Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/11/2024, 10:10
General
-
Target
2024-11-17_cdef4028147166ab12d985e437da7ea8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
cdef4028147166ab12d985e437da7ea8
-
SHA1
b790ecf3c7958d823a4e731f0ff6077fc449a148
-
SHA256
a53a94852611a026fe7a1e340cf8aee468e2f0dcfcbf8945136d2534df65478f
-
SHA512
3fdd30b5f821b1e0e502d323bbf521acc538e31bed67d3d07754d0e4c323c93498cd362a68a3e253e82aeaf1abf04caafd6556351c92aee65fe546b4274cca0d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUY
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_cdef4028147166ab12d985e437da7ea8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_cdef4028147166ab12d985e437da7ea8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nrFZLra.exeC:\Windows\System\nrFZLra.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YIQiiOL.exeC:\Windows\System\YIQiiOL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sGTStpV.exeC:\Windows\System\sGTStpV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\erxPlzn.exeC:\Windows\System\erxPlzn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IXUpiCq.exeC:\Windows\System\IXUpiCq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XQnwewO.exeC:\Windows\System\XQnwewO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rEXiElD.exeC:\Windows\System\rEXiElD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PEtCgoF.exeC:\Windows\System\PEtCgoF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DLxgxdB.exeC:\Windows\System\DLxgxdB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zVqxGGv.exeC:\Windows\System\zVqxGGv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LEQcDrd.exeC:\Windows\System\LEQcDrd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OEXhXjA.exeC:\Windows\System\OEXhXjA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wisTauR.exeC:\Windows\System\wisTauR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gIzuOUe.exeC:\Windows\System\gIzuOUe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rFKDVOP.exeC:\Windows\System\rFKDVOP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZSJgWdO.exeC:\Windows\System\ZSJgWdO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YelfevJ.exeC:\Windows\System\YelfevJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kxSHZhj.exeC:\Windows\System\kxSHZhj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vJCcsAr.exeC:\Windows\System\vJCcsAr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OBQzJuB.exeC:\Windows\System\OBQzJuB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wVpHBzy.exeC:\Windows\System\wVpHBzy.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD556cfe541ecceaa504095d6f5b2680700
SHA13fe51707c369a923357efa52d290650f8441fc74
SHA256c091a6dbf1905703943231f8d4969cb773a82e8208127eb68d70e29938eb628a
SHA512028a0a004a47e325a749b3be0ae8d2c6b49ec5a0c79109edbead8d0bf1be97e37e12917c918aba40a1dd70d36cb58af8ea89675cc40e80fe99ab212c2c255206
-
Filesize
5.2MB
MD560883c69fb4527b569936bb604222da1
SHA1936092a57600a3a712f0d48fa9ee7379dbcd4d25
SHA256ef9599de09aa6b674c09a26187326b255d8e19a76edc7ed86c4703a75ecf77c7
SHA512291a79eda7277c33c01e480e523fe223d7cc989f7ebd093f643b59164340821cdf825cb98d26b9c4d91c8e4ffcb16bc7d54f8199ae440e09de4a8e1ae16617fe
-
Filesize
5.2MB
MD546e0a96dfe0f5453ead50219342c1dfa
SHA130d6289bf8edf3a5030f0225e87281bbff8d69f9
SHA256abeb4faa92f05882bf6ab60becb4f21207b7e1f9367ba83fa58a0a0f505a5ab8
SHA512ea68234f0f027b15b726d07a710495c2608c1b816622919683d66d7735db93a6bc933983f911eed180312c447d8571468a8dc59ee08311d6da9fc22783d1c9df
-
Filesize
5.2MB
MD5427d191c91a3b2251d3202a6c9dd72fb
SHA107601558fa4afc55f616d579b6db5263731a36db
SHA256ec88a3231935ed0921305b21f23b6e5bbd5293b804a8e7747c54258836ea435b
SHA51206e54035ce850ef0a2405ae1cc821cb9489855adf00792c7c42cac07e4e97d6dfc33a5787032a342d452c782f7ea6e46f4ab57f7f893732dbf65f6de74556588
-
Filesize
5.2MB
MD51ddc1ca99e0582a00dee11b09a4ef739
SHA1fb2c0cf629ac36862b6ece2d9c73596da073090e
SHA256b777a6cf37836999e0c15b486aa86457aa87c7e3844c1177c2a294cf83f12a15
SHA5122fb44d3bb2b624ace0b96c258494866f7bc3ae5ceac9614f5bd0d77b52372b92bac85a0c12dcbd56fb91f18c93deb1a7c6e367c34a254f51323853fd63b182af
-
Filesize
5.2MB
MD54e72b82a5b5a8724da609a6b6a159d3c
SHA1b6e23d36e0befb58171b9d06899b1891a802bd62
SHA2566b87a1f7eaf2a86888b28c83c66366cf9f7a015e0fbcdc2b0d17502673a60950
SHA512ee831c526f16b94075843bd6160ee100ed25bb3fde3f646c39c0be68e4530c1b3074af10fa22396ad075baa73a9751a03e8111d9e96f782a4f9e044ac7a34fb8
-
Filesize
5.2MB
MD58fc2ee310425da77dd8376e5c8e2ed82
SHA12348960a75cf456983b61085194d6293759dcea9
SHA256cd7559aabaae9444bc42c9b197f1dfcbdf2d1726c8d7263e9821fdd2c713c6ea
SHA512908a09d4d7728f17b345e0b3c0297744fa6df87f5c0cdf846d526ca44c05df47e73075c1b1a42b3b29540414df1c6f23e6b7fd9dae846b9b66b5c05862e6f564
-
Filesize
5.2MB
MD5cd57e11d1ef2067c65f8566c74aa75ea
SHA1d9130d2ccce260c3408908f038bf3846e03a62c9
SHA256ed10daea01bd51a5fd04c868270b0e8b4cf14b10d636793037085faedeb14cbb
SHA5125e35104bb8aea66e46fcad400baa59219d7e8552354e797cf68a029a29f1ee088919bee073789053e910a6cd66e8f0e822ecca1aa93e6b87e92ecf32700535ab
-
Filesize
5.2MB
MD5a0d7f1a394eb4d907943406832a5397a
SHA1db60bc0f235a8c8e7b74b27bbe243ad0ff9db867
SHA256dbc200e30bba8132eda53f37339a7af76be7c954451cec18dc2b7669b0eb9d37
SHA51244d0de90490d84e7ead2a868bafb385a23be5c3568028e2dafd5a22e6fa0b852c95690a14a5187e4e01560886455a654ac7757b65093bfa5d34bdf02bbad08db
-
Filesize
5.2MB
MD513f0de289b3057d569abb999b634451f
SHA1a66254b1fbc29a1f7f9958d913816daa8829ed54
SHA2566ac638aef911b36e18aeef15acd86a1d4550e3b8a820227ca964d7bf6b1f79ae
SHA5121968c3fd6e99cceaca4f62b5088d00b983cb30ff70060a20179d6d11d6ee2f5b1ab725dc0c98743d5ef3a3f410e7759227e0e88f41a6ff30ab8f26c75a2f9529
-
Filesize
5.2MB
MD57b04e4cf280afb88314d6b4ad947bdd7
SHA19eeaae4522e0960f647ca61a7c1e1f1e05d203ff
SHA256e74eed31a4de333a9cc9a3aa499f284b40d1b3bea768cde48f9ea81ae3904353
SHA5123c1bded3a5d2496fba260b9f7c2cb19a3ba770eb2f4a7735d070faa12d2fe6989eb5b50b87745c3e6ea2d233581cc2bdbd240397cd4313eda12e1a006d81b34a
-
Filesize
5.2MB
MD547d2e5cf6cb0212edb6660d6a16ad143
SHA120436526decf7c48f8b9fcd1d80c77c8d095b40b
SHA25650dd39618248f281039a15ad74ec20330c9424f9aa8aa1311e8bf51267ce4cd9
SHA5129b121c9080bd3b79b105ef65eaeef78e54e7835a9f88451ee08af22a53cce954c08feaad91f6c30edf64d99c9e9cec64ceeb3d38b18510b62d62521a9589a5df
-
Filesize
5.2MB
MD5c23b0139dab1218cdbe068631b46cb36
SHA11cd209d7485f2e873bff94b04b2727ede32fee5c
SHA256c8915a56d30c8b355059ebf353eb031faaa65ecc547df6bab1c07546971a1dd1
SHA51250cbfc4b8952a09e7a764585df887627073a9bfc126e586432f3e3d1195a3805bd309015a29fd609a34d9eb038464abb1b4d7fbb59398f80a582bb9c87dd3de5
-
Filesize
5.2MB
MD568918b81257da986c3a5450dd1fb60a1
SHA1e921008fedee4bb244c5aac98a874e5b138ab441
SHA256883c6841832308bf168b65eb179838abc120bd7aa6552e3a42a0bb9df8ef4dd4
SHA51263f1823bab3708d77c28bb5810b26388be096b9b806afec110f387176cc564600142d588e51cd8907dc15c911b438958495fbfe3f075446c5f0e594a345ae39e
-
Filesize
5.2MB
MD5c3a2fa0217f49c095851da4076652c3b
SHA1d9bd968da0bb3a58e7759bc483861850a51db30e
SHA256ea30c92a0a5122a5dee1da5c03c6d1d5a46df8992b715660245344ec6a244280
SHA51237a8f8a4e5a17b40af2ebe070cb679ab11fab53766f6280047fd53b38c86bb732eac6d63868f3cedb69dc6c2da623b03cf739bade6db1bcfeadf2074d7336926
-
Filesize
5.2MB
MD5829f2d5e1b0cd9df5a580e92827d40ad
SHA1c5be397e9e4fa98c0dce72b9486b8d78d7fa8488
SHA2560d9557975c25bb250465490c97e51e8b0842a985fca11510c7ca075f11c24774
SHA512d870048db8403e4588c21b7e08e6386c74cf158ef66b64d39964934490919174afd2f8786831448e643e9de3ab1235f306bc594aefc4b387ce221846e8325c0e
-
Filesize
5.2MB
MD5a7221771d275e7afd1422fbf2e0685c0
SHA1ec462d3daeab2ad7b414c350d48bbb5d5e3cf9f3
SHA2563fd04d38acde3382647d6f8d27878f39e9693fae44e7e767e53ba15c39a5fc40
SHA5123982d77defd46d411482de6629193e62d948cdfc42a28f701235aef181f696bd3c3771d6c135b87d6b6c8c3d76bfcbb1f2a2458f018f3df95780831f7ababbf2
-
Filesize
5.2MB
MD559dc9d26a3bf546a2927bfa91cac4f29
SHA1ef32d7d8856b5c3402bd681bcbdb9abbbddb5d95
SHA2563dee7a6617737f5b7ff3bbf9bc9051c0c031defbc775e2eaa9a48bbc6bc811bc
SHA5124cdb86ae57adc4fb1d8fe3c5d2206e3d9871b875f04d38b81b9f9bc50d816e68126025ef7e3d107d1eccb4948ad19e3c45c7cf0c9ad874706607a57f2f22d48c
-
Filesize
5.2MB
MD53a81660f97ee893a44fdd3f3202213e0
SHA12a36d4a8877ceb6e7ea305fe6ff19f3be161b28c
SHA256be45a425991de53b1d7a38f283e0027d87dcade7379cf68d1856a8e7b07b2272
SHA512195fecc771d7f5ca4635fcc5776f732f894dbd0f59a3e1f94fbb19516fad7a031781f6f9ec8e2f1acfbd6b6fafd817d0dfa92d43cd2fdc248193554e7453cdfa
-
Filesize
5.2MB
MD55f52d631ab1f2aa38afdf75a56f9958e
SHA12da534aaa179406c2af77d501d4ec3d96c308f8d
SHA2563ad80fb61043d81cffce1abdf07131a3bfab7c39679ba8d22aaeeff846862fd9
SHA512c7fbbaab7b15e63443aec8ca73f333eb1baa1eefc8ac38d8eb1718421b1498117f33df2024e795abf5207d786747b2ae5aa4894953c77333977d34756a48d54e
-
Filesize
5.2MB
MD520df4f4ff2a91194df3172c5f57741ef
SHA13dd4c9b7e301b48bc53bf6844f97852d22c3e0e7
SHA256a96e5587bafa079b37534abdbf1236dfd62b7936584046dc72c94c4c04dbd3bd
SHA5128e6776bcb2ffb1e74f8303004f08f8a6486e233e31f1c46b2ed9824ec99d5ba44b698712858b6cb88fd20f80db13584f9615a709db7d4bcf37dd7debbadce96d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB