Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/11/2024, 10:03
General
-
Target
2024-11-17_05186e131231f48647f6301375c4c298_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
05186e131231f48647f6301375c4c298
-
SHA1
5f8524a790874c1bd0b38f1fc97cbbf0a6a97222
-
SHA256
87397cce545ab0011e7da945cd1a3f5480560a131fb1168ed6019d6b8741ef5c
-
SHA512
5cdb7a42b0f436cece640bcd9261151ad38d3934e75c82a60429592576db8130881587437a88546f8d0776c9db9551d344becb6bb7f098dd4f3085df2c67a675
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lUV
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_05186e131231f48647f6301375c4c298_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_05186e131231f48647f6301375c4c298_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QYVmQGo.exeC:\Windows\System\QYVmQGo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yAQgRdi.exeC:\Windows\System\yAQgRdi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aVqkIbX.exeC:\Windows\System\aVqkIbX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ioNJmWE.exeC:\Windows\System\ioNJmWE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ObssCSN.exeC:\Windows\System\ObssCSN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JCCKNhx.exeC:\Windows\System\JCCKNhx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OmhkacQ.exeC:\Windows\System\OmhkacQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yZafFoo.exeC:\Windows\System\yZafFoo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pWOMyta.exeC:\Windows\System\pWOMyta.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Mcvwqkf.exeC:\Windows\System\Mcvwqkf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tDkyeEs.exeC:\Windows\System\tDkyeEs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ALjLYye.exeC:\Windows\System\ALjLYye.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pMGeYaD.exeC:\Windows\System\pMGeYaD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JKvDOAm.exeC:\Windows\System\JKvDOAm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MkiGWIW.exeC:\Windows\System\MkiGWIW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dEgNrbf.exeC:\Windows\System\dEgNrbf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IcbmYIx.exeC:\Windows\System\IcbmYIx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nMGrlRE.exeC:\Windows\System\nMGrlRE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UTGgopy.exeC:\Windows\System\UTGgopy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dFleSeJ.exeC:\Windows\System\dFleSeJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YGrlfag.exeC:\Windows\System\YGrlfag.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b516f24bfc3a8d9e00a9640b14b409a4
SHA14ca416bbc26610d0e3d996f82e26a3e8b2c1e569
SHA25698a5dc76b8ad18fccc9af7591ff0fcc9ccc17f2de6859086c367501349b1fc33
SHA512ce6cf63601b760a354da32743c894619aec640fe63021f87bc969bda621c39c0fe31cb6f023acc9ff22245bd14812fe5f796ece8c725c3a29a33a9644366ea37
-
Filesize
5.2MB
MD5425b8fba29e43228cef51c20b6ddbd11
SHA1e144ef089eb37bcf6305dc32db7c791cf8344a08
SHA25644dd461bcfa5cf9d919613995c352bd59b7d2e13c21b7beed48f4fb833989808
SHA5125ec94dd9479951ca61af5ba9a16915e4ec3038948f6172e95563f9ef805e60d7da19df7e7e02fc9ff11df4eb670000cdd9fccea1e6df1de9f6e8ca275217c358
-
Filesize
5.2MB
MD5b6c0b272c0c6043e137b030cffbed424
SHA1081c2d93bbf34a99df4e098d9cec6760138ce7ad
SHA25690e12d75de60eeff6609f0400c4be54d179d9ef8a04bb9dff636a2ee187410d3
SHA512baf1112f637eaea4e7360a40149305e6102cbb413bb0b4a06e85f1b8a6e3dd86fe1cd411edb7ed7095baea973f461e4d7da18a7a121a91c4c6a2fd03bc96c650
-
Filesize
5.2MB
MD589036d46a6f1238e96339ef49a64b40b
SHA1594b7ac0ab8de970b42d61e6539ddbc73d1d198e
SHA256169b0bae51c567245579e79032024b1b2230e843cfc36791ced3d99cd7af8cde
SHA51273a7f6b8eb275ef8d31fe5e4c59d7f6504b4c68827da39d11f14ac1ea3968a2b0956b6f7346d2d00c915273d1ef5eb7e5e9d1004aae9a98aa8322e7c2eb7aa9f
-
Filesize
5.2MB
MD549932d75548480d46d0df9105c4ad087
SHA1af3d1ff95d8224cf6b461844657baf47c0a428c7
SHA256a6d4fc7bdfabaccb9ea7a53717069fd7bfb398cd72a909cec4c9b673147739c0
SHA512dd4425344b03b6a7247f65ac2ce9897e0c2370a5ed80eca5c1b0140bef23b3da2136e605fcd26f77b8a06c6611d24397712afe314f6bc184812bec4d1c04c561
-
Filesize
5.2MB
MD548bd29b406cba5df8d607e58a14f9105
SHA1ae25dc944c360146f29660800d6373d891f62150
SHA25630d1829cc72074e137328010140daa712665c3cb7500bc82cca996c12d188781
SHA512b223f47878483188b4d85fc6fa412ce5236b476bf5eff5d3f7d364f03601d5d89078bb15fe0d9bb7d1234cbc32848aecb890e08f7070f488171cdce3baff48ec
-
Filesize
5.2MB
MD5bfc9e88bbaa14065fbc4d9667c09ef8c
SHA18b077446d725be4f233b74fe0e9bcc6ef8e59512
SHA2564b4fbcb80c4bf65065ee814828f7ab2ae7905cb3fad1954a5ff73c68e564af6b
SHA5122e2f302e28704c80c6414e14d15f82c2030627ce0691e0ad6dd976acb89dd73fe661339a37a2675db1bec5198defa58629110fd22273594345d43d4b7325c966
-
Filesize
5.2MB
MD534687f5badd75415ac00bb7c8ba41142
SHA121a5cf9d7a479294b26615008b40dc0c329e0980
SHA2568226f9849c64326ba1962601a5b2eeee9c38f93b1245ce2d8e8315d65d7de995
SHA512583839a6d12628ff0ef0a7273e6edf4e1fdc53ce70b7bd315258a8eab9105c4d7b50a5fff19832ff0c805e8364b94dcbebca57e7d7ef06ffa84a86547ab03e97
-
Filesize
5.2MB
MD5d6345e0f88958d7a5c61444776db3dbe
SHA190d49c42ea393cb73910a2d78998a39fe5468efd
SHA25671bc132db874c921549fc0fd585bb92f91c37a2ba05862665b76873414d218ac
SHA512b597ebc240cf41b17a901f0b7711153c896032c64ca3aa2201cc9588a27e07722537d75681cd88c4d3d7f2c616917098894e954a05ddfcc07e47aac934fa283d
-
Filesize
5.2MB
MD54c5c27bbdc01fef3a4a223d85d161c89
SHA1392eebaf6b3c51b33bf70ae4480c0bce94447185
SHA256051fec32bd1e1059247d144407b67ed043eae88a79c3dfdf9cc9e55269e9af1c
SHA51223f8b2d4371eb2e455511b48ae1b2040f6cb1540143b21472593f146f573c8ecc92c7c45c4b4ff59d43846a52b965c457cdadf8cb95bee82a758bca7cae3f254
-
Filesize
5.2MB
MD5a523e064366ca718fb8a3f27c6bd094b
SHA18eb76ec5c5ed84cbdffa3a8e43b047c8099148ee
SHA2560c0c4fe052615a559400c89d0f5f21e14792eda234ea98341787ff32985e1933
SHA512776debf5b73eb35d8ebf0666250965cec2049654b9442507d47dba5a9fda71c906dc628cfdaee95c28d8b83c7c3b050cc3e993046b41804c1e050473e46b3557
-
Filesize
5.2MB
MD5a9e5c07b587fa4ef4ddda8b06fe8cdac
SHA123063e17f0316a878523caa2936517851e172c5d
SHA25600e71cca6a6c0306872bec1f8648701ab190d742f6b4afa2a4bde9d52d329731
SHA512ac97685d8eef42f4306e8f2cd4ff50d1e955765e8d690b5268ceb0aa89f88a4a972c277e1851b7277fb2129c45e8f70a84ab0e1b8732497070df806617a4adc5
-
Filesize
5.2MB
MD5d388f18acfa7b77e9452b71508be2707
SHA195833a261f50c7ae3c4295095a66d293543322ac
SHA256ea6099a94d74030a73fbf0c5cc594645df913437501bf5cfd7abcc5ace044862
SHA51298a698cd0cf9f1e6c8377c1eaf7bc26088c6b41cc10d1fcb91e4f561af1fc973694019869039274d43eba81f0257f5a9e33e37c651a63778293de6ad5c85bdce
-
Filesize
5.2MB
MD56120a9ecb942e280a0b63928829f4fef
SHA155a30c711af6d7bc6a288b4c98fe07a3b796314e
SHA256b9004f87813d524dc01d2c854e8539b5b0726f8886c28b1c636777aabbb8fe39
SHA512e166af4f92d2d3b20f98b78ccf4376aec1d9c9c51e2f20c5b47a47882d048006a85d3c221d231d830f631c6427bff8a788875b879c3ace102c86399e970586f3
-
Filesize
5.2MB
MD52f60382f7b8ae81471e4bb579b1b58ac
SHA13f8315b6c811fb7446ff0d1842b8913d91ab88a2
SHA256534b19e0d2b118d3ebab368a9e8b830e1ce2badc9282ac6a340f64dd2e5b16ac
SHA5124cd91bc52276ad6a5680fe3de8a3b257c37e16ea68fa204d61ca2739263a084ec00282e3b468fdb97619ba61dedfdfc70e94af9b2bda1a4658bc137472a13560
-
Filesize
5.2MB
MD55d0c7dfc77fbed30f658ea46d30c4392
SHA1556a31a5055e93f32128941dc174353d6a9e98a5
SHA2564ed66d7dcb1cc70d064b433f8630c6d0fc8256830101c7e7d77da78ab99bad3d
SHA5125111e4e66d5044467611932d8a537bf2ded8d147d5cacec45b9f537780785f783f229628765b1f5e38b79566c9e148c12c0b49e73a203a25da4e394f575e3c34
-
Filesize
5.2MB
MD564a8d633fc75a21dfbf96ae5d3b883ce
SHA1dd3e590a5fb5f3b28335d6a1cb6a8cd1b49c5f1c
SHA25607b7f2d64d87b47801506a68abec9bf69ec1df9de9fb9bdaae88364b2c26d6da
SHA51273b5523e9a3e65a976954108f258f8f501317a793ccd2354c94d2074cdefd60a5adc5f0b4b9112152ce366745a89578fde16b29460488cf387d55a08cb856a1e
-
Filesize
5.2MB
MD55b1e5a2d2975dfe4b135fbcbf6ac398d
SHA116996d99549affd3aa46bb2476a7731f0610d98c
SHA2562a56bbc1bc27d4bfce22e030de66f135e052e321115daf5cdaf5273477f5d374
SHA512e1da5b3783604b5564e066ad1788a90c1ecc6bde0475e2496db7747c0846773737b4e5c725d5571ef519c560aaff3d90c2b0533e4e900cf667d4715b30c55c7b
-
Filesize
5.2MB
MD5cca92ac1c165e96ff3c81bc9bcee5ab8
SHA1a5f6f1a5249d26c810dff2178ca6f5ca3e2799f7
SHA256d735a8da54eac99475ab06bd158e5a63c9efafc02d55f13008b79282de17a28a
SHA5126d89b25805d8ee38d01ed31e6fc7d1d6dc9ca3bf3f8113849962ad643921d5b792a91050b9f7abf8fa635536b86b677ae97fc88c7e90b39e657fdb7a1fe279b0
-
Filesize
5.2MB
MD55230cb4b146ca09acf039176156f2f92
SHA19acdf530d325617517f27e149fafce6c540a7e44
SHA256c255207e624ff77b8964f7c4d1d9f8471bcc72b6c065e8d6e944e41bf4ad3ba1
SHA51237fb0841344da523a1878d555287dfaea1e7d52395f6f96de5ce81d373208bc25a1563ed540861a55a9f584113389754e35689392313beb5a5e12127e1d0a936
-
Filesize
5.2MB
MD54c96ce41d0a03defcc68d181aec644ec
SHA1f2f096b894bfc3291f551056f5009496a34ff443
SHA25691e4047b5eafa85359794fc8047359eb582c7fd95a52a4979b4106585877fd64
SHA512bfaf19b9690b0d0437780eda61807e7ee065b04b8bf24514fbc9c82416f16bc18a9f8298bce3d24e21240bf855e3c4fa812f91c9a6ed13b81a7c6d99be336c2b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB