Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/11/2024, 10:03
General
-
Target
2024-11-17_08d9ea0c2409963573658a369799df6b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
08d9ea0c2409963573658a369799df6b
-
SHA1
5511a4782f983cef8d8df0cfb36974ba22d6a30d
-
SHA256
db852c3810344cb85fa10dfc0893c1d1a2da3f762b6612cdc6beee5e7654e5c3
-
SHA512
c1947f87aefed864acb81bcecf64bc6d4e5bc3b7c12b9c4326cfb83162f5ceba1ce074e9283ac18af2dbedc1ca66e481b9f97845275324dbc9c6ad7de1d82c1d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_08d9ea0c2409963573658a369799df6b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_08d9ea0c2409963573658a369799df6b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kDoIBCp.exeC:\Windows\System\kDoIBCp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yhgXDgw.exeC:\Windows\System\yhgXDgw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JnQaxHc.exeC:\Windows\System\JnQaxHc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CTFeVWb.exeC:\Windows\System\CTFeVWb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ylerKMT.exeC:\Windows\System\ylerKMT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xrTPBXJ.exeC:\Windows\System\xrTPBXJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CyygEtu.exeC:\Windows\System\CyygEtu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KtqBYXm.exeC:\Windows\System\KtqBYXm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CzAlYQc.exeC:\Windows\System\CzAlYQc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jlPllvd.exeC:\Windows\System\jlPllvd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NnVogqA.exeC:\Windows\System\NnVogqA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uEUTAQU.exeC:\Windows\System\uEUTAQU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cnYhsQw.exeC:\Windows\System\cnYhsQw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DGlaRsB.exeC:\Windows\System\DGlaRsB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CPRzjGB.exeC:\Windows\System\CPRzjGB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xAQKWGX.exeC:\Windows\System\xAQKWGX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CfuhHpl.exeC:\Windows\System\CfuhHpl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xLDLfwE.exeC:\Windows\System\xLDLfwE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vYIeQTJ.exeC:\Windows\System\vYIeQTJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kifMNWj.exeC:\Windows\System\kifMNWj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KmwSMPo.exeC:\Windows\System\KmwSMPo.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52a4f2a4903d8c644ed9dfb91d468750d
SHA11309f0f2859b9de8d9687123009c8af019e59b83
SHA25697358a5484b12c28e3666633555f6238ae4e07d04dbb32c5d7022471a36dae96
SHA5126a7baa7ab6e43b159f514c6474203187c3f55f527d0a963fef06a588c25506c9fa1b25a7f1a87c7ed4a56d16ac176b5360be680419fd937abf72dae605b7834c
-
Filesize
5.2MB
MD5780a9befe0e4c558b7655fd009f1256a
SHA1316271010f2a98352b204e0b069b432a4b3a7f10
SHA25635631b02038368e75180e7ca2d723d9437497262181ddb57f103ddbfec8ccf06
SHA512296d1f1bd428246034a1a16653074bd752f3de34eabd29256d1a739ddc45dfef5d8a29d96afafc560fb80df59800c366e7d48ac8570c2d605eee794795c77d20
-
Filesize
5.2MB
MD59d41f3f81802285e6db477699265db70
SHA149ceee6b04d7876ba1b8e3809ac2599030d0c9ad
SHA2560eac3ce67a19458ad36685fbe46350c4add34aeb757486d5570449378145dc31
SHA5123b7fae3c857de44bdebd2eba01b6c47cc8b4f53208bbd435051bebbee2761ce6d64c861353778883279047dd350a83d5d6836fdcf1208e018903495c29aed28f
-
Filesize
5.2MB
MD54746ac1660f085dd388745246dfd532c
SHA18ba573c1c1313f3959694f92a1c20d321b823d7e
SHA2568df89b382858516116d85e6c3cfffff09fefab5cb565e79d50c6cbb9ce56e21b
SHA512b78cd4273fc17b0efd8352731bd254e1b4aa467fdec98cae80f49d2024136f2f416e1615120f3051ac61fe40413c7d315d0041f0b496e8d4fe582c562402dd06
-
Filesize
5.2MB
MD5615a6c01957c8f84403990a54b40dcc6
SHA1687a10f620ff827d6f3245b535d77605144ce7ab
SHA2562164dd1eaf9822debe76f89e7bdb9d1796edd973af121cf806e83f03db3d0377
SHA5122134f6c55577860c132663973698f76cfe3409f4913ec17b01d3a1adff7ef845e94ccbee09afb211263ef304fc1008c391c7af4aa8e040ac31dc134189523f42
-
Filesize
5.2MB
MD5fac5860ddb22df604c29dbf74bf4eaf1
SHA12c3ef451efe74848d38798837430ea61b05ed4b3
SHA256623680ed7ebccf2f2c1875cca099853afd341f2b5069b290d164b0a2c517be86
SHA512a2e89ef77c1522385fd929a6f2611f4b3da58d4c66128feb3613bd36506bc9f3257686c295540ee5be51b429a9f5cdc6911e7fdb92008bf894c733f5b57b418d
-
Filesize
5.2MB
MD5510d36f05e1784f193920ec4a3a7e9b8
SHA1cdb91fbbabf73dc585e1ce9b7d8afef20ca9f831
SHA256cb98eafc2303c7ff536ecdd8c3b94571074d27b25d90b40cedbdfe48d92c9209
SHA512fb781c19e1b8b59e04fc50711e72504e6c8d71149be0ee6616e3e21c5a8eaae311c199e61c76fc93cfd1ff1267c6b4c5e01c2f8c9fb1b8c947bc17784e36c74e
-
Filesize
5.2MB
MD57260dfd514aef4a409e66da54f4c1bb0
SHA147447f4fddf35a1dd69718c52bd077dcf16351ce
SHA2562742979aa0c5673965d4e243f069a3b415b0718c0468c55e9c896105df72ef88
SHA5120a1998f00170a76b8335991f55ec1ca69da2d061eba218aaa2c714889c8d2be3b1c0fbdef0672003a7effdd0cc36294b9e16ab91266df08e0335dd7ffc30f22b
-
Filesize
5.2MB
MD557468108138d184953b6f5237606581c
SHA14e322b4b077ef50e83e40e4fbef243ddabf058ee
SHA256d14dafb6c464cd8b8fdb2be1a6567f432c8070335df0e94a82f1b97637dc68ca
SHA512ad1e0f829ca40ed8b2aeaa0483030e7f044c5ab8f2ce36f8931df257355d6ff8fa4997001dd2442f09cf9ce3ab456947e9a2aae2b8adfa6cb65b29bfbce2237e
-
Filesize
5.2MB
MD531b85c98736f47f719ee58113fc27547
SHA10d6b57c3c2f7da85d9d48c29698b9fd739c9d0e4
SHA256de659c6cae90820669266f2fb729e0e7e72828a9656232c6d0caa4c9c14f6e7a
SHA512c6dcf4bde98a735177cc4af4ac088ffbf5a4bcbda60265fc561354423d3deef290a6bb02c64c79cc08f9781b15a7cf63d1e6e67b551f1c00336569869a0c8d4d
-
Filesize
5.2MB
MD57f67aa04c9e039cb2949dc3c776b170f
SHA1242561803e2f4b932d160028a41237637462efca
SHA256d39f7e4f8539b66d911d6f084204650a8f7f8b963d63e4dc35c9ef45d60dc7af
SHA512c0561bd70b21fbf7a093d8824cb581dd063729b8730554db9c4404b45816f4b3aaa2bf072e4561a3b85d3dab7a72b4ab5dc586cd1731543f1928507bea1be160
-
Filesize
5.2MB
MD5506efa843626de0fe92c48482fc6c916
SHA121f10c3088eabffee15be6f9e893e6ff7a21b7c4
SHA256febc65710b11ebc1ce0377182b8909ddd7a8993ef80f11c53ea75adf688e805c
SHA5126fdb0483ff07e9bdce6ab25a77a029b35729a5e4266b3119839b76c8e9b2152052f110295b2a4b5f4a10fa5dd008645b866bcc55bcb1e8bcfdb194337c92c159
-
Filesize
5.2MB
MD5122ace70575620262b9e31d498b94cf1
SHA1b20a5663d4c0284e79e7b4e11da396e980d7700f
SHA25657eb7c1fcc9726b7438963721279180ea43e10601d82944c067dc0b5a57f5339
SHA5122fc8330007e19a0bba52a4393cf5647cb3415c04807871e31ae355e81e3cc6e7ee6619e455a4f45391c3a617729cf136f179c5e3250ae282abd5f1f96a8cb602
-
Filesize
5.2MB
MD5d398fc067a48f7a71f4ea511fa7f315c
SHA12c2d9d0f90d91724e7ec85c46425a6e7ecd2646a
SHA2564888391c7565b63cecbe4b7748ba989712caed6c7fa2be6cac2f1ec4484d9792
SHA5124027d905bf171b9084056b086d550f5d199693ff032276528ee1d903df0b160552cf896016849d17bb3d1bc30ea68de9f7877a14dae45019782af88d81185468
-
Filesize
5.2MB
MD533b422ea3a70219da811a241a88f9c3c
SHA108a9ad98d0b582c87b3ec06d08c75ae677affce6
SHA256bf09c8b8c6775ef9b6347a27f576569bbf452d9d091bf5c7df8ad8bd6f2ae0d0
SHA5120fc0384285ca4cd00e5e96c78da4242312ce2101a3f0b0e842278c8e48122902d13f00c3032256a57e9538d484f37c32244f3a3d706d0c009dcfe727da2b44f1
-
Filesize
5.2MB
MD5d0f0ec097f082b092449eec9d5700beb
SHA1b120831dbe02761400b0165ef0404bb2acdf3e7c
SHA25692d1e6304ba2c1a532532360507f3b862e5a8620a72fa9aa16068f96b7bb1cae
SHA512277281cdb0a20f0ed795637b94f49413f8b8cca8ffe8338b69a82b9705984917499cdc965cd9048a799d858a10b47a99821f2d865dc49217d3b4e94157f74256
-
Filesize
5.2MB
MD5a4164dccae26a2ae8b4805074cdf3946
SHA1d4d0886a37d9d897d859e45815ada673ba402cfb
SHA25647601c3069c6db0a28073451bf411a8b38c689360a6ac38b9787c2cb64eda1f2
SHA512c7cf5bd68e1b1b9988b253d25f233d8a895a2dc7f85f10be93cd761d5135d15eb70915e2ba38a15be37895b3e49dfca0ae3396b529329ebd0c0bcf706de5c773
-
Filesize
5.2MB
MD574b5427d6d95945f8fa1d0e61303f44f
SHA199f159831ff7fde6a804ab4f0011806e2128a43f
SHA256fefbd694be0f077087acfa1bdf5ec3aefb25e01770638484bd85529866d29973
SHA5123c1fbda0f76294827a7a498f77321fd615e09cdd519030effadc530a9c869ec77d7b1d92eeabc3e17d94e48207144c7ae641d5fa054d40e2e9a920e7a5cb4e8c
-
Filesize
5.2MB
MD59bc218ceb90c0af7ddb8ec7dfc79925c
SHA1e486f416581ae00cb3f74c719bb48f75486d503b
SHA256e167ca9745328519bcaa8a97df0815ac0f20668a7c5e8d80366151de8ae10839
SHA5120e498682a7ccf4239118a07ce3257f6847c7be5b9ceace2b268231a9211edad4c3fecc6359d30df38095c8369d9f77ff2373f585ff497a4b140fb34a853ba8c3
-
Filesize
5.2MB
MD5aa791325af82acfbab209b09878e32ae
SHA1c166a900d2c2420958e1a36ecc289373949bdba8
SHA2562304879039ab49f20d8400a631665343ce88f18b62c098fb00d321b634cca4bf
SHA51280cd20620cc7efdc5d4c92dbe5d23f4e033e38c84a5f6d66a8c61e4c2f463b69e2ec8da461cd72523c58efaa5bd7c76f99427c5c80aeb6b69fae9dbbcd5cb716
-
Filesize
5.2MB
MD5c2fac879b6bb9d47236280d74ab13051
SHA144f4bf0cbce83f219b238fb2414c5dcbb3b00394
SHA25691d0ef8646540aff1fa8044391cd9117619efe1b21d085e1d1649ec78f0b3dbb
SHA512c623fbc413806ebb488d4adf71e6ef13f991ed68b09c58d703f48075068a88b094b83030960216134867adb3ba705aa0c96748843b11871f4168fe6e5161a6dd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB