Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26/09/2024, 18:54
General
-
Target
2024-09-26_64484c7afae991825ecb111e736e9a4d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
64484c7afae991825ecb111e736e9a4d
-
SHA1
25ba0dcaa8d4c8f56a415b4bb2884053c2ef8068
-
SHA256
702426d16bcfec8399b80af291248415654c977f19884cd30822d2fcd3364f82
-
SHA512
a03ba06f5c8ee4ab0f8dc63233db331c093d5df5fbabef9431bf078827307ea8974e89cc52d130ed89fbca8de60f5a949c14700db5bafba9a270f7d5783d2d78
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:T+856utgpPF8u/74
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_64484c7afae991825ecb111e736e9a4d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_64484c7afae991825ecb111e736e9a4d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gYYmaOw.exeC:\Windows\System\gYYmaOw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yxkmZNH.exeC:\Windows\System\yxkmZNH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vMYuVFs.exeC:\Windows\System\vMYuVFs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jwbXKeg.exeC:\Windows\System\jwbXKeg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fiynYBa.exeC:\Windows\System\fiynYBa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qyPGNKz.exeC:\Windows\System\qyPGNKz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jcHbbBp.exeC:\Windows\System\jcHbbBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tHiFDAO.exeC:\Windows\System\tHiFDAO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MtuexRz.exeC:\Windows\System\MtuexRz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZsPpKiL.exeC:\Windows\System\ZsPpKiL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FRSKdct.exeC:\Windows\System\FRSKdct.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mwtiuGI.exeC:\Windows\System\mwtiuGI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qiRyzRU.exeC:\Windows\System\qiRyzRU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nDHmliB.exeC:\Windows\System\nDHmliB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eshJgYp.exeC:\Windows\System\eshJgYp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lMeonZB.exeC:\Windows\System\lMeonZB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mvweRWv.exeC:\Windows\System\mvweRWv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fkGfhEx.exeC:\Windows\System\fkGfhEx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LFzyysN.exeC:\Windows\System\LFzyysN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aEnQriJ.exeC:\Windows\System\aEnQriJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QcnLZCJ.exeC:\Windows\System\QcnLZCJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD57457ae8ea19f839b66e39efe8b009494
SHA1297edcbad40a00d595e105dba0662419c365c7e2
SHA256c30da25719a8fec7264be686dd7ba3e4164eaa8ea96edb62f6c2e21bb5bf9d62
SHA512f7aba3d6efe714f3f675f3f959d87ddae566df069f64da2c31831896f098381ee959710223f2a45aef0f35872188dfd88547e27a43e6a026bf950fc36a5b078d
-
Filesize
5.9MB
MD52d8e72e32b4c4847db39a59d4bec3aff
SHA1039101e09baedda1534c52cfad07c90775dc2c8a
SHA25646a1dd45fbd940e177e1d61da29fb8067ff38ff6a0c3f5bf16d6dd4d09ef88fb
SHA512133a5e119bca583c9b5bbb98299cdc8d6b9ee0e2798d483556067d8df68e18addb53c088cc7c7595e249b1ae4fc46dd954cf9fc4e10cc3ce1fb0a52e00dba291
-
Filesize
5.9MB
MD5e3f1fba3f3c6d46f81dedc704464e93c
SHA120906205e108ae5a35832848550a88e38f231c47
SHA2561a3035b14c9c7bf748883ce89a05c2195eda4a93077b53284df91a9601f9cff3
SHA512b05c7c1f2fccc549d1de0e574c2a595f9c45b7d3be2bc7bf64c520180d63975e0a54cdf8957521433e181a0eda1e4f2610a3ba61c702130c6ed3b45aec5197d5
-
Filesize
5.9MB
MD5dd07efea670a57aed2582ad0f56a7885
SHA16401b752ae77249737e44a0b80c50df3de2e6436
SHA256ca4cbd5034a86f4d74a58158edf06461c8dd835ba9db8fc51416774dd1b865c5
SHA512121cc50c968b2e906dbbc9050bb2c63e698332c0c5f274a99075eb74d92cc50f97ea20f526e21228d1b61c5a8e28d186a9476ea811453fd2220df09308e918c7
-
Filesize
5.9MB
MD53eadb937a67ab9552a338b047796505f
SHA147865fd4368a66777ccc1fe1b7eaae8817a92994
SHA2560b71faab463b82e299429ea79e02a747d7464371c99dfdacccf0c0fc678c5000
SHA51271474cabbfc5f74fbcbba0344444bc6a563a04f46c44985f7327d940d70d6c4988d8677b9aea5380d0fdb54f3754afad5cdf5af0b486f95f05f879f6c5ba7b54
-
Filesize
5.9MB
MD5c372f969045bf385af361824ba0d506f
SHA1ac69f47665c7c7ccad780f421228b9ac377990b7
SHA256818d182acbdf539f01289e196982f0c97376bf77f10a50c2f63fbde4c9972c72
SHA5125c190af393204ea75a10c7ec654764e5b396a32c3604c32fbbc18ecf27cda227c4777f55ad066a863a644be42daf5329d6215967853cdad0f724aa0cec46ffad
-
Filesize
5.9MB
MD5606de998800f58762dc373b0e3d02a1a
SHA1609a09fcdfb008be1f0ef71791d118487289df09
SHA2564311a3ad2df0f7131226fc4835da85887b4e2d3e6822cb6b156b79bf6674a9e6
SHA512d7145b0424e1eb729c6088551e75cf07f6cab78d6c467214b8a0fe3d5b82a129ec38b4db0c371cc6ff6504b9ebbd0d3870c05ec0703f7b6002ab7d9c6bbeed72
-
Filesize
5.9MB
MD5f67b758dc03e07a153a7ee8ae8d17354
SHA1fc3a4d36a889ef6e230f59bf37d974d97b853f7d
SHA2567079e56bf7a5bdc0c22db0faadd7052994506e653e2c53ee00db11c40952d6c4
SHA51258052b123aa719ef443d8c510c7c78878a7f82a0a786ae29c23143f20bc26ee9a74a156f6fcb43cf7e4cc710da4b450ab780a5c2396b785c0466efa18a76f84c
-
Filesize
5.9MB
MD5d83224d1d241474d48a295c91368ec99
SHA1d5943b3d39f3663dc4f09b4a20f8543f0375d550
SHA2565e950603ef74b38e4e82d846a2932d03476e96fa61408834fb975f6d474ebf84
SHA512c3aa4290bdc143440c48f14336131785c321a47e4361a75751385f62841a1b9628092560b65b3760cbcd14985ccc4bde80f76d512535d361a818bd785eeea9b7
-
Filesize
5.9MB
MD5e6c867c7de91ced8babfa684e13b8454
SHA15b5dcc7284f260970d179ac9476e90e9db07c3f8
SHA2569099ba7a61d21e947292cad5cdd8bb43246dc7a68c9c5b85706abb41bd81edf7
SHA5129f589de229a5cbd6f51d2e78f0f7f61ff7d749886060ad581db902b694e7d4b25f2f68ef602f28f0992b3d39da05945b0e1c805482849cbe315738d828a9b0a0
-
Filesize
5.9MB
MD5efab8d3e29b5d90bfac18350c8b76f2d
SHA1c16e36b7ce1699ab742c2ed30974a025e37aefca
SHA2568ef7073d756338d054592d8de60be732e8a30dbae256f01c2bacea4cd54e40b4
SHA512fcff637406f273be9333bb33b9885b47d8ef89af25afb126d50a491895409017e7be94398f24ff6ab3fbc2e2b65ca884e8f58fee733af56e8590549b238b9eee
-
Filesize
5.9MB
MD52622362b014ba4e9e91a7d2ab722bde1
SHA188102845072d46e732191a45513b2b161c75e26b
SHA2560047edaf6eef8e98de2819545abdb10e2b92e721e559c45d08c40a900d389de5
SHA5126534fca5a9e9008ed0aa17a2b4884c7908cfde303ece827cab6fe874047adf96daa38007b5c8f2a34e7a800b5a418cea08bc55eaf842855eab3fc990d48a0e25
-
Filesize
5.9MB
MD520357c42461e397be9d1470cd5da732a
SHA162ade8ca60b8a5cf44a3017544541e42c84f76e4
SHA2565f378b80d943d88c658935d7f774fd535e9ab6e30383ed1585b599fd8e4e7f93
SHA512cf289a7b11b2877432b9b8dfa71cba780be82afba9b4a54ec43fa855e45be69b19c42470019d0638da7ebbaeabdf5eeb844a36f11ec6c03497494000dceb6e7f
-
Filesize
5.9MB
MD5464f5f481457deab36a82144141503b5
SHA1fbb0e26331d1dd3729a7e7206c3b967e415df8bd
SHA2568e8195c468824f47d7e5b4e8cd9cb4c2c850d62e7d417a3a9b1320afeb46caaa
SHA51293be620db070de2ad6622f4f13f03968f12e5d0bac3a6f55773896c58a6938829e898fad3051c25602d9419fecd0a99138316970b0c18094935ecc55837e82c1
-
Filesize
5.9MB
MD502a3a4186b498b4c461fd4eae8aa476d
SHA111590001f1b3b90d8cabd5259c151568aea390e5
SHA25665aa82cd783085b1073de345d40ad88cef1f8f60bb9867cf4ea08fd31648b608
SHA512ca5ceca71dd890125021ec6cf2c56287cbd750cccb2659091b59e3694e3a452657736d50774b2d691526b67bf15db6d9831d1d96ad2e9a48170d98fa2b7b591e
-
Filesize
5.9MB
MD524fe3f5aa3471a049728c0513d3cc006
SHA11fcc58068800c6f394fd1eaaebea01aa459b388f
SHA2569d71067e4ee75fb7e633656f8fc9f5b3cd14d45268673dafb1f4ddfe1d33605c
SHA51210198301c99ca68ddffe3e392f52898247c3ba8f9fe6223aacc500c7881cc6017367e8908ff0119e79852cc4366952894e6e020e8f96ac1093fea26970983276
-
Filesize
5.9MB
MD5e3dce64fa2d6da3ae7e59f69c33689f6
SHA1e2940838eb0ffef1d07bd65ed6af2b09155d3f05
SHA256ec138221c93f00c42cb853c0fdcc9d287231d46b5a837ffc4497831fc7c976d1
SHA5123e7ccb9655e9b7c28fe39ddd3bf3e35be90a087f5834719e343e97a38ed30eb07b09a5f0a7b8fbdbc2e82367cbe6b895813ed3f04a605c15107711ca6a687014
-
Filesize
5.9MB
MD557ebc1306736f7d66e61fa045dc1d773
SHA113679e65170c32bf5827f1123231393e8e0ca546
SHA25626d92ed3b65c43259dd0f685e03848f0cbfcc9ebc0d959d359663ce71cc00307
SHA512aca4bf00fff7d65300d5f6323346387e811c8d83af3b2914d383aa08da6c1b1b1093a2daf05a7f7d5cab931122095ac628b31f5b81138083b2b99b3da97aca54
-
Filesize
5.9MB
MD5b4dece2a64e43510ffc7b7a1ed0b0ea7
SHA1c26c4666407a10af82f7d8b24ea42c3bb6990b3e
SHA256d0954c7ce2d853ec91e3665f6a802650b2de0c4b662e8c848b6c6536514bfc5e
SHA512ed666db0c0495551f6e2d383ad1d7a0a1caaeaad22bd513796936f4d6a08b0afb93c290dc2bb23fc56733470a95c65c12dcde835d96b27b4b1506cd86222bff1
-
Filesize
5.9MB
MD5979245b8864e4435fa48bce92b60668f
SHA14473d10ae80be49634d8d98838b5a87b5f7a47bf
SHA2564d3f0b37826fbd7c9601b305d88f49c58f325aea4ac0db4dc0a2c60f64f00504
SHA512c6a6cc8817e2521c38ca83dfea74b9242a04b6661dc68ffe4f84089fa80494124d3d5540352bf13aef930d404e0fdf75d1d5e8bd8bb0bef090c733bfb820338a
-
Filesize
5.9MB
MD57e37c1236fe28a42c5bb87465b708d47
SHA1e7cdbdc45677bb7d54087a9b4516e83c07786d94
SHA2561102664f38a18496ee03f164be5d09ea706651551540d7ba6f38d7011e9b354c
SHA5121c85e9de9266367176c5b8d874b20c1cccc7dca193bdff2c40ecc5a23e2a215c10cfcb0a0e90f65b30fae5ede86a190696fb601724bb678ec7ad73ace7723426
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB