Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/11/2024, 10:05
General
-
Target
2024-11-17_7e8eccbadd278e711e4f8433c9a1de4c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7e8eccbadd278e711e4f8433c9a1de4c
-
SHA1
e7b3a6fb60f4fe931a958ad1696e88b029f2b314
-
SHA256
fdba5126bda89a0d6f18c0994daed7ff89c769e2f317c1d1565a484034efa111
-
SHA512
f1e19bd6d71fb0e75326c8098a0d88570ff75dda377b80505d865e36cd8c02051b136260be3d28d73d532bf1bd0218e79b753264847d59175ce59ae83cb61cb0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lUU
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_7e8eccbadd278e711e4f8433c9a1de4c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_7e8eccbadd278e711e4f8433c9a1de4c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dlQvYuI.exeC:\Windows\System\dlQvYuI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vHHGfcS.exeC:\Windows\System\vHHGfcS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hMxJGBu.exeC:\Windows\System\hMxJGBu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XZhvXQd.exeC:\Windows\System\XZhvXQd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JYokUgI.exeC:\Windows\System\JYokUgI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VAxtkkr.exeC:\Windows\System\VAxtkkr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ButzdpL.exeC:\Windows\System\ButzdpL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uIGGANf.exeC:\Windows\System\uIGGANf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GWpEerh.exeC:\Windows\System\GWpEerh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BxCaZlz.exeC:\Windows\System\BxCaZlz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kjSJMdr.exeC:\Windows\System\kjSJMdr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BiQRUwy.exeC:\Windows\System\BiQRUwy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jzUUaMX.exeC:\Windows\System\jzUUaMX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YIHXGfK.exeC:\Windows\System\YIHXGfK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXLKxoP.exeC:\Windows\System\sXLKxoP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EpTEUtT.exeC:\Windows\System\EpTEUtT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bvSWpLS.exeC:\Windows\System\bvSWpLS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\znrlvny.exeC:\Windows\System\znrlvny.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AZWCcyG.exeC:\Windows\System\AZWCcyG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XoxSFFD.exeC:\Windows\System\XoxSFFD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ISjSKfL.exeC:\Windows\System\ISjSKfL.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD546315a28845ba61265e6b64a72913978
SHA1d53b47fe9beb1d285ff77197811b5a33aca305e9
SHA2567f2e4f0e8e5c6293800869e89ecaade9682ef83b71ba9b6488957a5b4d3d87ad
SHA512adf3c72f8b482f5b6681e216cc40908a82fa4d5b4b9b285dfeac44585712e94be866ac8b198ffa7f0911043a867a95046113e35155b93769060fba97841df2fd
-
Filesize
5.2MB
MD595c209e6896b4eb11eda36b9b715feab
SHA1b3fe9a72670fa78d44e0f068b3a67ec19fd3a029
SHA256c17a7b570184c1f6e3668d1d58821c138ce38ab5458852ece01a188d9820bc53
SHA5125186c1f11194a5a6852ffabfa84e8618fe3366299e9cd2f2d2245fda647d02346d16ee90b8beb2f63d8144c0df44f98034b4deac7de41411727c8361bf236cb2
-
Filesize
5.2MB
MD594d60e52557c25773df9d7ce1873c9ff
SHA16bd0bd2be3d619c48a7a0003701ada16fbaf31bd
SHA2566d4631b04187c8ed22ba46eed3b7140b1880104171c9ca3f63e69843d7e11f97
SHA5128c823456d4cbf2e6c53dee1ab72cef587a2378d89c0b6073b1574bff8a7cb857c226fc755fa2699c4ef23df9ffb1215c3e2e87c456b517e73f7aedae1f3be1c2
-
Filesize
5.2MB
MD5b05275c8cbe18645d03a4ed1ae1c9ae0
SHA135daa1e424d676b36f2d53903d271aafcb6029d1
SHA256db364d6eb5e82f9eb07b070ee1e99f6a06d1afaec1af818ec24dfd848b4144ff
SHA512c9e815e6360ef5ce88800187e17697c4a82a8855deec5002e354561cc89516851371a3cb907596780b1b25195e6d5d8dc586d1ecbb0d483a056e8dcf429c7750
-
Filesize
5.2MB
MD57e04e2e26c4688db8d67da27c4110d8e
SHA14cbf6b4c8af18e0aa1d06f5818738e175734c00a
SHA2561a5dfef92aadba90cb3b9125fc43002a3d8d310d4eeccc4d53ace106b20a4594
SHA512ab86a97703fe1fd43b0a2692aa3d645e03d0d3acd1103eaa5cc158380cbd066fb5dc0e467b3fc6ecf9b092003927fc716b9a6294c3b915a2da415577bb8b17e0
-
Filesize
5.2MB
MD5f1cfc95fc2d33e59efca1eb87e9d3209
SHA1f88ea524e69f4cabe62583b4f35b4ff961ab2679
SHA2569c318b20325ad6f9d593bd04b375d35a216b675384fc47e2c73dc903409429b0
SHA512e6050885f49c17867713b73aa16d13ed587fc3d02f731bccb82167f38017e2583b8a733c7a0265907fdf5945286eb9246122f34038d0340cb2ff89bc3bbd7620
-
Filesize
5.2MB
MD5d6accc3424e81dd0363bce005d5857b1
SHA18acf74fddd5267b035df7376dff4daf025288044
SHA2561379be86584484a6cf30d16df65157ba252962cb4bce0652f97a77292bdd268f
SHA512c63e68cf510c4f5d7ca51e5856f3d3c381b0d35adb4913ff208907694ed7bedddc110f8c19416bf1d900e2ddf3884caec5d1ba6d63acb7b21fa5dc82cc39997a
-
Filesize
5.2MB
MD53e9df67fd2a3d8949aaae6b35707f1ee
SHA15b4ca0f681cb6439222129b8dae46913d3cff133
SHA256b1039a9c2acbbb78b30158c17da87a4d9eb87c796e387df84244c6c1970290fd
SHA512592bd8b395feb2fdaa52745356a311d1848219a6f6d49267ed7abe61f7b324b9def88e7a16efc5b3d685d99f736ce751657e626ddeeb575bc39b73517183b2e2
-
Filesize
5.2MB
MD540b3078177c704cc1417d57affbd60d8
SHA1c478aa50a47fe6025ce53840a1decdd621d80849
SHA256b5afa5af95b82371b44b42663ab6a54d2aedbac6e2afde2fc910896b1058b0b7
SHA5120fb77cfd64795cd53f0d733ca4ab8878525871f932463bc16cfc74d99938325e4a1162f995946e9b8268f40e69aa6980daa4ea947f7255fac57cc327eccab39e
-
Filesize
5.2MB
MD57ac50d94dc8b17967a6c1646a837a2d2
SHA1b2ba0e0a46764d1b4b009838bf4af1d454b74dea
SHA256c6347820a3d2e4154c7e87741af73f34f4bdda975621075a1c9b682353e09003
SHA51273b34bef6d78315086aa2a622a1a0591a6d2d9711c1776b985a77254acf9403d28785f5308f18f7c86ae86a91fac7d4ca0195df65cc5a97fbbd9dda8003f8067
-
Filesize
5.2MB
MD502efc418afdcaee3ae1031a4ff86fe22
SHA102635e7055a0f87749d529c8e9153ac4f0954a7b
SHA256bd61c73250715fd332e9b2e6c7fb71fc9ee4c3ae40b99455307a20f6b8d97fa5
SHA5125969d44a1d45aa2b79c834982b9863ed92c910edafd795b776312089c3182f7ebf2e455ff90464589640fa73219753b8aa3f6be9e7c5ff39302c942f8179e255
-
Filesize
5.2MB
MD5a21f23e8f23669ffb217bc00046eb4f6
SHA11756c0eb00ae83cadeaa8ed72f1df2952a6fd4ce
SHA25623465e3253614aae122cc2a4374e39007dc9dd2fe194dc2ca7ac12d9b672bea1
SHA5128823a04026a5631281a0becd16e58990b11c0ee870065dbbffa702dd5f1407d2fe063d608b8a3679cbd81cecb422d6d2d2f10c55e541e8cfd2508085009568d8
-
Filesize
5.2MB
MD5a2fc704eb75c5468a0ffdfea1b023e47
SHA13bf17a80311791ded6fbd6627338c6ae3250c2a4
SHA25601523eb82a4e4889994f3082e59d69a3dc7c23b5a7d04267991604bb47342400
SHA512803e44e9a94bc3e9eed94d4b34daa8162418af9d51732a852bc468ec0e575ff6916f1fb059d9f629d8eba0d5152214d2335ad59ecbccdaf5e500f854a511d45b
-
Filesize
5.2MB
MD5445259979dd4070a266ce201ebfc50c2
SHA17a83e13d3b0f134012706df6fe29183bfa86ba25
SHA2562e0ff14d7350f044912cf4e394d88f613469020758cf35037e7a43b9f5078940
SHA5124988081a564472690696c4940c1594d7d44f911cf361d4da1a2dc5ce32a3a6b2a761f362776b8c7cd9d54f60902faeec4bc77be4ed9f0611f5117db3f0bf984c
-
Filesize
5.2MB
MD51765f966d709890ce4dae35cba0d75c1
SHA145eb77ceb5dbca7a3e6076347954aac982d38094
SHA256336ae59c99dd7d46cfacffa438a3efdc1976037eb3d89cc0942ba88745ef736d
SHA512180d149579d6d368be926eaf3cf61cfa205f30ce2d843dd918b5f7237add03a55cb889930e3efad75a2cf4bb9afa508197ef9c0a4936603a934d6a32e46e1e14
-
Filesize
5.2MB
MD50598a5824cfdc2c5b869c075a53b95f8
SHA18be815de45dd4fb8542012997e229666b18ac3cf
SHA2569b81a78afa4b836f4d5bc4287ded9268bc35f2247d545f03dac6ffda38992beb
SHA5124c7cd4f44f7d83904b0f480f6cea05e0a5c237b0d8fa1f30feba6d4d8ebf801e484bd2208db94d56cf18f704eeb464c51a57d30e31fd047e3ac98b4cc62dd116
-
Filesize
5.2MB
MD57be4734fa134fc4aa468976e37239495
SHA1a4cd95eb04b657341e1e2d10e0dfc08b365a9df3
SHA2569508af89901e4f59b3d0d2919b5e67191466cd1867860325bdc67f029487e670
SHA5128bec2b44a78593145d07ba15ea2932e1ddb2655fa9338aafea237bacaeaef11f3d3e4a1140e28f57ca4d7b13fdc3e3c8d5e1a50c58ad970fdbed3f975d4a0ef9
-
Filesize
5.2MB
MD566deddb084297945f108cfcfd483ff2a
SHA1fefdc1d6fad5b03145f2067b73d7521ac39a16c9
SHA2567f73957350ade7d26880264eccf8a62c023ad2942cc6b050346edd2066b99e11
SHA51272da330990ebb4051f470bff2f724ce9fd3b0f0ea4ebbd43bf1a97f43c5bd3da903d88a9f9609868ed2e8208948dfd946c0f8f9aa37e55dcde0e8d41c04e15ab
-
Filesize
5.2MB
MD58d07bd5b0c28cc40c2d7e2b2083e2de8
SHA160776fb4d0b503c30fcb1dc7f5cc56f064ef667d
SHA2560e57d78fc247fff74eedb8ac8354ff1d7841c5526ad76477438036d8004e83a0
SHA5125d34081e86b7a9323a6735d38247059ed77719c25dd623dfcb953c137c74c202541cdc0c4c41a5b9776bf0abab3a69763f62689b0649af6086f2bc918590cfcf
-
Filesize
5.2MB
MD5c49c00acc0028632c1722d9ffc5abdfd
SHA1417187a0d600b938442f7c44ec57ceff6ea9e892
SHA256d2da00716863c84d5873ed722ba4a3b75ebe52f056831e4901baeed74ba34129
SHA512c01dd401f816015f1237e554490e65f5021771b3c9c422ced7b01d596a6094faa332c444093db2be043ca4db80053e3a7333dd26e2a8c08105db6ce285204307
-
Filesize
5.2MB
MD50e1e2ba28fd361fd3dd6b5199cd6d342
SHA1f909944712b445e2cb9d0882df03b360f194fb2f
SHA256430dc6936400aa6aaeb6f9b35b550c23ed4c3761dc03aeac3751ab4b98e03939
SHA512abfbb678f3366bf9bf5b9a67efad824d8f54ea340b7c46907a46d000a9b79810c0cc8da420d0a07e6919b0360d31788b827902dbc78251b362a1bb8c589887bc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB