Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25/09/2024, 19:43
General
-
Target
2024-09-25_c2a0cbf88830eff9adc749b0167a81f2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
c2a0cbf88830eff9adc749b0167a81f2
-
SHA1
0363f4b942146a2fc07b89cf4774abc5ecf5d092
-
SHA256
7ee5611b15aea0f297efac170aaad4b1ad7b47c24327117eb741277b6dce67cb
-
SHA512
cc33ebef38c50e0a656dddd0b38d628eeee807d777a04a7f8adbdb164cafa175fe1f12112ef1589a670cf752179ef4ab24087ac8cefdd9b4adda576d5cee254c
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:T+856utgpPF8u/7Y
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 59 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_c2a0cbf88830eff9adc749b0167a81f2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_c2a0cbf88830eff9adc749b0167a81f2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KDIcaGD.exeC:\Windows\System\KDIcaGD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gUsTpMr.exeC:\Windows\System\gUsTpMr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eAqQERn.exeC:\Windows\System\eAqQERn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HCrLniU.exeC:\Windows\System\HCrLniU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tqVtwgH.exeC:\Windows\System\tqVtwgH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HIGHuwF.exeC:\Windows\System\HIGHuwF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RIPMGQv.exeC:\Windows\System\RIPMGQv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FyvRMBm.exeC:\Windows\System\FyvRMBm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dqSfheR.exeC:\Windows\System\dqSfheR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fpRTmMp.exeC:\Windows\System\fpRTmMp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kWHMKmT.exeC:\Windows\System\kWHMKmT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fDKZWVV.exeC:\Windows\System\fDKZWVV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AXitvgr.exeC:\Windows\System\AXitvgr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NVkQspZ.exeC:\Windows\System\NVkQspZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dmbGqlb.exeC:\Windows\System\dmbGqlb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LIPhfuk.exeC:\Windows\System\LIPhfuk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sQxPRfe.exeC:\Windows\System\sQxPRfe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\agConGY.exeC:\Windows\System\agConGY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\emYJnfi.exeC:\Windows\System\emYJnfi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aBIhKGV.exeC:\Windows\System\aBIhKGV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CNqwmQb.exeC:\Windows\System\CNqwmQb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5fc7aecfb792c0171fb870c906d9d3c06
SHA140906209af380414770642ddd667478c6cb0ad90
SHA256fc8d588eb4381b9ed663a618c7ba3040322128218fcb672b4b3920e25212cf81
SHA5128864bef1ee1f972ff2e0443fb5609e8b240053a8e6ab0d572dcfda389ea94c8ec2bdd1900b9f53895acb329bdc1b54bf81a5930ac1d4ae04f79894a2036730f7
-
Filesize
5.9MB
MD55036e621c055392b0de6e3ac747c7d79
SHA161332a04344d88860ab28546af21d125d207355f
SHA256e02519f75418cb89886e5be905ca87c151a31cc81ece03b9471b9c4aadaf86c4
SHA512e404f15df35ae41b24668072df20453a50e5397683a4e657aa302666574f5dbd8a44595ec657aedb5316f1965ce0de40f006ef6f75fa8fb993462a4d0f498f22
-
Filesize
5.9MB
MD5bbe490ea94ea7d4a1cde56e746d659a1
SHA115498e13d2f02c36958fe90ac6298e3d94a87bb7
SHA2568f4686730191156af570fffa4904fde3c42e5916a66b8a971afb814e207d6f46
SHA512b5620d0ec47ef7e14f3cc4c966b5b3ebb824f2b166cd63d2ede2524ba56d9ec31a04b8ff48b9b3d81fed32785e72eaeb6d563b748f90d6046430820ff570236c
-
Filesize
5.9MB
MD523869b515d437e23938f5b534c5645ac
SHA1b35ede3c00ebeac5f6f034adeb59333f8524410d
SHA256946f2960e92892dfe4be5e4dffe8616217fd04eeb3ad419567fbcb06c2bb364c
SHA512914a65ae634c26f7986a4be3efdd2132f06a209fdc5f8075974244dd05cd1e9cb3b314eaed420042963c3dfbfea56df9cedcc259742d4bffb75d12366f506dac
-
Filesize
5.9MB
MD5bc6a4a398b06647b36edb95ab51e379b
SHA17482a8237b27cf92d767e367ce54b0477b61dfad
SHA256fda3788a3b6e43bc60ae2dc6634e9d510a136ae1d5d173058b86604b6881ded4
SHA5129c55623c2cdbdb22c0349d1ff047b613ef21c79de0b4eedb9b9c2bfd8848691883576d02f35abc5e7749764c892f4b1ac32078e0c538f6ed645b0fd9529c360a
-
Filesize
5.9MB
MD535934754d993efcaaa3fc833d26fd6ec
SHA16bf2a648165ae8f8666e232384d131c53f1532c5
SHA2563e30c5145ef5059fd87de3ab2397f07a379112010d1a21c5b49cf02c52e03c9a
SHA512b40e91edc6f704290208326c4265a438de1989550c09d22a4f9bba1ba3e5509ceb9847e1f87fc3ca88db214dcd2daeae9cf78d042e6705dbfe94cd25398aedc9
-
Filesize
5.9MB
MD5151f5273710cf5b325d138cf706c79bd
SHA1e038c9c02781c9e36d60a35372e82fa883694914
SHA256af3decb944c6b10f7cdfa21533dbf3d828a2b41132e9a406b99326ff9d9f1808
SHA512cff02895906b6706955c28ecf9fb00c8c63af03b99c2e1c5206a56d534342255a4dac127886a9b81872f284e2acc79904a6d67399db561906b7562928565b2b2
-
Filesize
5.9MB
MD57702468b457927e7e072076385f9802f
SHA17fe35dcffacc15121a8ebb9cc21a5c1f05d841f8
SHA25622e59eb45c5932bb9a2d0cb629a82b9922a808cf848689189796b13bca577ae6
SHA51217453936218df41abedc199d243c4f617f724f94989000c85249bc1d1e97c9720c699b45af9819505594ad94291b883e4d47ab5cd1f70fb294966f84b35dc5cf
-
Filesize
5.9MB
MD55781025739991ca47dda4be4d82834ec
SHA1513868e66409ae8466c4ddb8fe99615e02960e54
SHA256c5ee85031866a008a60eadf4827ff4372bef4be746dfa6fbbcdbf24ff0ca1cfb
SHA5125813a2bbdc8612587e1b1824fb2b742daec4f080444b7b23d386f7242d5824e2d023a3f397acfd40642e26841894a97af40959c985520d4aba3c4a4bcf187926
-
Filesize
5.9MB
MD5d6caa39543bb538a1e3f18861eac2006
SHA131161d022ed9dbfde77437e497538cf42b4066dd
SHA256295d493b60ff8664b084d7030278a082afcbd88849637d23cdcb02199f8fdc39
SHA512b47d3b4626899d99930762568912dd11441ebe40c82ff8f971ae87bf9f237357f6512ee2ef41e1e98a01aab021cb34f62bfc004f264e0f0f9e02bc924a9d498f
-
Filesize
5.9MB
MD5e967d5eff3ec48f72d508108122d79ff
SHA1e615d65a611a54aa70b9b15ca03afac77437a476
SHA256657a0b9a1cdea4a5bd3075d74564a44d800def1e10f0f3bf7a23393e82ed3b83
SHA51249b13a6ad6575a8ec99315fd496d1a04a4e73ade71914cdbb0106d42949a9c00caf40611c46e35e62137e8db371b95a583e46ec46d73beb4e6409e5e9bcf025d
-
Filesize
5.9MB
MD5bc26d43b9736004a2785a3a656348033
SHA1ec17c9ab49609536a8ff17e38c47fe6c230ce1aa
SHA256d14cd8ee85cccb25a9fd57e75d80017a0afdd010cf96265b3c217f299b3b0547
SHA512ffd954ab3355499818974c854279c2b77109871d2f8217ff9d56bf71a3212885e0d7a0ebff5efdd84e6f469b14af719ec373ef148c141ec42fae2e78b3e163c0
-
Filesize
5.9MB
MD5d8a0192b574cf65592e99478a4263381
SHA104ecae5ab632ce13973d586107662e428423ac52
SHA256185a0ac5cd98121686fd72973c84f22fdf33d93c9b3e6b6c71f5700e65361309
SHA512fc3f91d6825c58cc68f4e37cb1a4133e2f10f9066265d59fd8c94839cd0167786bd6c55d84c1606e936f3e006d266c67043205e7503d0b500f937cd4084e33c6
-
Filesize
5.9MB
MD5619ab3563169fa0d60c293c3598e7721
SHA1ec28b14f813eb75800eec0e2f137f55ada07664d
SHA256249c5c89e1a68246f54c7e4beb8da4aa26969d8fba8218c2ae4f9349853aee37
SHA51245c66917a6ae450c2950cd6a64a3696328b82f82e58bc1b060302cf229fe2acd5690d5d474bc9a6de5c18584b73b9a17eb01ac0e696846a50ab3dcac93fd2a12
-
Filesize
5.9MB
MD564d9b7b22c3355145f356c32b7da601c
SHA126fc20394a8544baaa3d9ffc6b80d5e218e7e7d1
SHA256428284bfdfb55ba4b069323bd8456fab593cad9dacad6e6f7f7584a05ef7b425
SHA5121869910fb0c8280666bb62ef114e13b4d56d945e2b3c3776b4b164945aa7d673b39024c0bcc5e24b23b85518e150c3f622c513733b8f75aecebbaa6475a4eb3b
-
Filesize
5.9MB
MD5e55c0d0195736b1ee10f8fc8377b8f72
SHA1b6dad0cc9821b2e8b98da2372d604c2f6a6cc7c5
SHA2568bdda18fd738e900fe590570e309839104704e5502dcd7d1bbdb3f950e588593
SHA512f21d380de5607f7839713d200e2d6df94e067519bb426d0b6f840ce648732a812879b5e3580c885d3402f1eec1e7434b40e6d4e6b70c2db587f9a968d13b181d
-
Filesize
5.9MB
MD5f27f7d11769f619b4597089ee7ffdaec
SHA18d547851e78865e3916e9908f1db7c09dc7a0038
SHA2560c53e781f9d0de3442ab9c08fee2fb4b930d9bd253638423dd86dd63732bd70c
SHA51232207c4befa63c81b758c6bb048d982553fff2cc04c9b77042824697bf51696a3155ef67ba098f751ca1c285371c99891acd1f8d9ab2cc2fd0341b15d06af130
-
Filesize
5.9MB
MD568a3b35d3af430ee06e48fad0a5a3601
SHA14d8432ae6cac413434e3e5be4afa3745f24a9a13
SHA2566c49e7aa25f8b2662440b29f11b9686486cb57445210f73da21153d54103c351
SHA51295889409f6b0f23f3ff0e2359ef023cc97929b66c03cfdf00690b6ae9686e379c60766723b89f967eeedf9aa8ec64cc69898bddac7f107bec58fd4ce5c0bd7b7
-
Filesize
5.9MB
MD544bd6556dd45a292a966abda1fdd3cca
SHA1905383f9e53a27f6ce014520c76a9eaa1abce3b5
SHA256689931b97c2bbfd207f8ea0cfaa24c961081be837f4cc7cecb26f953aed602ff
SHA5121dc263ae42f85185a6488a26858f3a027c867abb32e020c7620733605374348fca2464d6a1e2d2623f94f4015cb642ed8c9b9b5dfe7a14357b281a26a1efa0c5
-
Filesize
5.9MB
MD57f4715754ba97d9ac6bde61c1a499825
SHA160f7f37ae839829e8450c8b36a56a74299d5050e
SHA2561a2c5e8a764d1505bab04c46e38b66a064b0c05065c93fff066e8ddbcd355544
SHA512272006f7a1b6c714adcb0312cb778eee7d3ecf8f53b508db718abc5510b3a2b49128a85b9a9dc1152de52af545ea8c75cc0c232c62c9e4d30d6a9b53d8f94d4b
-
Filesize
5.9MB
MD50aeae3dca5ee48fda33569e22b845361
SHA1db11aa5f8a2ca98f4222203ff01abfc846641a51
SHA256aa668f8552ed1a7c2d1bf09be8f0778507e3449915a687dd72c25a38add2d5b1
SHA512435a2c17448f6b0082d1e437a72750ded18321a38b5e95e33082341e00d8df9da40e220da48556670cfd584953f86dba1a399017bcfd4a1570d570b460a3cf43
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB