Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25/09/2024, 15:47 UTC
General
-
Target
2024-09-25_7d603e6db7d8297083ccc274fd662491_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
7d603e6db7d8297083ccc274fd662491
-
SHA1
36852420bd323b0a5ae3501abea71bec36ec4d1f
-
SHA256
9272966959761c5bf196a7148e11a498d11c37900b35497ee9fa7cf823508424
-
SHA512
46692d39c05407b9a9f123ff68718a5fd09fa2c33a29e2c201ff63716c441a50c9e465f538ec52afc26a54fd56b3d109a4867c6955fbf7cdc5f3a63bc6b746e2
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:T+856utgpPF8u/7r
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 60 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_7d603e6db7d8297083ccc274fd662491_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_7d603e6db7d8297083ccc274fd662491_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cqAmTqz.exeC:\Windows\System\cqAmTqz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CbyDcRH.exeC:\Windows\System\CbyDcRH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aPSDMvA.exeC:\Windows\System\aPSDMvA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ozIOfiC.exeC:\Windows\System\ozIOfiC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zxyTuNM.exeC:\Windows\System\zxyTuNM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\euVVYTu.exeC:\Windows\System\euVVYTu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eGIsZxW.exeC:\Windows\System\eGIsZxW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eYgfcPu.exeC:\Windows\System\eYgfcPu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cVMkTqz.exeC:\Windows\System\cVMkTqz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gOChLZx.exeC:\Windows\System\gOChLZx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LEfrlgh.exeC:\Windows\System\LEfrlgh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zVTMiDD.exeC:\Windows\System\zVTMiDD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bpEgcvj.exeC:\Windows\System\bpEgcvj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BjSQdNc.exeC:\Windows\System\BjSQdNc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FJBWpmU.exeC:\Windows\System\FJBWpmU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vTiWiJk.exeC:\Windows\System\vTiWiJk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qJacLKo.exeC:\Windows\System\qJacLKo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\waCQjSP.exeC:\Windows\System\waCQjSP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QSgAQse.exeC:\Windows\System\QSgAQse.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mxmjYtP.exeC:\Windows\System\mxmjYtP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RGFxRVM.exeC:\Windows\System\RGFxRVM.exe2⤵
- Executes dropped EXE
-
Network
- No results found
-
3.120.209.58:8080 -
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5d4484d55b7b30c4f723118f2de71ded5
SHA14dfc9b6d96d61491f33c4cb8bb8768c7528a1216
SHA256e3c7a33b8721b36e3d3d368a76ff3b8c27b22496b5acdcfd3e17d9bd96428096
SHA5122f69afb1b453933242e5bcc017a5da7a1408af44c33cc32e671cbd289099953044f03fdad0ab812fba95ccd4a94c6f38abeb7b23acb303a0d89c730c4d7c784b
-
Filesize
5.9MB
MD5be0a5a5469c7e2c780748fbdd0d42b57
SHA14e11b2ca6eba29c6b146f4e865c1b3b1d4c9cce0
SHA256439fff095ad09a983598805acc1c36c715595df1aee99d1349be1007b345ad16
SHA512a5331fd085b2a723cc8613467f1b38ab04da0fd46bdabf06a95e0d0a436fb025d21e8c85885c40c7ee0f64a7159fcc24ff1f70187b564cb68bde1d53b628140c
-
Filesize
5.9MB
MD55d0cbb2bbb0e28c2b4255400b34390ff
SHA1703fcb86d7dbc4fd0cc26ec1291835220da95e4a
SHA2562e67c1dbbb5d4ce77ae1800e6f0a9d42d6ac5183681a5652fde19a53943f447d
SHA512ea3795881960267545583f6ad3aff2619601a99eb417f85f982edcfea1f85eeddd1b17a0559aa8e46a0e3f461c9701a0f8e46043714cb7b198c53958485d6201
-
Filesize
5.9MB
MD56162e2eb60ad31e45d5307f8c23c289e
SHA1821d968411dfb6b6d95b38af5c668dc3c1439464
SHA2562ff4870f6203f5b2e532873aa893bdf477d96239901ee6cf879b27d6bb16c80a
SHA5125d0a7fc771fea35fa32b6f775fcb849e9b36d2de144f6e5bb49d7bfd7ccf2bbdc14f84e5dbbb6ca7754e0413b5dfc5911b0fad644d5db5dfe109d2815f352aef
-
Filesize
5.9MB
MD5f3b879e580c494af7d559a6876c54c06
SHA14a54cbbc8a677f7d853999d9ecd4a19a558c8dd3
SHA256f926e43424c3d1b9aad4587079216653960eed9b82b35093090c8c2eefb5cfd5
SHA5128b737fb2627544dbf17dd220a2882cf7ff27bf4e86a119b665112855c16355d733ceb0fb0cd38396d7f37e98524c0aa39f3f3f38ea922cd76933ba125968e458
-
Filesize
5.9MB
MD5163b46c8a319e60d3cf21c0d5b76d216
SHA14666198fe53017b279e9581218a7f1cf0722623e
SHA256fc18c99e98303a16c398e8e53c6faabdc4b9e2b07c14cbce08072aea32e0dcc2
SHA5127fda0bc89ff03850b1445de976562ddcd37e3195b8615a6322a9b4164b8e12803547f9b9bcbbea902e4df328c868b9c0567506d3a5b3a8bf2035228762b18033
-
Filesize
5.9MB
MD599b5bda62466c1851c4884f5d5e2442d
SHA1c367a5fbf40184125eb91a23880b80fc902e52f8
SHA256b97148537703096775f59afaee89cf51b9c0b695d745468f4cad28d32778db9e
SHA512b2b19ac7ea74a405d4fd20f02a82a9e60ad8b71c26e13b04307141db806413e1aeb62ac0799c3e50c86e1d43e4c833a0c564d3b897e1aeb9229dfc69093f44ac
-
Filesize
5.9MB
MD514f374445bf9253334ce0dc6d77a564c
SHA1ab4fd64828fb1ff44189bbfe8f848d73186b7fe5
SHA2569a4981c8115d59100d940bea7886e9f2f94821d8d7bd339fa2120ea5b6988fff
SHA51274775ce65cbca59eed03c9ba37ec22b292a50c78fdc0d40db78a426bb6095caec19eab5fed1abbc270f1a5e3b078d28498e1fa9f0285382f92969aec7608a4f2
-
Filesize
5.9MB
MD52364ac8f6b04305d151407e63078ec51
SHA175b2514bab7e8cd372d1c7e8ed92fdb1c15656d5
SHA256da73cf95e51495a2930200bb165424ffdbf25a031e20cdc586c63379d7d16d98
SHA512449fba4d8fe1ab00735dde3f78bdccc510610a152972ac50d50431eeffbd1fe6f84824c713ce93b2902a75209e24eb181569a4ca741a9357e7e23ffc25a85d86
-
Filesize
5.9MB
MD5e2990df77937465af3541ab2871c32e6
SHA19cd4223fbf3d2ce92af424adca5f0501ececcfd3
SHA2566c3216c07d3487cbd85038a5a56c56a560226409e2558cf8d51672bddd707fa3
SHA512f0ce6f7cecb34c32f1c41ab15b22c3edce2800214e89b17765ef3428b04c4837cd0d7973831ce8a89b94920f837bfd51874fc07271545cc0bad668fffca3b735
-
Filesize
5.9MB
MD52c793e64d11d96dd04430e4fb0a41507
SHA1904629f926e9320f00e34a7b6f09f154c175fe87
SHA2567047b2971e13f54d04d05f8db616e65c500678aa9d7734ff403fe5da3a083dd0
SHA5122f10c5397064352d760c42758120f18459ee6fb6c670f23afba1fb2a22421f6919d09258dd68a1eec7d58dfd4a4aedea0f05810c825736e6aee283d93a0ce4a4
-
Filesize
5.9MB
MD599c1b547a3729120e8984758c720d748
SHA1bcb8b149e1a40ec22d0c702126dcd244e05f0b0c
SHA2563363e934e66829e4d7fcd2bcfde538361503c1294a3d42dd3172c849ce5e2d78
SHA512c0aac80428858d335f7838046dc86cf396128c1a658fa5e303ade2607e5b7e80b393076a016552998881f34693426aefed05e90f30e1bddf41223cafc4aebbbb
-
Filesize
5.9MB
MD569d072f879c79641d4b2c7cfc9799672
SHA12bbadf3c6a5d1bb84783d4b377ee2809803d0564
SHA2565e7f1e8fa4e41bb0b2fe2442b640a98e206c6503eb2cd7d8ce5df17699f37569
SHA512f8c6b5f53a2851600a2b16b7a584275be450512bbb1056d763632855245aa61640ee47c66766bbef893f8104ec774a1c3ff39aa9fa51453fdc2c34152f1b2934
-
Filesize
5.9MB
MD562b4c8e9db2dc2f5d2ada62d8a547d2e
SHA1200f8a64c2f7a77168f243a0ad6a99bc278d8afc
SHA256322421d345f29eb4378975954def40561e851d587fb92f392c844280cf434776
SHA512be3b6d7c25c746fb8a84215f0a14d4193fd6fb90f5fd1e2b8549f70a19e0450baaaaec43b2eba7496afad6af1f3c5c0ddd996f7f8f354fc2d2c622c90dcb9b0c
-
Filesize
5.9MB
MD5f8a4bfdc7eba8378c9779b3a7433db1e
SHA1b2d520bd977c9964b76d288be7ece21713a71e73
SHA256c7b20c6de98e7ad8c40e90386b1148ad391a71f5f144699bd84c1cf1bf47b5ed
SHA5123f5d601e8a7a3b846d1bfed15cd51bbb4eef640526f76af72f58fb58ea5ce672dbd57fe8444d54862bc01e46da7657e4154ec6142a98effad6cdb9e03194ec6b
-
Filesize
5.9MB
MD587e4c7cf40d1b96db08f6bb084eba543
SHA15b7012cfe13ab7f4a2463e19cae7ec2b76002f39
SHA256f8ae9d8bf434fd52b73167432ade95113e96fd6bcb66fb122d46c5594a02e0bd
SHA51211a96eae9965ef680c1566e91f0285b6fd0c28cdfde7dd6b4d67f5c5f8e6b9e179caeaba75e8be519b07d2d32f658fc07e1d7afe4929d1bda7fcd17a98b545c6
-
Filesize
5.9MB
MD5909f07de850df504f127b6ab520710c7
SHA107ab3de51cba09b62efd245ed549d0c1b7894eac
SHA256b1b282ed3a9590ddcd5ffd0a9d0c41a80e37450298a96bb1238ed41eb6909a47
SHA512f18a0eb237655b3d688f32b4794d257d2a506aa28892cdd378cfe0cfba6ab32b4a21d4a2a27cbf793fe8334bfcb4a128d6ebb2185c38c98b0f6b5f916e8af7ab
-
Filesize
5.9MB
MD5dda6fb2605385f8d2c04abb01b8515f0
SHA170fbb0407452a8d833409935c5e34fe31ab05d99
SHA2568b34e55db08638fb1b798bac2268ea85b593ad3bcfb99591bbc442585476392c
SHA512d3a399fda50792393ffd0c27345375d4c7e6c0eeef8e9828e78c3c8028d30c3735a27dc217ad66e11cbaf88a3ab6e5d286c4b53d00fb2512bc0044671997be1d
-
Filesize
5.9MB
MD5694e2577bd1136e773a359ad1e6d8b7d
SHA1051f139ffae00134ccdc0cc1a526b85aa326ef0a
SHA256f7cbf0ae081417ab4c470877f4ab8ebe8ff25a9c7b5c18289eaa458a070f956a
SHA5127d80fa8c7532af93cb423bfb9d97fe0f711de5b5fb55239e8c1750cbe860bdb4448163fbfd32e61cf50bda64173dbd76ff7b7ed106e31745cddd4fa71f472d9a
-
Filesize
5.9MB
MD5572c8cc6548f516927a6ec4575792ae1
SHA1f5f86f42688a242568bad6638efab7f70f2c3745
SHA256ac3bce77e30f0cf758d145f155d7e54b72446ae55773f2fe9270bea23ddfe0fc
SHA512a81131a73e9dca723c368d9511d4dad8b25313f26323a9a72fba1cd8095a0c400f2250ad0df7c2697249be57923e191aae8f1b666af2580eba2aebd6fdedd5a2
-
Filesize
5.9MB
MD57f90fd261716c3f6bbaccfe8766279af
SHA1700c2ebcf859155b29ca00bf3f459d715fbc10c8
SHA256428e3d77c1a65fb5ed28825ee9b7727bb46f8953218974ad4d56dba65acc69f4
SHA512c1fb1e2a76bd2d6430d2bf001bb029453610b197d4ed01dd33cbd3dca2d8b8da03b095a18861aae5ebeaf7b13e4225d1a87c703fa21d3c22bcaea35d0b150bd4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB