Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/09/2024, 15:52
General
-
Target
2024-09-25_e8f82bb557418ecbdb6c6853b9ce29df_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
e8f82bb557418ecbdb6c6853b9ce29df
-
SHA1
ad359864f05740c5c8d49bc8765756c10ef8ce58
-
SHA256
d52132b2c7e005fd8b5b7b7e41b625a2b60c3c341c3d456a3f1d960b0d0efa7c
-
SHA512
663ce27fb9f8a26affc9409a1fe7d79e1c2ecb15b3306e4bff0855afd12e095b0b68d93cb59bcee9ff322633806400c36b6529ebfba9d5c1620ae8e5c9f360d1
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:T+856utgpPF8u/7b
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_e8f82bb557418ecbdb6c6853b9ce29df_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_e8f82bb557418ecbdb6c6853b9ce29df_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uSPDVTJ.exeC:\Windows\System\uSPDVTJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZszcRnW.exeC:\Windows\System\ZszcRnW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZFUeMNC.exeC:\Windows\System\ZFUeMNC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zrcGpln.exeC:\Windows\System\zrcGpln.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SCklvBh.exeC:\Windows\System\SCklvBh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nLMmqwb.exeC:\Windows\System\nLMmqwb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vfvNOAS.exeC:\Windows\System\vfvNOAS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fHdDnCV.exeC:\Windows\System\fHdDnCV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xSBMuyU.exeC:\Windows\System\xSBMuyU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\POOjTpy.exeC:\Windows\System\POOjTpy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SjkCWQE.exeC:\Windows\System\SjkCWQE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zfXQmIz.exeC:\Windows\System\zfXQmIz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BOTTpzr.exeC:\Windows\System\BOTTpzr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ueXBjzY.exeC:\Windows\System\ueXBjzY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OFPUjqy.exeC:\Windows\System\OFPUjqy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GzNguiY.exeC:\Windows\System\GzNguiY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GDVCKYL.exeC:\Windows\System\GDVCKYL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zVuzyJq.exeC:\Windows\System\zVuzyJq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BpBuuCI.exeC:\Windows\System\BpBuuCI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Urntiop.exeC:\Windows\System\Urntiop.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BhALIhc.exeC:\Windows\System\BhALIhc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD57a146fe381251ef25aa25f3ccc01d4d3
SHA143d686df3842aee61d11cfccd1892c4fecb625e7
SHA256fda8afcaa992747900629b92a7c0e74f9273bf53e0ef846ba8c1fb05e88ad64f
SHA512650a400e9f2cff72d7e212421ada9fb5c298f79e1851668eef2624c888ca9b95782999d11f82994d5888cf432461e5f8ebe5c42ae72e2fbfa43c9bf52a07cf3e
-
Filesize
5.9MB
MD5a7e2b5287ecd8594b2259accb0654968
SHA14705c1bf3d2223786f468618c74177511ccf7f0f
SHA2564d9cc4b4352938e46ff7d5afde3933e49c8b87d24779258770ded793107e2c35
SHA512cdbbdfa49dd1034f1e19b4d3a7bb04e14a03b495f52da0b61569049d0f5538787e117c6a9a5894a4d81c66a9ffbc5cb4c038abc8884bd4a7281e5cc6eb2df661
-
Filesize
5.9MB
MD576cea5a1f6049c0260e5a359ae94a0c3
SHA17083215a166873357a3103e2a6993b5463862536
SHA2563031f1cd5f5f10f50d768cc4726cea556ed8f7008314f93f810d54dc3162f85d
SHA5129b96d7747c2255725b9f57c21ff5c9eb9533ce53adeca58870b21a4e7fc6592ba54368b5c10ffc9d68a789464b48dbdba080546989caaa9bef080cdbf8d21a58
-
Filesize
5.9MB
MD56c3f5d751cc236a18715e767a0815a6e
SHA1f5e2ea7bc925ec341f0ab4564da667192453797a
SHA256bc24ba2bbd8421cf4c41ec7f1c81a7c408a0937375edc7c122ef6d4cea9e8029
SHA512598bfb3c32696e37ac44130669e53a40058c29bc2df78c9e728b109a693e693a69910832d148831439b08307a26644d80abbd6955bdd0009012910d38f713651
-
Filesize
5.9MB
MD50fe075c9c73bafd58ec26bf1acefe2ee
SHA194953e6555acff12cd0423557c1ceec843a083a1
SHA2567d18d59eddf14359ed0b439416e8ac2662821e64b4cdcbffa67aa03bdec94baf
SHA51260e029f5f4e9569743ea6f8bb55a8f400a79e70c77ac1e6b3f9a2e61006cc4989774dda0e80cbd919313a6dde93e81227a85204f75ec8a17659c1e825eff3178
-
Filesize
5.9MB
MD54f2b411392e15ade9f45c2d5f19c3453
SHA16ec03d04a4d0cebf84f8556d488e18aa0cfadf94
SHA256caa97bfbe493a77c0780cbbb71ee3a24560cf26eda4ea80833a7b2102af6ece6
SHA512f643c69082162eaa5426b9534cb7d2d0f0b43843f7d5eeab26f9cfde34699af999668e6e40136f3b18d7bba927d96eec56476426638dadec4d1bb1d328c15601
-
Filesize
5.9MB
MD528c1fd04874845dd6ab6ef7ef62c717b
SHA140f001f128604c156c11ad101e42f6c26c0a3b16
SHA256901467f0fd0bee9032b87e5e062251fae4d890c3c47069c824ea6528aab9a4cd
SHA512fce91abbce1355a3fbdc19377773f79f07d079c86afe3b9502c95ebc1d724f0f381046812b86fd305e6f386743d193aed5743a9225436157af838ae86fad4d89
-
Filesize
5.9MB
MD539058ce8d1259baad27c73226bd083b6
SHA1db80207c0aa91a2ca7fd7cde0523cf85faa823f8
SHA256656b11a6f0216955b792cea07d73efd2e7ed68cf02b0e2f4131c9ec975aed5ac
SHA512ec1c15c84786b98b4d4abe6c124e503db686d6941315285a1b7d20baf843160b3af88f9a684e69afa9c4c45c6a4ff60ecc269d94612d9e9f7e18f402afeb3e6c
-
Filesize
5.9MB
MD5c29633ffb1e05c1980f9b2836884d067
SHA17ae3d21cfb9ff9769899998d5bfea4fe16de8ca2
SHA25657e1b3e0a3c43ae6b38c7ebdadd51e1e719704f0a088f507a1c6d01b6202503a
SHA51289982c1f2bec9844c0b7bac23fe6757039a404c252366fbd9c6d8c3cf147fc1e270a0e6c182a37c5a4a77f2f87562f328631f9c879b30c471f02c95bf2b43c5e
-
Filesize
5.9MB
MD5c6a106636a7ed920b2247a6a5c81eb86
SHA187ed249aa4957b933203d45024bee0ca020d5633
SHA256617474f64d5f6edb5d64ad0696c9a35a10abd3af1e37a1c6d9d4727648c7f50d
SHA512a19758e23a79b0dc6e99ccfc41958aad24566fa0a984c70ace4ac919b3fbb84bd12944c45cfa89fff1925151a23057a22b90b3321f37c6be1d0ba77c8f856164
-
Filesize
5.9MB
MD5f4f2d5b0daff0fc030cbe70d7cdd2668
SHA1cb4d23b8fc0885f1ae946796165298f73f7f6a41
SHA256ba1be483a3374505e7434c8c44af7f9df10fe3858fd00e5fbb979bdc1d42d7c8
SHA512de246f2aa251c7bc841aedfcea5c7b4b3405277e04b240c4872f16fe92b44355e839a45cf53ed96b98af112dec0840635d6aa4b5b9b39b4469a7a5cba9256ac4
-
Filesize
5.9MB
MD5458a4f39a70fe0211231cfb4a23a41ee
SHA15bc6fea02147c14f2c74433f5dccc8404b581bc0
SHA256232864bda7ec0364ab4ef99fdcaeeba38450a775bfdd00be183cc79246474ad0
SHA512c8ff818a13442e3ee60008c2525e7f976804cd349259643512311d1293af9ad94a4d569b43c065ac74c882a6eb9106019e45ba20d137a8713e67b9f635a61dac
-
Filesize
5.9MB
MD5065f9c10e746350fbb51cc6d262c9e33
SHA1aa21c3375eb2403e93b7e93b57ad8cfc5b697bff
SHA25683d3fd2d97fde4f50668b1a7a1c10005cbe4b86d5f06002ecd9a006793526cd7
SHA5129ab5473831c66fbed73947059b0cfddcc131771ce3c2e8494779450676ed01a5d3c0d3037d244180ed1ca2ce0f5e976df1b16986a769ca7bbb996ddcded23310
-
Filesize
5.9MB
MD5b0b46ad02d6b01e27d82f0adec702792
SHA189973cc6d6f49595367188ea239f5b05fbb4f44a
SHA256fe8ec155635971b85527c65f8d253a6ffebd72a78b04cd1e9f29031fc5762ab7
SHA5125aa9dd4dd3d8e0e8313be23a31ef1be14e2d012fdce8f0ecd5b692f99f6e01039b3b63cb52b7ef0486569326d716ee16347d1ea513e234526bc31c3c55dad3e9
-
Filesize
5.9MB
MD520078201e95f811bf2e0cd5eb807d22e
SHA1b0870b45dec4d8ea808244a39ae11851bb92ce5a
SHA25673deedeae7ef9110204e3d1fd66ecc1ec0ea70521e51d6ad223d4c5d3fd5bd46
SHA512bb3020be43962063ab79d6644bdd89e9245b6697e9c8dce339cfeb99031763c6ed612f035e3814fad96f6ba80078b54124f401a0a0bc08053c784bceb5565417
-
Filesize
5.9MB
MD5defcd3876e5116421323d96401bd3f59
SHA1de1bc5f867a598ef9e452492a0e87d9a5fc2d236
SHA256930434a9c0c68385ff0af3d2076d9187fd78de5b8afd068604b34afdbf6f5671
SHA512f98b4ff7843c9b0b265dcb484bdbd96ff63dc799aceed9ff83b03452864bc228771abf0ff9f62eb2bf7d04569df546f72f465ad8676275088246d870cac99090
-
Filesize
5.9MB
MD57b7d6f3eda085c3607edda1c75fb37c5
SHA1078f9329bc965824cb1770bfacbfff4713cd317b
SHA256bf0c41b42cadd3446ca4559f0a72b587043897a697abf7f845bf0273391cd7bb
SHA51289c8a77443ac2d74002597ee12cad6e3c70f7447c3ab312bf3a3454d89ab653fdbef73f4139c18e1f8ef5bdc86ea5d846bf3e7ace1ced521000dc05c0dce660f
-
Filesize
5.9MB
MD5988c39c15c446e5188cf7d0323fe0937
SHA1fb669b4c491b9c3cbd2c91fbff240e0a72c211bf
SHA256b71b6eb97194a53e49f0f977b78e560a8860bf50ee811af8ddf7d7dbf461bc2c
SHA512f201bafd20ccad6ec20d3914c8823bf4ee2102f2be007593d070a97d5905adb6e8c1e825b7a9140af5cdb7bb081dd7025a520d03b2fa9dde1ffa1e2b6f42db7f
-
Filesize
5.9MB
MD54ca10b8367d751710121d6342bdcedd5
SHA1ead37832bb7658fa9f10048cd48541db66269669
SHA256fd11d14ca03a1b7975e6d6036bf8ae57f4be0f410030a14b43d94cd966557e1d
SHA512b7dea25bac2eceee3d8000e7233cb3885a946fa69760c314aa085681655c7ccf90ce58d0e912e3124db04f09167e025b5cab7e2a8ac1acaa737b42d6edee61ab
-
Filesize
5.9MB
MD5cd16182b4c544feeb5c0b90cd06e70ed
SHA14a7874e06c72da066bfdc2ca917e9674d8c9d2cc
SHA2566eaed0d78c26732b9e960a6199c064e5aa09551e0b127e0729f57e21a05dca80
SHA512d79c196fa09bf734be3bd2adee86ca47c7b2881610bd309871b742c738ed82ba1161eb7db99da82bee2f657fcf3974ca9dc3781e5a6a7c3a8eb011a739a2b20a
-
Filesize
5.9MB
MD5330bb4d74b48d1944ebfc6e5a65cca13
SHA1d07d2281a112ab05e11932f79e0081f765a4ef23
SHA256dba1a548443b2be6754c35b7a02d2ace9e9ccdb90ac486bb7d66629ac40a2730
SHA5123f8ac7ab63711542c095239e72a13902ef6094826d56c76425897f46612ca398d2fb6f14c23c230a6f9a754b4ed652dbe353db9ffb08952fa332c112ab6474e4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB