Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/10/2024, 09:45
General
-
Target
2024-10-01_0e3c48810862e57adf019bc2338120c2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0e3c48810862e57adf019bc2338120c2
-
SHA1
b687fa5577598db21f0189f388fe0e52db99f234
-
SHA256
4c70098bb041a43c73f604ee408fc97ffba22d41f1fcaccec2a081f5cee48165
-
SHA512
54ffc052d7ceee532916ba477d8a8441851e03062afc713efab32f349368c8e1601f724b48cc8990ba1762c26e232072bc1ceef1a0b6c4aa733c72c441455162
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lUO
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-01_0e3c48810862e57adf019bc2338120c2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-01_0e3c48810862e57adf019bc2338120c2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HswzurV.exeC:\Windows\System\HswzurV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PvtYjUV.exeC:\Windows\System\PvtYjUV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\akdkKEh.exeC:\Windows\System\akdkKEh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tdpeCnn.exeC:\Windows\System\tdpeCnn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mlrnixW.exeC:\Windows\System\mlrnixW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gUeByeV.exeC:\Windows\System\gUeByeV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\leodnrj.exeC:\Windows\System\leodnrj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hhTSfng.exeC:\Windows\System\hhTSfng.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XofQUXZ.exeC:\Windows\System\XofQUXZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jqtmTUY.exeC:\Windows\System\jqtmTUY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CiPHXlX.exeC:\Windows\System\CiPHXlX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kGoJOIq.exeC:\Windows\System\kGoJOIq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VOjJrUG.exeC:\Windows\System\VOjJrUG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OjiYfDp.exeC:\Windows\System\OjiYfDp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QlXUUcf.exeC:\Windows\System\QlXUUcf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BArkQpA.exeC:\Windows\System\BArkQpA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xDhkYju.exeC:\Windows\System\xDhkYju.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XlfMxdq.exeC:\Windows\System\XlfMxdq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EejUoDh.exeC:\Windows\System\EejUoDh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ennqPbu.exeC:\Windows\System\ennqPbu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GrqQUvI.exeC:\Windows\System\GrqQUvI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53acc0e8da9e86535b78aa81cabfd92e7
SHA161a95b2bd130de9e62f4f9cdef38e8e68fc3991f
SHA2569b7f5d921dc679f01288f8042f5c29741d65dc0cbc01079d43137c3cc1892a13
SHA51237a42fcefb57015fc6f14fd29935ae2d1e21e98ad6b5583412a9190e8b8e10d1937f01c89cdf88ce325ac24a77eca59c3b77cf123e63fb8b31dbd6569658e0b1
-
Filesize
5.2MB
MD5f03c2d857779589e6a1319ad26e54680
SHA15e18e590b0312c278cdd30e17381a2cdbf686635
SHA256800cc2d465a07ac85b08060a491a11f4541c23033785d100a6558a7d52028593
SHA512c36439d5805d6c2d71a8e5e7eae9d6e76fe0120490945d66eb3002a7594107ecf8f5f7fe49bb9a7ea93021f8b94c4728b3ab9032c9a83eb9633bd7202cb3609f
-
Filesize
5.2MB
MD537c2862f059082c3b9de05ca2d61577d
SHA12137e2b5e82e4e969a0ec384c435757d774a17c8
SHA256f7d2796022614c6d8d4118da881d31bd3c40a0d71a68d9c6cf5dc5b0b8ffb5d6
SHA512df5a8f5c05e1a9e21e8c25fc6f908cef612aa0f02abfa15329e2317823bb420138f732341ee36db2c4d2c1785adc0d15a1ad1baf24008ac81e02533dc6fbb466
-
Filesize
5.2MB
MD5227abe62b011657bc4cd773a20a58b2d
SHA1123b8122fd5b66bacc36a9703a96a283e55b942e
SHA256895bf2c840bf5ed38959baccfa669cad25f502f197a6ba3fb8c5d05108b002cf
SHA512d08315051173edddab93cae215ae70afd730ceb2e3ea8ceae6e08b93d4b3c44e663541c1e225575a95c0943226f9ff68ce1e55c6b7bd48866299b759bdc434a2
-
Filesize
5.2MB
MD5696ec4aa2ef0d0ae36ce647d8da166fd
SHA1b88c97811b8965c74a63b09999a1fe393cc1672b
SHA256cdd2ca6c8165590c4315a4e42c6fc51f5700ba685eea5931c7f2303217ab7dd0
SHA5120812048085a05abb3e226223b056a245b43da8d1528b365a70acf36eb20c04f4c3c372b2852bf3c646770caec12f48c66247d068d730384f789011f1c8ef797f
-
Filesize
5.2MB
MD50c089d6168a1bad3a8715967af143833
SHA1e4fd395db36f7534ffa4f0c911da1019ce025e55
SHA256a9057d11121ef626ff13045def6458da92ccfbc3773cd2898f3bc13277d4686f
SHA512873fa5b45dbf7a46ce1c84a423e8b97e9b0e4da411947b976026ecf0c1575cb7635d3ed2eb8573b4619ace45d2b6909a9c74f28095c40505dca5a12dae2e311e
-
Filesize
5.2MB
MD5f8b8ca087d8627125f05674a52529d8f
SHA11e89633f6f015bdeced3c5b4cde212b3db6422e6
SHA2561972c3ea72a7fd3a9021b343f7903203a19af34741032739e744ce6dd092dadb
SHA512764fee7d8eca26ba6b44f23e7bbe366aee35b1052aae10615272eac371aa77d4ee0b7669f3353f3cba12ae09cd1f43b195bf93ba4c31697fe44e760fccd38665
-
Filesize
5.2MB
MD557da504b2097c336f0c85cbb14c76923
SHA13155eebca2887a84e6ded8540707d8be7dc6bdae
SHA256c1ca2a9047c88083181f28f92a06549b0070cfcd8aab5c6fb6222107311ff3f3
SHA512be9dc97b457b4ece09998d9419dffde85bf0f9531a6a0871b641009c3a65a37d07746cad222298ee7612b2d4c2aad00dd20fa0132e63e4be39dd0c962612912d
-
Filesize
5.2MB
MD53612a527de416bf1dfeee9f9534d2c4a
SHA1965a563800d6f7dce1fe0aa3eb922ef387d7fdbc
SHA25678224769bf6709587ef8e579625b03c8c70e6189c7a70edad5cf420524d96847
SHA512cd251db25a906387b9d8e36664ab9e74b7e54bd336e1367f2e127fc77a7607e88af327d2d3b30cb7e0be3ad30488d97cf726ce23cdb0eaa0081321a60bb82450
-
Filesize
5.2MB
MD5dae95494ae25ba480b154696ee7960c3
SHA15f775b1360a08e93e5b20d994f4fff647cf36394
SHA256a47008d08486545926ae2cd1bb5b73cc93be144e8ceff2b2fe38832f5ef76dc8
SHA51268d410df481865478f43f99685c4274a8336ed657b9101c9e112e04e9655e0648f00e4723846c257cda404bdbeb1cbf939dbceb9e5cae9d9461cc3de980e8b27
-
Filesize
5.2MB
MD5069f73c839889691e5cdf591b8204d91
SHA1552b0fd4826915a6da7066a5416b44e96c9d6530
SHA256bd899ed09dc79c725697f4b56ae362203ce9b5508146664b49c8305f3b0bbe54
SHA5129f2a854a2249b1ed3b1b10d07c1d29543cde288e2c9592aabac6fee2a8749870dac079fa01ca7eda6597ecc1d7eedd8512f7c492d4868f76c7026a3f8d932fb0
-
Filesize
5.2MB
MD54fdab18dd0760014259bfe9c46b5d6f0
SHA1428219d2d4c14f8e46b3eb54e5bd82e0cc4b239e
SHA256bd9af4d721339e0255331b88bb2290baea526190c89d6deaa298cbcdf6f19f2c
SHA512e5f7306d4ce7b6f8af7302f9e2b10f12945f99f80eb2fdbb8ed4bb9dd818b5efda39d96b052879c21506c8665ffba91bcffef70e69304f99b296c757e8519c14
-
Filesize
5.2MB
MD5ae920c057192d2c37c22f20455fa691b
SHA1be484f25346a95c82bdd0d49f4cf6589f16b71f1
SHA25647b6f8b56e43a82d84070ab95324424eaebbfc3ffa957a5cc70f91afc0ee33fb
SHA512e71bbc147dd9a3a1d3ef5856930bc0ae2a3e43b03fb72e4f63c2d5959167c7f1ccefbfb1e2d0ac7a08fee5d848399a9cb3b6f8885febaea09a5de7366b80edf4
-
Filesize
5.2MB
MD5cfc26d5f69fd568028ed72b759e6da37
SHA1c871c961ff42e8d04ad9fbb2fcaa33cd80914f99
SHA256dd707f1449130fcaea395796a27f47cba1db6e3cb87719d0fd0225130340e400
SHA51289ed5c5580ea9a16a58748049bafb26abd2ac0bbd297f93c5bf05d308a39e088460b8923464bebd41f32b5125045a38bdb2c2c9ac8306b1ef7900590ed84f5df
-
Filesize
5.2MB
MD581b0b3f487acf124a385873ba72ce2c1
SHA10a58e126c0c198a86e877b0de4b4ca71f90b1453
SHA2565e3073e8a5e2098580a5b6bb66e07821e74c131aca22690f0041e70ea2a15f1d
SHA512e93e8b3c4fe20969677cdea735e07ca7e080775a97a9b3c55b815c72238a7865100c7d3fc980458b72a41a06113fd80f4219fa996d7f0a203f2a25fa51fe11f1
-
Filesize
5.2MB
MD595c8ad0f944ca9faea0d7170ca2d510a
SHA15489ac3332732ac3790dafb8b1a30e2b820bfd71
SHA2564e065492bc33da97e2ad77984a3c0453833354b6fc37283cf961367d91c2f65e
SHA512f3b4ae2b5be63a8ca17bf07701877771584e12152a9183c0352bf6e0032281fddb4ef1f7bc47956dc6a8996d4758c9792dbeac7be3ba05e76c9bcae172b477c6
-
Filesize
5.2MB
MD524020d3393d1fce4cf8c0dae63c72133
SHA1ca25cd720b2b76b2969bd61cba230e8b84b62f82
SHA256df18b59228fd6ddc1e8a70e989c83ef8149c6607527f997390f609bf3737c284
SHA512ffd06895f6c0a9220560551433e30ba9f229feef428868dfa5e5aad617b6df282d513134f6898d4bffb7a74d45283b9ee307f54123d45410b8b2ff909f3c7621
-
Filesize
5.2MB
MD5cfe849a572db0f69e8a70988e43343cf
SHA13e015b952f834c35c524e24e6ddd49609e527dfd
SHA256a066ec07fafa3303be54cfe9f1693a6f9ff3706ed1dd07231b1cf965e5e69474
SHA512c7b846729bc4c22be177e3f25c880f9035e815de7348c8ce483731903a90a240628485c39e3364b61eac710cd08aa29c6fe90fcb5a355e030fa9ac0982a98ccb
-
Filesize
5.2MB
MD5c3f2ab0963c71bf9f806dd9881c57ec4
SHA1b90b25fa9913527c3471bd6e7113c988d1c58c0b
SHA25655b6af3ece4229820463f1a9c951a6d67084aa5870d8afae0f70cdf324dbbff3
SHA5120b6ab5681c00dc70758d164c3d6f368cbf2382aec30e843400c055ec880b7068bf8ac46a059a5540a7481e92cf603023e44c89aaf1b329a56d9ef475ad73e6b5
-
Filesize
5.2MB
MD570960083a18829f478ebd76e31f5c349
SHA18d02e968de26a8a8dcc0bf11423c685686b11c03
SHA2568bc532610109a4b5005c31e1a13090d134bd446259b0fa59d1686981b0abc3fd
SHA5128e5a9b89cf2a57eb2e74b92131010139280fdd092ca431806cff41a27eb09f516e4f6d47628e26d82040797b2199946e03c41d2e3cffabcc8fa5718214fe9fff
-
Filesize
5.2MB
MD51d319bd6097d9f34d8925b42ae359e7c
SHA1c966fe04e25864a4f7c2bd69f7b97f5e900ef97f
SHA2566269e296313b883b64bf85438c70567c29dec2e043258f2829a202382a9fbcd9
SHA5122bff5cb9ff82a74788d3b26136265191623b1b1cfe1a69a379ff3dbcfa13b91c06d0fa8068f035602826be9d3219536def4faf7396b10164ca789fcaac791b2c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB