Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
17/11/2024, 10:05
General
-
Target
2024-11-17_7e8eccbadd278e711e4f8433c9a1de4c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7e8eccbadd278e711e4f8433c9a1de4c
-
SHA1
e7b3a6fb60f4fe931a958ad1696e88b029f2b314
-
SHA256
fdba5126bda89a0d6f18c0994daed7ff89c769e2f317c1d1565a484034efa111
-
SHA512
f1e19bd6d71fb0e75326c8098a0d88570ff75dda377b80505d865e36cd8c02051b136260be3d28d73d532bf1bd0218e79b753264847d59175ce59ae83cb61cb0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lUU
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_7e8eccbadd278e711e4f8433c9a1de4c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_7e8eccbadd278e711e4f8433c9a1de4c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mLaYfbL.exeC:\Windows\System\mLaYfbL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cEnauSx.exeC:\Windows\System\cEnauSx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXLOYEp.exeC:\Windows\System\bXLOYEp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AvviTEd.exeC:\Windows\System\AvviTEd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sprGKAl.exeC:\Windows\System\sprGKAl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\blQnmXg.exeC:\Windows\System\blQnmXg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kelckzj.exeC:\Windows\System\kelckzj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vnSjGgR.exeC:\Windows\System\vnSjGgR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DyOrLdg.exeC:\Windows\System\DyOrLdg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HjKvbjv.exeC:\Windows\System\HjKvbjv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ixKvBmF.exeC:\Windows\System\ixKvBmF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SeTShzt.exeC:\Windows\System\SeTShzt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UCmPscS.exeC:\Windows\System\UCmPscS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lLXoPGj.exeC:\Windows\System\lLXoPGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eZYOLfM.exeC:\Windows\System\eZYOLfM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\axtmqZY.exeC:\Windows\System\axtmqZY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bNPvleD.exeC:\Windows\System\bNPvleD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MZfPdAw.exeC:\Windows\System\MZfPdAw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NAkBIzM.exeC:\Windows\System\NAkBIzM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zDZDXrI.exeC:\Windows\System\zDZDXrI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gyuTuQU.exeC:\Windows\System\gyuTuQU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c8a3bc9fa83562701afa008ab44abbef
SHA166fc290caa247513903e28bd05fc3497f22f35fb
SHA2563b857c274c45855685a057342c1d2fd194bb30a061d1c390e659d0758db802f2
SHA512963c01bc6b2e96d4b36db511c59164ee4d30ff6dd12d2c6b593eba9f541fbf65c4d34976b410060d7949a7cd93e2956edd4e76278f4046829a54a8975659b219
-
Filesize
5.2MB
MD5a12dc76000153a0a7752a96853c89554
SHA183abb89411542f3557f9602dceddb6b6e7eee73d
SHA2563def660b2527764e957587ee52b23948c9f7ce4a95f5c5abba07e0617582c44c
SHA5124b005899f8d77b4254756eeb37c9429e3852ef46e16e83ce63b398f694d4d11bd08a597b8ee191b2e1f3182f07ab619f9d7b2debeec5630b5916a91b92f90a5e
-
Filesize
5.2MB
MD5b98762b0744f3286d2356e0d60d08c3b
SHA1d3b39204aed7166cf7edde83383bae1eabd9af3f
SHA256d9f36636b8c2486846fc106af063c4a2c33fce4c84eb68fd4c57607119ad6c1c
SHA5128c13e30a0b850f74eb9b31d93f2295a7e4071af715def43aab4e0b384b0637f8b3fd07f09431806111889c9cbcb4ec8f6222660072818014e30230f55b8ca210
-
Filesize
5.2MB
MD51e20c5a0de6043d950c46e36fdab3e91
SHA103d20047e0eb16cbe36b3a66c8910ec0557aab2f
SHA2562bfd52daa00d1edfffb889d97d6b5b4c91c5aa48b7152672b47ce48394268bbb
SHA512807ffae5b8cb0e484d419a7d70b0d79c3dfa8a4b280ad0112cf5e0173535b04792f68a82e049c8b8c87500027d04852a6ae493f68f49c094995f0d714e864bbd
-
Filesize
5.2MB
MD51dca6913a43d3d6b35ef3e04f8b74df5
SHA126af6eeeb82de620d009c5af6fba00a7c01d8aea
SHA2562d908c8c056455808397aef2c7717f8ddefda249c54a72906ab91a2923e7ce26
SHA5128ca1e185a037fc9529edbd7a955ca059af9027859aed6bc38a405fd9d16359933e346d910c458658fee9462609c5cb747d4f73de3ca250fb4a24099a1be48c12
-
Filesize
5.2MB
MD5046b4e809bd516290fe12b1a0fd734f5
SHA1c6e10fc2c975dfec155d63491feec6fb764e9c2f
SHA2562b35d7af7424fa34bf86df3f476ab0787b67e8ab285238444f1cef15feef8a1d
SHA512a58ed1bd279000125797a6ef57977e059ae6b1853ed396304ee611f706d1242599bf7b7c290d3354ac969d3b2285c06b46f38ecf24801dd9fc648c68d34a5e67
-
Filesize
5.2MB
MD51d6a279dd83265dbd37fd6fb2cd09d57
SHA1260aed6c01a8671ebdb8d1248139b1738fa00ccc
SHA256f1a42635e61f2636a62eed1acd1f6bc05fdfb483b02611b3991683e028787cfa
SHA51229a76940123e08021f2512241c29a6e8338907ec364d5bcf3355cd8468c3b2ef84fb2a2d38f515b1aeb454d28ecbc131f9bf98983587b1de6c302476bd9c54ae
-
Filesize
5.2MB
MD51fb58df0dc68726eb58d1f5397701f90
SHA1fc9d7e85b6ba5f9e5bd6bc842cc7c2a51bab002b
SHA2563afa0d8b9f0d43a58c948dce470768e62f4f65137fb59dd91e5e10f4aad4e366
SHA512aae302fb54979fddc15873af8c57b691b0a36284bfca153de699a26980daba7a7f1264e31442dfb6b335d97f9137755273a95512ab58d51d61b083e2e69edb2a
-
Filesize
5.2MB
MD54735e3c97702650b45f3d8b940f11129
SHA1b94516ee2505f01a3caa1740e5225d111c78ce8d
SHA256c5cddf1af28dc0c0694c2e176d36af20eb10072b2b89a7354d5ddaa0f29fdf3a
SHA5129e8ea3bd53287002f0caf7047c100d119e024521c604b79b670f88868869e22d956ec15cd94132f7610fdf6b81205992fe624858240654985b107ea35b7ee88a
-
Filesize
5.2MB
MD5864eb20bd05be3f056874636a1895fcb
SHA1d39724652215a33850e46d682ea250988a21a6b0
SHA256ec18c11eb13b8de885e748b999bffcc9694a027aba753da739abec79e2e019ff
SHA512d074edb266225dc58670c4463c4e9e9c3d3beb102d442c790fc77b7b41d3c6afcf0856608b46ea82827d0a34619b17b6fa6346567b6dbf19f4a06e0db94f0132
-
Filesize
5.2MB
MD5b7b841d483240b7dfe1a44857234bd74
SHA10c0ca7e917a68ef2eaf0b830b90bb76f9cc21fba
SHA256ea88e8d14d5effde7b93781ca04cc238e2500ae19b2e694f7ec31f1e28b7522b
SHA512b1c23ab0233445e1368fe151943803000dc849bf7ad97415af6f081d3a692c359076099ec6d60e95202848593e57f8dac665ef3b8ad0e97919de867372aa6fd5
-
Filesize
5.2MB
MD5ed83538c7a2129da502ebf813ffe16cf
SHA180c69256579cb726440ad98cbb3781596a9461cb
SHA2564e5df9ddb2566068ede84906e93452baaf2dd75295f0ec9d049e332bed988f3f
SHA5127341bc50cf37bcfa24160a65bbe14a70ea481ca15cf8d34b85c062ab94cf7eae495be065449d88d1d7d4990a7b9860b138771695f0c41b82f7db0c36b0b21530
-
Filesize
5.2MB
MD5f734fb7e1b455bd4cf27a5b2697b8090
SHA17de2112ce950a8a1c95176c0f0524d9d1d508b32
SHA25662e395853193e639251b71e1f468538bb18121bbcaeb5f1a5ab48e392529f803
SHA512724dfa66a6fc649b73263a605f9cee2f7c9f5365ff242ff8b21862f812a50afe960a8f68943aac02f131f893bf340fe68b8a8e997909bfc003452a88c1ecc81d
-
Filesize
5.2MB
MD5fd25709af8366a81257a359c749ff806
SHA152754b4612edcd4ffe8b75dae171e4b4797d9272
SHA2562bdd12b6688caba594a8546dc2b5c9e3223b4f42d91c58ed05af1370dd9acc83
SHA51279438f518fdea6a40ec8267a8a5307d87cf02343db3663cce93abccb71da3e4685e8d237c5ec6b5d3bbd0915a2dc53a9262b09956ff3303bc9070b928bc50ba7
-
Filesize
5.2MB
MD5595b843479f14991117fd7ac4bacd19f
SHA1d0075fab3a865d09b08fa91fae03a70c255cd621
SHA25645e6f60c045fa2807e5882ac392cc036fb7a58aae5b6a182cf2e3a8218b67127
SHA5127d7f408b06f0f40f30a52752340ec7694334668e86dac994f50536a1fce0dbfeffff6b20b135aa97d8e2aa63697f46c610bd0c7bc5f6dc1030154dd0ca6e522e
-
Filesize
5.2MB
MD59ec0ec02cc64270f6e971f292e73110b
SHA11e6c6cb81265cfb051ca1bfc4eaa8a05db3a4874
SHA2563311ff0d8e48cc9acc226e683e46bd0d5aba4a14d76093495baccde4b0269e01
SHA512e7b392aaa4936df26084a52f75d282cea51c4bc662922508bb5305968a9e89c1a4db2727be774cbe801d4cd2694a8fbb5566ee4989529996aafa875f273543b7
-
Filesize
5.2MB
MD5cc5ed0cdc2548c106323d57caeef146f
SHA13344a53dd47d8bb21a66636f469156103dedf911
SHA256e71b935c290fbe462234ced75c29a9618ced4b5c8770c67c655ddcf0069c1008
SHA512cdd86ad74986cf6f16f39b014321f94792811a31949ae4ee645c89d7d5a9a37ececd4911bdc145cc0dc1571712558b242bf848e11a31c72f5e52d964847e3252
-
Filesize
5.2MB
MD5cca69477c970b5e16800aaeac147e7f4
SHA13907ca73e565af27160c3774a66acb5ae8350cf5
SHA256f8fe403d9b37c21daafd10cbb78c347af63aa06fa07195493bdb2401e0abe5f4
SHA512fd8a038f4be7b4776c54f6efc20b7b499704afa9b3a69bbfadbfc67e9d71565057cc6ae892a84ef64fb25b9b3f37b69dcd5bfe04b52ef26c10bb33b6d6c81b08
-
Filesize
5.2MB
MD5a6cdc450e41154ec60e8cd32ab68da25
SHA192a47bbca357adc7a8def490c58a6a99ef5e76d1
SHA2560dfd03578569359d4f5ca9a79aaa287ed6a7f2fb87b120e6ad647d8438a1bb4d
SHA5125f37daa4b6623896e0aa5227058de35111fdcbe044ffb5fd3d6b93a48290e4afef22a8f6103944343995a2872bef38ea75464e67a3dcf0e06c3031fe66efe6e6
-
Filesize
5.2MB
MD5bd59c1ad71dac4c405882f25ac0b5095
SHA180348931d01800db5823d28affaa5ba7b045a054
SHA25630d16bd6507302024ed6da1d0a50ad2a54bb732bb403c09223afc64f9923ab38
SHA512a23edeceda0c3dec9023934c67d0b2a8b688afe44ea8920fa02c19e0a569f3ac3d2e2e6dfaffb0ec2415102d6bc39d353181661d9210a99ff7ef3cc1c155659a
-
Filesize
5.2MB
MD5a43bb89299642ed15d2cdb87d3318111
SHA16fc279935f3fbfb6cd17ae6499a5e370e16e7c43
SHA2563fa7a71da179948fa3bdfd7934fae1f93486ebf363595b86b3c0881e333122e8
SHA5123501a0ceb2b5c4067ba3db2561f6d141636a3af08ebe3fc56c71eb7ca850073ceb0055302069a344458f130e2e1b8df367254763c0363e6587040d158c54f7af
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB