Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/09/2024, 17:30
General
-
Target
2024-09-25_9341a9b8bf611882fa84ba95a57057d2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
9341a9b8bf611882fa84ba95a57057d2
-
SHA1
572f1b7fbe4cd9b9e148d0a84f15ae6fd4bdc122
-
SHA256
1b931f8682b49d9b578e6599b2df44c207898cfbbe75ef7534af6997b7cc9414
-
SHA512
480e12c0837571532f099d416311ed9af4b72fe8034acfd095887a5ad44d25c18e4d70fe25f5381c96295e98423c110e4258cfb0200f83dddd45952b9161d7fd
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:T+856utgpPF8u/7P
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_9341a9b8bf611882fa84ba95a57057d2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_9341a9b8bf611882fa84ba95a57057d2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QLmIaEY.exeC:\Windows\System\QLmIaEY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rarYFuc.exeC:\Windows\System\rarYFuc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IwYEolv.exeC:\Windows\System\IwYEolv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XSgJhIt.exeC:\Windows\System\XSgJhIt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fZxsIUm.exeC:\Windows\System\fZxsIUm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nLMshba.exeC:\Windows\System\nLMshba.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LQBKgtg.exeC:\Windows\System\LQBKgtg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gcGzaXP.exeC:\Windows\System\gcGzaXP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JqVOqaM.exeC:\Windows\System\JqVOqaM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DJXlPdT.exeC:\Windows\System\DJXlPdT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xPjAZFD.exeC:\Windows\System\xPjAZFD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mzdoJnm.exeC:\Windows\System\mzdoJnm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hPDdvyP.exeC:\Windows\System\hPDdvyP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HKxAAsd.exeC:\Windows\System\HKxAAsd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZcFOnwi.exeC:\Windows\System\ZcFOnwi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OavGWur.exeC:\Windows\System\OavGWur.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CXlgXca.exeC:\Windows\System\CXlgXca.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Engzrmy.exeC:\Windows\System\Engzrmy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mtrUWlY.exeC:\Windows\System\mtrUWlY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vAGpHba.exeC:\Windows\System\vAGpHba.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GLRoNGQ.exeC:\Windows\System\GLRoNGQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD52b036d17f156c885a67db494d2d89bfe
SHA1373fc969f44fb3a7fbe61b9aa7c511b6cd9c4f9d
SHA256e11f311bc7ae669e90685c6f023d7e5431948b2f6fcb6b9bf5424f2ad50d12b1
SHA5124ff148ee83d14c84d99c7233fb6e0f7accea7e5dfa27bad73ce1c836f8b9a41145ac818985d264b518d2a127f197f392cd7c41efabacd24f9b8950ca817de24b
-
Filesize
5.9MB
MD5f67210ffe42cd7d702bbfcf390826ff3
SHA18f5cbd1bfc71fe3fcd8795ecf719b040aaaec2dc
SHA25602fe14f673e9e743cf5631ba7668cbe3c6a253d3dd2bd52f5bc7bafaa0251e66
SHA512fa8f5e60b1e12a5a357db643ec96bce1293d6d443ba6677b04efcef65bb85015163336d87ae03ec99c381efe318f5c3f72e7cac7891d617836e53d9a194482cf
-
Filesize
5.9MB
MD5edcf23ee6cdc637c77346838f29fc584
SHA14efa6adb0d8f3d6df03b4e84b97acc0d282ca6c8
SHA2563b4a510492b7f5b7fd691d933a939df6aae104323039c9c1f921e719cc7f15b1
SHA5121815245f29baf0194a7d18eb58715f95a853ab48e05d0c481a5af6ae2915a48be2ef7881a66719f058f992dd46ab72a60c02ae45590933a551dac28611c05b0f
-
Filesize
5.9MB
MD567bebaf4b81cef93fcebce6308ef5bbb
SHA1e4064258f3eea7f6189603d7f8f981b3db6c7ea8
SHA25653319f9cc22415a445318585c9dfe3c206538bef1fb08397584007a9d1efe2cc
SHA51282d9c39164265b396c80878e87422b5455b1d913de98d4380262c789cdbb85a5e10ba3ecbb644eef17a0903bcc356bf213feea4b62e033305e4008e3b6a03f66
-
Filesize
5.9MB
MD5b9cc9fd9fd56f4c1d5b3cf3976cc71e1
SHA1c08ebec689b7421b2fdc221c0d296543da18fecf
SHA256a4ecad76ad4226236195378a9bfe87cb1ac5684267121bb27b91abb8112b500e
SHA512014cdc717d863417dd4bcb2337a6527464beb8d145ac342da76fd819e25e8511da167d142a636f1cad8201eead42faac011b9c0760f2a20974f0609a9d66d016
-
Filesize
5.9MB
MD5d11f383b7ac89d18804a7318e5c01470
SHA1ac6f9572caac26da6c7175b046a057403f3d6026
SHA256ffc1ea40d823bff5c2fed8dcc20dc554edd6a00f853be945a7745363f6f2e9b1
SHA512fb3a732a2b672a3f3770c199648ec2215b25e6f9e6be3261c2e9ed8f87108df6dd5d45bce4b958327322d64c1b36906a3bce3b69d29050adca616d5b262e2845
-
Filesize
5.9MB
MD59aefd7befa3f2574f0a46885ad1a368a
SHA11045d14ba1a6ed0ca2d2679fa658cb56d0925d08
SHA256732095533ffc88a1aae945408f115420c7539fc08eddb82c097a12fb80cb2f51
SHA512868408230b743047317aa0f32d78868f65b2cb20fcd3bdbe6c443d744292d67052483a797f056205cb75cd0928db246179d553e70aaf672ea40b1781fd3232ec
-
Filesize
5.9MB
MD568b93e3d9be994e834da4f5a244eed4b
SHA18b839c00a2e76548eec059e8c598376374ba8f6d
SHA25646eaa7bf91478d70a1651556ca3f7037b0b0c986177bba70b55d9ae00a94740d
SHA512374532350e4375ec1df31213459b1bfdf1e6f21f18af485c36786d511a2d9943175cda805a9f77191f25e210ac1378fe32c938730bb69694d9584499ffb0470b
-
Filesize
5.9MB
MD5561367f24e6abc2bbbc97ed9ecfb4c0a
SHA16d4a4dbf707eac6bbe4872fb0eb20e34aa4dfef1
SHA256d0574117db6ac4a1dcebf0ca4c2d5a98e696e7cd825cd7d4e4fafbb75917c4c8
SHA512097ff02a3f12e19ef09875b519fcf779c2de04edcae0456a3813ed531a885884050c226d8023a526549c0dd032e556b88247def9172cbbffb1808a5c4be650c0
-
Filesize
5.9MB
MD56206e4fe44cf3f80c67777ff57520ac0
SHA1c8592358ee7ea398bee293215d74c3e42d51cfb6
SHA256a01f1ed268b437ae05ff292b3bec4890d6c0665ed84f0abbd9b24330ef4dbf42
SHA512501bcbde3fe6e05614297232fa1afdfa279fe28bf5bbde78b87b570942d1fe043fe3d8c09582b26d5e9cc0689cc90d9733199bcb404e187d7a34ff85c78a01e4
-
Filesize
5.9MB
MD5f4f0248f9eb8416e474834355d7480eb
SHA1aae587cf18c1842bacc80eb23892df8dd54a0b41
SHA2560d31365f729c3641092aae9e3ab4d18e074138ee9d9af5fe943def07c3f90669
SHA51232a34ae380570c0a305829432b13312989db18c1fb6d6723138c92d6f2415f91f0ac28c0509f3906854a99f148e38170671ad7472e1fda2754d661ad5cceff3f
-
Filesize
5.9MB
MD50f8debbcaf1afb8a400b59d9fbe8b201
SHA16ad368f280663c0a13b6ec4c0f93877ca02db9eb
SHA256d6c8d42db917f4d31ec59646053987c151972dad94cf4ef4a6bae2285438be3b
SHA51226495cd92190c28a14b643cddfec575a8bd663ee46c3a692b1006551f0b5aaf1a8506f1f62eaa724bca2e8e45428e1e92a7423df723c8314fafc375f87faaca6
-
Filesize
5.9MB
MD5aaca69149389e1f571e9188717a56007
SHA15533bfc81376657b80752e19fdc89de846e6e587
SHA256882d7c36b70aa69845492a772614c4987954862aee77e51d0505222d3cdc2c2c
SHA512d6d2635505b53e013779078dee1083d5349cc162ceada2895915ef931ac4889612e7e717dfd266c95e95a5dd1d3018ff7bc8db3c0348fb0eb07495b833c681c4
-
Filesize
5.9MB
MD5872840a3cf16fd8a64b750bc149b082b
SHA1ba52086e171e8920f0a794ebd81f0dc6a9a3edba
SHA256afd1ea7c5004edfe5784b945678dec9da3ab288b5c9a1d8b2c3b6b83d99aed7b
SHA512e6b4817563514d6c0a804a7e6c31057beaef03f590dce72a192c1b1117089d8b6f155b4e82af0f5eb29364199f60b30bd04a07a4a135e1ca15e942227d164eee
-
Filesize
5.9MB
MD52624b559672f033f28094b5cfe1ce0dc
SHA17a12ace0ebff8f6bed3b6f8dc9e3313269ffa17b
SHA256c3c40c4f6955ab708c5ae68b6cb3fe60f16b29a5a8a4479df271396dd14e69ee
SHA5129d8760e71b661bb100f74b2410b241ecc5215a1f4355bfe06bb0eea2cb31f4b5ec35322f9a64f79d21f89612cf1921a830a2929578191c72cd4beb47c6f646ea
-
Filesize
5.9MB
MD557099cd5f2f53fa3819011a7ddc4fbb4
SHA13951dc285ab613b94bd8cdbe03d9ea5c6423f6f8
SHA2560a777dad5b5a81be44bc5e7d88095a9a204c64cac5b1d2892c83739286d40177
SHA5120fd72ce5ae54640f555d5431aa6abf2d67be0c55edb03d95d0a093a3c934675dff74a87d22f4dc91f4bd8985b8ae795a2c3e43042b82bdab477e071bd3c6f2c0
-
Filesize
5.9MB
MD54520719554747bbb2e940fbc9318d8d3
SHA1d2b837cfa5a5b68102bda56f1f647fcfaf3d8533
SHA25670fcfdfdcd19d77e646b996052f5cfd4bdea0b19d9876c955a8f317cae2e146a
SHA5126ea9074eea56e705286a5827d61461b421924a51c1577975ad4b65d8b5b964bb803f262f37a99fcd757554d2a4abae08843599f0009f50259051cb647e796272
-
Filesize
5.9MB
MD5069823bf689e28a7d0a52c59dd3b9b92
SHA1fb6945b2744301214d71c6c6a05e7c7fb6b59855
SHA256a486bf05cb4d36b65eeb78969b585bc59eccb325248965913c3edddbdfec9946
SHA512967cbd54b19393f4cebf3d82456a622202404465d83eb5a26296bc2a28928314847d63b2cff64d781cfdea2bb473b6db3e04a5edd7bd5e218aad2107631d1dc8
-
Filesize
5.9MB
MD5b04628f4b2283fc9217999e254423a7c
SHA1c17869a8cb6de3fed4c70620dd09935b46975d63
SHA2566539f8fbf397afea63da1c86c9885c9c34071097b15cb8c64554313c95df2b2e
SHA512ba39ca4a2b264946358556532867c206e4c79b3565679bc11d83232f9f67251bbc64c6db3a54f73b09944953b8fa1dde4c0e6726046a19268bfbec1e860239d9
-
Filesize
5.9MB
MD541077a3c653fb615dc7328160afdb514
SHA1a8666441ca2d9589bada5ad14a0f51b24816c5f8
SHA256e1c188acf8457a4924bef13bd79839617925b93df46ef076bb312fb1014320e7
SHA51254bd2d6a39de0e9bda18898129e8bb852058b8540fde1e4cd426ee8d1c2dbf4c38a02f14517f9ae6494898dde083b8226ccc3b1bd16d9c5f2b07180cb22e07c5
-
Filesize
5.9MB
MD5931f8d77e5adf56013963adc944d64c8
SHA19b15b7ce1a2a6bf69b61005dd7861dbe7e44da49
SHA2563f127566dbb8ef11610d18d2e5c0d7d5e76e223eb0cf5dfeed3279458cfc4a2d
SHA512e3536edb12214fa9cf1737781c6b560c268dbc6d3af35059c52334ffe8c2d12963559ddad941270f6e5c809f301413b0b54123ad14cde275dccf314981a2127c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB