383ceeccfb3f9b75715da1f633a1e866ca96615e6a4f8e09cc3b03c2885f44150a000513740b2df58700106c614dd3f566a2eafa1085fab9eb6c
-
Filesize
5.2MB
MD5b077de062790a6e4c7856c2394675680
SHA191cfad9f3ead7f3929e4e47cee50b37fef911d74
SHA256412e2b40613a5e82c248eaba002e3861b53479441b2f66f96638ed944ac18145
SHA512773b86005adab18cea4947806526c7a77fd34a2b0f141bc2f62b194947c8d3c6238df3310f5fa1805da366b71f8c4ed034e30ad2e6e6772d9e2366ccfcfb0ee8
-
Filesize
5.2MB
MD5fdf06c26af022a13a96a0552df0c3ec0
SHA19cc33b07ba3328b12c87a34797d3adb4f75a97bf
SHA256bab722bb887552eab5e89dae9692cf5968af06427c7c5b3199a51532d685ce09
SHA512ccf943f1a323091e99bb93baf9396a099d6b935911e99e057d3df30d72593e2e8eed68853990c05e0bfdc731db1e1b8028453c1cc7619b10b1036b6ebfcc1d35
-
Filesize
5.2MB
MD564167650b94c39f4b21399a79fb29d81
SHA163f6715c80887e2427ee0b804c13a29d95f1f719
SHA256b248ebcdbaac1088608dd7e8a73e191f5cc7fd3c23c508f7e7e2b1854ce809d1
SHA512612264a10bc88dbd02f83d383e640fa82f6c2b8bccca4b29481d23361f12e919f25fec158283adb3ccaee5a0da1a1cbeb07cf087298b3568473338294bc7ca6d
-
Filesize
5.2MB
MD57d7ee78c8d347e81aa4feab30437c0f7
SHA1b6f0e4b29b61ba114c7519e3c7a9f1813f441f36
SHA2569d8c6a69101dfc3a1ae279b9df260712c8ca496bc9b0502018eeae933a805d6c
SHA512850e9e9d238670dececaa2855c3402a0cfca182453a48fa5a0630d7e0badebc538ee3216ffb0dc819c4ba3478a41e99204e901d9a68f40dbacee2697d9a4e3e4
-
Filesize
5.2MB
MD5524d913a68b668b5745dbd583130043a
SHA15a83aabdf7dfdd9532f5045356084ec76bbdff32
SHA25634666ac091343df779b2068a09db17dfb3ae768fa658a60a9cd778a016f3bcee
SHA51209316f14124e1c921f651c0c915a69f0a3ced12b15b3cc95464b00be536d14e2ac6d3915ee92dce6c68cb37d7bd75cf54a4249118a968da219ee9b12a973c992
-
Filesize
5.2MB
MD58ea55e13e98b74f304d47f1021e8a29e
SHA147307e7f86858a281912bdba0add7dbab93a3856
SHA2566f2356fc8147c0040faa30d442605c0558c72f7170ca8568e47b96b60b5c9862
SHA512bec1e5a581007a1e40c7f5cfc4e5cdbb298a9593cdc81fd9073bfaa45c4838b4905eab620403d7ce9e8dcd89fa4bbd25b2c72e47b701a644b97dedfba6db1d16
-
Filesize
5.2MB
MD534a18e9a5c7acebe77dc35da1b002f9d
SHA13dc24fd9e5a671daad588ae8ba2461c48ffceb6d
SHA2561ada8de387a4b856a0b5bda3757df889eb8c210623173eb147572aafbfc18d34
SHA512e27b537380155e6caef86460b9df071a8f0e9cbdfcdf9c0905b0074a17171ce6a1af5a886a533207a05a1dbf8471d9f1b6f9037dadbb28bd45946ffb4230ffcc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB