Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
17/11/2024, 10:08
General
-
Target
2024-11-17_a85e71a04519498a8dacb40825d29b20_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a85e71a04519498a8dacb40825d29b20
-
SHA1
36779c5a3c9a3edc3216dd3cd88b30f02e816ba6
-
SHA256
ca32e834c6a719da8248e3df8e118c02e592c7ce7b0cbf7e758ab6eb384db953
-
SHA512
976926cce083cece58498bc6b3cecad338b5f17bd9d559838b316d512cb0d1328e2a7fe69218439eb6313f0d88216eca9613bbd43071b816ce9128cfb50cebfe
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lUU
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_a85e71a04519498a8dacb40825d29b20_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_a85e71a04519498a8dacb40825d29b20_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cBLGelo.exeC:\Windows\System\cBLGelo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JKflttH.exeC:\Windows\System\JKflttH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OjEdPAi.exeC:\Windows\System\OjEdPAi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rRGZVEa.exeC:\Windows\System\rRGZVEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PhYiiLA.exeC:\Windows\System\PhYiiLA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OyFEzGt.exeC:\Windows\System\OyFEzGt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GEZMzDp.exeC:\Windows\System\GEZMzDp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RBpeGSq.exeC:\Windows\System\RBpeGSq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WbXRQhq.exeC:\Windows\System\WbXRQhq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BSJtFHV.exeC:\Windows\System\BSJtFHV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QZdEOaw.exeC:\Windows\System\QZdEOaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\brfEpiP.exeC:\Windows\System\brfEpiP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lrcatTR.exeC:\Windows\System\lrcatTR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SHgCJrf.exeC:\Windows\System\SHgCJrf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iTTzEdu.exeC:\Windows\System\iTTzEdu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iAZtxMR.exeC:\Windows\System\iAZtxMR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pLuWpgF.exeC:\Windows\System\pLuWpgF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bRYvaUn.exeC:\Windows\System\bRYvaUn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dwGnmRo.exeC:\Windows\System\dwGnmRo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zcAqHjc.exeC:\Windows\System\zcAqHjc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wvjUuEM.exeC:\Windows\System\wvjUuEM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5866c5183329006c5cf2d6a91dc12ec04
SHA1a4724e2b4601cc20ecf900d3e5fe8194474be83b
SHA256371feea59e91d2fb734e4e131e49d9b2ef4993d9b6ff254f91010a0ef311f5e3
SHA512dc986c0c163a76f4c94cb6b1a7f8918cad2fe8cfb4bb96e4ac0339f89186e2155d90557ed5b5d38934f9dc19c18268042ed7f2b91f8acfaaba58c831004ff65f
-
Filesize
5.2MB
MD5d788b84ee1e54b0cde69ba342ee56d90
SHA1ab96e4c5c0dc908179b97aad748ccb0a8c99eaa3
SHA2563793b774de97e898eaaaa481c9ff97b971ca1ee416ef1552ceb35e21e1644ef9
SHA5125c6770e56b7025c1afc6407f79d273947eacd8a20822667562ff620ef7a618d1f7414c76896e64eef82a857988056b2ef72cedd1dc761448277b49d27ea6933f
-
Filesize
5.2MB
MD57bccb7ac9270823b92168f3ceab10b29
SHA1c3ba7ca60e10bc4a319e3dffb794a11f9e2ab719
SHA25652200c44f98d61bb72be0dfdca3ca1a9935758ff127e0d9928be4d13bef8926a
SHA512e198706969c0f2815e1692a99e6eded3bb86c76dd54d00f2fc9c9cff31ddb6432448033353170598a85d40ace105611b381e826541e8e931eb2a2c8037da4abd
-
Filesize
5.2MB
MD57827c57186a679b94c147cb263f4cc76
SHA1df6cc4f8d710711aae99cbe59cae1e47e923ff9e
SHA256ebd3dfc3f74508a795e00c18b2e3e9210176a3af7312ce7d5c49bc645dbdd2fa
SHA512236acb39fb0e3a2851792971575e0de51474092f6a0e30c7b9c4111e59ee5a3570d87cfb07c7338a98c63c8d96486c23b1ef59d48850b5805d67f519e34837bc
-
Filesize
5.2MB
MD5bf56cc03dc3832e3ca6cf89ee3648748
SHA13648ee8af358b7b17b982dd5bf03d1095bf7804e
SHA256b553f7fae10d51f66cd1a04b11331cdbd5044a59ce1af5eaf2ab327a1a64ad43
SHA512ff70723412c8bc04ed82ae84a08d45eb016d54ec7e308bb2d996cf1ab3cfc69518f42fb005df418b77c4778dfd726880cc7b96d271d80f5dc7b43cd8d1580f11
-
Filesize
5.2MB
MD516c18787fa12d3f0d56ff8d5e2751fca
SHA19b7050b32c89b745622e355e6eae4601dae16afb
SHA2561aa23240210631cef7f01f41f579ffcf8cb5a38cf7fd0ff6ec32d78590d234bd
SHA512354f258447c3238156a7b1bd0cd3192fd4453b4b43129d4b360388dec4ffd0e2986341744f3db319769bb7e07d2ed015ba6a4398268e1db4cf299f4896c755a4
-
Filesize
5.2MB
MD5d5f20888316a6e2912c0cb5186baca86
SHA128b1612eb80b8d48f07548d595185b88e4f0dc22
SHA256c90e7de0210330ab8ad98f4bea8844db4ee8a98075ff82afe7edb294b2bccfa2
SHA512e1ba6734ddf995e8b9b2eb0b9ee296d668af5d9af5e76f865f36b6aec4878eafbf1292453032ec06c220b5a3229033385abea4d3322aa98da61a24bb36dbf402
-
Filesize
5.2MB
MD54967bd6ab49ccdf7fc8c5fbe44c8a0ab
SHA1fb194826c5a8315b666c7a68de6f8fd2ae380c95
SHA256169a74e59946070baff3dac40fc0e82bd770818a8a48999e2caf118db5ba70e3
SHA512af4cba1e454e4885f36a8c6557ad6ed13b26326f7dcebffd3ed26d2c3a3863d9df843f28010df6ef0ac1cfc9eeb0ffa2f9052fceab922082aae5d818768ba705
-
Filesize
5.2MB
MD52020af45bdbf3db96b0ef3f0ff31eaa7
SHA1ad3d7c4df0fc884405fbb6dcb0117c0e8fa282ab
SHA2563ff4be5980d436162da7735550c292926eb726de1b145640d095a9bb58514922
SHA51228409efd506af7071a8934aeae65f4f2553e3289caf1a604d45ac8149fe8a58d734bda7d6394eec0b6a6e67a80cf7f8eeec124825bf8db91823b2155049990e7
-
Filesize
5.2MB
MD563eb6a32b1e93f419714b027451a32ca
SHA1c76fae90d6dd07d297e580f4a268dffc806d9a3a
SHA256201c6bd5365e99acf6bbf0e954e5fc30119d7ebcc4e410519ed9051e827eee1c
SHA51228d4a7986942e6892b8c56ae52211d1a0c6fe2ce4e8381105aef236001a9aaef3f4155ae116d7c45ca6a9dd127421899ef3bf9519a706023ffd4bf84de72ae7e
-
Filesize
5.2MB
MD5b05479f6b02aca89290addc7a174c743
SHA14bdcdb7662694772eeabaae0aefe99372db6920c
SHA256b7963baa451e252e73b3205b477c0d18c3a26a163ca3732864023fa1e4476c14
SHA5127a07d69c9a3c793944ab82904173b422b64c1f4abbae2d6c32247464465287abd06fc101e1924380ea77a8d1a785c9ef3e8c99b3dc6e3a45e1f79cd9927da5de
-
Filesize
5.2MB
MD5e79bec420b106ae5c53072cb55501452
SHA1b57c139f287fab8bede69e0f209b2a454e18f70e
SHA256cd52f606d9373183787dd63f32efcebbb4a29221a1c3d1b18258d714782885b5
SHA5123f043383ae49e5214c7eadcdc5a583f89ab4004892bd3f1813e54de6942599fb9fd0e165fd0066e642081f53421e1062df9ae08b84ea2d14c6ea4d5b689d1323
-
Filesize
5.2MB
MD5c4b5aa1b86be1650040bf4307fdc0b55
SHA1c8ab943a06b196184a0b0df035c20d1185114f8d
SHA256a4cb1efb315fad1292b2e49326c491e72b2105d7366906cc2f006811d7d0e726
SHA51253f5e57f7c0cd6eded50026bcc80105a092d45a96f695ec23221625522e7af85a972d8479bb16e1daed6c4f9b947b4e594df252fdd42d480c75e4b628d740855
-
Filesize
5.2MB
MD576a79a4de767b1d7be78aff92da23137
SHA1d1df72636725a4e0f70d57852534ed2a059f0962
SHA2560e78685b91113405beee77fff1358c6c387cdf68eac56e940ac4d88bad75b045
SHA512814cbd1253698673b863008ad0b3dce81645170b48ca01c5521b98a6fa36d29c9c9664b02294fa02d325f44c510c95bb132105a59a7bb14444a27d7a4038546b
-
Filesize
5.2MB
MD518c3e9d0fa4ae5a38e052a3d72455bd4
SHA12452311df9b6d6138285a97d2905f0d72016bc39
SHA256a43e50508bfe4a2a0d5468be82a9b1531b8d42331b40e97751a726ba9e4730ac
SHA512d9a4e2fd5d46e1c648dd59e40cb2ac351e9f94d05fe4c5d2e9de11fa1b5356550ce47e01ada0fa373d9e17e7682b84913a34311c04cd4e974e4ebb1698cee251
-
Filesize
5.2MB
MD5ee6b9d214a3c3d744ea0778cba90533b
SHA15de5ab4c0e963aca1cbda21066ec8102d85a8fd6
SHA256c19f1464919fe99145e0a1ec677cb377ce28f5a6eb76b232c74aa57594dfbd77
SHA51254ec5c74307250dd02cbda7f2d3e934aac1f16aa30379f218f10ed4f595917ccbf4b63d0add8d781caab946dc7b1a52e9425f05d15e8035a1b360861c1130010
-
Filesize
5.2MB
MD58bfc40e3202c72c6990afe45aac7576b
SHA17a6655ef95d667dd99d39daf67641899f05b0990
SHA25676b3788fa0b980660264cb4f46d0557afee5faee3f1ed23d821f2c3293d311ba
SHA51204f24ec8f1a13f4487b0c462653587517e1475d3d2a0e5e55202cb2fa5246cec5227f5fddb64243c3cd719bebcfbb9e43e4c50dba5f6401ae40c433fe1b5d43e
-
Filesize
5.2MB
MD599d696e3b43131a5e89b6005077eab48
SHA11abd1781fbbe5bf630df3dfbb54a6ecb6671df1f
SHA256ef853f1731bd086b9f4bfd85dcf1ea1c83b735b9f0b22d364b4d4832269d2534
SHA512b918a69bf4e539fb39411266e2503ad890251f1a90210f73bed857ed91929f9e4bda9a27bdf5a867406f2a66cfb851b2c8c010e351e4b77e6febe54cc36bf3db
-
Filesize
5.2MB
MD540cf0b58c5bc977bb65e47b988c5e59a
SHA19575f8b6464d0f3a732f6ab6518c319a002da3b4
SHA25641b52e4990b62cf39164c424a3f7a204a2e8d699f66705fc69f1d90304b6a76f
SHA512d2c6c80a2b733c89152ccd6f0516fccef5024f24ef9d8bf8d15686307651c61c574f3695f83657b8d4e73668c979811c6d94c7e0e0ec7ec4119b138a8ce2ff08
-
Filesize
5.2MB
MD5c018e4b681d0a1fa487414e9ab7f2768
SHA15745d6857469ec0b7d9d540181ae0d568e0c9bab
SHA25622ec6d17f6406da4372daf1691897e4725d979a154400633392476333e05c5d0
SHA51227008aa205eb7f13fa2001a8fae2a5e6d53af195c532cb54a85f34ecd5aab96e162ca507fc547bd03d01ec91f9abd38c9e693d9b82780c1b52b652d54bf6d9c9
-
Filesize
5.2MB
MD5ab9b96a77105254434542fe77966b46a
SHA1fb01367b8473515577f1531cc2cd8124072a00f6
SHA256a12e562e25d95f1107e9016c5b52efd3ba4a760d427f779a71e174f96e924c04
SHA51299ed49555ac83d86a28f4cf547dcf34745133f2b4175a40140fa4b677ce251ed53a0fc75d17abb0cd9cbf4545011548b36b2a6f9294624240407bb3420eb27cb
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB