Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/11/2024, 10:07
General
-
Target
2024-11-17_89da154e88cbcf7ed2e639fc59535648_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
89da154e88cbcf7ed2e639fc59535648
-
SHA1
e41f5fadc9687dc88510a04e7f6c3748911cfbb6
-
SHA256
c622388c10a4836d4094605d16d7bff2f7a9217e7bb2c84c03ccde55c24a796c
-
SHA512
4ac4430f64a23646d1609b83830a05e778d705e7715b432daa261b02691c0acec2bf1f8d272175603a828b56408baf6334859d672d171d4ae142b37dc0310bb1
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUA
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_89da154e88cbcf7ed2e639fc59535648_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_89da154e88cbcf7ed2e639fc59535648_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bmLLuxa.exeC:\Windows\System\bmLLuxa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sccWkar.exeC:\Windows\System\sccWkar.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZvmpiEq.exeC:\Windows\System\ZvmpiEq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pHNgleU.exeC:\Windows\System\pHNgleU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhYpdaY.exeC:\Windows\System\RhYpdaY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ndCJDAG.exeC:\Windows\System\ndCJDAG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fZsqwSv.exeC:\Windows\System\fZsqwSv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SoBYzIG.exeC:\Windows\System\SoBYzIG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EPAhRGr.exeC:\Windows\System\EPAhRGr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bfwGoGu.exeC:\Windows\System\bfwGoGu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SDbPNSn.exeC:\Windows\System\SDbPNSn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yMkTiJT.exeC:\Windows\System\yMkTiJT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\utZCJJd.exeC:\Windows\System\utZCJJd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RfnsqQw.exeC:\Windows\System\RfnsqQw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SSEvzGI.exeC:\Windows\System\SSEvzGI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UvXrRPN.exeC:\Windows\System\UvXrRPN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tlyIXmB.exeC:\Windows\System\tlyIXmB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\duDEvQS.exeC:\Windows\System\duDEvQS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzbSVIp.exeC:\Windows\System\WzbSVIp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FTgeKbV.exeC:\Windows\System\FTgeKbV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AcUxFZU.exeC:\Windows\System\AcUxFZU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52e3191b4bb382f8cdd48844658ee0d9f
SHA1ebe0a296f3fa028642e48aa0aaabe37d8dcdb083
SHA256f5d21ce4b430e3898581a84fb9414dd4a668eb05285096f57aeebd4b7a594668
SHA5121ec75eb118be034120b5b51b237499aa3c9bff8534512176be4c5c4b7939e1016fa4cace9eb6ac19e3ecff5f5d5a075a9e11f15489f58c0730d33aaa6d88e39a
-
Filesize
5.2MB
MD5be61220e0b03e856fa7681671b82ab4e
SHA1507960001223fdcaf6ddfcb88dc5de4da3e6a300
SHA256d4d3b871f3278c8348b38d731c1f90cb85c167d3eb5d1639145db92213edc547
SHA51274d01a1d2a5610da211c3a7e87b0e0484d8bc977b524eb5813a7daf1b12f5fc93822acf545d618675849c20e6f7c3fb62d40ceff45d27e432b6575ab3bc0369a
-
Filesize
5.2MB
MD571e55382763f11fd77571353e9eb4949
SHA11d83ca535e8e4ac7a66696e52753b5052cfb0548
SHA256d8826de432e4b38ab8580101238c55512723f4227a5b01a977f80699d0a66d39
SHA512cb0724dc8b552f97ab42d8747ab972c96d8c68196388ec288c777088b53de535f7743f7ccae8fdc4273cb1f2c43a0d33ea67960b459b94e4da88c2541829f344
-
Filesize
5.2MB
MD5b1778b73a3e989ac2bd9c1cbf20197e6
SHA1a3fde50413530decc11f0e717740f9fd7f4d3dca
SHA2560fc57e42c980fbc027419e2dc5f69e65dd6d9a59375601b530efe3cce311aa68
SHA5128ca8b22a42704ed555bd6bbd2a7c5c7f7c8c6db656e33d34b3c3b91747dd58858c5edef5cb2894afa92279320f018e6801c15d484be649860e5053b02c432a8a
-
Filesize
5.2MB
MD5e2404f34c2a3d3baaa0da4425ef5d327
SHA10e000f3314917155a0c3c1160fa5773b75a7b4d5
SHA256feced02547f029b30f8e386bc25303f40c0449ecfab34999ae61a4821cb8900d
SHA5122a897f0ed58b19e3d389eeddc00461c0cb1a8f0685853d70ff8347816436ca91ded69c1054bb80dd5c3f4c4cfd43d70b8a4f9f209ff1606f3902d311c944825c
-
Filesize
5.2MB
MD5c6be9cbece53fe9f4d50cb7da4d32989
SHA1524814f204026a9db132f6fc928a282248ee9c94
SHA256e2d2f2a2669c68224ff7c8ca96900797f33c528875372bf72d9d9d49e49a03f7
SHA5120bc9f9707e40835bf771a975eff02ad4d059d071640df1b44330e35c221f3b2fe1db62c375bebb5146f09d8c60ed030afb4321136a6c168825a16fc394925ceb
-
Filesize
5.2MB
MD569984c3477e16d291b3de95111520fbd
SHA1f351bd005fb360b0c94c6590a12d8e1176b72f23
SHA256986726d148a6ea6ddffafa836310cbbe8cbced930eb359fc1084fbffcc505410
SHA51284c217aa96123368cf1cfab3436101f6b518d6356711509301a271488a757cd45f71d3bc89611875b0f928a20f784e6b375437453e6fab659d78043bb71286ba
-
Filesize
5.2MB
MD5c7d1e86ab19d4a072c8f2adef4b805e9
SHA102e46fb1a2d4aab08367b4014874ff632e1c53b2
SHA256e6501b3f534ec418d1bead17784452b09385771e0c47d67e0a4353148676139d
SHA512bf47529103924b8ab3e2e0c4298ffcfd063493f692654de039a74fbfacbeb139d88112602c9624e16c3e559eebcce4fde7ce4812d5f8e6d05d8d1d880aa85a6b
-
Filesize
5.2MB
MD563c648bbb21144f4d80dd8dce70f18ce
SHA10f04b867368d329790667d1670e2407bce529323
SHA256fadcc6af286f6601f47698a06f963778289e70a816d4fd653660b205141cb242
SHA512bcbec59d4633158e87ee50f0ff627af4c257e8dd1438346d15080d6cdf99b3b7efa785594bd6e81d0a5cbc32b5854c7ebf9715f02ecb00aa2989fe4afbd1610e
-
Filesize
5.2MB
MD54580677ba1426fd46b852a3ae8974aa1
SHA10aa5fec7a87b7bbbf6853cac34dcf02e2e305b18
SHA256113fac18e6a40837faf5af37e5e756fe62ed6daf8df493b0f7b2f3fb6110bf2e
SHA512686e2f2ad4d9c667579a1bef7a4f507c7565157e9139e60ccd59c1653c3fe94f67232ec690edbe06f01d8fe3f17894531b510f5d59f6f85f2287f07d7c76d9e4
-
Filesize
5.2MB
MD5cf73315fb2bf72f812b9f6b03de609a3
SHA1fd70d6955c98f1f5f49fb419c2ea648b3f5633ab
SHA256c322997a80ae7c49fd5248ce4b13f8d9bd8b8ba2b3612ccd5adaa5ca4de4935d
SHA512b8e328bc5a4ec213a75e34e6d98e2b7f7ed91e4f416ea17b2de3d1a2eeec8c3ffb13dc466610c3db3d4e9722f51bf2cd0b9325999546d68ad3a5e5e4166aa70d
-
Filesize
5.2MB
MD56ef89d25cf8c0e00c2305bdde09c2cc6
SHA1265664c5189e01577c84a2385e55eaf4316d372d
SHA256214fd897f2c61d04ae8eec23df9f38d547e4e76501b6ae4a09cc3baca3763134
SHA5122d9fc0c00443a493df4bdc92c314108815bfe8e8f8f4d091a1f5465328923e7c7f9d1b18bb161aad98eb7bbb1325e79a6385a78f15532f302c591c8374258bb7
-
Filesize
5.2MB
MD59b02f070eda9a20cfdf4db9845fe5dd8
SHA11504b588defc800c64f96e298ae6bba25ffd2db2
SHA2564e6da27602ca3e67b564e53e089932872d9261013076ba1f796d4cc4ec003705
SHA512bd47b4c3d9e9bd41273d466c54db551b774a578e2d7b3bf901ec712ee3aec1686994f5ea48e333b870f607d2c9a16b369fe6ee6629311d922afa1b396ca0bf87
-
Filesize
5.2MB
MD53346f01bf584d99b9bdc826f27260d2e
SHA1fb0f5c4f9d5340cae102df3b56ff773cf49aafd8
SHA2567306804c9d146cbf458961a5ce30a8181445dc26f6d752a1cbf8b00f05a33627
SHA51253b16d3a10762a555fe70d1796089cdbb1c8b6c53d2272ba12646092da1dc819a9c9a3bbcfc9a1c56d7a10ba2509e708010a80f6442239123fb763e15c913704
-
Filesize
5.2MB
MD5e00542a25f831c4c938e2a66c52c74ff
SHA13c095c23842af45ff47e680994fadcd824f83a3e
SHA256c0773630fab3764f050f9790012c36c4e7a084e8c14c3844125c1bbfa39c19d3
SHA512483e3eec004bcb240d5a6ba2a3e5a35d025bc158d4ca9f0244acd5e5a4f21f5ae0836268e6ed9c1391d7a04dc362f001eb22d9a8d40aae875942094ee468a5fa
-
Filesize
5.2MB
MD52811da2ebfd88b3e378886ff06d7c8ac
SHA12fe3f7db5adf3fdea40c6756228666763adb95ea
SHA2568dbdcda0f7959f619230964f0b8ad7a0a9a7e2a77fc5015c5333ad67f4663235
SHA5127cd51ce8b5903d995f8c01333fe11d3a51e4d679ee9904041e4fb2adbadd5eebf3b7234b67441727d6583f9e0a4b82ee8d06d73c6696301a9d07f26ef3f8db00
-
Filesize
5.2MB
MD5acade01a45ee8447177e410728567c26
SHA146a3a27c50f2a56cc5504773835edcc0c771d4c2
SHA256daddd329746db5d36ba6d496d6602e912792a57af6db8addbc0bf337edfb3fee
SHA51293a6e58533478128e58aea4c5a2b7ce0fd5750dc677fa6e5f2b04f2477905efc205831cce0eff6f4221ddc2d313d2129e2ac407ade98b34ca234adfa5bf199f1
-
Filesize
5.2MB
MD528b2ee5f2a51193ba8401d4e5c6add13
SHA16d0587f6fd8ca46cac16127bede3ee313231df66
SHA256a285c76b9dc58e697768bd5092b883100d7ad1214bd557b153976c66c02762e1
SHA512d60dbce78167d1827d14ede493276cfa3b8868dc58a170b8db5ed55a870ed8a9b88aa57aeb3f040139daa9cded4dd2b47bc8b60fa3eaedbaf99d872d5a6d7dcb
-
Filesize
5.2MB
MD5ae9e7cfdccade305a52dffa25b70ce6f
SHA1d6d8d958fac4a389bad5fc7666e47a30b3c636e1
SHA256fd9058d0527062f8e1e7e63fc1970eaa11a31ddb732a66351dfd17b223a83f11
SHA512e7a7e2644da451076590be3ed267843fbb7f3a266750e30668350ad54c3ec833a62bc92ddf8d35fda13a800ed890018d7151d8fa3e28a3f92332254ad1d5480e
-
Filesize
5.2MB
MD5a4cf2c6cc954d3146ad04d7bc27db341
SHA149e1fac784860b21f0797c654e46eb5ed17a6448
SHA256ebbe8e2571a624e7f9aac692bb074fd71a168aeddef1ed3693c9a7e6c5aa0e78
SHA51297d8ba4698d43dbd9cf6b5a1969cd64d8304dcd3cd36afe8181342d5e14ecca0a489530e5aa99a8fc0f344cf12212f3389b22b43943bbbad65c332f11fa6179e
-
Filesize
5.2MB
MD5b73c266a76c5a8553cbb4fcd3a0e0e5c
SHA1b4bc85402cfccea698edf6e00273a1516f238dee
SHA25685270c72e1a7dfb7cab0d12a3fab3b95f408734e3471976e726262bfb6e30e2d
SHA512eb93ba99c759a0ea6e7ef674cd15a041622c853fee67fdc23f0b231b145fb88229ebf39446dda212a83eed4d0c5bbef254818af685e3104cf22de127fcd4d2f7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB