Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25/09/2024, 15:48
General
-
Target
2024-09-25_864a71c70992f97e1c9a2838c0dac9de_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
864a71c70992f97e1c9a2838c0dac9de
-
SHA1
2f0a2d30d6f88dd5c0d8c976e350683f48bf0a92
-
SHA256
cdefe99225a75c2d8da04b4ec668cc6928bf2191ac2a383c32f42eb384d716f3
-
SHA512
2dc9d78541c72dcbdf98b6ac118389f2feba9e12564adbe33b0586a10a1eb140053862c190236e498414f7a77df59ed526784b5f9fea543783441d4634d1e5b6
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:T+856utgpPF8u/72
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 59 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_864a71c70992f97e1c9a2838c0dac9de_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_864a71c70992f97e1c9a2838c0dac9de_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kSwrofx.exeC:\Windows\System\kSwrofx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HboZput.exeC:\Windows\System\HboZput.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YevASMz.exeC:\Windows\System\YevASMz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pBIsFTn.exeC:\Windows\System\pBIsFTn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lPsCqFd.exeC:\Windows\System\lPsCqFd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SphswgF.exeC:\Windows\System\SphswgF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZybjEGj.exeC:\Windows\System\ZybjEGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FGyVdde.exeC:\Windows\System\FGyVdde.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qmZGnJB.exeC:\Windows\System\qmZGnJB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lCymviW.exeC:\Windows\System\lCymviW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KOlWTWg.exeC:\Windows\System\KOlWTWg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cAxWJlX.exeC:\Windows\System\cAxWJlX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fwfkBQw.exeC:\Windows\System\fwfkBQw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GferJyw.exeC:\Windows\System\GferJyw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KGlNsmS.exeC:\Windows\System\KGlNsmS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bcEgcQd.exeC:\Windows\System\bcEgcQd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UkqQduL.exeC:\Windows\System\UkqQduL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oqhPfMD.exeC:\Windows\System\oqhPfMD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BWTmOuT.exeC:\Windows\System\BWTmOuT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CiVDGCf.exeC:\Windows\System\CiVDGCf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kVkGOWu.exeC:\Windows\System\kVkGOWu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD55ae0d18d97024342b1ea46ab87e0384e
SHA18e4eca3ad5251e2d313eb033000d86ab5af413ae
SHA2566f013710a1e7de41f1037d79b20523677856c322ab288a609e77421bd9db3d0e
SHA512febb4751ca93abff772e9495b02df0258f67020121a89fc17cdc1420b220917bc4d4e3e4e6f836b2a686d654dc5860dd970dc0766094bd1d4c94f89081ca91c5
-
Filesize
5.9MB
MD5b19c379c514db7888c0549c22ff3dc2f
SHA147a8bf258d9b8b48e15cc89597183ae551995828
SHA25692f0231a61503cc76c7eb22551fe06c53c348ddcd2f7ba33b96059f9e30854e4
SHA512465ded5cfe31ebf27c7b9623fd4aec80b4954cbf1eaf722a8e8d3f45778b89bc53106b98e5185c7fabbed9021c0566b5b4839f257e515d0e6d64ff03c1fdad51
-
Filesize
5.9MB
MD5bf29260fda28885d99ed78b91567ef96
SHA12ca70d33c0d2ca0d164e2a2f58a03088caa2dbd9
SHA2563b4bbbac3a68cb0b7750c7519c0abcf63c96801b4c2ead79366c8ca3465b8b24
SHA51245cf63ddf452f52a4aa782df87e5a4bafcb55d11e4cb3f5b4d35e4a34455d7d53de666ff63266eedc0227057a7da003c5d1a34511792606192b3a7ca519df2bf
-
Filesize
5.9MB
MD501a201c6cd055851fcfeda2e89a6d65d
SHA1658f8370fa52084e0a9e7917a77ae6c9957fd079
SHA2561fc057fba95c7aa15bbce3189cb355103fea7e80655053a557d4d6519dc9d116
SHA512dd57eda6dbf2585dc7aa1c34778c20951a046c8af50857f8acf8cf938db241b632e3d808d58784538805ac85d621069189f472a8c82db343c14b1742de8a281e
-
Filesize
5.9MB
MD58985f091724809e7eb586bc332d4a85f
SHA143b66c78c301559626e154f7e6d863d7f1a57fe0
SHA256593017e6eb2b951512b50afee183156373f3215d95860cfc113bf371833faf37
SHA5127133a628e6f5527179339268badd2446fe51ae5511ed84af2e170e6ac9f495c15280cfbaa834047a23461a896d95aefffcd6527f4bd8883b68101cdc3f6f1c62
-
Filesize
5.9MB
MD559535b0b279ff455048e4378de5a2928
SHA1db8958d25bfaee85ea283d1f61e1cad3535f762a
SHA25614fbdf398a6e09d1aa2c2f30c84508b1114664cf29b5cf9d64e435356154d97f
SHA512fb17215c198b7a5dd719688ca40b18f95e0c9e03da70fb2965e594c643faba3479607017bc06c027a60975522e5a923703e2fb0534f7754a04817abae84cf695
-
Filesize
5.9MB
MD515ed7bbd497b7659c9c4e8d620177d3e
SHA1b961b67cadd018c16eb6cb7130eb0ec4e3c993bd
SHA256b6b5e6b1fedfad3b533b95ca30791d9c0be59606e198836983c63b483c9edea4
SHA5129591b97a82a5e525cad74aab436fd53f31e9658f2a697b6cf14689e38f85cf27e3e1e0c010b9cea34469af4c700afc9409660959526f2acd306596929ed4118a
-
Filesize
5.9MB
MD5b1770f8176307737bff3cfc7449a0d92
SHA18edd83a4acf4aeb68f9bfa2e1c8ed2b700a418ce
SHA256d3185dae0407f91990f843cbba9415348b6b337d7312eb8ea788cc44c9bd5a22
SHA5122a7ff9e9cb8dee47afc82af27eadd608f7618f11f4d5b4c6877e1690def849feda409a2e2a1ea7631d6a767f98fd78c398b5871befddcd8b5d66f83736083fcb
-
Filesize
5.9MB
MD5aab57c6458d492534f2c39f909d9785b
SHA1e804a3ecfb06fcd3d5c77601044d72d4697a8dcc
SHA2565ca660cf4856b1b99b5247518c518cf5d01d2ad15ec48cfc278e6ef153d91c95
SHA512448907f3290b3c3bfb134d7a25b15f06fa0a4cc9f72b7ef66853d91bf0f6782105ac3b6016fe1c05154321fd33c3b8ccfbabe619aeff7ed2a8d06df15c282753
-
Filesize
5.9MB
MD5ff64402d6028882cf6f97404d5232c89
SHA1765af5d5060c0f8e2d675fb6ebbc302fb58e6e71
SHA25605c492b8decc2fbd7f01525bb13bc74841a567d8af197b6648a9ab22e0708079
SHA51222f053a2afc2bb62261690546ce01788f862d6aab915fcfb1d8725f6d9718341d8ab7fb211fd92f6bcd55bb4982116bc622d66f535d7e057c60e0061fd600ba7
-
Filesize
5.9MB
MD592c04fa9a5196e49f1e3260e9109b513
SHA1e7cc1b4e02c1dea3d9945fd2e537f388b4a703c5
SHA256688cf973c63187b01525ea1c32e030610c2ddde4ad2b7b2b324af7ca2e72d674
SHA512f44377a5d18157c570b850e4e6a463e0045458f8aad6f0310bdcd6aa61292d191eba7bddc9a31a9c7900add9227358b71efc5ff916fabfcb822a709bd502b16c
-
Filesize
5.9MB
MD57bb874a8fceb115ab328f6c302e9f2fb
SHA1b695b265dee8edad08438c0b0c91ac8a57b94a26
SHA25680f36c93e25a54f99d7d1632998fcc7fb950e706f3469c2b244e317e3a040007
SHA512f08a3f20ea0dba8a52886a9a5c692df82c31254c2149e353a87d6075d0afd1533a5cb2521d9b8b665f098ae976aa5070a3e983468344ea6987e6730c6ef6d795
-
Filesize
5.9MB
MD55790221c67f540359fdcd2b217347889
SHA19fbc362a5974e0c8c45ca48fb10c019d0b91f74d
SHA25672948471b8a2f25d87ccfa67aeb97bfa21deaf2aee9e067df5cc36aea9b43959
SHA512b943dccafe8944e1f3f85efa1c5bd2f49873690c5acb65f998155606ececb321267a549a483c5ecc988dda2518e258e9f46f9031d30db638ddce112e0d6deb59
-
Filesize
5.9MB
MD5c7902fa3f1712d2967337564a47a8d64
SHA132f18e9c8c0a140a9e5d703895a346f354829357
SHA25648bf3ae04f25d7bbc910b121dbd32c1639d3ad55e6be6b0a7006e99ca4c39b3d
SHA512af65174a71f662ebf5d6ad0684cfdb7f08bd13deeb9140aca91fcab273e89942a6f51d664964e21b0284dff33aebfb0d74582620dc992d14ba1d72a059f0a153
-
Filesize
5.9MB
MD5b084c2fd205cdfe6bb28b8b3ea00632e
SHA19a5acc62268a4f9ea4dd75f2c90a90c3ac194f97
SHA256511b5159756796b637b458e1fce40754d9823fd2cbb9084d4ebc082748689c36
SHA512795051412357c14002b992c4e3cdc284ad254c8c0e45a52cf698d97ddbefd1fe7bc3987456f093dbdabda7eb9957b933e6c6138bcdfbe059cad1ed3bdccd3735
-
Filesize
5.9MB
MD5916d5e5d695eb6c7bb694dd76e8d3cef
SHA123f6476ceb21ec0c40c2c64615815710e3228d06
SHA25673a637943535ed1f03c3a2a09cf122ead8f7333e33226bb9e10c1c75ba8a7bc0
SHA512e8ed758db4bab558d1ae85b8b54bdef3e7a3a678a5891440b86346d65f341a027f084abfe4fc5e8050056e45e9af177f3d6c1a088cf556880c8dd03517527db7
-
Filesize
5.9MB
MD5fccde29bef08ffbe63967c3ab52a47a2
SHA10bf012a639f5c7614f2e11a5f1ec47dfc7a457a0
SHA256c55a795c90bb2a4d9a3093acd2c99574fd3e6e62a3aada32fb068ae17f3b8c06
SHA5128b0b96765e7d1c5b9d163c1d395f020c1461e71f2ffc42308c7452632e0890b22e241fce62e6247cc56baec1684d0e439fc7c852caee996b1b1f0b883f37c6aa
-
Filesize
5.9MB
MD5da1c5cae0efd44feae96ffb31737af6b
SHA12fedd73f829bc08281ba09c5b27a128d7e0ab7f1
SHA256f20129d4c15c20754ed1f65a949843c10eb083add55d855c56a1e10fc0240e39
SHA512180952ab9284dfec6fa02fc19932c91363b134138ce2634b64333a01134779da57caf49f2c5ed3c3fe09c100333865237b1036b16bcaf02d0175a1a73e91b9fc
-
Filesize
5.9MB
MD587b2b41cd72f8e1b4cb33db906e5719b
SHA18cc1ffd0259574c6f91d8a973c4d1be3da3947a5
SHA25653405ba0103716eff1f52435fa749247965c750690bfa0bdcd969bb5a0ad2b99
SHA51260901d55317fc9f8601dcd7e6d227edd25f476f790947a337be23c819e67f168374c62890d48333c617cf43556c9210fceb0c335f143dab0511289a220b9e852
-
Filesize
5.9MB
MD56c57677deff68dbc20e17b3e2578e3c0
SHA195b5996c62e1613b241b8b8d36dd51c3bf59c86c
SHA256faccac37b163d3fddc843353ad096acf31d5f12984b871282a77fa9ed46c5a8c
SHA512b936d9a3d6c7af0e7f2b32f965a773252f4ddd6ab5f79174107b2500423b2fbde2d336e1aa0c7987df2f52d912a8be02ad53a48bd1eb3de7329e799c3a805e39
-
Filesize
5.9MB
MD58b14295459ea1d3863531af7181bc5f7
SHA172573c042285677cf762f2fa2cf6151da3234f7b
SHA256ae88646cab3cd8975fde711d8d8bfad4a8ac9482f5c04a99092767a83e649eae
SHA512d3d4b934c367e214c4c5ed28da1203bcc52012baf7f1e7087890c53e38d1fc22a5557f7e03c3b3c7cdab26736acd6fe66a263fe79d2737a54b41c0199ab3ad13
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB