Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25/09/2024, 15:52 UTC
General
-
Target
2024-09-25_e8f82bb557418ecbdb6c6853b9ce29df_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
e8f82bb557418ecbdb6c6853b9ce29df
-
SHA1
ad359864f05740c5c8d49bc8765756c10ef8ce58
-
SHA256
d52132b2c7e005fd8b5b7b7e41b625a2b60c3c341c3d456a3f1d960b0d0efa7c
-
SHA512
663ce27fb9f8a26affc9409a1fe7d79e1c2ecb15b3306e4bff0855afd12e095b0b68d93cb59bcee9ff322633806400c36b6529ebfba9d5c1620ae8e5c9f360d1
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:T+856utgpPF8u/7b
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_e8f82bb557418ecbdb6c6853b9ce29df_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_e8f82bb557418ecbdb6c6853b9ce29df_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\EPoBRvm.exeC:\Windows\System\EPoBRvm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\btgkYhp.exeC:\Windows\System\btgkYhp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RYFTLsM.exeC:\Windows\System\RYFTLsM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\izVuzQD.exeC:\Windows\System\izVuzQD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PnbWHhZ.exeC:\Windows\System\PnbWHhZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uDABotM.exeC:\Windows\System\uDABotM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZVfKqGe.exeC:\Windows\System\ZVfKqGe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jltrmZp.exeC:\Windows\System\jltrmZp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DPkOnIZ.exeC:\Windows\System\DPkOnIZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GyGQmCh.exeC:\Windows\System\GyGQmCh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hbcRrtp.exeC:\Windows\System\hbcRrtp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qxKfmzH.exeC:\Windows\System\qxKfmzH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NnYCFQJ.exeC:\Windows\System\NnYCFQJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SCnpCpg.exeC:\Windows\System\SCnpCpg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DqOFkau.exeC:\Windows\System\DqOFkau.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\paWtYcY.exeC:\Windows\System\paWtYcY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ENuLYsB.exeC:\Windows\System\ENuLYsB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rKazWYP.exeC:\Windows\System\rKazWYP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IeugaHQ.exeC:\Windows\System\IeugaHQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FEkfXmw.exeC:\Windows\System\FEkfXmw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kOXUfGj.exeC:\Windows\System\kOXUfGj.exe2⤵
- Executes dropped EXE
-
Network
- No results found
-
3.120.209.58:8080 -
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c4c61987606e70d79b999b0de9260fef
SHA1fb6e73e91750b637a5b141a20f0e96a0c48b3bb0
SHA256aecaaba9d4d94a02956a393d9b5113350fdc8f381b747e1bbab82310fa6e872d
SHA512effe9881bec57c23e2c5eec6ff3660c3e51d65c5ffd9747bef0af2d6b7e5051dfaf063f656735e80fb688f5ee06184a13f6063010fd32e1bbe8c0a5e345ba046
-
Filesize
5.9MB
MD54392108f9b0ac31d7699037addea8ff5
SHA1b97e4e3c8cc5f42439518ea044fcbc6da77d7c2a
SHA256668436e401a26404c367fe1b2a7f8419ca38d250dd9bda49a0048c5621d201fa
SHA512970cef71895cbeb4d54d21d83fa6d15d6cfb97af4cce0b7b75cbb1890517b15c993adc87daf9f41536d8bf3d07059f5e1e35b2527cec6b06b33e32e6515aca2b
-
Filesize
5.9MB
MD56753112680179840b9c6a602063f4f73
SHA175dbb1e8e881568f54fddc35fd58b3e3f55c157a
SHA256f0d9ae601640c5da7bd1f14e58ee7dc49724ce3e2d7073a286c63ded492c6f2d
SHA5126dacf2184898f91bac0c6a0a76f450b27052682121e37d216289cbaf03ea2f4805fd8ec950e6c2e5453d132106341a62cd6719701f2228ca535813f22b41e9d0
-
Filesize
5.9MB
MD5ecf916b1d9ddd052d33a24799d58c38f
SHA16e7875bd7b63b7b0b48387db51b63c5e3a803465
SHA2563f9d59e73515cac7e7f1626fceb62271da6f0d1a261367d6af69a39d272f682a
SHA512cc91d9ef0bc7f7cd5c60123ff11848fb2652c5aef291ad82f8f21dc3a81a3dbe8dd636d873c82ba901e0e8a884085de2edb6d4e11c4de9d2ba9f9e21d77ba44e
-
Filesize
5.9MB
MD56f8f98eeb54aedaabb2304316bd9531a
SHA11151c808e351c8d6885445d97d5d10577e2a6e6a
SHA25679c1cfc268e233382e7d9e36d2b11b029e0852dcc8336775e73bfc2e146269d9
SHA5120397125bd7baaa1f1c74f45776f6a38febc6f7ae7c99ae215b31c3a811110447a952ac87212106d46464558cca7b408a747c7e31e4ba49285e905b93fc7a2533
-
Filesize
5.9MB
MD5afbd8c6b39577a53a22a7415d5485263
SHA18fe97961686b5e22a8dcd5f24001508e3be514b7
SHA25639da3e3d3f20c6e017617c5b18ad83f6986bc8cf5e5bca49082dfc2551179248
SHA5127e26b4c1e7c8b59cf0175939be45c3f7e26edf86172e4efe3f2a60d5ded38323b2a589a71f9f3a1f8f0ec8df4e2771592dd412408aedd9b2734934623383c03f
-
Filesize
5.9MB
MD59009d4d584821daffc918ed7130a2583
SHA12c06674c3f9d69f4c2488533f0121b0da447d0e5
SHA256ceb1080d231f15cf806d96f78477c421339a83bee43e0bad21d4858909416f16
SHA512c57bf1d80983041ef8a02d1f0b9a4d5d224617d7c2afebd05056580b42fe44e9b5db4ec2da218f0c16887f049a067eb8fb1b4f884444ff6dc461137c9718accf
-
Filesize
5.9MB
MD527e3693b0ca04d84ca5d1bffd69f2762
SHA151fb49af88ae3846db0575b393caac176825011b
SHA2567c20e2bea7965e0e370e8544a9d1d5a5e69a4e55f49fa5c0e5360b792396e328
SHA512e51446969daf38a36167a14d870ec0aad782152f61cfab274340dd824262aeceacfd7c33c4de40f24e242fe62b7bf4e21c027ab72cff4054ecc173a5c046dab5
-
Filesize
5.9MB
MD5e3021e333985d4da8c82b6775a1d7193
SHA14c8e9b165b165647e5320869460a4288b423ebaa
SHA2562e1304c5f79418efd895e0a95eab0bd37300197725df72d54e82fb45137e739c
SHA512bb0f748a2feda2b523548c79703bc488d421a13804061331a73bc89836eb700e3ad97ae7ff7ec6e42e1b2ac942b6bc6cd1ee4e5ac839e6d7e8d5aa4b229ebd04
-
Filesize
5.9MB
MD52083851e545600e97752f16ab5a1576b
SHA10bf5b3501a6c32349e4dd3c3e8b73f7dd49d8326
SHA256553c4a8c8afe51aec729d50d48856706f47fb1a588e019cc73c717bab0c62610
SHA512b5095e5b7885f995f92fb60e16f583cbcee840d3589d1049ff6890ce75675ab5fa232b9a7af3f4ecde0f80f4ad134ca40747f4a63233a76f27245a67caa15a8c
-
Filesize
5.9MB
MD5cf7cfa9ef7584c8bcb8cec39887edbfc
SHA1582ef5b28c6fe8b2c294fdb1765f3c8c17fa24c6
SHA25683e3ef1836de95dc0e404e9fd7d3b9d5341585fcca7f1a9bf11fca2cd4ae3c0d
SHA512d785decf4692ded465b23239d61709507236c4ed672749b3fcc5679e27b0e53c35ed2aa6351d5a2da04e4c8e232eb2fbc46fdc0ed34d505abaad5f4a56402da2
-
Filesize
5.9MB
MD5423fd3f07aae3559ecd4c90ac3d109b0
SHA1386ba0b4b39d4baa566ff54c6da82234cceb13ed
SHA2565cf867194415dea81155721c1630393c5e165f727ff9a3e006a65ede06c06ead
SHA5122aee6d6f2f372915bf980261a9ac2b7207ec6bd5bd2c1512fb453c396ac9c5b912b024db8834695022ebdda25b7c71a622b29cec13bc4004b0da672f8d26f5e5
-
Filesize
5.9MB
MD5cf49d3648909f36dd61e005a0495ef87
SHA1b5279ce1073f426a41587e4f8b8cb1dd34033c90
SHA25667979eccfad95503973c2e028210841d7c6d17040c559cbaeddc9af3f8defe69
SHA5125e2a638e30390919f0c06a2f7179953fa8e8813922b86f8136955bd98028c260a55856ea241d1c4db6023b16cca1a7086e88214a414bd2f44f2561afdb229bc4
-
Filesize
5.9MB
MD51fc788aa2e1f9db60bb2a1e7ad931535
SHA1f3e500a1232a8d9bd59c22fd312141c2ad8de1af
SHA2569cd7eecd5b062c0f6b6d550ee5bf35776993e9fbe6e51b67a42a8d9f286b92ec
SHA512d4fe4d2047edf7b533d816dcb20cffbc4da8bcb593eb7cd4d6427099aeaac49f277e830ef0412736c5e9592bfb031a8cf1f9887d5852edd1bb0070d25ce605d4
-
Filesize
5.9MB
MD50447565fd23f68a98b32d9b57822654f
SHA10afe50047c0f0a48494ae34e54eeb35b60f35981
SHA256296d40f7af31f7d27520228bea1550ca53380adc1f4695d20f2ee6f7ae5ac01f
SHA512565a2b992d53880866ea87aac24bbc11cf2ec635345d2b2f9d6da8e0b2cee829a9cf14ff64aba9a5500ce779a0b14db74cd4d3c6ad5b6f9520c02140cf4d22dd
-
Filesize
5.9MB
MD5bfaf2bd5ce18cb87d8764c4e1cb202ce
SHA1dcbdbf31d4cc89b53d21cffa8b66d58585421d69
SHA2566d2d4144353112966913789b604c47195d781cfb3ce5f7c614ac74360c004f3a
SHA51234700a0bde3cc003cf970f6df7d4e67e5c7bbd7d945952de6194964293269408dd8fdd9496275e2fb7bd9efddbd1e72f1ccbfd9bfc434ecacc838273077b8cda
-
Filesize
5.9MB
MD5c048b2b0108fd1a377dcf45d81278c64
SHA189349fbe767c17f740beb078793c6fe189241d0d
SHA25690f03a2617bd2479cc8edad21976b6a7c893d5c245a96b9883906874eb4cee70
SHA512f870e479c52a74de1fbf4fec10912457c7ebcc8298d9a6f4797a01332d5b688e74d06d1bb25f9b5a66cd1ebe6fb3a1e8795f5470e365c15a04bae423075df2de
-
Filesize
5.9MB
MD57cd42a09c2d0f1a5eb153571fbfff536
SHA14585a8c4ce6b069cc52b6c6c9f96a6d805b83efe
SHA2569ba70564023d6157ca4db4ee50fbe3fefba25f3de6c259fdadd3339eabdeca4a
SHA51226f697633c8d91fe5f1e617490e01c229713ea118606f0e648c75c1e8ebbdb833045ceeaf1486bb6f48cf527a66f73af33515beebc733e47e712c7701594f9af
-
Filesize
5.9MB
MD5226f33a2950f24970ab77e8139ca1226
SHA1f3c63b1a1376ed8d886b44ab3217c2c9ed054f0b
SHA256623437b07524be5cbdcdea7f5f954706172b17184ad032b5cf0af369d43f9f14
SHA512c2ba71adf00a3daafe3763843e1a9f1db6bfd9ea72960afd761d0250d03b0517c5eea49af705fe1ecc3c5c4e32ea2c35491f312cf7a9ce2a2fedea7366b4df56
-
Filesize
5.9MB
MD5635d1011eec459419f5ceb8199a95b10
SHA1d8d459bbff5c0366d97168bde26fbafe9a006ca6
SHA256db9f47a6068137d15ff2d160eafd9b586b1f31d755451091718bb85723b603e2
SHA512fd49c1f0cbc97bccbd609ed8c8cbb565641ad19f5df2025784a246db035c32c75f9e3b8080e6b0cd3e7caa86a83515c9d8189b1c6e0bc6b669e7839d319319e5
-
Filesize
5.9MB
MD53460361d8142091a2ba53e27c7da628b
SHA1fe9bd3918ddb8fde73e44ac5bb9d10fff7b9e005
SHA25641387e217a92a06559f41389683f451620b991f1d42e8595733e0bb91cbb1220
SHA51285cbfdc1e79f0842c6504040adffb58957ff7b30c46aed969f4d57145b7f34b2b88fdf9de57abd57b07786b36072c907628510ca9cb5fa138bf71b835bfaab7e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB