Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
02/10/2024, 09:36
General
-
Target
2024-10-02_7123140f22d960fef6b78d163671644b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7123140f22d960fef6b78d163671644b
-
SHA1
5bf289ecf509847ce798ccbde8119a2ae6e547cf
-
SHA256
2f279143f622cf7bdb5d5e8a41c71ff128464eba2102aeb6f0283e518f61a49e
-
SHA512
e1a47a07ebe704fe2977179fde80ae8d580a150381524e25ea7c0d82c5806b3b9c8d0885c01285f81b8da276bebc66d16fa74a910038b29fefcd895f8f1b102b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l1:RWWBibf56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_7123140f22d960fef6b78d163671644b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-02_7123140f22d960fef6b78d163671644b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cjqvKij.exeC:\Windows\System\cjqvKij.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rIyjoMi.exeC:\Windows\System\rIyjoMi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wmrxVin.exeC:\Windows\System\wmrxVin.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mJdxhgT.exeC:\Windows\System\mJdxhgT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zEWLDjK.exeC:\Windows\System\zEWLDjK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LjAncWi.exeC:\Windows\System\LjAncWi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VaXKnzt.exeC:\Windows\System\VaXKnzt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rcGUvWE.exeC:\Windows\System\rcGUvWE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cLjXzPr.exeC:\Windows\System\cLjXzPr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VKOjtjr.exeC:\Windows\System\VKOjtjr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dmHHanx.exeC:\Windows\System\dmHHanx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NZFYyaa.exeC:\Windows\System\NZFYyaa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OYjTYTN.exeC:\Windows\System\OYjTYTN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jEGekfW.exeC:\Windows\System\jEGekfW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EorDXPh.exeC:\Windows\System\EorDXPh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XvasRqh.exeC:\Windows\System\XvasRqh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iMokjFS.exeC:\Windows\System\iMokjFS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MqByHcK.exeC:\Windows\System\MqByHcK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MbeigYX.exeC:\Windows\System\MbeigYX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EFDeJfZ.exeC:\Windows\System\EFDeJfZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iJXTJVl.exeC:\Windows\System\iJXTJVl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5599bd8a60fb048061b0e30ad812b001b
SHA1e3565c00f43471d94d1ac6202bf24cc48a358d44
SHA2569b291cd102540f71df6e1bf14979cccdd70f1df895d1711ad75e1cb4899a56e3
SHA5121ce6d7c9be309484bca69912d5eb8538be8c07ba0f79d56080544a299f3d38a09a01c1bce926fe97cc7b500a6f5cdafde76e86ad07bae360304020a41a0cd03f
-
Filesize
5.2MB
MD574d75081062d7f539bc5bfbfd8936ce9
SHA1ac82cc2d0f7ac82a3442e3ac9a0fe4a10c83f995
SHA256064bf1ce17252fe3e215c5ae0350212de07e85f18985b06a6b4faa6454bc6aa9
SHA512ea8f91362c6bb8f7fe421f59816bb9ea3aebfe887d94e6dbf8982a5681fc93a83557dee9dbca2d9b14cca48bd652e0c799f522a7090fa3e8e2386806a5f6b5cd
-
Filesize
5.2MB
MD5ed89c952a034b3b6b4e0c8b68d0db5a1
SHA1b1faf49e99a8ade24f4de26b70c8096dbbe8324a
SHA25613237be0f11d7c2eea004e2f1c4ca46fb48bbfdf6c3dfbe71bd2ad5677a6503b
SHA5126995e93ba1a547f27baf6d9b47acde35f569b0777abd2d8d73e155043872cfe557d32e902831d49dba2b8f75f874de82ed09ccf75f7014c2d42663bd220dc22d
-
Filesize
5.2MB
MD55005cdd0c02245950c32f66617a19bcb
SHA1f6ef53170f11acb2f85b14eae6efec5aee7c073f
SHA2565f8c3b3bf6312873975dad0e38b13901878ab205a36c702a5ce39fa9b0165195
SHA512fe7691d552b1e1d4cf71668df1683ca3827de35f983fcd48e32df386fcd3218cc3b187d4e26e93c4fb633f8aaf9f784c98d7400be76093b7d56b694af2aa5820
-
Filesize
5.2MB
MD573b431c386a7989232fb4ec67be7948f
SHA13c75d50d4a21405fe8f7d9d0844d89fcc3a33f75
SHA25663bb27bf94e34e09b8aedf223e4e3c6b6b24311ef8f84ad354d1a9cbe34e99be
SHA512ecec4596b9cb6e884fe5cf70fd28eac5e27a1d9efb49bfc3740441f654aa82c54a743c8f2c7494a9189daa6492b5c0f98a7949fa84ffe3eb058617281fb6009f
-
Filesize
5.2MB
MD52c7948e307d50984360f8ad0e90e17f7
SHA1b73fdd0130d4adcc7a2ee66fc358b5e1cb05bf07
SHA256fa314d3b6bc6b9dae57949f231fe5ac1abad6c8e44cd5a3e5a50779fb8b166fc
SHA51255d61b426dd28335482017d2bd4c16fb49ed985584dfc72c977974b14e599f0b9821d831f74f1eb1e6eabc0f499618c790101b81c60ef9f5f51b62d9f24d7c04
-
Filesize
5.2MB
MD5b1e6188a1cb0b02df37d58ec79ee8501
SHA19fd86813a565eaf0774e43c9960e1dd80f002480
SHA256ac1067b80cf35487506359f80bd7c4e2f003381b6371f0afdb0e2002b7e26d0f
SHA5126d20e9519a4e4ca8157ad70a62c29f84311005fe2955293e9d9843258429058c75c9553c77995be86bf57f28066929d6999e5edf53e7b79527c4fe6a9a280638
-
Filesize
5.2MB
MD50b029a3ea392112597a7896ff48285d5
SHA1e09ca1b3bf9ad448be531bf0803e50ec9be70447
SHA2563cb1701bb98b1399ad26b62521970cab0a98c5c2c3a778afa7fe357d9d3b73ff
SHA5128d95beb6bf5a868da3c1a8d76fef72de43a5fe952d03db0eaed5bace1f86fcae14603fc69ad28edd87e2ea2742f2d9594d33421c26fe5eb43b96e751a463bd8f
-
Filesize
5.2MB
MD548cdfb71bce3c76b93479be59c20fad3
SHA1fa718a005f571216316a953d693e05fced54b9c3
SHA256a285fc275b8c14a3f4251e5f8ecd4501a58b395a8d78ab8417d9ccc73c6d383f
SHA512f122c72e13d080220bb34e9aeab7b9caa201d6210a76f094a8475db88d4157511abc591878b278162269f633c2bff982118ba603eb94c87c2968bf82320a0b2a
-
Filesize
5.2MB
MD5ad5ad8caaf2fef6ecfe1419083a13685
SHA11e796274ff20f4354131e2c1b6f2d96f3e763c42
SHA256f3274124ee46f1ed0f3cb6c299206018a008b6ddc2b2f21570270a7bf1844ae9
SHA51224f98d857fef51102209753405032fde220cad9003faa21991db3a90b1af648ab7e2a616a32dc869a23aa000dc203b1149f8bd3856f67ebfc95908f03111a44a
-
Filesize
5.2MB
MD50cb6ab0d376dca4ca979f22674fa94d8
SHA13d59b8e39820acc2f33028f597397d345d7f7aaa
SHA256bc1a19ee3a7d3bc4ebdf18c39d675c5825b486da200579e7f8c7a9f9044c451f
SHA51259319dbf87c407808f02e0d87a2091b3c454aa7b9786b22b3c2d07361d59c1b84243b020cf042aed045b5afdd63a20a1f8cee23ad23ad35692de2de1eb21d7a9
-
Filesize
5.2MB
MD56f1500eb0f6c40c25fb73633f4ca7e77
SHA1efcda487bad5d2de015cbb203d5214cc7e5b2a88
SHA256321fab4ad928aa63a6eaf246a4624b80796d5e5057c6924d3614717c40ed6273
SHA512b89b56056cb9b7411dd127e5b04f0dca38e54155313447c7bd4d42f93a2534e64d2842a55b0b30d42a979e50aa6d3910262386e346e5dba79dfe7f43d0deffdf
-
Filesize
5.2MB
MD59e6f6dcad27d0af81528b52f1fc3bd98
SHA1c1ab6b6690913fbb683381c413c783d08f1ef6d6
SHA256e4c24390ddd49c776f2719e7ee7cd7455b3b390f76dce64b8c91a712bef96da5
SHA512209302a74de822f737a1aa26b2d896e1725b319732db255e8ac4284fdaca45ddd8fbd9a914473780daada619ab24a2f4ec335d4faa3bcda8269677d64adc05b2
-
Filesize
5.2MB
MD59e53726755c106bb84e02faa344f7bfb
SHA105ebb6f831c6ac41a1fba61cf9a24b8edb894884
SHA256ab989983223ea650ba5cbd9910bb2646d9417ad2dbe5c8d11b2e418159000978
SHA5123e477eb6d98acd150c5a37c44b6649ba443ecdbe26443ad3e9ee6056e0a1f944014801d7dca5e027ce9187a6cdc988a908179bb20892dc10d3b6a9f4c02e1188
-
Filesize
5.2MB
MD50785829682d08da7309bfc0de992c8d9
SHA1002255911bd30fd9fc765f54109d8b4f91493b47
SHA256df3e9549f6c288dfef5de1e9b947f0fd004de333fcc9ae4bf3aae681444aa9ed
SHA5127123103435c8301ab5d86846076a427a1cb3f67b0b1201fbfca03bb9f28ba75e44d5358e1841aa1652aec77888c4394ce885f1929bfe70c5fa7832f034c30715
-
Filesize
5.2MB
MD5934e16290b2b0ffc58863855f550b0c9
SHA19f115f1ed47876a953b60ed79449246e06fa3df6
SHA256605e9566c633e552342fe93e3204086b2beb4819d627ecd8babfa5b76374ceab
SHA512eb3d8f825af8069cfa4fcc9debeea3213d9ab9c1ca8f82c43d7926cb71d3d4b1023dbcb6ac2cf1a790c336dfe3bc4dae575e1f2d74fef1c152b23298e9903ee3
-
Filesize
5.2MB
MD515c575924752b3c6e56fce97a42cefc2
SHA1dd424b3f94d20328243f0db22e819f9b99e37a00
SHA256d5690e4932af827034ad62a31022f9dc1ebad37ff3890ae27a925ad715e7ec1c
SHA51224c42bc152b3b01d2e8ceb3805dd6a1ead9f0c661ea6c03e5c388b1da9b144a47c0855843084468ba9b92554809fc8cd610c1d7cc3a70b69def1c9970d4a4a13
-
Filesize
5.2MB
MD515e1573960f5a4568b962ab61b756a6d
SHA12574510197e1cb2141245dfc948539fe91088946
SHA2563dd2272ecda028f055aea243ee0206697c885f13da36e565a3700199bae7d420
SHA5120398b5f23189cc6b93e4e8d38f14679c09c5c46cad51d8bb271ece523baa48528ccbe757f6d5c83abc194a404ae5550a3d0d358fc1e737530681345c9a466508
-
Filesize
5.2MB
MD5f13fdbefc76042b89ebb58c7dff21e2f
SHA12ec900b3aa4b0a15d4ce4fcbdc5cc385e914f5b8
SHA256c35f4e60992d61585a28babccd660c81a95e6a1f8a6b3a3fe067043914675beb
SHA5125dea5e1e6835cdc012566f4a2f08c7ae96c58ea0b8fbd5267a5bf6ffb6194e9cbaf2b198a3bb85b87f681195266dae71b78fefc513d7d0346f2540ba2d9aa95e
-
Filesize
5.2MB
MD56fddbd9679b38fa6181568f7c426ce3a
SHA1af7a2d253eceb5de4dd7171cc73ebb8656f34b5c
SHA256d6354c869f0b5304ea128e0bf173813277f689678eae9dd3b9f6f03386efe246
SHA512706adea2f8446539a9e29ded49be5977942f1fd7d49ef3dbe618d86c94e5aa2983af32ccfb47709ab4bbefa8ab5e31af3aea919eb3d7940bf195a9c4b43e3f4f
-
Filesize
5.2MB
MD5776b27d409969cf97dcf1a7bfa7bc67a
SHA1d9cda90f43ae4d1a4a179df2a140420a6ff2ca7e
SHA256df70209948709d5e5299f999589e998c1e52c45f788089c6a930d7f66936b72d
SHA512e09e1465277b1d864b63884b0920bb36bc183cbee250947cb4775679582a00528a6dc449c158cde47fc198de829dff65121c54aa314647a7c9dd1024ca8f443d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB