Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/11/2024, 10:06
General
-
Target
2024-11-17_87d04c486746cfc7a4ef461da0f2afff_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
87d04c486746cfc7a4ef461da0f2afff
-
SHA1
28e541c2bb0f29f0e7db9446792c094e14488711
-
SHA256
7dfdfc9d3334e3a08b01f24053fb6b5efd0ebfd6439b74b38f02b034ee269cb1
-
SHA512
fd4134219b65f125bc7144b802f79408cbef611170d4cf15fb6e8b560badfcc0111ef3752497978fe103aa31713f39a4363f6c26608845a5673043041ccd8cdd
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lUw
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_87d04c486746cfc7a4ef461da0f2afff_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_87d04c486746cfc7a4ef461da0f2afff_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kqyoEno.exeC:\Windows\System\kqyoEno.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gowpJCZ.exeC:\Windows\System\gowpJCZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTCfnie.exeC:\Windows\System\oTCfnie.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bxBRiBp.exeC:\Windows\System\bxBRiBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZWuEuES.exeC:\Windows\System\ZWuEuES.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AoxvNvG.exeC:\Windows\System\AoxvNvG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BXVOvDU.exeC:\Windows\System\BXVOvDU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bsdkPfg.exeC:\Windows\System\bsdkPfg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TZtMemk.exeC:\Windows\System\TZtMemk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VvGargl.exeC:\Windows\System\VvGargl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KHgTOzU.exeC:\Windows\System\KHgTOzU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DrSUHyx.exeC:\Windows\System\DrSUHyx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FsRcBYN.exeC:\Windows\System\FsRcBYN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JaKbdKE.exeC:\Windows\System\JaKbdKE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\utKUVoW.exeC:\Windows\System\utKUVoW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\feNlHmR.exeC:\Windows\System\feNlHmR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GnGaiDl.exeC:\Windows\System\GnGaiDl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MAdGAfU.exeC:\Windows\System\MAdGAfU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aQXJaqt.exeC:\Windows\System\aQXJaqt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dULlXDR.exeC:\Windows\System\dULlXDR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JYJbckn.exeC:\Windows\System\JYJbckn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b00387e21335715b93e390860766c8af
SHA1ec09706eeb2f75edc053f424b16f17c661b1cff3
SHA25611a16cff03ffa12c954ae496f14989f8bdde92731d4b5ccf428bf3351ff16d06
SHA51223134d8d793833555c4447e8b4625fbcce6f0d4a1b1e6ba81ff9975fe78e70c6c9ca4ab701b0ae92fc02b287802bcc6147abee5205cc9a9f909150f27580d79b
-
Filesize
5.2MB
MD5ec31751902572a2be7d5a7a8077f8e75
SHA1c326953c894453a32e361f0cfbb3531d36e752be
SHA2569d5241ec917788f5a719ec94fa1cc7358c3a3553cd4ca6fd9c8ab66d78ef79c1
SHA512175ba3d51e4588754f6debf9d5a7369246763ed518935965a007d473adcd429bdc2d5c89dbb550949a346179e7b2268e586c426c3a4a7dbbf0491dbf78543f49
-
Filesize
5.2MB
MD5b1bcbdd67b666b596abfa49611127b06
SHA1fd624fce3f01e059e20c9af97e109e668931884e
SHA256227499ae98bc748c358a30e5ac2913cd3504a2669eb55ed15acd227fdfdf72d7
SHA512528bbbb9e502b67548001c9f5217b394cfeb19412d611d77297c5ae703ed474df0fce5798c10af66244516a52d382ec3f013fe0f341ec4bca8b5839b7fc6f08a
-
Filesize
5.2MB
MD55271a789bc18ca736f32c3383a4863ad
SHA1d719e4673a5191d81c416e9c281fc860330a37e7
SHA2565c26fcc4367663b7d49ad50caa1a210087bc986c0d563b717b89eadfc4b6e08d
SHA51247cda781b270dc79aa664a2ba73ee380ab22e41d9bdc316fda3653d37d06cd1a163993c454b81508f27c7e0baab890519236e3e7dfad2d83f1a94b6972f1bc17
-
Filesize
5.2MB
MD5375e1a205f26921ab4402980f838934d
SHA1e2cd5a87c158cc7d893c8987da65ca1c95759583
SHA256c05e7e6f101efe7289575ff6f5ec644ae7c345083128fe3e17ae491a82dbed5c
SHA512278134eb03d8fe3b9f0df44d95d0e4cfdec7645420c7a688a59ff61b0d47c195b1b9456d82513bd466926899d0702723464b904619ae1d0db82286f6f1b5237e
-
Filesize
5.2MB
MD5ef6f73f73d28153a9e1dd103c80a95e9
SHA15f885b9d5e08dfd0ad8ee293ca37b292b80161ad
SHA256706423601fcf2ee791880ccd0ec1f2ac2e3d6f08c3ef2f64d8f9de74be40b67c
SHA512ddf98ad17bdf148f06a6184e93034bf9a8b86f3b5bc00295e7bd4b3f676209a3158bab6f17017bf7ab94a025fb204444a04e033af9a020d7744ae0d25ef5b0bf
-
Filesize
5.2MB
MD5c2583549d968ed64f2dc1529298f1b45
SHA100ebfdfeaf822bb910d0df90bc0128778e30bd98
SHA256e1297660256bc9d19090dc48f4726b51093490e807d3b29599879018fcfeb7b2
SHA512d501a645abf9b338845e332a49efbf8a447490469a18a985e9998c938ad88a2b7b0f5667cd2628bff5bdb5090abfaecfeb3803c9e98837d96a16c62d3b62c408
-
Filesize
5.2MB
MD5aabf0aeacc13265580b2c33d4753358a
SHA148c124cdb9ed679830a1383b643547d3c79fe3aa
SHA256aae8f4d52800726681e5b5550197f0209ea6932b3c4cf9c4364d0e1419e40afd
SHA512aea9dcd1dbd553a78c0b1e5195648b9a241133c160b3efdbc3a5b05ea534daff6b84c92ca78192503f9b1827d7a8d0fb1fdd94187005900a357d096bf1271850
-
Filesize
5.2MB
MD51ee05bbab140c6372d476f880a896fd1
SHA13dff4182e3a403ceca035c8b2e9d60819ddd51eb
SHA256e9d9ac127c4400a4214044790bd5ee87cffcf7878be000b2115e24801a63f47c
SHA512644d6de5fcc4e9564ce207fa117cd65e32aace58c877af65eb01e431b7d7f34ef94735fe6ef2760f69535219c4ca135f363f2a64c2646b28765a466049719285
-
Filesize
5.2MB
MD56ba6c8540d5fd85133fd0da66f6f381b
SHA1e4fe48d99617b97fe2771e4d7dc91987b1b9a70f
SHA2567c73ec7453330e1b678d489f11a599ee1f71e8e8b477f7c04588a7eb2a47fa80
SHA5122babcd13bb49474e085b3359fdda2bd03e70bb986a6a37a095a413ef0d8e209372b6becad39ed7cc7b2386088a6486052e9a498172cb14418c7684985396b2ca
-
Filesize
5.2MB
MD51242db319ba54a20f33e8471214fd279
SHA16a13ba0ba7210fb2b01fb0876ed7cbbf24a0965e
SHA256dbb263c6f9fa78e9b272d9eb5f4dbff989d60f27d2808b384b5a2e3b04883cda
SHA512fff6573c26e56fc18cd25d6b4d9e345e7248ef25bbaaac045af5623e2bd0995b988b314b71a58e06ba243ad61316bbd54adb43e66de728311c487e68e7736f3d
-
Filesize
5.2MB
MD56f1d35c55b20ef556dbe9623e3d2bb3d
SHA14465aae6780d072e3b08ded9e4b977d7f3b62aaf
SHA2563267adc29980cc329aa7237684dbc09321094420119b11912b6f40d372c24d30
SHA5124503e3e9226a9f02fb740b84fc37d334585f460f7118af802971bd446bb5a22c0adfc5330bc7b4ca8a19390e9f67108c41b26d916df6cc8f4b4b6efa0e07af78
-
Filesize
5.2MB
MD5a66437bb5098cbd0dd53fd522126a3ad
SHA1960ee09aae4dc0ef75e8871c1d984f7710d38fea
SHA25671a20070b1259391bb70d84a212cf1ccaca1a2a755b1c1cce503c0ff0c0e3bb5
SHA512b034b9e67ff8bac046b9f3670198dbc9621d2cd31a3784d23f0b8be8824b277780dec5140aa7d59c496a9735916e08b353d7f331d97fe05a71c6042fc83b8069
-
Filesize
5.2MB
MD578c1680587866bc5bd26f2e5b6619cf1
SHA1e90cfa0b426ef69522670db67351f4d097cf3316
SHA2568560bd80cd364c812235c5366a3b31a816b2fa124782dfa72ae1d870a921ac77
SHA51219f574cc0bb2847686472f025d6fcc67afc4574fb63d6b7d8b65c0e94646c45a50ad02435dda28bc4e99877f1528802b3dc13763dd5a413134ad02d243498c63
-
Filesize
5.2MB
MD5009850a415e553a7c42d70f4cff98f65
SHA1d28ed0f0f1fcf1a74d86eac623b2738dda5d5683
SHA256d4360650ac4a73261635d321291c83e46e7713c89fa3396e58b28bb9d904049d
SHA51256bae8fb1c6427e16d06232009af3e4b3342e070d365833fd288f125af53c0e446195ea19d54291e15f2e829a2912ab7c097efe2c38f963186b15ebaf9d75be2
-
Filesize
5.2MB
MD59b625633b5c9fa56431f417fc433cf21
SHA161174d1c5f95270779b5e0260435ec3c875e7a80
SHA2562882d2e03000c147d145b8e1182b5548b7b7d99c0472e1ba31bb5d31ebfb8eec
SHA512cf3247462a1a7bc44427d73e8e43dfdfd2a596ac202bca4f187dea1bad67b03e25fb3cba3f2f9d82b77eff8ae6434324d6865b5f3d37b273a68b30856e0d65d3
-
Filesize
5.2MB
MD57a3e6dc9d666479c4bf29033a3dd3623
SHA1674ec7127ddb67a33e9bf0fb16446bf297ee3d72
SHA2561f92d5d53a607bf6a0a550fe06fa6bf76d31306448baae102dbe6e92900a7e7e
SHA512ae20b077cd5fe26b812da205675502fa3ac83d69633366e39a649bfe14d9584413c04136b883802bd6a45d9c985ec377ccd7cb4af770b1526902233b4974b6a0
-
Filesize
5.2MB
MD57202ecbb46afbe3deb862f95e9057c41
SHA1075434283d55f8d0e5c14fdc5c8834df6a6e28d1
SHA2563e352644065540b791a5f123c12ae067b51dc1a4d7bc25ea70b3b8d38196a699
SHA5122ad2c51a7d933d774f86e4f99948e5bc30667260cb036655a671a9ffd4fe6d6388f00a153e8b783ed4a4628f7aea596207f364db5ca1d3aaf8650f8c451add1f
-
Filesize
5.2MB
MD52b9ad41f6c9f471a1ea483cd14f8903a
SHA198f379899b1cd8ea7bf15fa8cdbea4e4370e766c
SHA256c27306a6ccc99c42d10615aa85f1025cffd08f1a0ae3de7fdfb813f65ecc9b62
SHA512da817388933353d9420c3f5e94cb704b896334da50e7de1faa410f214b56b569ce825fef3c2b751e8c5021fd2eb11ee507c6799635e2d5addbe6c91025c3d3c0
-
Filesize
5.2MB
MD5ac063165460a1a8857091f4b32cc6f1e
SHA1dc8bdb0518ff99fb4dd6f6241f3dbc32c5ef75fd
SHA256aa7875f3345689f18ea86be522287a67c088431f5c6495d7dd760b90e3632076
SHA512723a223070f8c6c3819444932ca14f6f46153c2dc5a009fd18634e9097cd98fc74688806c0a106af31b31880ec046a5034d895a1dcafa92dedae5ab85dd99634
-
Filesize
5.2MB
MD5d479073d314b24d9a1cd7f459369b1f7
SHA13de6077a7441ceea76d0ae77b78049ed591ed987
SHA256f9704895c5cd4047ba27b4dfa923ff65a67b391dd10b33957da5eb291cce0a24
SHA51256a72497807d0f635ae55a2ee6c36d5ac7b896be8bea05e279179b0e881fa80bef48a97989b10d6885d3b171bc4b643a24bae805fef0600593d84186a186968e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB