Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/11/2024, 10:03
General
-
Target
2024-11-17_05186e131231f48647f6301375c4c298_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
05186e131231f48647f6301375c4c298
-
SHA1
5f8524a790874c1bd0b38f1fc97cbbf0a6a97222
-
SHA256
87397cce545ab0011e7da945cd1a3f5480560a131fb1168ed6019d6b8741ef5c
-
SHA512
5cdb7a42b0f436cece640bcd9261151ad38d3934e75c82a60429592576db8130881587437a88546f8d0776c9db9551d344becb6bb7f098dd4f3085df2c67a675
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lUV
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_05186e131231f48647f6301375c4c298_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_05186e131231f48647f6301375c4c298_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AGIejkh.exeC:\Windows\System\AGIejkh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PhxQGZk.exeC:\Windows\System\PhxQGZk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XKulrTI.exeC:\Windows\System\XKulrTI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rYNtmfJ.exeC:\Windows\System\rYNtmfJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lgORIWY.exeC:\Windows\System\lgORIWY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\piFLndg.exeC:\Windows\System\piFLndg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhDTOsl.exeC:\Windows\System\RhDTOsl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BZorLFV.exeC:\Windows\System\BZorLFV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mMwglsY.exeC:\Windows\System\mMwglsY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\orcxFPq.exeC:\Windows\System\orcxFPq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\egfubtR.exeC:\Windows\System\egfubtR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JsEWFyx.exeC:\Windows\System\JsEWFyx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RfVPTyF.exeC:\Windows\System\RfVPTyF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gTTFbJC.exeC:\Windows\System\gTTFbJC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZDOaWvX.exeC:\Windows\System\ZDOaWvX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kaBkrXZ.exeC:\Windows\System\kaBkrXZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lQqCCxp.exeC:\Windows\System\lQqCCxp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWQjxET.exeC:\Windows\System\tWQjxET.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iXOUUAA.exeC:\Windows\System\iXOUUAA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OPYlrwt.exeC:\Windows\System\OPYlrwt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TnMqBfs.exeC:\Windows\System\TnMqBfs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b9c819d567dae3af6f667683b0253900
SHA1bd10a8c2a91a13815bf6d6817269ef6ed6e8663b
SHA25638023aa9c26a4d5120c05788fae273f7c0b9e801dac232342f854f5c4ee83931
SHA51284d8d88ce2b369ec04ca9e4b4a55ea563d747f88df5ba8528826512259df040384aac353cd60f134685d161ea21457d6020f8e744bee3b4dabf515e6e53f2baf
-
Filesize
5.2MB
MD57b60013ce4fd48bd6a84f432c11967b0
SHA1450af8243f7a27d4b59aca497c4f607494bb28ee
SHA256aff093b15e8f5c8ec293d9442700a01140a2aabc83e0099d2eaa09fc65da29dc
SHA512371a16d9588f7f04c120a4399eeaf64115ea1caaf5ff3c09254cb0f0e5bc489b553608e05c839ee39fdcdad9e3b14e9ab491d6db995475ba578a7483bc7bdf4f
-
Filesize
5.2MB
MD58a5f555e27fb30b171600ccfa6c5d893
SHA1a6b51e5353b7a0ea1acebb2ef65b2a0b9141b222
SHA25660250d4ad3ac64a8cc53d80d3991a57f9ae9d796349f5b99ab1d31c1a4a538a3
SHA512fa280e4b9ee070c8954affe2e75ff190ed046028d44a1b8dcd0892f48a0b75280a64e8b00210bd1df0e07fd933458ebdf65f5bfc66394d2373f369c81e3c639b
-
Filesize
5.2MB
MD5a97a7f7009692f1d4d80de5131348682
SHA1fe9bf4d0891199443e43f5958ff2f7370632d9a5
SHA256d2d41ad386438766cb192fa5ba3c886057d26e2a9332e44e7ef314b9fcd6719c
SHA512244f04916196a72b502532758eb64ebabeb3df59c5f91a85fc8aec5d1bd2abdaf5e2853bbb90fbd79fc64ff34357ba6f9a587e194b7cdfc77e99843521705550
-
Filesize
5.2MB
MD5f453fff2353628b0ad648b0fcb6d61a7
SHA105ae415c21190cd91c5f948f374d967491eb909d
SHA2564147628fdd5aeb994885bec4206b02d410dda0329ff8ef605429ad2fcb65efff
SHA512255aefa1117a4587ba0bf33eaf9d0e021425e6bc222896cde037466f4836f4fbf2cff3581b090e473bab9c166ab5242a90d73b6ec0d81e0fae3222c0163f51e2
-
Filesize
5.2MB
MD5055f6a062997b404464d23817c126fca
SHA153184350a9d4ad077c8eae58cbc5ca8f42d24929
SHA256d0bd81fd9cb9c38f4ff9aa74d7bf932fed01e63290aefd70fdde1177e76afc44
SHA51213af9bf6336892ceeef5b99a087dc96c8d9fc1e893c36a0c7266ad225b7cfca515842a3d045a047dd0fdede10be16710bcbe34aad5be81c96ccc56ef7c48b515
-
Filesize
5.2MB
MD5c9e823d15b445c89dc618ac9938ecf51
SHA1e39469961979c1e48a5ce92e20d5ea276b889d9f
SHA256cd66b7024c0c46f5c905a89f5bc0838d81d5a7f9334e948aa60f30ff3c306aa3
SHA5126769c6080e139ff3caa2d473c8b932206f3e74816a03a304e390d8dbb0565ebb37d5e768f4e66be91adcd70d0567e664a23c51d634054b58c35e8ff215e2f7d7
-
Filesize
5.2MB
MD592d0ec7f128bf5eda378c15cbccb7be5
SHA1c7c271eff00d0f6df66a747a241e682ac074b305
SHA256b685a64b9af09d0a470a8a3e0a095eab1850d7c375871aeac4137d02f250fec5
SHA5123ad8fbc37a8c9fb1743183803c2a95d712e0eaf031819cb03eb25e5fdcff4e3f21c7fb31625236c87be2970127edd0deb6e3d9a5cd7495cbcc487c33c96aa847
-
Filesize
5.2MB
MD5d1d19a4cc928c1963e6a227ad10c9795
SHA14d4c29d6ea0b0e48925a630a7a68bf8d45d05e52
SHA2563d9c14cd63b645b48020c556025d30c7b6a6ada6d3813dfcdab9bf40e9f0f6fb
SHA512617ad2f493e166f260123382d2c3a82d796426607a4b6ad742209c2d962a4b8de5fee338bcaffcf4e7097fabede4ebba04ced5d4cb7eb302386c4c4d741470d8
-
Filesize
5.2MB
MD5a364175b73ac7e4bb0e450eec11248b0
SHA1327356c83606a4fd7472d76fa46e006bb066ac44
SHA256bcd1bf775c7f5b4c54879f064568926f49bb0ed55c4b3fdc4a693034f7e9352c
SHA512e4430792b93a0b779371d623897bab3e86671dcbc9273c0d669064d651673f479e21bf4e5b13db17c68b3358f5dfcc6a0311d0e5314d43a215a6d8e079357632
-
Filesize
5.2MB
MD5156a9c35fd7438e1fe5f5c29084ed816
SHA16e0004defd3cdd7230a046c6f7c4d141da444366
SHA2569e44ccc8aa416fdad13f6dc7a9510009755fb26e5e1a034eee753b29cd1be0ef
SHA5129ac6f17678caad38ab0d748e23e6ba9b6b62ffcdc3722f2e131e9efed3a6ae542ac381ad11296d0235cf0ec154a9cb1d288f8a73fd6e34fe0f0e00512c44fc5d
-
Filesize
5.2MB
MD53b8b197a119f5fae1cc94f1d6bec6963
SHA1235d5af126462f809a51af2612b98372209d6ca4
SHA256579fe4e4843d327096806818d8b49cea3adacc139e2526006a485491b7ffcc16
SHA5121635440f70d9ae90aab8f0a476f6805168405b442f8af62183cbf09e8136ea0baa2e92d1a762f72b5e0a09deee757c6cdb52f96abca48dd63195b8d107c6e160
-
Filesize
5.2MB
MD547275ccbc4d16968fb86a2662565e6df
SHA161eed0309cfdb3a070c52a91fc1b1f7456e2df93
SHA256d5e74ff9cce9f21cfb058fcdc636cf6b5553e62028befed3b4ebb89f323f2055
SHA51257ad3a2ce8e286f4c0319a97071e10a18c45a6d743fdafe9a68257e208d5e6a2e7cf281aa9b47f26a9137a736564647a8384de4324d926b9f07c71ac9ca12610
-
Filesize
5.2MB
MD578c212c40eb473f054313adf509896cd
SHA1198ffad70f57f981ebafcd779e7b212becb99094
SHA256ee6f1dcd7e79d104074c5965a9be38acc2ffb51913b5c52368693d0fc6739455
SHA5129ef2b564b0d1d58b24fad65831cc38edf6bea54b9b4c80409ced7b24b8e9ad126f7f6af72a0efe7035ea37d04b0bbf1f943e0369e70256a970d16dfc5c156a4c
-
Filesize
5.2MB
MD558909c0e0eb2ac0009dba38ad5d71729
SHA18743c46e13857181d1911a689a2775e3f277fe34
SHA25615c036195debc13b27c3cc98d546e09f60220721836846394c036ba4d15eb0ce
SHA51280566570d79519e1a309d6a4a6e8dd6c14aa20a8d3baf019040e06fc9ae42274c9e16c3b5763ce9b8540c1918d0f939fe18e7dd7cc30ad3ac6267880a236337c
-
Filesize
5.2MB
MD540a2bc8e3fb8aac86d664b952f0a451d
SHA15ae43aa0054316854873de69f96a99631b3aa4d3
SHA25626952a20515c7711cfcd6114a4b07c0e33c5e7e8f6b787ffd6623c4a48587c9f
SHA512e53ce5922201b9cc1920b876c9f0cca13ff1551f5efc13383ab33d916cdbda5539c0b71ea96c5b298c717412004d40b57232553093d077afc9579c33b5edcce0
-
Filesize
5.2MB
MD5dd00ef5e8e199bd9a367593e30269d9e
SHA176a4a1d48576c2469afd90270a1f552fa0c3009e
SHA256e1004ce27ebc9e2368200fe37ed6dbe130cf566cb3e03179f5b9b94c3315f3f6
SHA512f4e577c27dc343bc58d0e37a7ebad9b76384fdb0b589471b2a20650724aefd7e40746617cefb4a96930e31a8b2d7128754e16dea12c9f8b391d23e035b5be004
-
Filesize
5.2MB
MD57639157031d528afba33251fc4c28c16
SHA10587b89d83ea6ecabb0f7c8bf4804e2073646fda
SHA25620a9fe3fd0d16d424043003007f12ffd7a5efd299b3d5108e073964aabb3630f
SHA512ae3c459e7514125e98d4d4c8dc0b660c49119cade15f36e6d8c677d6f564dc42d35ac22d58d82edb08ad246e10fc7c3c9dd0d7af118252193f4d915497696d11
-
Filesize
5.2MB
MD54769069330a58c38d4ba877f197af5a0
SHA1cdf915a3d42cc70737259736fb382a9c5ffa3e3a
SHA256e08d918589edd2c3565d33db77de61aa1f703ba6ec2188e9ccc8b8e74019ba93
SHA5129ee262b50a10e8f980f2c30b90959d35d6463240a7c5ff4638cab3df456fe80547f06dbedca25976506e82b9470bd40486aa0b53f70aadcb9637da73ab2edc0a
-
Filesize
5.2MB
MD5409f668e8d4f440428b73285856bd3c9
SHA1b58bb7b9653400faff96a07ad15706a78c08dac4
SHA256c5be9d46e3e601ec2417f5dedc2aa404b97b193238484ab3648bfec78be2e52c
SHA512161b62c5a0f88bb3486b9963dadf6af99ac6d1733c6a5b61dbd27f2c268141b62d9fcfabe71a4b7122919a28a589a9f0a2740a670497d041f62748a7bb568942
-
Filesize
5.2MB
MD5e886b2151e7190efec24fa0ffa16beac
SHA136b75d913559b23916adb51badf2fe2a7b93f167
SHA256a22704041cca4cbb04d9eb190cae575e05f4e4730528ef12b2ac4faaf79feb09
SHA51238d2ad1fc03f8b16560a76e4a7b9f4c907ff95634ebf153f40714c3817a8239e97a3952ba95fdb733d97d48e4da21f869d1d83d38b5d0a73ba336613e7d07bf0
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB