Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/11/2024, 10:04
General
-
Target
2024-11-17_26055de68d74c846d4ff408d74e3013b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
26055de68d74c846d4ff408d74e3013b
-
SHA1
5d8179d2d33e388c32306ca53204455bafc38eda
-
SHA256
7ca7cd26ca00d7828460aabe26b6f69fc7fef4d297f033276204346ebfe89f52
-
SHA512
ec5f43dc57e51f8b3c08ada5add7a2da8119a199d4e01eed58afb5f806948d72b296ba8e0b030f7068562c95c493e2134f12ec5a28831b931c49ee2727e8afd1
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lc:RWWBibf56utgpPFotBER/mQ32lUQ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_26055de68d74c846d4ff408d74e3013b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_26055de68d74c846d4ff408d74e3013b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FrOenpi.exeC:\Windows\System\FrOenpi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pFvNqbK.exeC:\Windows\System\pFvNqbK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kGqQmmg.exeC:\Windows\System\kGqQmmg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WywGMXq.exeC:\Windows\System\WywGMXq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iDYiRGQ.exeC:\Windows\System\iDYiRGQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mhdcqNd.exeC:\Windows\System\mhdcqNd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qLPdrCh.exeC:\Windows\System\qLPdrCh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OONXkOk.exeC:\Windows\System\OONXkOk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QjfJFnf.exeC:\Windows\System\QjfJFnf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GlbbfyT.exeC:\Windows\System\GlbbfyT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gXHdicI.exeC:\Windows\System\gXHdicI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wGFTTiJ.exeC:\Windows\System\wGFTTiJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YFxkLGh.exeC:\Windows\System\YFxkLGh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pBSoUbQ.exeC:\Windows\System\pBSoUbQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\slrrwMg.exeC:\Windows\System\slrrwMg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IpJPudY.exeC:\Windows\System\IpJPudY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\naNdrWh.exeC:\Windows\System\naNdrWh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HKBoYcw.exeC:\Windows\System\HKBoYcw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fcKcspV.exeC:\Windows\System\fcKcspV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yMYuJFI.exeC:\Windows\System\yMYuJFI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ERBzBEw.exeC:\Windows\System\ERBzBEw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d4a315ad3a03b6f357bd843c7e83773d
SHA11e624ce826a05c4fbe12c5b11bd7ef67be2a2b80
SHA256e951e9212953295da16e94fc0af53be9dec13a61ddc3ef0cc4867aa155d66444
SHA512e1e8a61e0f76a4516d454788cd0098d7103d816560fd6b9c8f6e1e8186cd0cb04149d47ee6273e49601b9e9b54ca050464dcfbf83f9dbc2ce903f8c28eb0599b
-
Filesize
5.2MB
MD52062e10bb15264960ae40f7949866306
SHA1e8e6b737a24a263fafb0f2b15f61811a62ca67e5
SHA25678bc47e4bf5d9d74ba73904d149cc197aa7efbf9d9776ae6d3c16cab38f8301e
SHA5121a31104cb95b214d837781be7d712e8bf3596cb683a4035890bef236e96e836951d92a1e28b45f18665964d06503b3bd84dd7ab0f228c1d5aed32df9bce8e176
-
Filesize
5.2MB
MD56b41830670a5ceff51418fafae23db16
SHA16820988b250b8e1a8341a039e827f47ed6f63d86
SHA2562f05774cbfbfb841f8f317b8bbd9b9d71a407294916ad1aa870cd4245c3562de
SHA51244f5f67c6dd23524606550054e325a19802dd19cbf1ad6eae6ff523d6523c1a941dcd60f691a32fc75c9de264aec34e9620b379c20bf858c060f2207f6b1fbc8
-
Filesize
5.2MB
MD57ebda18368301106822ca48648b11d0f
SHA13dd3d6079f1d95e712e4bf51c659e8328527ee8f
SHA256201a0113ab6bfbfe339a2da86aebafd0888d8603443acd9ea170741c85d81917
SHA51222b027fcda30aca5675d13448ebe678fb0467e183c34cfdb9b92933d11d928d92da7b44acb8065a5fdb6ef1ac46e1c317394d551b1c578c341b60e63c1aacddd
-
Filesize
5.2MB
MD5c2faad6f5affcf768400e4f6a58ff702
SHA161f8f9bacf1d1a98a5f43ca62b7786d476371e85
SHA25602c763d97eea6193b68515c6bebaccf6e25324ac00058c3dc6bd6d04f7f61cf9
SHA512ea94c112192fcffca904143d7590e4cccd8cc495b6f6d4510a59e239c17eb3bc3a0873d6c2d4c4e2026f48fa4d90301a54820900bbe18d204fa4d88e2762644f
-
Filesize
5.2MB
MD5cd2825041ad53faed8694a8d01004811
SHA1ca712ae7315ab3a614ce83863230dabb88f09ace
SHA2565d5a202d47be4cb307481913d13083b7ba950c1559bb8e64482a2759a08756ea
SHA5128ea468db5f7a3787f11333ca23e557c758540b6110c8386f14cd1c23b17f48cf718e74d6fd7ef605e985813520527c9ffe4b6c0756ca7e142e1f366586b34704
-
Filesize
5.2MB
MD5fe04c17e4719d1bdbf8bf0aeec6a373c
SHA1635d2bea35ac07ce59b9bf0f1bfb296965a87573
SHA2565f643610c019de3afb7e71be129ffe7badf586d1bba965445720e9f468871314
SHA5121cfcac5d69807e2ef9701e70a677cd7f8054910b29c71dfded0cd2f7ae13837cb7ca51106793a1ed81b4ec61508ac6249d44aa4bf0d2b4f025d3abe484c849b7
-
Filesize
5.2MB
MD542b1a5005b59ec038f5accbe2ac5d3cb
SHA1ba634047d0b1eb7b56ed320aef038be3717b0451
SHA2563d5d2750188c20935e37c6ac0e81052e495ca8d0c9d8a029cb905f4d661fe643
SHA51267e2e0785e29ef0410395a2cc2a22382eed34a5dd481e85736a55cc0fa3a65e4f585c2b46214a9afff496f4c484531e564186e4f616d801c67e85cc60fa02d80
-
Filesize
5.2MB
MD5bb3a4255b9d1408f40c875676d11d2fb
SHA155baaa437a32418a36c2194b1951c81cf9102b18
SHA2566c06b27392d5c7a3184d8d1aa08b93c0eeb65160523cbecf5839c8bba263d4c1
SHA512eafa54b4996069418d584a70fc8d18fa26adb494f930718a4c80f65087097a83042f3ea10faa90758040cf927c08ea76301c6d9f5fbe0a4b8dff30284a8d68f3
-
Filesize
5.2MB
MD545bd23df60564a5d9dd72f6eeac6bc82
SHA1299a5f13dc6f99ddba25634ba1c82f0b6212fcb1
SHA25613eeac4b31d1345b32502467f57f2b1d77cdd35791f9066b642366eda69a9341
SHA512e8d11fcb2d90ed4a9195a67c9c8cc037105ef20ab2d8d987c88d81d05b2e2f0869a6bbedb32e4de95de9d208a6c67d99d72a5ff94a1f3eb5eff1c2e015b3baeb
-
Filesize
5.2MB
MD5e388b86b2687c92b258e85408d9cd34e
SHA14fd47f40384599b7a4ad887e08a6e99cd3a84682
SHA256c0814a075eeb5aedf5408534df31450df306e7d111d79111f2bc8560b9ad6b85
SHA51247841644da095a7b2d609629b7a4f46cf6518c6e956486eb5c8422896273093afb204bfca5a61fd6146487a8dee9b40d9f24f217f09b9df107d0dfe3aa51b647
-
Filesize
5.2MB
MD512e85fa34ab322aa7fa118190008bee7
SHA1ca056f99f3a92b74b8897962bd490144c2f1bcd3
SHA256c65f137501bb3a89d25f3250db5c86cc6026d26a3b9f12c0f1571226af54afc7
SHA5128674303c922773f939286ea781690e9a6b45ef9bb0ca8436ced73c16ccef98674d4ab9feb4e465583795ebc81e35db37e134b86b1037193f34e7f0696148735c
-
Filesize
5.2MB
MD58db2b5f717d1cbf9e88b2043952caec8
SHA107a891667987b307f884fb8c2e2d96f1430c40e4
SHA256a3872c48d8998816890aa2552f381c9947f4a42ddbcbedb0e7e14f7763e97a99
SHA512060656df2aba5485910b097f7361be725b766e72b978719f40b3093848c7314f132e08db0f215e2161cfb1f6ab4754b7dc9c207a6a88b5049897e64ed05bbd63
-
Filesize
5.2MB
MD5fa044a5018ea7fbe0aa1ab70821c520a
SHA1922bb3c09c914ded8597acf69c6baf7cc5dbbe3e
SHA2565348764a7d7a34f7de57fb6b81fffec3c7b28ca1cb6f119658ce8d17dc08ea2d
SHA512c654b159082f80607a04b5e805e2fb7534d7f3b6a819fefd0b6563d8582d5cbf89013c6dc16501154f1f08c3cc3eafb9778d6ea4f493b1bb1b597000ddc33611
-
Filesize
5.2MB
MD5c0af08b5b2f78d35e0570752886dc454
SHA1c526bc2cbda395aa4a29f74abfb0132011a9572a
SHA256acf88fc5fe3f516a803b66e7121e5443f414f3d7c37bf4fb51f96d749affef0e
SHA5124f26d774f0f87aa45724db6e8c34ed0f801073fe0ba365a13070a4a2d9872a477648a27e5415ddaa3f7c6bf92a93401bacde3a527805e53c460a45ecfc43a270
-
Filesize
5.2MB
MD5f51bf58d7f13b4d5a3e89fc9d1dfd45e
SHA1766c9754c447c30ef859b2819d8892745d3c65c2
SHA25680907d4ed56a4ab2329fd1e19c665b36f0c26b3b6d31621a20062030106d89ee
SHA512ebcaa43b1093dafee4c7f9b98d873d07c0b8ddc7011e80e1a949af242b5f96887d82c8184e94a5475ae3eb77d83268674ca34ba4a250e8145b86f17baac388b8
-
Filesize
5.2MB
MD5b30eb62bdbc4b96b939c69b0c8fd6702
SHA1d755de6eac6bef75df3833a0bc9f80f55e4ba3ee
SHA256bd329763fe86663b791a7fce499b92ec2b19c7210a820d53dfc4181c34b9838d
SHA512c0b6626bbe3a7d2e8fd28b1de88124f80c29e86b48332c767097b5cc1e51fad4aa95009c0033ae52a7aa529a48034216100d4787b73fe0e85a46b0e9058fceab
-
Filesize
5.2MB
MD5d9f1a843d06c917c6527b2401ce24a12
SHA136cf01f160fc89a4011fa7fcbae360f4dd7e109a
SHA256df701798dc7530d0cb7e518b50422b4e3cb1673c088c3432f03dd323ed910601
SHA51222add06238b40afcd7a4dddc5ca7ad80021ab5468d66e343a65524d2c321cb66650338e58d3f97b0a73b783659804f3df45dfa3b10c37b868fd918f7182937a2
-
Filesize
5.2MB
MD526e6d3a0cf945177bf95054cd16510ca
SHA1ad4a94a11aeee139e2cd6449953aab30188eb00d
SHA256515f38bc2f1f2d8cea67c207891ff238026280eb7f72187d249e13fbc311b66f
SHA512925bf79c2c13c3b8f9c902e8a51465ab5a113f89c0c16cec710be8201eea85d18dadf8be58be35e2206a2fa21beba8593069ad27dd811ab14db940243e5ed54a
-
Filesize
5.2MB
MD57f914d931256ff7988d34dadcb66d0ba
SHA1ee7f081501b049a0128cd04016020441df2e2baa
SHA256c57bd4a4d7ee1a5294577c7e708143d62c382da974c7f34d1a1cba3671bc63d1
SHA512aae93dc627b7e3dda5509c0f1a2c3eed0297e5f2b5640d00fd4303ed89aeb93a7aae921e84355512e480b47aa63b0bde4032f8dee9fd0bbd677e24c3025b446e
-
Filesize
5.2MB
MD53bc7b513f0c3c769dbbf08a63d91fdab
SHA1de63e9ab9183f3a205b3bf11d97e8b6cb05ced5c
SHA25655b32a4463dd4dedd28f34160f8e3eb5d0d37918e9ae0ea9b97cb576dbfdc8b1
SHA5129a6bd9da8f89cb852111970ff04cf6895601627f5ee527f586104d097ecd5ac66b50b2a644096dca4dce51cc92d4363cf1b0a18865d0b228c4cd1c18dadb275a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB