Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/09/2024, 19:43
General
-
Target
2024-09-25_c2a0cbf88830eff9adc749b0167a81f2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
c2a0cbf88830eff9adc749b0167a81f2
-
SHA1
0363f4b942146a2fc07b89cf4774abc5ecf5d092
-
SHA256
7ee5611b15aea0f297efac170aaad4b1ad7b47c24327117eb741277b6dce67cb
-
SHA512
cc33ebef38c50e0a656dddd0b38d628eeee807d777a04a7f8adbdb164cafa175fe1f12112ef1589a670cf752179ef4ab24087ac8cefdd9b4adda576d5cee254c
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:T+856utgpPF8u/7Y
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_c2a0cbf88830eff9adc749b0167a81f2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_c2a0cbf88830eff9adc749b0167a81f2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HTgxHgK.exeC:\Windows\System\HTgxHgK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UdyTnlC.exeC:\Windows\System\UdyTnlC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vJHlnHk.exeC:\Windows\System\vJHlnHk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\huNtSGb.exeC:\Windows\System\huNtSGb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dPYGbzN.exeC:\Windows\System\dPYGbzN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FybTgOt.exeC:\Windows\System\FybTgOt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HfScOat.exeC:\Windows\System\HfScOat.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrKNPyJ.exeC:\Windows\System\mrKNPyJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bOaQBEX.exeC:\Windows\System\bOaQBEX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LOzDdIM.exeC:\Windows\System\LOzDdIM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OKboXrY.exeC:\Windows\System\OKboXrY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nlOjqmn.exeC:\Windows\System\nlOjqmn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BPKhTbG.exeC:\Windows\System\BPKhTbG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kHfmmSD.exeC:\Windows\System\kHfmmSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eOyIvWr.exeC:\Windows\System\eOyIvWr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ClbVQLp.exeC:\Windows\System\ClbVQLp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kQjYnKz.exeC:\Windows\System\kQjYnKz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\djXoXhT.exeC:\Windows\System\djXoXhT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lMYwpMJ.exeC:\Windows\System\lMYwpMJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LRaDOJR.exeC:\Windows\System\LRaDOJR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rTjZmFC.exeC:\Windows\System\rTjZmFC.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4448,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e8e31701a88bec9f5e5d0011c400e10f
SHA1d28b3fcfafc08d5df1495a10bf90f15eb5ed3aa8
SHA25660d9125f9ae89fe5d96d7387372d31181b3cafb0ab6a6c30904747f6eff218ff
SHA51275ca4988d07d543d6fc13861d687d1c29707f7dd6db542829904162f686a0c04dded72022b7a68d2598b3f75d879eebe2bbea306a8467358d4e6c482558258aa
-
Filesize
5.9MB
MD5f37cf4fdcd3f20d6df1765cdebcf2a49
SHA15d1d03d1872cd59c3d482745680a44620b2ba188
SHA2563969538c7a64fdbd2e6eac19f93b50ed7f1efba8c8d13a302382b61dd840112e
SHA51292040a53fd554c0d002ec0ebd4c1247685d130d4c9aad9315ff46bfe3953731f95212466795ebd57eed5ec918e474c60b03c2bedc4b051070b6f95a558d3abf4
-
Filesize
5.9MB
MD59c8ac5546d2e08a1864f4f8269924152
SHA1a57c2138de1c3428ae031bca009cd6663c27359d
SHA256b5b2376c8dd5a3327dfed4b7c8c31c0808fd06024bd16e14cef245498430e6ab
SHA512f92873e0d91f6c361e457e7ea5fb596d542638557758ed0c6bd45878122a0250b3d63f169ed854ff8472b77867c054a2fa3d94cc040807b4fce7bcf2ab10a315
-
Filesize
5.9MB
MD5ef8aed024849e4c249ca23cd6c0b2367
SHA1b573d8d94cfb41cf4dfd974f289e063d4a78f42a
SHA256539cba996b5f5c0631d7ec68b5a05b9a91dbc9b63a6d66a6ae8b4954f61120d3
SHA512fa2894977268c0b592c5a7cf9e5b01fa41aa725a702d3dda33cee80e0eab219f459f3b7f0992433a634238aabf2b9ce02ce46f195421c066e64ba8a895da69e3
-
Filesize
5.9MB
MD5bf95f1d2885909d4fc4839bc35123ead
SHA16a70ec65a071fefe9cf9d52d47468ae9acb349e5
SHA256fa1bc432361ab399a9ffb5227b6ecfa9854d37882315de12b5736a23f85ab89b
SHA512841d5edcc481a2d02d2063364a866c979dca765ada5279fc36ebe13d37eafd40c23e754d00da89b708a7a018927561f2aa1b88ef6a458ad39db48db7bf9a7086
-
Filesize
5.9MB
MD511b41a4e16bb8055fa3d379ebb59cc91
SHA10de1e647bc51af6d8fc300ac2e1e487d315fd285
SHA2567fa00416cd25e01541a0df82d62b622422d75fece9a63d678519113e27ca0bef
SHA5128888b8b5f6e545a21158cf7f6b9643ccc1952f06315024f1a2569663cf2cf49f3912049a1a6034290b53523fea6eb2a7f3e9e2fa84f5d70fe5a022970af0fe93
-
Filesize
5.9MB
MD5213d9b442336fb89004531a33b41fe8d
SHA1e105c0c36e511f5fbea5e4200a189c68babf74fd
SHA25615a473a5dc454ff4fe2bc10540dd6a9dbe376fa89914fdd8e6b0f100b2c2b357
SHA512e6f0c7929c5ed580569f3a0ffa2e19774e436f513951050d108daf6de3fd24c3c260813843c6c8b4e0afb3b052a456f4000bb13d54c8b83d04da7c7b01166483
-
Filesize
5.9MB
MD52400304ed92bb8d0fb03aa2e246eb76a
SHA10e647239b72ee865df410d6f80fd7bb1e3354648
SHA256b2990278976d6b4cd44647ac65304273ab76362cfab53a9509af0bac4cd7e263
SHA512cfa3f189a1e1c21d3c08ca0efcc23e9a2efdc4f924a9ca5201480ef822fea1671a79d3a0c68ce97420334bb8efe73c4c10629deca54684deb59ea2c4441bf093
-
Filesize
5.9MB
MD5b36469d016de27ff532de21bf6e90077
SHA1526b9d295ba8878e970172dd8799dcfc1afe8707
SHA256dd109aa7d84f71130d42b9d4cbd5ab53aebc9841c0f53cf87d855e06657a9937
SHA5127077696afe756b2e29995ef6301cb77812b1b1540676c516c0d09c7feeb8413cc17def949eb3dbb95b79d979520bab6d9f5932dc05cac51a482ee90317ab7b58
-
Filesize
5.9MB
MD568c662f1d8354439662f4ee4ba4a1f93
SHA12f492f23ba2371a960e53f6ed8d359159d4986a8
SHA256da4fd5aa32f87a7bb46e8903ceb00f51221cfef3f1f5a011817efb17a24c7b3f
SHA5128f559f575710fd76c95a10cd6c902b739bfae436ef26668010674a092a359d228b1e009189265be90ee1f973ce181ea2ecdf061b11f382733fcc586e0b5da3d2
-
Filesize
5.9MB
MD59e5167d6ee3d91859a98dd0e8e748dd0
SHA1dc57e3bf48502e231500a30b0447eeb3147b8517
SHA256f633dfd604eeb60f10fabfabf5e9d5635a6fbe23587152ed1139b0ba08dc972d
SHA512cf2fd8919b80c32982d18e2d74f8c462c846fbe12387671b30bf00729f68b020ca13975b3d74b3e2283dc0ffd0862d02d1a569884c0ea70f390c4a29ac9590c4
-
Filesize
5.9MB
MD553224fe69d1efae80d71488beec8f27f
SHA1d29ec4d8f75bdab0634326e73a7a76cf4e075e25
SHA2569fcb62f902d82e5374f09c85ad234dbb466a5a804efc6c587342af6a9f5afeec
SHA51256d1659844c18196944f55dfde67c203f692694b105136c02b4e7c0ba6be4f31d31906d31698f0c4db9a2683da6d2cb162096f9a5affa4097e790f694cd7e331
-
Filesize
5.9MB
MD56ca4b63b34c232ee48783a8aa29030d7
SHA1b482fb3a03a441b180a44a5d3fcd70786df3cb4c
SHA256c832a74d8fc598c88359ec0db01e2451a7f46ee44a3a21f0b8c53b7677204543
SHA5125bf8efedf2a8468b8c217858b91efbafe5f597d817270077c25eb814c9eab35ad0587785f771f76bdb38f83b29e4b74fe2f0e286424211b8d1c78f562f7a669f
-
Filesize
5.9MB
MD589a57cc2c29cb1544c5f7b5da212673b
SHA1a7e280174c43680373639b230e3cf0440ab3f300
SHA256e7af96b428a1329bf18201af830fcb6b944df4e51c16d9e527d6afa1fe9e291b
SHA5127385541950647f9b343466c303d870d2fda18716a9f0cdd5bbaaafb1f372f4778c9a87bde103f336b44b073268c22d2591578c5f2ad5a01df8b638d92ea6c33a
-
Filesize
5.9MB
MD5097f41e6e340cf726595f861551e70a6
SHA1adfcf9c5c8343e09012e3b2f66993bf0c795ee5e
SHA256b0d8a6e90c735177303ddf6156b96ba4c6b43e8affa2bbe8de8ed86fe94c14f5
SHA5122800bef32234335d2616de19789f886b3b056c5ee1b112dd37d7d7bfaa3abf9271fc6b8615fe666f093e973ba730c649dfe2152b188938701f550f436ee2889d
-
Filesize
5.9MB
MD5b717d1f0cc7d4011ed3ea5eccb557aad
SHA1669eadde8d526accaea7e303934afac2d83f248a
SHA256b4e0e14bdf4bfef939ab1916388547e22d5c41d9c0404273c12367bcdfe539d3
SHA51262b1309b96ab1eea5167f9ba8c33f6150bc432f2dc5dba7041d9abbd79756a4aeeba3afe6aeedcfcca43c5cb544d8df5a6cc8a4d33ada80610bf58594652eeaa
-
Filesize
5.9MB
MD5ecbadb0072165554b0579eb0530142ac
SHA193f3fabe6a797908f5858510c3526e35d3eb64f8
SHA256552b865cdf597129db2715f33299dba62e8ccaceef87d5b4bc9d1b516138078c
SHA512b39d21ad7ff557f50d62e1dc303ec8a220861902d9e85b4812d474afd814b65bb9c4ba48ba080bfdd6e9afa6731815937877067325242b98f483f053cefaee96
-
Filesize
5.9MB
MD5bcab6ef321326a47bceb7b1b00e8d2b4
SHA1e3ab27248690c6f8f4bfbf6d537461e4b52b2462
SHA25651d3b39bbad3895f84b4767aee55591dbdb4c70fe76c143ad33cd7f2e2372885
SHA512b83126483119ec5078694060b9fab81b744f08057a60dc7a2822cb3dd45b7421ae961effcc4353a3da77175c897226c4c2e86a209085346155945bb86f0d4e9f
-
Filesize
5.9MB
MD54c0895c2684e4f4fc42483bd0122e634
SHA1c8e6240bf89a8368fa554ad8862b1c221077cc2d
SHA2563634dbb4899329cc701f83cb4c897347e019991fc6c823ae7e2a94218acee37b
SHA512b5d8951d856dfe5f68cb75025e16cacf3faac697e5fbd7c0cb5d6e4b581223997c880d13548d9c2be17203212dc48657a4fd06bd4561525069db7ea1061b39b1
-
Filesize
5.9MB
MD5eefe13455a7ff44c62ad90456b4916fd
SHA1399d1857133a68f3629abbcc7114c243f23af209
SHA256e465ed1a013a7ab7106ad62f190f6f41e98cb39820f3b6e8277613de8fd4f19e
SHA512120fc8d653b99100a47624b3446051d655fd97601fb5f1490792956c2ea557b291ac90402653636f97eb7bc91445de6d605e267db65945fd8b7630ab071d3058
-
Filesize
5.9MB
MD5b0135379d118833e31bdad20e29712c3
SHA1af58084ccdf1439fa4cc21cb48f65b6fd94c4165
SHA256676618faf7a641dd48d1f3ed072ec9899c0d539326e0d55193c6aaed11923597
SHA51244166f39b9a8c30796da0702a0ddde25d7559dc289d016854c2c08d2cef9b5cb75cf41f6eb4d52d1814a058e76e779233df878e8d3c9a3194a7aff8ad824bd25
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB