Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04/10/2024, 13:44
General
-
Target
2024-10-04_f7abce7e19b841350e4fc57f8bc85e9d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f7abce7e19b841350e4fc57f8bc85e9d
-
SHA1
049d33aced3977775fe2ee3ce445e9d7e1056bac
-
SHA256
8b557eab81e908ecc90a0ff27ac6cd4b346ba72cd3591f9ffde5c19479f172d2
-
SHA512
bc2aded90793ab838b37191cb2d88be5c6ebcabf82533c7ceedcbd6d050500d5b0dec11cb7635d363bb8d483cb37c0807e9a2fe81df3548a2ea215448ef969e5
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibf56utgpPFotBER/mQ32lUt
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-04_f7abce7e19b841350e4fc57f8bc85e9d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_f7abce7e19b841350e4fc57f8bc85e9d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rLfPrtg.exeC:\Windows\System\rLfPrtg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nsiwxmM.exeC:\Windows\System\nsiwxmM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HSiPIBU.exeC:\Windows\System\HSiPIBU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jckOoWZ.exeC:\Windows\System\jckOoWZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YPWbNPE.exeC:\Windows\System\YPWbNPE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hxDYTXd.exeC:\Windows\System\hxDYTXd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mxoFJSt.exeC:\Windows\System\mxoFJSt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KGwhMvs.exeC:\Windows\System\KGwhMvs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EjSKsnw.exeC:\Windows\System\EjSKsnw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qdHHDoT.exeC:\Windows\System\qdHHDoT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cuMzHzM.exeC:\Windows\System\cuMzHzM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\piXILOo.exeC:\Windows\System\piXILOo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JnheYZE.exeC:\Windows\System\JnheYZE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KnmCEJm.exeC:\Windows\System\KnmCEJm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RBHCYzC.exeC:\Windows\System\RBHCYzC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LQQxwTK.exeC:\Windows\System\LQQxwTK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NgdddWN.exeC:\Windows\System\NgdddWN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YYNEbNh.exeC:\Windows\System\YYNEbNh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pRHgjLJ.exeC:\Windows\System\pRHgjLJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EdMLWAY.exeC:\Windows\System\EdMLWAY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QCgiynU.exeC:\Windows\System\QCgiynU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d666202250c41cc1b911875ab3272ac6
SHA161f821efc7e57fb95b48af554c02fad2c2949c04
SHA256f6ba4cf1253181098bf337ee32543ee760f0b633d1d34b247f7d8b3fade8e959
SHA512b4ad386835bc36cda45e5aeaf1512aef62ab7ffe7a2860e7c1a5b20250ba11a18f389e92a66cfcc54a41937466b8b128402d2b7e9e32cbb02f9dab531fc9fc55
-
Filesize
5.2MB
MD54cd6b67baf5049aafd5c8e4dfeda8b13
SHA1bac6754bb41c979eb398d000be86241f51bb4a10
SHA256c59ca16a9a05aab09730e83b5ecf93718dea2d052c6756f0e651aa7e485a70a1
SHA512baca3d087da1ef4c5cce499129d50adb7359ab10669bfc6af4b23a50cb025ce6e83a21be4bc32a88dbab60f8b2b907f5cd2c18a861c240372092ef5c82f048fd
-
Filesize
5.2MB
MD5953a913b066c45b2f300fbc6d0a30ba6
SHA1e7cb6bec9d202c3fdcdc2775ded686e7cd55e7f3
SHA256ae99efb591453c022fb86b88a71ece0a50ea4bbddc552b55b7f52896536ffa2a
SHA5121f64ab5c158dcef3f91b13b989c0b4d595ce8f8780132bdbecda04dc8bfa2c70c1036b0cb932413d75bb64a9cbfa6906a77de317d6ee05d3c21bfb0a9296d47a
-
Filesize
5.2MB
MD500ba64275b70f6fa438140997d8ada9a
SHA150a35918eb039eb6867f8a9edb97dc1ce9d4dc85
SHA256a16dc170ae0a4b90f317d0e0be87c628e492b8f7dd6d4c501dddb8b422d2204d
SHA5127a5b506ed2aa195274f9f4e917bccd3c1f3c4acaac96ac04ecf1714018c82d4a86f8c8840190c1337131d8217eb962abbba0a685a52bb66ecfbbe9e73a48f3da
-
Filesize
5.2MB
MD55c9f12eb260acfc6dad86fe7851127dd
SHA161c6c96b3f9627ed08b2ca4599f1cb74706d35b3
SHA25668c1e0828f5fdadfe97ba94a1ccaae85685e3aebda5cac1efa813d1deb74797a
SHA5128f29a749211200e079842a76b9ef27ce08f41a48c0a307dd1dab8dcf4ae50571d5d22e7b1fc10a8a58e4a6a9f10d5c2afa731f7b9676b6292d42ed2bb8922d95
-
Filesize
5.2MB
MD58c4c03fcb35da43dd0bc417e9f0096c0
SHA12775c310486d28ff9c468262e3207e3ab5e6cdd3
SHA2561698d0947aa15af1d4fbf5170be787b227a1198b5bb70673a9bc22715611361c
SHA5120acb4986ac087739647c954377021150c90bb9a19fdb2027b6933b66a4ef6d6a3ef93c4d8ac64cdf13ffcb0971a2720f265e0be37ba88f5b6841e9f499bb2078
-
Filesize
5.2MB
MD5e178d976ad5927a92b3edcd42e49412f
SHA140c77b81e73f5c674a340e5fa456c5369c1f5faa
SHA25649ee9bab68934680506df782256937f141272896927f74f2a60288da43ccd1ba
SHA512f60de4ed95ac3db07e29c2731df3bf76860cb8567bb66fa8b5663606205be2f17bd3118b24cd23c88607e2db4afbfcb886069e8c5a256d3aa8c32ef0e3dc9181
-
Filesize
5.2MB
MD57ba25a1397f087808617567d9d8a4641
SHA1c23ac22f9fd388fae082a024a2aee3e5b87b950e
SHA2566268018486f2ed2406c2638d13c8664f31678dfd43663b936f938329b6bf930d
SHA512059538251581b14acc18739eff4b52df4762b106b4f7395dcf051a69ac78056d7a7c2cf29e37cb6ae061c9080673c9c1c1cf261dacd914f9c55f7d0dcb72586c
-
Filesize
5.2MB
MD52df68cff7ee870ff0d0bd9188996f177
SHA1dd89e3dde7c7f40194f92dd5f26ae9f6cfacd430
SHA2565890230231e27b315c5928b4605c23c1e6176100989ed3fd70b093033eda95cb
SHA5120f15e39311eb11d3a5d6c0ed3654ac6ff0f894df925e5d92bd1c393c0e3dffe66d41205ad459feb4068fcaa939da14e1bef49556dbd4b499d3381798012013fb
-
Filesize
5.2MB
MD534450d91e6c30605bc026298f19bb0f5
SHA12858aeee57d5c8cd3e88dab16ac2512930712b36
SHA256febf4a867d34066cd3e93b61a5883a88232745ac8a4965145c5035a4e5033f2e
SHA5123899d611c8e5c109dda1d7d8472067858bd0d07ea9c13ee4822f9efb4704adb1827714aa754d83acf510dcc3e59b0e762e7273ff1fa4a5f03242ce31c884b982
-
Filesize
5.2MB
MD59438a66812703fda383b4188a4cb6a21
SHA13a5958a5d8e7dc3aeb6a2174dc218d3b9f5cb765
SHA25634e6f04b816fa03806246c83984bfca3a1251b0623df9a1da2640186b5c0d333
SHA51277111129064d006a5bb525fa123407203cbcc6edaec105d708fbc90ed5f9c6cc866bc939fa8a0b36c588f3f0df15ed8bd5d6be402d09ea8625b58a61ef6d09fd
-
Filesize
5.2MB
MD555df110cc6bd12b473f26f119227d214
SHA13db65d0670a401005ab8675ecff461f6655da7ab
SHA256767b01efdcc9768c9c9bb3c131c6ed88d20d957fbfeef69988eea87478b30216
SHA5124c3b23cbcc0aa5eab5f2ef16de92928697ddc089b58a1cfb9679d17f2b654d18422f13bae7ccbeaa930fb5b44887f9cc378261be45e59c4b6219542702fe0f52
-
Filesize
5.2MB
MD50ab4c981b74c4a3cc876257b6c3d1869
SHA1925d3716a6d95966d26cbe42350747a17d2bc0be
SHA25651a976b51c98fbac01a6719f2ffc9c9c14a95fd9b011c765dd1da8b55a92280f
SHA512a96b166c27a14239544afb58a2c677f058b736dfe70dd62e0a32d490b299eba5148d90061e79328e9a5fec342fa610ac31e523d69de13be788e3d64414fdc2bf
-
Filesize
5.2MB
MD5a109fb1266c3d10c3e398dec9d94f0a9
SHA1df7f3e5ac92560f26ee34ba84e367ef4d85bcc0c
SHA256bf925af824437f31cb19f22756dc6191235c1d2a5cc1538d6d3246d2890bce59
SHA512aadd2400944aaa6c8b991ad4410524b55c8f06dd19e4cc581aece2d53494e083d39d6f7c9e5899efaae5c78ebf7e00e01c923a68c4cc1665485089ce0709ebc7
-
Filesize
5.2MB
MD5dd34db1abfe6a3a8dc5d43006c0cc612
SHA13a8a384e1be31902bbf5c30239584850b7a3975d
SHA256735d5aa289bfe85377def1e24dce0045b898134f7cff0c0dc7592c2444a7cbb2
SHA51256ff7a7f275e9ff24d099f5937b3f59efa758fa8bcccfb21667a2a0d06cab5343ba62a67c20450c079d37944dc4c7069669bc3495c4fbbdd71a642ffae79a08f
-
Filesize
5.2MB
MD5c4add4005a12ebe53a81b47287d97b19
SHA1845388e58ce3985797d65a8abecda338244cff77
SHA256a35375941f718091646bd8bd1f5e2fa8898080048d0f95b84148e8020cf63edb
SHA51275b3351d5cb4f778c88e2adb21e4e2390bf5dd336352cb7cd9e8116b4b3e620e148b6700a3bafe511731f77a10db4f5c9bba38539f899d407c02585667833796
-
Filesize
5.2MB
MD58682e06286775107da63bc509a49cb34
SHA1457fa41c9a7043237750de43ce53464324d03e72
SHA256a7209845b26d96120e6eef8cf2ab1d35ac84315b8675dce67dea183afa3adf7d
SHA512463bbba7ced95b16ce927d33a2cccf10923aa3946598bfab3d790c666b8b6fd7d9c0c0b229bb3a5b7f9965379ad356f3e4e66ea5ea99b758f96c3f40c88859a8
-
Filesize
5.2MB
MD5af1eeb619d23b7419bcd564d7a171281
SHA1e7963b5709dfd835f4859a446058deb0baebc230
SHA2566ed9c3609d47ceac925c6cdd49be0c3aee4c095581254bdd9d673fdc46f78c6f
SHA512d5fb15ccc04523be82c485d221b177f470e41d7e5cc6abd107d9dc37c41aee2b2f501bd0b0afb29f3a19e3dee1489a0f9455dbccfb03a4fdc4d1aee70c21aac3
-
Filesize
5.2MB
MD55b15e0a7ec9a03c13ee44600116f0ea2
SHA1c94d637143dc696bc560005386344eeacc04f6ce
SHA256bf3565545dd549fb1865801c95b69b72874520c10dc306991201e34ffac487b6
SHA51283d59647460d3aec2e536e45b54121b63dec69a30d41268d88134c03499832071af813dfe3e718e11d48c0af4b30ca8759089b0820074d9c512e31e34e0e03ac
-
Filesize
5.2MB
MD58907615c8617a4140086c138d62088e5
SHA191cf00a29037722ee3fe61fe15610cec667ddd6c
SHA2565e696766f65a09d16f19224cb05972114bcf51cc8ff46caa27498549af2bf02c
SHA5123bfd726715c96e54b0a644f69098c37abc898ce301013dd51e653d88f0b4237cce3ba01203deef3aca9a205edfe5f39b64a586895072a1ab99ecdbee16efcab1
-
Filesize
5.2MB
MD5cef4314a3b1cb3332246a4bb5edaf43c
SHA178d9369b7f0c59f9789f87b7e072cf886071def4
SHA25660d9c14a2a7bc637b9aae3242da98a6500349cb63ab4583100620fe3e3a3620e
SHA5123f684a2e6d25f7c65b4af0e6d05954253a3abdfc82a97acd0f8feaf7fa442eaa29385dcea11c4f04fd321d5eb0945e03147a2414e79bf874601f0d08b3a0b610
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB