Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25/09/2024, 15:45
General
-
Target
2024-09-25_3efa1d5f2b80db6cc8cd441f2a79ceaa_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
3efa1d5f2b80db6cc8cd441f2a79ceaa
-
SHA1
5ca7ae4126f461989651a8ca4aecb7b0c79a19d9
-
SHA256
8c57a86c036d6fa9437a5de41735da9503ec2e89562a2c4e632aee27e9d762a6
-
SHA512
9cd9a96d57821f6c64e7b6511ff2a98e328d9b03efb22b3fb9e58196461c654e1327048e25e4885a25bdeee7a83e660f680d42c1a4035cddd8afd5570200efe0
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:T+856utgpPF8u/7n
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_3efa1d5f2b80db6cc8cd441f2a79ceaa_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_3efa1d5f2b80db6cc8cd441f2a79ceaa_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yyRXunH.exeC:\Windows\System\yyRXunH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kTrqaJJ.exeC:\Windows\System\kTrqaJJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JqYcsnn.exeC:\Windows\System\JqYcsnn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kDnEBdJ.exeC:\Windows\System\kDnEBdJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OmcyWAm.exeC:\Windows\System\OmcyWAm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zAMyxiD.exeC:\Windows\System\zAMyxiD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mYadQid.exeC:\Windows\System\mYadQid.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PFMQDIr.exeC:\Windows\System\PFMQDIr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rkURuaA.exeC:\Windows\System\rkURuaA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rqlWRAG.exeC:\Windows\System\rqlWRAG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fxAqNRe.exeC:\Windows\System\fxAqNRe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VOAEIVK.exeC:\Windows\System\VOAEIVK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dAfVQns.exeC:\Windows\System\dAfVQns.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pnTvfNX.exeC:\Windows\System\pnTvfNX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KCFoVhI.exeC:\Windows\System\KCFoVhI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrfCBon.exeC:\Windows\System\mrfCBon.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TWdBnPx.exeC:\Windows\System\TWdBnPx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pHDxfTU.exeC:\Windows\System\pHDxfTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\akynrBM.exeC:\Windows\System\akynrBM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sxbEyLU.exeC:\Windows\System\sxbEyLU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AbMsgcN.exeC:\Windows\System\AbMsgcN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5af40fea98ad121731cfe091987325bef
SHA1ef049e07c25abee41fac14b4b2671b27b6dda295
SHA2563d96eb5faddfcd723795fd5bb631641ce61ae55d17dc4b3fada45dd2f085bdbf
SHA51271fb70382e2d3fa7c646091a6b32fd03c7ce053afe4dd302a39631c735adbb4c03fa52e5ec90394ae37ac38f9a3ffe1ca687fb1472c9386f2204dbf73d8ece3f
-
Filesize
5.9MB
MD563ef527cf381e5dd25458c2dcecb8be7
SHA1880fea47f43b2fe78247477e08be283205b01167
SHA25674ba4789551fe06257062d50f74c68bb66a96fa9035aa290200ef8129f4dbdf0
SHA512e9f89b58c5d3e8a46c1bc9480affa21923db68b2fe9e839bb548cb71f1f7865ebf88da81b0283241126ac5056b4bc5a65cbd3f499e245c4f10a8b16cb7f1ffd8
-
Filesize
5.9MB
MD560cabc3827ba8037d05b45c309a1f310
SHA13ac1ac2340cec4e9cb39c42ba7b31be257673f2c
SHA2567a2ade2debf0ce5ad389e65c3297687f54d95b8a252ed56cc03ec1f6232f7507
SHA51277d550429d4cc2557fca3897cc0d52988964b13180eaf131593f9615cfe6b4208e4e246f96f2ef33a6bd6c2e5fcec00d890d4610ba22488e8e7036cb4aad4dae
-
Filesize
5.9MB
MD5631010159721a3d01fe75d9015092d98
SHA1046ffd20343b95dffc69176af822f7fd925a378a
SHA2568bd32d374cdb162e067f0d15e7ceaf8f814cbcf8678c5424fde8d9064531745b
SHA512ddd3f6255ea0116017a71d593de754d538d09bae26559a6c9801698112919abe3565e1abffba36706bd80e1625bfabd836bc865944ba3f650f2da155b2b3f83e
-
Filesize
5.9MB
MD564c7d1dfafc41d4a848ba9b7777317b6
SHA1a460b7380e4dc2df2b7b15708f3f04725f4cf14c
SHA256ea637e8e6835ba5af351713b3b4e41235682c3f09ea56d1febd62043aba495b8
SHA5124c81fcabb493a2197b2a0c4bc517a08f242c1db4c5b59226bcd3fbbd42447490bfe17cb3559f37eca85656de162e45393557ed7fcd2b285d1aeb64b6267a3c1c
-
Filesize
5.9MB
MD5b46bc445541f9622ae174c2aca37fba8
SHA1811cef70e41fecfa54ac7cf99f3b92094d213cc7
SHA256f5f768e0f65ba63bfd2a1a4a27344b471fd61509d896e56d3a9f7c368d811dc3
SHA512a52a598dfa1a7d454c4d356a0290ec2fd12824de335c463cbe6fb3b9ba5064bcc1f9a7c79dc49e29db1e55da5dfa3c1e6fe9146f730fcc1b87fb254ee0402942
-
Filesize
5.9MB
MD56e136d4e7aec91a774412d73065e6207
SHA1aca586a3bbcc281af239f3c14eda493e67bc7b86
SHA2567926b6b14d5d16e898652779584538a1bbc0f8ff5682bce5f824f136ed961604
SHA512ac0038c271c1ea7bfc9f32e32a972d2519786ad3418a337033094f134620607df05690c033042acb711dda61dd8a0a2795a97b428b51fa7b974195948cb09a61
-
Filesize
5.9MB
MD5a00f880c1de980eba38817fc4f93b181
SHA1d3a2bdbeb2e5002a9ef5c9be9df12666ce5b552f
SHA2566ac84e4adaac1a329591ab0d90c3427d3c17cfa0fd8aa78997f4eb913e1c181e
SHA512f9282b19b9942fbcfee05e66d75d76650da3387d448e44234890036907874185486fa0f3daf29382e3df98191ebdcae3cfc192c2bc820e200956e8a2b0fe7cde
-
Filesize
5.9MB
MD5c65866e758da93202ffe0a674c28a6b9
SHA194c12e126ca34ddca43b09face9282ace7f4ebf7
SHA25630bf30de57e0e79c1e89223aaf2653d8fcfde387e9f50d7c2843d371539a0ddd
SHA512b534a33459c5e295c64e402783edb0b816aefc1bb605a6f49689e9037f0b38c82dede2e971353cba8af33f24a84eb26e44b3d9ea43640419568bab4484de339c
-
Filesize
5.9MB
MD52442b0779b3733d275b68a4ca069207c
SHA12384ff177207be742cbb6ddf2be22ad193d02049
SHA25660c854e94b468f9e093afc1e13944e2829b4e725ea0afa843cbb453bba53b27c
SHA51257ead8e355669b9c2311458eac5d470fe5c28d6d49d5232678d5972b69794eac261eec3869ea631101c720ce9db8ec4d0885c93281cbc99c6e101f11982da629
-
Filesize
5.9MB
MD54f0a6dd8465b00d26045da6287d21561
SHA10bceb68182fdaebe7155239d70c4272192496186
SHA2561dd9156914f353d70cdc52b8770f2e9b126830f74fa33daf4e1f3518974844f4
SHA51275fcea9721a62a6e45caeb7cfac75c4fd1ef19b0e0a3f515d7127d36c5af75dd8b71d6f0f495c57bca2e638f8f67d50749f8870b1fb43e203f49fc5d9288d60d
-
Filesize
5.9MB
MD595841fccdc5ba67370c5bad86392640a
SHA1710f0f262050429c170db9cfd52b604f1c35fc2d
SHA2563734a053974ffff253c76b2018d8794aa863f33b8d5703302dc4a019b7b18c65
SHA512161c7f2b6a9ec89c5f4b57bf5c045398dcf1357a925964e2d9f619516a67dce6cbc0de973b9213a0de306fd2d9d2cc4fb6087442c8e3ece104660a9a6f05d3b1
-
Filesize
5.9MB
MD5d704b6f08d813c0c48914ad806ce5fc9
SHA118a52c39e6257ed13a8089e1ded2cfac9307de43
SHA2565b159cea00fa374160f5a39b92b840c48215b9a911283fc6f7960726272dcc54
SHA512e7cfb8fdc8af687d523a4f75dd456698369c114942b35469062c57d9d7a0778b26f3b7fdbadcfa9234d86339db22a9b6241edf3296dadd8a6d8f9035e3f253d7
-
Filesize
5.9MB
MD5d18d4f413767f9dd4f78dc24f2571867
SHA1d4ec2295dcba61329076be8623a582a7bacfc42b
SHA2560542e5d1e9add55b562c7a2fc5dba749f2a2fbe59657fb0cd7f5475bc76038b0
SHA512460be2665ebcb5ce80476794ff03a65e9d0b40c3feae90dc03daf8dd1aa505338253a1dcf8f48a2aed492066ee026c7c052973b0aac6a8ab536284f6c52b213b
-
Filesize
5.9MB
MD5985fc0f864a4ce1c7531e5495d2cffcb
SHA16df14b6cb6b16357a09f354ff6063a134bd5aa1d
SHA256d89e23a8278ff79d382899b2c2038bbc1fc7780305de1c6824dfc2ab2b95d1f7
SHA512adb5e2526b1fb12e9009fed25b93dc49ad98c4baaa6460ddedd4d9e8a76ace2138b32d1349351f1b5239896a3d95a3256d2c7984774d090bc90393a654a158f8
-
Filesize
5.9MB
MD54ab339b68d5fffe555b680709781dc3e
SHA1a10c579ecf6863f554c3ae40ec181009d4f8dcf0
SHA256cec62413d8de1b466c05e8fc0258d57712dcb66b149dbcdfc5ec15bc9299f9b9
SHA512f1f4173c99ab48af58d3ae3d86f8fb32d95d254cec08b00ea4da1336bf74891f00bafefff2624419ad1cf07c18c733a8ce7e6326864bc481f8e17271dc39d513
-
Filesize
5.9MB
MD5b54cf87c14985d69a6edf451187fa04c
SHA12459f5b085d0d29b6055a5914cb5f0e254e286bd
SHA256dfb9d829ebb81798e698368e0e730b002f4ac113a26c946c05315633cd972411
SHA512a2309d69308e7f59528a99d28c89e3650d7cd9aaadc60d7f69a0bd57cba02723eb2f736c4af6e92d535b9e731e4180a733e61a780d15355096c629f644a158b6
-
Filesize
5.9MB
MD53d05b334665bb15797324be0edcb2c3c
SHA10feb1eab74e88e79b027632c2bf16b71a76d13ac
SHA25666afe3c7b520af9609537bcf5931aa818a06006c16bc0bf735716a8481a01a08
SHA5123f93599901da2393dc0f8d77a165aec3cc35b059638ad67befc7c7c8d7c9dc3191d487206fdf54f90bfea5c8faa8e8c952eb2784ce95498ae8e67eb7b6ef00d3
-
Filesize
5.9MB
MD5ac42d5c518ed8bcfcb56b1370a2e9579
SHA1e7be75397adec2ab631cf318121f02c05efbf14a
SHA25656cabd1de004afb3f680d7d6e8653b799ec901cfaf1e7260f188095fa6c0d32f
SHA5129c61b54d84990b7a7c97e5dcaf81200ad0d05ea63019aeb5b341f5a71b30dd471b4b2b5a4b5617f09cd83e8b90007fd65bd1e001282bb95903291be8727be6f4
-
Filesize
5.9MB
MD5c089d84aa1f8175d320022d224fb69fc
SHA13b5bedc869d5dd2a4d09b3cc23b6e4f5f7180ab5
SHA2564c0861ee78a31f99ce9aef033a989052038b6168d8bd73960f53d89c317e11b1
SHA512501469f66b440d17d836e6fa50a44f7b9dfe6e9ad22623721beea8ca67889f56f30d8e45ea6f7f625011b416ff7ecfde35a01bf237b6ba136419be2597dd0ac2
-
Filesize
5.9MB
MD53d0222ea72838ea17b7540e56e0d2ce5
SHA1d6a28fdd937d7a8b8c9b29252942123f7a0d7879
SHA256898118eb6a1ab98de1f7ac87f10b0c7ce2bbf4d069586be0292649088696514d
SHA5121c5c4c554adc1e13952afa30df643c8813e15b18e3af170f7414ef992e46e88db7f566b82df63b2b5e40f1dfcba00dbd998ced50ffbfa15fdd9f6fce239e2701
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB