Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30/09/2024, 15:31
General
-
Target
2024-09-30_f8ab2ddf99e97da64b99e5b6433e786c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f8ab2ddf99e97da64b99e5b6433e786c
-
SHA1
f2c3ebdda9ba882cd6daaa21d3811e2ace368e06
-
SHA256
6b04d88e211747e105b910cbda4153477ab6613dbab87ef5cd24f78020e912ac
-
SHA512
61ee7c611bdd479a221611b4d1473ed148192fa37c66b47d90fcae7e6faded0f40986b3f3291d9282fa1c490e0f8f2bdd60870586324a395a1bac78e21a94845
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibj56utgpPFotBER/mQ32lUY
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-30_f8ab2ddf99e97da64b99e5b6433e786c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-30_f8ab2ddf99e97da64b99e5b6433e786c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QytrJOm.exeC:\Windows\System\QytrJOm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DrfXJGa.exeC:\Windows\System\DrfXJGa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MoFsBfP.exeC:\Windows\System\MoFsBfP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gMIazNe.exeC:\Windows\System\gMIazNe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rdIDfPh.exeC:\Windows\System\rdIDfPh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fUuIGQI.exeC:\Windows\System\fUuIGQI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\soDNuPE.exeC:\Windows\System\soDNuPE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfNMTWD.exeC:\Windows\System\kfNMTWD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vftKUDf.exeC:\Windows\System\vftKUDf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fQDfLLY.exeC:\Windows\System\fQDfLLY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dMxuXpq.exeC:\Windows\System\dMxuXpq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TxgyYKm.exeC:\Windows\System\TxgyYKm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ShjrNel.exeC:\Windows\System\ShjrNel.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IwJmqcL.exeC:\Windows\System\IwJmqcL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VGmmDIX.exeC:\Windows\System\VGmmDIX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xuZigiw.exeC:\Windows\System\xuZigiw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rKRuLsQ.exeC:\Windows\System\rKRuLsQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TNQQFUo.exeC:\Windows\System\TNQQFUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lHOClDJ.exeC:\Windows\System\lHOClDJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zlKkoYb.exeC:\Windows\System\zlKkoYb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fUAKVCb.exeC:\Windows\System\fUAKVCb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD532abdcf1e2e2c335e9681d8b15df732e
SHA136c114cf1fa011afad0ebe531feab461c240b9aa
SHA25626a0c15e4fc6c88d06cc91f7960a007703bc07c371d1313a1e4cddf8a8321e41
SHA512806ec8712be06f95f415d571d6a1b34fb5ee79c248f312685c3852b2c13cfc0666a0a4e648839056ae5a252869635fbc6a2bf39df97c8453fbd99c7301bbb20b
-
Filesize
5.2MB
MD59fe5c3d353fa1a4a8b8468d6f9c1aea3
SHA11099737e9be5eb6af5c5d81ddb382770cdbcf7af
SHA2569c4874312a1cd3f45ff7281d115cfcac4e87a67c2ed1b432f97489b0972b9758
SHA512f5bf11b9e57f4a698e2180989df0abab5404d3328e389320c907e56630cbdfe4c49a8acb91cd3e184249e9b08752ab9084a90a434de896469bababe33cc4d4d7
-
Filesize
5.2MB
MD5a9ba1e11a3f41ce746fe4dbb180e5704
SHA1fd44b62f5df2f314c15be3b4f9cf6ee91771b404
SHA2568c99af07f78fbfde4444c7868a4fb0dfc0ace3b88f6d08d5d066fa4ac422f249
SHA512160dc9458438e0fc0f8a7ed2add42c768359c6805e9c09fccfd654877a07a99a088076a424c7c9a5da72dc3c43712ca17285fae0c09641e8efe8a4aff342ead3
-
Filesize
5.2MB
MD5f123df7efb1bbc3fda07b05534ddaaca
SHA1b5e308cc1bec41edcfb49a0d0c42f39c79491985
SHA256ee56ce51aba21ffe6fc2b761e8f62a787da7e484e6849d4b16a8ee25d6a33e39
SHA512a7e480ba9af9fda156fb649dc995513982724047c5b0fd8f84a03e70fc2e524a33d7900ae91773962f16918783685177e053c75b08cd61e3f8ed42ca86e2208c
-
Filesize
5.2MB
MD580ced3c15f639506a53f3e80e0d1767d
SHA1ccbd0f20aa5027b0751c501e5790f279c23279b1
SHA256e182dd0347675da7e21c919e066d90c96c058c13ede640b676df1514fbaa51a5
SHA5127f265b1f609f7c6db204ddf835f6cb126daa33c30a209fb5ebbf8f516abbbd76dd5adbaa21b8290fad60dcd385f4fd2f25e2af376147db13c52a2d66fb7f60ee
-
Filesize
5.2MB
MD5137910596c1fceba2963a26a16ec8ebb
SHA170bc8a700d4af3b416ae24a515007a4a73924502
SHA256ad3d40c95ce43fa36f570eb94938a9682b16834382a73655d7bd3bbe1e74e810
SHA51261b192071c71d851ec991854da2887ebd0687537fee164c970ad843db1af6f863ec9ca338002c558f0948ef1837c09c7f18f79eb9d7953f63bd96189016a9e08
-
Filesize
5.2MB
MD55397af10bd9b996b89b3d92bb07e8daa
SHA1c69704d0c2e677e5fbfb610225b072dab2b53cc4
SHA25667a255ff01cfb4cec50bba1c2c9f396d924ae7eee3b3fdcc886e288677cd2158
SHA512e2c8c4d9d64a6728bfc99df72f213ef6425bba6eccd99fc43b42229c4a1e8eaf388a676952324ea8a2b616ccaecf87ab60ef411cc3301274bd8a0043b762e4d8
-
Filesize
5.2MB
MD5b6de3741c11374201d318b49178376a0
SHA14cf2abeac03d530006a2fb6e3317058505434077
SHA2569a1cff67bb71d39e6b8e5a57bab0783213062817cf44a156ada3be9ee8b21ecf
SHA512df06e93bb3102af3e8cb01ed51679e8164e8992817f3f28aa162bdc453e6aa47409cf48af162f6ab6f10ec508c2a04a5dd493170749eb5c072bdeb366ce377bc
-
Filesize
5.2MB
MD54733cb2552a0f2c346f29372d27e45b6
SHA10c00979cbe4c400f2937fdb1633fe6998d3ed8e7
SHA25614894b444b670b9fc77ed6fcf23cfd62af079a1d5258ba034bc1c74c4532956e
SHA512bff506c3d68d25a8be3d020e0dd7008808487341216dc40a817116cb5d9e2f5daec1cdeb76860189e0f628ac8bba4b05bd62dfba379d3ce5984b66fb3864bb69
-
Filesize
5.2MB
MD57463403727e0d979091507711bcf34cd
SHA12922c12f5266e71601241fd227baf2ef94ab9382
SHA256c4294cce06fcfbc52c19efa5e3b189e06c95c5f75dd0ae2dca5bc119eea168d0
SHA51280ab55a700038ce210992236aec5c37a693579fe995099d02c817f834358a583bcb6fee6c604e7c05117d42323b8af7cc3dd757365a1468b2e7e9a996889752d
-
Filesize
5.2MB
MD550f0bc0f1985d7ca06b9a0a9f55f77be
SHA1c28f71b1ee6fb1dac1aeb67d3633dac435bab82b
SHA2563d64fd3b079c4f6731040cdc2d1af6519534c6d9cc3cacff0dd9bfcdf9c9c55a
SHA512efb1527987482ca9542d749e15ff002bdbd5116ebc6ce67edeb602a8676f5b986b4a100d72a63f311793a56554be703cb13e3e2c008193931c4bc940bb68a212
-
Filesize
5.2MB
MD57b74225d5daf0436d63eb7b4f111ddf2
SHA131729870fac05e36ea84a915159d802835281cbd
SHA256c1b8de5d999dba75c367a4f33340938327accc280ce25bd9b9495dbbe252de4d
SHA512bd15deb8ffc320b3e7a071dc2fa25a428237b1a6c38676d5d19b0732946db7892cab22afa6602fbeeb22e1018cc27f55f5c97066cd012c06c008632fc52f2492
-
Filesize
5.2MB
MD5289843740cd9be81d01b0960588ca90e
SHA187940b530d86d3e1db70654bde39157eee96b1c1
SHA25613eebda5798385e8ecd154d4b609d9694cfa4afd8a2223b0b4c0d7425f6b1ec5
SHA512d99902bada116e7ca60afd5cb33c3f2b280abc3258fbb9a2d4112592f34df5ca1bbac233cf0bc72852ae2027737886eef8fd73d53b22a0dd957d89f56544b538
-
Filesize
5.2MB
MD5fa835ff3a6dbc337fdc4bd1b615d623e
SHA1361446b35807bb2c78d7ae372d1343915661f09d
SHA256751bd8e8ae588d3086fdb2beed8e945d4dd6cfa2e98875e5e01d1dc55972e972
SHA512775aef91f87b95bbdf6bce0c39959752a02dc7461868aad7c5f1fc1716f6f0e5227cadd6342d813fb013fbdfbc3ae98595e0ae963c0ff8d5cad35873dd631898
-
Filesize
5.2MB
MD5f6f7fdc733ac8089b1b5fbaf008c6771
SHA19092bf95e9fd7ab739a9000e26a1e2e4fab129c7
SHA25698e0286de352ca4188d6849f31b8781f0bda8294c47cf5985e7ca5808cea3059
SHA512c90a66cb904985ab8809d0abff3a0b326da09556ea4061bbfb969cb03f55a5e9b48102c0975b80abbff1171397552567123ec4e3085b0fedebec0cd51426056c
-
Filesize
5.2MB
MD5d80a737a7e752aaa7735c62a90ab0eb1
SHA1d99d01b80e504724a0dc37dc6d8ca43bc0250731
SHA256a09d0005a078d6ccb5d7104a5c0ab96a82e866f64ebf9116a68310709fe5ecd8
SHA512b4b0be7e5ec07e3289639862b11020f3bc20ea87786de7ea8ba442963af269adc77baa395d4b12ce896e69ad6d8f89df21a0165148c68af9fcf06438f46bf6d9
-
Filesize
5.2MB
MD5ac5cd7d5a99e2fef1d3791428622fc99
SHA19baf8ea70fa24a1514ab54529cea2ebf3e627eab
SHA256a9c6b448aaf153abd5e4fb8678330b53390918a5ebba514c8acc13ef784451ff
SHA512e356b142125f96dae68f02a539cab5af1f5239804d3177c98a73c2a4204fec74765731ab48117c6427eb211c091214f168b0d6a8fd9a6f69619dbd880e421bd4
-
Filesize
5.2MB
MD5660c68a361e8b04a8d833c65cd911637
SHA1f662644d4bc51aad11daa80ec1635fd50e381954
SHA256e7b68b072f01485673a6bdb1d18850194969272bc51a6b17df60f3101251a1ab
SHA512e4415b1a8709a7caf4faabab7b35b0c8d12d943394b3268f8686d3573361de0d8b57dd1da957abcd4e570f5b49014eef3b68f1ca8da42cdf4e6c80eeb973e58e
-
Filesize
5.2MB
MD5ad3044e93b10b95dad1d4a7e3906e0e2
SHA122ac648594683830e3c7c4145595f65dbcb97521
SHA256645e76cb598084238a5c6cf2f049eb429cc89a52a09cc37a6d4279223d387c19
SHA512c1ab21348c8de5703a63f20b3daecbbf877b954397325d5a132d8f47e17afbfe1cd39c19eb38f5f0d2cf92ef1c797634e97d0fc8e6839a40306cc0df84b4739d
-
Filesize
5.2MB
MD5a147bb01030a9dd4f82cbe3af6aefad5
SHA1947b588eaaec50617dbce4298bcd6676abb64c27
SHA256e9073b197381c57b71afb56d73f8fd58ef3a9213b3552c9b6db693017cf7b97d
SHA51293931db231e50d5b432c61246abfcbcdd9dee9c1410072adb3c66c735f81717419e8bcf9b2cb2b647055d9fd7581a07be65053520e5dc268a7fe5eba2e7979de
-
Filesize
5.2MB
MD5107793d78379376594fa673d370f8ae7
SHA1085a6b5a88f60792a82b5f72568d6fa423781e50
SHA256646e2fa3dd750456d7c170ea4d43e9981ab9a035232101b3fa23dd3c6863a92c
SHA5124f56c2351e8dc7d5c4941d5fa401ca1f8c91179bda35cb2ed4ba2809ac80e7f0c78db0f90b22c689e2e680ce55d6684692375b0959065472c8ef4ca91db851e7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB