Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02/10/2024, 09:36
General
-
Target
2024-10-02_7123140f22d960fef6b78d163671644b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7123140f22d960fef6b78d163671644b
-
SHA1
5bf289ecf509847ce798ccbde8119a2ae6e547cf
-
SHA256
2f279143f622cf7bdb5d5e8a41c71ff128464eba2102aeb6f0283e518f61a49e
-
SHA512
e1a47a07ebe704fe2977179fde80ae8d580a150381524e25ea7c0d82c5806b3b9c8d0885c01285f81b8da276bebc66d16fa74a910038b29fefcd895f8f1b102b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l1:RWWBibf56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_7123140f22d960fef6b78d163671644b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-02_7123140f22d960fef6b78d163671644b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fTKacBc.exeC:\Windows\System\fTKacBc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LzsqqvX.exeC:\Windows\System\LzsqqvX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XdScmtq.exeC:\Windows\System\XdScmtq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MJGQCHM.exeC:\Windows\System\MJGQCHM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PnLyYRE.exeC:\Windows\System\PnLyYRE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NsebqEu.exeC:\Windows\System\NsebqEu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fLVufpC.exeC:\Windows\System\fLVufpC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KjrQAYa.exeC:\Windows\System\KjrQAYa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ewaught.exeC:\Windows\System\ewaught.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pkfsCoU.exeC:\Windows\System\pkfsCoU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zGnYNis.exeC:\Windows\System\zGnYNis.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NzAOeAJ.exeC:\Windows\System\NzAOeAJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VZInsZH.exeC:\Windows\System\VZInsZH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MJMJqKl.exeC:\Windows\System\MJMJqKl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DVcATeR.exeC:\Windows\System\DVcATeR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gTGEYRc.exeC:\Windows\System\gTGEYRc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yNuTFiy.exeC:\Windows\System\yNuTFiy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JmfyXBP.exeC:\Windows\System\JmfyXBP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xIevWqp.exeC:\Windows\System\xIevWqp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TxlIFce.exeC:\Windows\System\TxlIFce.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCXqRgC.exeC:\Windows\System\uCXqRgC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c0c49fedba774b245e0c96bf3a2bb66c
SHA197bad7385730a91702e3c133e1307a019b03cd06
SHA2565416d5f5731b92a04bb49b8f5806d94e9f2e17aa409e3e03374c0801af1257c1
SHA5126196812a8f236fa7babb09ec622ae4a348bdfd2bf2eb03ecb077ac90b4832c998a35df8c19259310598fbffca642f2a810ac55b8c3e6bf98a7c526a62b05aeb0
-
Filesize
5.2MB
MD5f6ebac49c1e605a1686c131657482164
SHA18c8bc874635180f423c88e6c52fd7ebb994a1d4d
SHA2564f5a1e9ef9d4f23fea75663002cb6734f349b1a0abba669ee40536a0034040ec
SHA512f104e05878baa26f490465ec9a9ec53f2a8f3d71ab76cb530604d2fa2ede745ca1830d58d61b93b58337a822d925fedc6104c5cb2be93a4eeec090c0d8a34a18
-
Filesize
5.2MB
MD5ff06470a4a4086a3febbaa60b890c689
SHA1d4b2aa373c3bce9f3b9ce702052bfdde2a53dcc3
SHA25633996860915b406b512c226288e4f17a6d525e5e6fc3c516b8d0422fc4fbd559
SHA512e284a035b9a2e4c60ae55d8bb9c07f08a9445d83bb1ae05bc5159d4641ccf1266eed4ad3cccca6273d717517cab86b4cee5cbc96d2154e9c2e6d4f38ee13afcf
-
Filesize
5.2MB
MD5a209acca57e5aabd06f63e51de1cfab1
SHA1a74b74fed9dbf24e47bf61eb5319c560823cb278
SHA256916773482c320f4c094c49da13c222c9c45728e8d7bc98564b1ebfd7ca47d0d3
SHA51298188c500491408ee34b4600718685a00c1a8e2f57c3e19ec6d44e005b77ec36700b9ea5a3087d200a48e8c311c0326e971ce0554486990c09ff06b9a2b1db01
-
Filesize
5.2MB
MD5236df6a00c6102b267188becb3058fd6
SHA117958a474b45790d571aa2ddf1d2882eaaf6acac
SHA256ca2dace1324cfb9bf05d562852284ca85ab17d65e5036f1e2bcef10db8527250
SHA51261460974c765890e810d602e29e646e6376d52c51b62c31ff8d292f4c69ce646dc44f5b0cf9eb6cb84529f1f0148b06e5368797c1dc7df3d475f7392bad2ac89
-
Filesize
5.2MB
MD5f91cf7d92e1e46ea4dbae865ae5e15d7
SHA12697643f852aa3adcb9100d0b6832617c78e26d3
SHA256c4b8199ea78e3da52485473c76c9bb946e7b09d49337b0aa0d4534844f03f61d
SHA512ce7bfc1d3b568786fdba6cb6e001e1fd41f0b739639b9237702a5373c8e8571145ede2438baf5fcd7eea1f5cc77438db577be5124cefaf948ee3b2c218c512cd
-
Filesize
5.2MB
MD55d808d33db5a20bafd3e08e684b180d1
SHA1d2accda11e7381394417fb0a02456712eeb996a7
SHA2568d81b9e4fa9f5bc915eb2c46242cbc539fae7a5b725a5880f59d91d582455142
SHA512297f6512a8ab8990c48830efe925bf9da16060b8ac2799918b313743e27629ccfb67c306b79d144de1cbf72dc3c14cfd31034c8068444db731f3829b67297f99
-
Filesize
5.2MB
MD5344876d3e540080e371926ddf9757716
SHA1ec38d8586a1d60d7b739854bac25e3ac68c80ff6
SHA256ad078d299d395a71e21c4066b7142f9e28af0cc2a7cc6d94b4089429d9e47612
SHA51226333ff718ea6e933e3710fb1bc5a247ed8570cb44a64b3f9ac292d9c2b827a57af5c5edcd4e48684caf7b75bfff5a992ea92dc3b91ff9bfac4e275a55681c55
-
Filesize
5.2MB
MD5378c82c182694237a53a6015e1cea36d
SHA16f4402120a29a01927790a8bd3c8408992f1415a
SHA25636634f0f0a5c6c6fa7788f58864ee61e847ba8cac4f13edb7016000915047e9b
SHA5123b6c6319eed760d8da65799e01ec376cf6060ce5613618e64847ca28a79e1f04f3ab5ed407bd0b0f67570edd2ce5b13f629fd610332c0a65c2744db12840e2f2
-
Filesize
5.2MB
MD572c3f0845831f25d71050151cde3dfc6
SHA108db421aec7b48ae84fad1702c423e02886d0c5c
SHA2564034e8d785b24379125f862025c50e738c266cd80e674e234f7076110977c174
SHA51250ad44279c8eaef4d2cffe626c2610970acea79d1d2cf65f99639f28cab863ee674b22c6d819ba65d34b058fb10d26b714c5f4be0fd4648a4e3b1976b38fa499
-
Filesize
5.2MB
MD53f648bb437ef741041e6720bd6279f8f
SHA11d03e1ad816044d690d3400a4378aca949ea23be
SHA2560ce5b57e6dd705124ac1a55b158e153c3550133a46a6f261763c8277aaa6cf8d
SHA5127385b228a1dda501eed14d641f299054acb65ee8d4fb7395cd30a32d3a452a805d26e6052c39fbbcc908f7b094e0e9facadd11716864c8667ef45fbfea6a30fd
-
Filesize
5.2MB
MD555abbb1a378c0f8151959f99d592e8ca
SHA18846ef9cdf3a1bc4c0b6b1e70684950a7709f25f
SHA256a0812156e3caf1f47032accd175d73ba472e68d11614f0426eb3d81f09eb87b8
SHA5123a2df9c94f8c79f22b102cbadd2898f1cf0b35907632a74519217fc68fcb1f62a87d7ed004f75a70dcfc0f44a69ec8539a3dd39d9be7a88eee53d89b18e83a7f
-
Filesize
5.2MB
MD55c6b20231cd875ec9a5a6632ec655683
SHA10f5bb5131fa69eca22c60029065a725bdd23ba59
SHA256d2ac177661ac9e9b6317ede4006d5f1f762f2c3df2a3efcba1c2074fb1486ec2
SHA512a0162a1c5650bccdfbc9fc5345615a848e60e6a8ff08e6c02439a724b3d069c93386585a4997b7b4521f5f28f294f25b3a594e79db94536a8ecbcac4d0d37669
-
Filesize
5.2MB
MD532c23273da57349629872b6c6d5a4e04
SHA1968e9500eb0d32c66d1a104eccc8f44a3479e5c4
SHA256fbbe47e9638cbac11b78295a2eda107e59f93e66f2bcc550c3cef476494f18d1
SHA51296a49e4791f28ee6b5abf04634b97aecb05c52da73d8eb607307262a01600982c7ee9b7351b1811fb8426b11af999b199c9edf208a703191e7c9e180d4bb42b6
-
Filesize
5.2MB
MD50a320cee9fc0ba78729614b4bf2f145e
SHA168ffa3fabc9caa9877e79c4e3d72342b54172f3e
SHA2568ccdd4bd83a010ef78203e657d4918f2e8bc7c5bd582367f0609188e34e392af
SHA5120c6925844496bf29d2f0360819469013102be949af088bfb63e6abde147ec338f4480e4a72ce75c69aab6b0edb631d1df3d7657d829d0b4ced1ff095d3cb1cc4
-
Filesize
5.2MB
MD50f56f8a009e6e409d3f43d3fe3ab3fc8
SHA16d3f02739d11492b7d287711942f1271ed1a00e8
SHA256f8b0f0ceabcec52e5d31cae0e2ed58d88f2dacef80a6ad604a0374a54febec35
SHA51234535b6a1fc1643c1f63ac89856f0dd9b0315e03fa35e6ab9fc047d7e5fe0bc53fd94bf9931e3d7de6937d6a7ef3090c6e599d621613bdcab2a538ba22b4a852
-
Filesize
5.2MB
MD590fa42e573fa17503cbb6b5696969eb6
SHA109f334b96ca845f164cf0a7ac18e841c90671736
SHA2566d148f1952fc06f8114f4de39334b0579ee2db49336c3cded854b235300a1971
SHA5120637bf2bf55748a45fe2dce153e158c2c73a0ccfd69a1666c16203e31adff3eb8234deb95ed8cd68f55c2718e1df853c0210feec910cab30b578b78eea36a703
-
Filesize
5.2MB
MD5a7ed2ca19740d34d577af61c565a2aa2
SHA196c45cea589e6ba81218aa82ae14a8cea42ed2bc
SHA256b70eff68671e00e135fe8cd0d604669c8800109049984c1531d7a71e3ab587da
SHA512066c849b0225aa616a18a1a638649585f7018b188ad503e3647bfe3a700fc6f3a432ae76cb5f0f9894e22f37f3c700ad78f13b70f8ab61f5e79017247fb4c4f1
-
Filesize
5.2MB
MD5b84850dc526cb3f76d29162da801085b
SHA1b205b9010cdcfc456111ff86d10a26c116c167dc
SHA256e5ecc53779e334bd98c2de0caa7745f6fc518ea52eefc82d62eb79e23e971ead
SHA512046a55293a823f8f25ec7816a1657be7bfe392c92ad8ee3a0aa96bbfabeed76144d3b11547df0011b278634bee454a7f435264a8550920e2c38f1d362776e312
-
Filesize
5.2MB
MD587fe4fe26a56221b10a61b5f3b23d42e
SHA1bac66ac9aa446c63edde6bd37b889045366daf6c
SHA25612089fd46f47318691f179cd6a52ff6a5af3a880130ee86484c8d4c1dbe0b0b5
SHA5128f42f1f4417050f0de7ad522ec175ff959fee8fc51f7c30b722de84b71d7554c5fe6cdebca289ea7ea605711392947be0b7dba6e04271bdf059bf1191fe4d262
-
Filesize
5.2MB
MD5c2e3e492d63c800247970b4424ecc4e2
SHA1dd512ff114939742410552889590b5d121fe9931
SHA25649255714548afc4895527f654127fd154d9d1c4eb524404420b56204313b002d
SHA51230078a1f9b41b1a2cd7502f26f1803b095c1064c82a3edf05ad9a14cf3af8e06a098b0545d9b788baf1193c4fd58f37520f373fb92cd6b3c5bc7c6dd0507daf0
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB