Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14/10/2024, 11:46
General
-
Target
2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
52860eb26a813412bdceaa5838df2552
-
SHA1
a1621a8e3f7b557769c3a8641dcad71d3c72f498
-
SHA256
d1d57138a9ad8b5e16609a48b3190d26029e875077d5ff9e91134200508790c0
-
SHA512
854a65ee61a87252ed2d16b452b864046ca03ce54dacb78a1cf0b4249919e6b3972f0f7e5026ce0b1a48e98fd557f51b95a2ad4834c00f4ec0dd46f10b2d562c
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l1:RWWBibd56utgpPFotBER/mQ32lUh
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NXDtxLz.exeC:\Windows\System\NXDtxLz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qnPLvLF.exeC:\Windows\System\qnPLvLF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YdvJGkI.exeC:\Windows\System\YdvJGkI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZnJXBsM.exeC:\Windows\System\ZnJXBsM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CNsWeFk.exeC:\Windows\System\CNsWeFk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zrqFfqe.exeC:\Windows\System\zrqFfqe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cefyBVJ.exeC:\Windows\System\cefyBVJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lWnnleF.exeC:\Windows\System\lWnnleF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cBoBodC.exeC:\Windows\System\cBoBodC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HAMVPJa.exeC:\Windows\System\HAMVPJa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kFmrcsG.exeC:\Windows\System\kFmrcsG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VdsIHgI.exeC:\Windows\System\VdsIHgI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JBsxjIy.exeC:\Windows\System\JBsxjIy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pInhzhN.exeC:\Windows\System\pInhzhN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EEhSXev.exeC:\Windows\System\EEhSXev.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DTDJsXg.exeC:\Windows\System\DTDJsXg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JZCnQOn.exeC:\Windows\System\JZCnQOn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCGCnqG.exeC:\Windows\System\uCGCnqG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sAzlxYj.exeC:\Windows\System\sAzlxYj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vYDASKn.exeC:\Windows\System\vYDASKn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nrxiocl.exeC:\Windows\System\nrxiocl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5bf911b166b94c93b2b1d9482b6622a1d
SHA117a04fc5181fdf51246fb70a50e22ec165922be8
SHA2563b8949336fca45281a580c6c7c1026022e925f8e4591518ee8301f9c7bb410c6
SHA51275c9cab74199a7e422886cb040f4e8f7bfce774e1ab65b87421666c6e86257a3afcfe3212a54739c1ac9643f67cb8c19fee303d6e8132c803cf954688ec99cd2
-
Filesize
5.2MB
MD5ed5ca9453a7890c5e88b84d555887414
SHA10cf54ad310890848310a99fbb6ebf577a10a5192
SHA25603c9e8bfae2d4fa77cf064bee2075d419a3a21ad699b21056e22d7de94b8cf7d
SHA512a547615ced98d38c5c4e365cf286eff95f1bd0bf5f6332ebe476dc16db38b2bfbc2173a620bfc3f43d31c13990c3c91bf4f5c75c728754bb4fc8bd7358566d38
-
Filesize
5.2MB
MD5adda56c28cd3635fef2949a9ea11ece2
SHA14ff1b318d5fe68b00fa2e0bfe7d708fd750eda9b
SHA256990c260ccba0760bde63532fd6b05f7f36b66544e4442f8cf5462c0773c88fd1
SHA51286f5e92b3642b073e019b824f3006b471e28d114e676bc1e9251af429ce2af2c50015077f2171bd50c0a22ac0dd9e878ee2565dca620713fbd3e4d7466b70e80
-
Filesize
5.2MB
MD5487e41a424e3f8577b53d6557cfc6bf3
SHA11d0bb1f1c1a6b0166c103dbc0c9b2910b21aa4cc
SHA2569601d0f6c718df220865687ee9962f7c5127376a27e5302279fd89c0ba6319f9
SHA512fd3a14ddf98472fecc52d3e13cee80f74204956dd11f963492995ed575ecaefc1b40bb0a3d24d466b0e7cd6c61d14f9a4b3e3b19d49207135fbe645a31704815
-
Filesize
5.2MB
MD59d2efbd1cd2262eab4ee7bf0c62ffa4a
SHA13ac5028579cb212213d0c04e7e05ebb16421c2ff
SHA2565b6acb4b8201d9409a7a53e858968f698216d7c3c7045f9d44cc47c2e234f693
SHA51222d7538349a44ca304d116387ce8ca754ebad5319341308c9dfc538408f2ef69fc81fa13799345b1bb15e8f4b2c1bcf926977ccb24fb0687f375b9ec30979663
-
Filesize
5.2MB
MD5af547f4d30e903a18349dc6ec3aaf157
SHA198c4aee8ac7500acba3a8451618ea4cac1ef1897
SHA256d3634ac0fcc7bae79e4de8bc0898fa63428a241275db21c4e57eb095bdaf827d
SHA51250e6c8754864a54539df9a12d1464de1fe1227c580658116b24d89a036a88e53930b831c62acde3f77c4a70a302a23c5064e21792f270e8da9b2d866ca7309ad
-
Filesize
5.2MB
MD5416541dd944349ee7346e07982b5699e
SHA13dc5a3c9fac43fcd14c3d4ca5cb65e9239157116
SHA2567474dbab21cc115ece2a85d4b34fa1d2b144c5b61b64461ca91a3686d6b63e78
SHA512f18a82c298a088e062bab009f42508f142b78d798520f0b04e64f2cb7c824e87c2eff0c32e59a1cc1a22a60bd50b02c11a42d39692cfab9d38fbe82f50decf6d
-
Filesize
5.2MB
MD56b1493ed5157879b9ef64b4f4353de84
SHA1d3674ffaa7b673e058d0337749ea465a93e9a371
SHA256fbb36227a1eb1ad98188e26e90bdecf052f0af1b3ab90c072b4daa3fdc1687ea
SHA5127ed0fb5aa3e5150d1bd185727401366f1680da7a2f8165d7f4cbfd1b67d72d996f50a00b3a841a2fc36fd3b9d52b67e27a7775c04b59564a0791048c6ef4006f
-
Filesize
5.2MB
MD5c5b9ac44046b51ae56e7dc66f90ff68b
SHA1a35d5accf110177bf289a1bc39838bf2cd9170ba
SHA256c1bdd02f80b0c43e8588d4cc3f850256d28ffe15edafdfc3800a8176d3607b27
SHA51230ee24b406eb4c6ae50940637f964d447a1612f1e61216536210887ebaa6e42c7e431fa9b4415e9443d5114d21bb8f2d8e6ae9267dee26d5d4c7c4646b4c69c5
-
Filesize
5.2MB
MD5585870fecc85dd12bdcabacb1562eff4
SHA17767d48adc30cc12aec325b63744d7b5387c6204
SHA25633adbefa9a36f7784a2fe38eca5c3812d54cd9cf6a3a933974ce75a818a3afc0
SHA512df8f99eec62bbdb30618a54bb48cd906b1de3665d933e698469d98fa02637ed39819eaa70702022a3335130e2211655c9e4474f00c3662c241a69260e83c6cf9
-
Filesize
5.2MB
MD5e406ebf0c2bb38e41d389ddebe34bc3e
SHA15a6f41660c28e5bfb86ae5628fd1744cafd7d9a0
SHA256f0a2e9d6fdaa51ecc397e4606aae4689138322afb5b65c575281f7508c5bfabe
SHA5127a5810fd7d46307fe41be918c4fa62e5fd4b43df4acee8f20882fa22defca94d5e886bcbf9dbab795a96551140f8f90f270b4e694f5f1a72fd6eb7a2705e2717
-
Filesize
5.2MB
MD51e53bb16752d1a67698d5b1ac12c4b83
SHA179a519df64df5c89cbc7a73a77e84069e0383403
SHA2564d50d093a030bd874eb122e0dd214211e5984d71381dcd1aee26e6020f1c7c4d
SHA51227a483e8f03b9c636891102c8fe7937cead08668f34b46627146e8d934b6ab22f70130c8a4bb3f843e8fddd904aa4c33e9ba4e9eb46eb2b9afdb59327ea61b10
-
Filesize
5.2MB
MD5b2cd513dc37f410179aa555e042f65eb
SHA19ccc5797d327123e4a80d53ae8aecd5dfaa45c54
SHA256be7805b91d1a0260dd9824dd8b1890cc98c3daff50953ff8ca47006bb1fa635c
SHA512c23996d7b6e7e839bddd7cd28111e3b6fe4d5418434c11dd27202d10311f3890cccb01fed4c0738adf8d64a2c9068e88fe837889e6f8270159dfc06a1bd1a23b
-
Filesize
5.2MB
MD51f1afb600ea3bd5c691a72fb6bbcdc97
SHA1e95b66eab440fd03e3f99d171474968385977a60
SHA2569d2987e7de06edf9422eecdad3e8fdbb543cd8dd4a1ae97ea5d77f99a561d15b
SHA512e27c2e19f08491dd80fd19eeff18220b69fe8117939feac4b2a1a8fedcf365032c310b63d5ddc29e603502a3f807e92f8fa510e2474637688d0c07599c038e7b
-
Filesize
5.2MB
MD583b90f4f8e4c5e8150d35fdf78e75d44
SHA143fce666904aa2eb9f8d869918580dbc5fda9a80
SHA256a6ee4373b7ed395be161be38945eb15a1ce30011f4d70abb70eea829283adc44
SHA51259a952d9bf88b566e5a9d11581dd32676e73cf4deb3220bd6d62db46ffb4ca646a359021644c2fcf528d0b12c35e300e5d12cd11b7979d8e2cecee468fb589c1
-
Filesize
5.2MB
MD571638a19d52f4294477a8e6b11033b44
SHA16d2c385fabaed90e4bfcc9d3d3bb76961c514d8b
SHA256be22887e68411056debf18a871db4a5f526fc42282f35ad79e193ab3f3871f80
SHA51227438fd4b7cd6060c2df8cac5da195379ed8b2341f5542a55a4117af06d8c86a1f30284d2985e643022ba919b70136da51654327e5ee86fd3b7e7d44b61156c4
-
Filesize
5.2MB
MD50cffe860b70f70463ab635c630997002
SHA194819ee80ebdbae8df005fc2f46b7729e4508316
SHA25663cfcb3657fa109de7734e1b7e94c16f9faa346fb70fcfe5f960410cf885b2bd
SHA512ca9b17ba15c8fcf7ed0f700ba9e71685f73c2e92617744275ec59e4d62dbfcd4df1da45d16ec7881f929ea276f31557c34c483e1597570461658297750daee07
-
Filesize
5.2MB
MD5e19813ba5b8d25424fe7f059b16f44ee
SHA1b09ce760bda9f30fcfc36f81f951a6fad5711a12
SHA256f3a413d25859ac486b85c9c23d94962fa72fe3230e1712c3aedfc94d3f4d0215
SHA5126ca01f8e621952ce036441cebc45c9b8e8917a12a9885bec89c21cb06c77351dc7030cc05b906e1e779bda3bcae2960be2c719b2d03c6ea3a5563531ba6f2c61
-
Filesize
5.2MB
MD5f3c3a4de9aa0ff89c4fdaf1c18fb1a7d
SHA13fa0b8747f4c5b38f15f96a8de52916d147e1c6e
SHA256bd6b7ce2fa888c79de162ed17053cd7a89884215ae2530983387c4885f35dec5
SHA512b2d0b6c1c9eb9fb586f0bbede8664bea20eed9764af0e4f78be1f7e4e5f1bc944c21cff71da923e27a21e501f74d856711f330a6deb06d5762e5467cc809d5c8
-
Filesize
5.2MB
MD5238303d45a274e5441e77cea420b0835
SHA1a45fa90b38b49edbfd150cf957463e102bc1cf2c
SHA2562ff0c323c66d99f5a8256fc646b08ea1a5a46f2a4f322c85447ae8e291ad5759
SHA5123e56bc3defcb160866e0f24da2ea5372d12a8d10aa48bd577e3e92d915cbb16d613df64a154abcfb7302b0412661955d831280636615a47fad109c8e892ae34d
-
Filesize
5.2MB
MD5c72c04ef8b63619b6130024b10162d79
SHA1750a2321b208429d53fc7d21ad207286019dc1ab
SHA256102ff93306426b00548338bb016aec68611c59ead2c308db8f2d3b749e67f644
SHA5126a4138f3a05439643d6a83252c2ee6f64b5ba47f563d7e800fcca7d6b6ffc2e31e3b9a2f5bed47e74075893e6fbda532894822f3a941b1ddedd81fdc9fd34936
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB