Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/11/2024, 10:07
General
-
Target
2024-11-17_89da154e88cbcf7ed2e639fc59535648_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
89da154e88cbcf7ed2e639fc59535648
-
SHA1
e41f5fadc9687dc88510a04e7f6c3748911cfbb6
-
SHA256
c622388c10a4836d4094605d16d7bff2f7a9217e7bb2c84c03ccde55c24a796c
-
SHA512
4ac4430f64a23646d1609b83830a05e778d705e7715b432daa261b02691c0acec2bf1f8d272175603a828b56408baf6334859d672d171d4ae142b37dc0310bb1
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUA
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_89da154e88cbcf7ed2e639fc59535648_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_89da154e88cbcf7ed2e639fc59535648_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lUNwtWd.exeC:\Windows\System\lUNwtWd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RZIrAQV.exeC:\Windows\System\RZIrAQV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TPAuAHl.exeC:\Windows\System\TPAuAHl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\alaThSU.exeC:\Windows\System\alaThSU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AybLUCJ.exeC:\Windows\System\AybLUCJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lPVLFvw.exeC:\Windows\System\lPVLFvw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WRtLLkT.exeC:\Windows\System\WRtLLkT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ULNBOcz.exeC:\Windows\System\ULNBOcz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tzZTytq.exeC:\Windows\System\tzZTytq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hYDaqwq.exeC:\Windows\System\hYDaqwq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YQatubA.exeC:\Windows\System\YQatubA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PAwUCLO.exeC:\Windows\System\PAwUCLO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eEzxjiY.exeC:\Windows\System\eEzxjiY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ehMJGrV.exeC:\Windows\System\ehMJGrV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EUKyFEG.exeC:\Windows\System\EUKyFEG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qDyZmwR.exeC:\Windows\System\qDyZmwR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sEngaxu.exeC:\Windows\System\sEngaxu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qhraddQ.exeC:\Windows\System\qhraddQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\japRAJu.exeC:\Windows\System\japRAJu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hbAGjOa.exeC:\Windows\System\hbAGjOa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PAeyoKd.exeC:\Windows\System\PAeyoKd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5473ca3630a2e65f086cbcaa93668d0cf
SHA16570d7218ca15a0ee916ada7b2220cb40c6b311e
SHA25683e707378d8b0bd2630ddb3b09526f6fc3905a674ba358368ad79e6edc1befcb
SHA512bc42510673cbae8cd6783b2e9c92f073b38710337bfb309a4ef29a22dfb2f538f8e63df6e2a8866f5027d39daad738d30e22974a71a9a06b98a7d5fe90d6673e
-
Filesize
5.2MB
MD5e905f284ca19178953d64be8b3e6ccbe
SHA1c47571664a38a641108e3ba7e254a10cfbd4f21b
SHA2563d870aaa7f05ff7526f560294ec762344f0b08d026d0b8d2845bd187e9b08273
SHA51213b40ac4249dd08142c45e8cd3ed7e32c90c16e85ae33f3b7435fbdb52857aae56756a6e71602c9bd8e7605ef43124df02390385ef6259761cc065078f876b6d
-
Filesize
5.2MB
MD52cf6a7157c1149c094b00105063a98c3
SHA14e68cbae3ec56ac765de005e7ce81b0e4648edcd
SHA2561dc3bf4d4167c0f06dc9b504ade2b1569e6e911c49ccbdbe88547169ef07cd20
SHA5127deb195dc59affebf108b0b3bdec9c9b7f695fdd8e1d7a457d1aafe9fdff96ab16699246e61066ade44c313512d921b5b395fbd5bc78cdf556038dd42ae3dcec
-
Filesize
5.2MB
MD5ea8f5a638d104b5cf21575e940e77bb6
SHA1957b55470beb27be6fe6ffb7b6380c6e6e0872be
SHA256f58c98512d3fff16d365c5f6dada945d41e6f157e5c26706b16f69a9ac3c1038
SHA5125c64b120d8cf73471cc6e1ae0ca17b6cb748b29e30657f6dfd62169c2b3ac3683e8300b73c04629c5a879be9013c6cf372fff5aee55b0f9ee573f1c023911dc5
-
Filesize
5.2MB
MD5a2df09409693a15657ecca6a1271355c
SHA16f758bc2e9ea85a0d889db52b96b13f60d52e19a
SHA2563ce5ba98492b8182cb2281efb6f0c88a833ce0bf0702fff2db54e95f17fb3bd4
SHA5129a5195cac1d0fb238a179113e82b5da8950efce88f144b9385bb3841951ba46ef31d582825998a3fc92a1769e46f8d94eb1a3851737a6b9a850e93c1d4af38c1
-
Filesize
5.2MB
MD516d481676a19eae4b5d93ceefb15fc33
SHA183203ee446b0675dd317d7dd56f3b81b1f9456e3
SHA256a5d5fc30b1c7a0c9d78e7ff34aeddd8153ecd21e18a41b4db0f07ef33405f5ef
SHA512de125e2f9611fe7afa48882745bc119b70f3a5125549bc998dfc14bea06827065f7e0076ce65c181a49d9a0bdd6f9943af644879be9054f5e57af82d7d176a9f
-
Filesize
5.2MB
MD5b20a3fc41f792db06e9232daf0d70314
SHA1ad7162f4a26a71e02413fd3173cab822e1800d4c
SHA256499c546c0fe7540a53aa91f852ca9a45e71630a1cc3316f6cd3d177a25e1892f
SHA5126a172eca75a15e74252c4e61d630e17b5997c1fea859d6ee36bb52c842c8d00e3a1b9772b305e6a35fad43b9576d114fd99c93421b48a2db3f87ad845bec3f52
-
Filesize
5.2MB
MD5c4cc9db57122390e1d331afaa9c2041c
SHA10c7b51024f3e46aeb20102020386a9964101af2d
SHA2560010f8a2c33c4ebe951aa7b368c858ca89fecdee1974ebab24f7ddf21a99375b
SHA512b11966e9556ae8f1712c6eefc35365e065ab97143e449586c876acb257015d31e1f5c4a6618309af096f34c1e325c66c81cb2a13d948e7c3efe19234de1a542f
-
Filesize
5.2MB
MD5539f400fdee1dfb8f06cc395cd9b7992
SHA1913d37f141fd2fe2651aa27bbe9002caf996bf03
SHA256e69e43d2d140afbf0a85e70f24cd172b55c95d910943d3cb317300863e066736
SHA51252880261d3318aaea43da9b84ef683bb2d0b9a42c1866cf0d822fdb616e9cd8713e265647e46d7f8b00f09f3664fb3b1ffbd7e081e6d0ce52506802eb3995f20
-
Filesize
5.2MB
MD5a990072ec19648511c4877ea6bb923bf
SHA10f063cf5666d19e1bef7a92aebc5596588ae82e5
SHA25629598f27822a7afef5d54c78c10e37b8928df99291832a11e3c365222c23b0bd
SHA51244df951c6dd7d69ebad31b5874d7e7cc95c872e2882c24b8fbd8eb9c5c869d8a2934553a16028729520516fb8624a6930b810a5a39f079be2c990c35d3d5c1bf
-
Filesize
5.2MB
MD5f7ace4fc33e0e0da503f5bcd622681ec
SHA1224b9a755ca17623124b694b7af50ac87b3c4591
SHA2562a1781c90a7c7a443c4ee4b7c675e30ece03a9db57970d59aa9872f096e3cc7c
SHA5124384f8bcd0096a22a0aee81bcae20533e86c525e01d3f763d7bf332b9650f267adb0cad98758070b81f9b9fbe8af207354004ea013066e3da3973fdc3516adb3
-
Filesize
5.2MB
MD56e51c71dfc51d284360c19d1eb15860c
SHA13faeb1374f0e96fddcca312c500a2ec10dfbe5f8
SHA25646e22207d3040159012dfbb48981bda0c8cc4897ce811a7d317edc69a54c62d2
SHA51275e2053a196b1f158277ae677c2f758c25e881c5c41dff5dbafb5f082a57036b1a8c06f7eefca75ace10a09e98b8f32376061398bf3ecb7a234596740505b219
-
Filesize
5.2MB
MD5fdc6d609612cb30c7743444d4e82de12
SHA18d06d95b1be396355024db38e2ea6dc1f44ff487
SHA256ef10308705fef53f34323c9994bbdc52d8d37041f7b338a0de1079934c3f61cf
SHA51238d0c2814cb2e542933d432baa1a60cbc85f928234ded7c3818ce8a067ebb60e29288288ac5aeaf42eec66c1913d7dd13536a88b7704d1d24a8b74e2b4c0b735
-
Filesize
5.2MB
MD5eb72ee07fb3f55dd4fd55034a89e04de
SHA160990b6df1d45359c4f8a4247e9d16d2d240473e
SHA25686ca5a630b31ea196b7ba2b98a8e67e408b031e4089761f306bcd2d079486d7f
SHA51237cc2eacae85e8eb930e026b58e2f304a64188bc05c2aeb3c2368d0354f633522afa83dc7772ae0bb652528b6e6327ef98d560c22e21e37170bb5504f7454a39
-
Filesize
5.2MB
MD50989109b0056c648aa4cd6b8f0923a8c
SHA1184fd8e3e9870e86810f701fa43405ab03dbf2c6
SHA25613eaa10cd8ac17ff956b303d4666beed746800f59ced7222a21abe49b6b164f1
SHA512a1a3a64eec0a2e4ffe0de341042485dfcf265dd5d000a12063af82fd24cf6782cf78521fece762e449ed7685cf871f5ecbba1ef819a115d9be84a6de1b5023af
-
Filesize
5.2MB
MD598dd4ef88a2df111a7f9bc08f5f501e2
SHA1f6df4c374548275ce9dc4cf8178aab9e737d5922
SHA256efe00df7853016132ed74d0a5c6bad58f30e1add857aa1ae676b31960b0cea26
SHA512f5f6b14a84163fc39717f80db1ed3577acf60413d5dd78329f3951b1417fc22ff97a945b977a1b57aecaf44ff5fdaa1b23ad9b73a9113c88df2abad8d060b533
-
Filesize
5.2MB
MD5f193e79449adbeeef9e0908c8b8fdc37
SHA18305253988b873a90543fd78c265684b8da85b82
SHA25644a68df927d385c285c65154f1fff9a1975fe07773b94dc498f055d6169a2f8e
SHA51227237b6908de808326aa85fab6868a5a7f80390276d3d5369ca200bb61b9ba64d688f51ea316edc3f6afe194bc84d68f38cdce3782e3e48a5d7cc21cbcec6559
-
Filesize
5.2MB
MD53d289efd6faf3614ee9c8a146a68b2d2
SHA18e83cda4bae20c196ab532e37f1e4d57a5c6ca2e
SHA25631d29d284844a3aceffe1a5af0d1c30d9c1456b3df63c5d0e3f3a0853ff735b8
SHA512299b66331aebc067e947ba224e580ca53ed72e77e24da601b51d2808e8bcbb762bdc1d21cec965a1178e24b80edb7b9575a5b833fa480c42a06775b9a3ecfc7c
-
Filesize
5.2MB
MD50167e015be0e5963a764d3de4aee69a1
SHA18c189da08c22c44b741253c706f8733cd5a107bd
SHA25652ecc82395cc68c748865ef77a5c5768a507dd3ae57af5208222cb21fe9785f8
SHA5128691e3301a96b4302cb7990471b7fe9ab8bf5283b0c587503b785751aaf0443f4547d748b5761892ffd8169357a1a03a2f0c9252788703f8a97f665b7bf6f904
-
Filesize
5.2MB
MD5859493f606f89538164707cc8d5611e2
SHA177abd213d0f80bda88e1f3d05bab1f8507964459
SHA256ebb6fd7782bedac6bc6296531090509c5946a1558f45dcd2b65daa94a5d62951
SHA512c2eab3d831ec9905cc4cd80f3b048bfc9cbd64b34a818f350c615272923df9cc19ef263e2c4ac7ced7a10e283f129d9770c6d3f32661ef6b593a4a395dc3b76d
-
Filesize
5.2MB
MD59fe8ac086aa0d09dc14edeed64edd243
SHA175549a540416d8f5e23acb883bde8fb8a1a16cf5
SHA2565ffcfd015ad2c34776e55e99647aa7365747bd30b67c4503ea89072b501663ff
SHA5127c4de9481be2a0f35756811737f571858a979635882f2cb3306385aec6833dbd8df4fa38981214fb6908b809b642d43a910b86b382a9bcb2acffda7d2b922eeb
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB