Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
17/11/2024, 10:06
General
-
Target
2024-11-17_87d04c486746cfc7a4ef461da0f2afff_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
87d04c486746cfc7a4ef461da0f2afff
-
SHA1
28e541c2bb0f29f0e7db9446792c094e14488711
-
SHA256
7dfdfc9d3334e3a08b01f24053fb6b5efd0ebfd6439b74b38f02b034ee269cb1
-
SHA512
fd4134219b65f125bc7144b802f79408cbef611170d4cf15fb6e8b560badfcc0111ef3752497978fe103aa31713f39a4363f6c26608845a5673043041ccd8cdd
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lUw
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_87d04c486746cfc7a4ef461da0f2afff_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_87d04c486746cfc7a4ef461da0f2afff_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NMoNuQx.exeC:\Windows\System\NMoNuQx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JvpZlfq.exeC:\Windows\System\JvpZlfq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UZwOnFA.exeC:\Windows\System\UZwOnFA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\citfAHX.exeC:\Windows\System\citfAHX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IRXnIJo.exeC:\Windows\System\IRXnIJo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cCrcCbZ.exeC:\Windows\System\cCrcCbZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sExkzng.exeC:\Windows\System\sExkzng.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWMFUkO.exeC:\Windows\System\tWMFUkO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VvjCEsm.exeC:\Windows\System\VvjCEsm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KBFCnCr.exeC:\Windows\System\KBFCnCr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CMIalGL.exeC:\Windows\System\CMIalGL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MYwzUiz.exeC:\Windows\System\MYwzUiz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UtsxAdj.exeC:\Windows\System\UtsxAdj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bZYUfIj.exeC:\Windows\System\bZYUfIj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KAUBXGD.exeC:\Windows\System\KAUBXGD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MxGAkPW.exeC:\Windows\System\MxGAkPW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tSuQUCK.exeC:\Windows\System\tSuQUCK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QRmsndI.exeC:\Windows\System\QRmsndI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LMmZRHN.exeC:\Windows\System\LMmZRHN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kKakLcr.exeC:\Windows\System\kKakLcr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pRPmqTJ.exeC:\Windows\System\pRPmqTJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b225c17ff2b67f5714bb9afac217558e
SHA12d7cc240bf688f24e711658eea305681e786f48d
SHA256207e57ee55ecf7a56184bc405c05980045c245b8728aa44df809a2c1316e95c0
SHA51287a8b61678135db2c12783d0e2e730bc9a5b0f18a86a70298cd8d033bfa4c44e7a2d1796b99beaab059deef2c55f2440d792f4b052e341e51e3741a6524399e7
-
Filesize
5.2MB
MD5f0643e82b8108643cec5d22c0326ea5b
SHA1fab6b90ebb8ae4bff50315856bca9af851bb7ec4
SHA256395691c6dd603857319c68f1759f91f0bf97c63aa1db7a741b704a543f9928f6
SHA512f3f87bc40312697cd5e4e73f645d30d871bb942253a92954e465bc249ce2f994a95c00a2b07cc43b9a207cdf57c3d9e93e9401f02e1d977b47cf5c9c27ffeb0a
-
Filesize
5.2MB
MD5177ba472a81b818ee064ad2e74cf9c70
SHA165b516eecaf883724cc3010078f7db4054263683
SHA256d200267e2a296c895c0ddc52ebf068262611de015d388c7e9027d2d6e5655082
SHA5127e07989c4d749731d55e02f06ee64876ab596342a47bcad12aae941cbde8f4ed409098b4cea79ccc8b1fcc4206033de1aca0554c985b2e7f5bbe207f2d309863
-
Filesize
5.2MB
MD593efa8cda0664631279125ac51f09f59
SHA1e25829de0aa2a8caec6d786cdbf856290ae00d6a
SHA2564afa8cfc485ee67c97e88d6c601a23d7fb2f0e07018f6bd41fe2533ec8b403bc
SHA512086f93f42b3a1ed093cb807f459699f03d92dc404cca4712f16091f94f452c9a61673a0e872b60b2076f2ac16168768a266e64f007ac6aa76db766a43769d3b3
-
Filesize
5.2MB
MD52859ff8da8a2e6b4d6108d0154476b0a
SHA15d12e0cde11eb8e53f1b31d2db13f4f55336ce36
SHA2569a569ea64275a5cdf711dcf48459eb03683f5a344856b4fe3281646c98e53f55
SHA512b58f5e96a8ba9893146983678e34a839fced6772c35e4061e0abf2e2e249b7ad8aafc19f67213cbd5a86722dda32f8659f0e9ca149a08c1fa0a11358a029e12b
-
Filesize
5.2MB
MD52434ae300e12225f5b58044d3f81d1c0
SHA1366d21aeeb98e544bf63d5c618011e5328284a5b
SHA256a2ead2d5dc9b168141e41feb2dbf5274da99dd5a54e4acd78db57d46006743ea
SHA512f9c301f362f9d0c3d65d4f31870af76d5d841c91ea3cb56535735727f97ab5734566d1d2d6589cc16967d7c7569030cf5134b875358736b0e3ea1586d96f3336
-
Filesize
5.2MB
MD51355624445b582350cc8c9522af8219f
SHA1899eeb6bd2f25faa9d26e15920883774dcea28c4
SHA256fc1ff570489e7405c64c19ca810b2ac4b28193fa1f35e3d01ad70d54107f3e54
SHA512a0166e46759180371be527c4fa7819f4227cd03a46ee5425c060f9f6f047e4de8118fe61c05421bcc1f6b7df448897de1af23cd6187ed7d0071c3d28bce6c382
-
Filesize
5.2MB
MD5770c4294b7275bd8dfa6b740a73bc654
SHA12819460ba2eb6abfaf6503469c275900234d8484
SHA2567714a1872d126a1e35f24dd40385092887da4bb5dbdef63abf36347c0f108816
SHA512f1cb30d039bfd91cd2b041af63c5dc4d1790a00f115ff62da0ab7c25f1df6a596f895817b46b288a0cae2c042b44d46024a6b82e9e73163bcbf2114e92ae43a7
-
Filesize
5.2MB
MD5075ef5b18c623c05af51c5e99ea7cbb3
SHA1ac1535440ac355b0b4f6566f3533c860feee9c0f
SHA25669d16345eebd173a567ce62e225051aa894936144367394597205f43b900affe
SHA512c1f537c9ae9b04e40452c2305045f4e7acf8ac99e1e84633efbeaea584d558631c3d67822f73951fe670bbaa54f29e824d6c1bc8a239789189a7258758942e91
-
Filesize
5.2MB
MD5f01a06a81bd2336883e213358e38bc49
SHA159041a26e76c92d63ce3b0ebe0bd180f2a7157bf
SHA256384266040a67e1a827417b2839527de642e816a091104419c6573eaefd12c603
SHA512a56b8281284c1b06cc19156058490bf70751556ee5e4d063dcd17abd3b7a8d5db2d2fe91cf8802ae49fe8817786a760c6466755ad2626606f32c9b342fe49761
-
Filesize
5.2MB
MD500d22cdfadfa1d659ca2c47fb0e2d841
SHA17c13e13f2d5531cf198b60190a69ba933501cd26
SHA256253bd5003a4a4dd3959c2d52d645400a4f315e691dab0c070f1e3fea6aa7e2a3
SHA512e11c471e654b4af08c3f75e8ff523992113a062ce76a57430ea9ee3f3785d0fe24cc392b4cbf24632eaf28f8173f427c448a69542fbfafc379eab5da672e5159
-
Filesize
5.2MB
MD586f173211565f2ef12bb6968444aef56
SHA1b28de8dc69a6ad5a9938c6158e2e0f2c0aed1422
SHA2563653d47871bd249b27777107e761d83c3b17795e60b2f5173ae390b73ec6022f
SHA512c163870bc9a9a290335de53ea8c696746e0e1c9e7f8a4fafec47bf61039ed9efe3b96bd9fccca00ac7db663352c45e42cd254a07f89b407e0996e8a1dcd7ace9
-
Filesize
5.2MB
MD58d89347be897d4e86469ade139cc694b
SHA12b389e639b0fcab35c9f61c866dc12fab41c3c0f
SHA25684b9665cf8bb67e8e16924f7b626d21f598a072585c6627a5397078bc7c16a1a
SHA5120d94499755129d8ba81e17ac8ab760bdb68435e0c85cb31df77671306bd3eac8851369ad24effc3c22011612e32f1d55f550c2ef88e5698c5c20a446e1309af1
-
Filesize
5.2MB
MD53a9deff8a70476589f346ac215416d5d
SHA14c67625bf6c9d979374e2c2b5960895e43470a76
SHA256f4e02658174d339e848553c9df21241c4630cd5d3a6162730fa74b7edf367105
SHA51272e24e8e200aef09c8d61c9819915eedeeb2b42c3c497ba4c58e043c3fd562d2b244ee6ee6c1e86cf7ae4e3e27eaee28ace2dec6718de6744c69f3866d052511
-
Filesize
5.2MB
MD59bfe458c01ed6522c9a61f5d135d864e
SHA15d60e19656251700ef0e153af3a21fbe26748ba1
SHA2562bff59a43ad883216895f3c05c0cdc1918f53a824e71ca453ca3db3eb5ad0c65
SHA512fc655daecd0a38cb3c05a4dab91f2f74b0ceeec59312fe82e0cffa1bfd2442b8744639613de22b36232d74a39dcc69ad5bd8972c43887888fb7de1d6a5c4df8c
-
Filesize
5.2MB
MD5884a051445dcfd3faef2e54dfde1f9d3
SHA161dbffe5751e9aeffbe460ad1d8e1a2b0124bbf4
SHA25664235c8b34fd8f05ec97ed461885a365c2e9c72d6e7dc127c068b0aee5b09563
SHA5126d6b73e86dd8a32e3297e026a7bdda8f09cbbb1495cd113c63396be875d259cb470e3481e501ba9e3270b214501d513bb90e397523a953d81c326792d13f0e3e
-
Filesize
5.2MB
MD57d7eda73321e6e94ccc20cf5ede2a23f
SHA13a7212f36cb1045a5772116e8fb6508abfe1f2bc
SHA25660419b49767f2f4a2ff9ac05892588ef6f6433cb14c6432755922fc4410ac18e
SHA51277511d55d4168b296756af270cd966c48861b489f955425a49685f7782ceff680ffb468db93aec215e918b981c427f4f6c9e0678e3c7ac805d54a40ba8a766fc
-
Filesize
5.2MB
MD5ad373c71666227bb25953e8fbb1038a4
SHA1fbbab4907b6bf57fb3810f880a1a14321ec23b07
SHA2560ad1defb62fd90f85852830a9f3c42eb94640f159bdd3add0fa21179bab63afb
SHA512f873256ff97337b5febdf386e974462df34063699038b88afb0c800f934d15a5e764437df986c136d2de32d5bec3cec7636b4497c5f0f53da9bf37379f0e0539
-
Filesize
5.2MB
MD5a00474444c668c86ba2d7026211a780d
SHA13576dd6f19da1c307b34a14c98fff1d81a439da4
SHA256def12c5650bfdeb96519cb28b6442e28da68621165b87df25da5db46f82248c5
SHA51247a111ad074053487d6e02a1b390e42b20b351a6493f5f0c5af7a0a6b1e56f2ea94a4e13a4ceed4cfc998d45f3a0e7192e633d4bc3053fc39b7cf4bcb0107d94
-
Filesize
5.2MB
MD5c706b6ee1a4143c534829ba339ccf188
SHA14a98fe849d4a797a908f95559f007b40a860d73b
SHA256ac305707199547058b05ea48904233957ab6dbce80a1e43260a5c828282b6acf
SHA51261778db7562f4878e5aa097f330a6876d964b742ed3f63e61249e26268d0cb0c97dd95a930b1c7ec917f79eb0d68bdc00efd530012e2d35100062eb40579d752
-
Filesize
5.2MB
MD56d388653e1dec0ff8aa4a102277e6ca1
SHA1287f8131e7cc324f3e97c3c3941e372dd588cc14
SHA25694315e70d4eae788992c2011e20b61650d48042bddd1070ea562834185f50d09
SHA512c54f9fb87a0f0bb5da2d0024b2c311926f033f29f3fd1ab30210fb4b82d804e7761e6c9191f8074854c1e27dace5375cbf973a62055dbb42da2daaec6d946b6b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB