Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/11/2024, 02:04
General
-
Target
2024-11-18_5fd2801560427896fa023e85b33000b5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5fd2801560427896fa023e85b33000b5
-
SHA1
13c098a61c854981c9819d4d64b613e6b10fccad
-
SHA256
79a4805597e0e66559bbe66a762ec33164455c23796a16dbd1ac0724710c1158
-
SHA512
240e025a5be27fada221a9f75a72e1aa981eb46c90cf8e8ad938bde95f6513cec64b9a163c1dedcbf6f461a70505d61f6a93b0c271b66ef4586ef75a636fdeb8
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lU1
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_5fd2801560427896fa023e85b33000b5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_5fd2801560427896fa023e85b33000b5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nnCHcnh.exeC:\Windows\System\nnCHcnh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HeUiyXC.exeC:\Windows\System\HeUiyXC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QTqlMEJ.exeC:\Windows\System\QTqlMEJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oLJOaJQ.exeC:\Windows\System\oLJOaJQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BBvAxzu.exeC:\Windows\System\BBvAxzu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xvfUXgp.exeC:\Windows\System\xvfUXgp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oQsJApf.exeC:\Windows\System\oQsJApf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bVlZuSn.exeC:\Windows\System\bVlZuSn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ousxZbH.exeC:\Windows\System\ousxZbH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gDoaxNA.exeC:\Windows\System\gDoaxNA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kZZMqTi.exeC:\Windows\System\kZZMqTi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yBRRCcO.exeC:\Windows\System\yBRRCcO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zJPnjhS.exeC:\Windows\System\zJPnjhS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gCoQprK.exeC:\Windows\System\gCoQprK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZGmyCGt.exeC:\Windows\System\ZGmyCGt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CuPFgOw.exeC:\Windows\System\CuPFgOw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EOtHhRV.exeC:\Windows\System\EOtHhRV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oCkGVew.exeC:\Windows\System\oCkGVew.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tzePRzN.exeC:\Windows\System\tzePRzN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DFgFSbQ.exeC:\Windows\System\DFgFSbQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MJIWgtK.exeC:\Windows\System\MJIWgtK.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5391b3a5740b571e99235cb2617d7e20a
SHA1b8bd9ce54d15acdfd917a1d06d780264bd415028
SHA25659cbeb304679221f7e0cce82c58fbe086958865939da5c05495515938dcfa571
SHA512a03002adb96759af7578d01d3d5e9eaa24abe12d6582a1d7556e45a958942faa878661dad03f459d6ecad1dbaf4cae3e62e0f7dd0ab953a1af7a0c3fbe5554b9
-
Filesize
5.2MB
MD58b49a10ce489a7c38657434c827a2a1e
SHA1f7823f925c870739915822955b16c8005893f82e
SHA256dc5fbd85f86b56c7b331d62362f485c015bf6ff15c79dbf052a85fa11148367a
SHA5122275c63d213fcd1d6408a7e7f943b14fe51f43a3100c4cbd9d930a71d610b588cd36f65adfaee7651f41756f631058b6230b95f095d6b4b9aad9ed8d04c490e6
-
Filesize
5.2MB
MD5b00ad1cde2fdf70d3308d8f6e9b331c4
SHA1f01994fb6bdf144f70b1eaff26dc1b9d0b2252fa
SHA25637b45e104e98e0cc6c60951a703ee44595b5813c601232f39961bb10c58748c9
SHA512ae08d89fa8282010e6ec2cfb8c541c5e075e61987f8468aed4b54915313b6838489a01dc4d95b73fb405b8e4e3130c0c95d3aae406a61b45822a8fa6cadea722
-
Filesize
5.2MB
MD589f01011496f5c745b2861165ba8c086
SHA15eb1aa292cb85a1162e0573c069471d2d2ad2a28
SHA25610d8e232223648f47945f611bfabceed7c416df32c71e0a906d20bbf9668715d
SHA5128ae4a3807aefd6ae8c13c8f3610a7080f0b366ba243b87b966ebb49cb288ddfe2d7f7bd606bba934dfdd943f5e30f36d3134543c6f0bc01836a6debbd6410993
-
Filesize
5.2MB
MD5dc6719b9c70df06e975231e249f8f928
SHA199bf3e623f681c9046db0dd9022fdab1c3c87dbf
SHA256f3283183fe02d00c272bc27d7b4fa64f182ed844fe0f100a72e34a589c3553b1
SHA5129ded14f608125a8432906793a8186433acff5b5466645d962cf527df8d707aced679f4671d8e22ae13b43c2fac5b1ae7ccaf785312f66767737adc766213b815
-
Filesize
5.2MB
MD5ce5b79eb700f00b89a16db7750cf778c
SHA17bbe7f12a37a5754c44a3bc261c9044b67d16b6a
SHA256bc823755768d9dcdb3b9e2613666a42593d1488ec24dbd05f0d1ec9de6192ad5
SHA512021f753efd832497ebf25eb7d42f55b1b60c45a674338976d468c365271a4117adc479d21df509e4e9f6ad6d14609fd20f29dcc1bbc22fdd4738ce91fb4c3121
-
Filesize
5.2MB
MD5a5a54fde9d8c85c776edc8446d768407
SHA1d5cf5c0e7bac1336aef8226fbaf6ebc3df20040f
SHA256ce04370b05b0b718242851fb2efd5141c544cf63606b3dc328e5022845a28714
SHA512c349fcc9fd723193a3504e93a7faeae9c24d08fe1881d4135103a980f1cc4d80a4b3473856da8addb295152385a5db63c3bff16770270ba8c1ac5eda21002028
-
Filesize
5.2MB
MD5c880a34bfd75e7f6c25b040f5ab4f0e8
SHA1438bdf73c0649b1db966ce830b8840cbaddb2b9d
SHA256369cc0ff51a0b44217371cc3bbdb682137e5b91729bc74223530610af51d3a1e
SHA51213e170e250d628a44122700f621a44670bc1676eaffe379e14b65796d3653e668b261c0c99e9f9019ab96b04fa773e876a58e1cec077f1b832758507ae9afbdb
-
Filesize
5.2MB
MD5798cc0632951214b5b29dc54071918ac
SHA1e66892ec276652081120649db465c003f927e134
SHA256a2f9703f6e1b3a655ae967098f2587632d35f8d14fbba0c1f35c763cfdbb0d85
SHA512013112574dd9cd737d41db40aa835004686bcd5c3b1e7e77b33ccb0aa9aab1dae4d62956824567c29dc81f623f5aac7cfc05600a00ba0e5985aca94322acf09e
-
Filesize
5.2MB
MD5a864ecefee7c0fbf2a6543410b94f1e1
SHA128f03307b8343bf3e8337556923324be0f124bd1
SHA2563adad8b90bae84d7267a1fe2fa473e95bfaad25fe63b2a54645adafa1b396efc
SHA512c7ec4a17eaad6cbe0fa6888c21ee2c4cf33afb07adbc2284c3fd9c76e92ee05e52990c62b53269f9ff4eb0ff9320090eeb9d0656a1dcf0ece1aef8375698c80e
-
Filesize
5.2MB
MD57c1cddc49bab3f45d3f21c3fe917f3cf
SHA172e1ba75e7a82a57502594d5b00cbf645506a644
SHA256909f07b6e2b706be7b7232206c170a0d682fa387a3339f958a9501c9ad894ada
SHA512ac160f6ba47b80a9655abd2473336179537b44d496e0d71dc54951a738af3f5f23774f29a45015e185ee9f7b4e28b41c31579574eae831c8f6ca1d444769b593
-
Filesize
5.2MB
MD5b572d0a7500225cba9c897b161ceec45
SHA1f7f12988f9700cbec51bfe19a8bef787290be8bd
SHA2563223a0a4f9a7ded4a7423361964e3858c21a1d1e9b63f51c60ba50c85c175958
SHA5128f07b22df44984731135d26e1971a8199daa82144c36d8a3673563af2c9a5471ff22fef80456f495fca49035e78a726ab9724e0ba07a3911b07dbdb0b59513db
-
Filesize
5.2MB
MD575bba0472ac4e24e9362230424aa1586
SHA1823796bc5dd3f39a63922502b4a75b10492864f4
SHA256b4423d8e3069d7afa9d53eea9bab585b58910437cdd7a2ffa7f78c1ac9299e9e
SHA5123794479094cce14d7be48e8492a50b0305b5463130963f1dd42ec2b29512cc3f59e8da8759df0a175ede24b3f8085c45b7e924fe105abbed7df2530afd71bc3e
-
Filesize
5.2MB
MD5e335609cebe7a364f595e53568f1e527
SHA1809ecc9761905892af9800e5e75a5f90c6d2e098
SHA2561a3e2aa8f91b6fe41b27d868dd12ce60ec54b95eb529f7178733c9a79430126f
SHA512572903f821d58f80e0ac563c2c7a5aa70755dd85bebe61a61bbe2edd885f64c5a1203113ad120960f693aa8b4bea336aeea2ce7153b10f9c844b147cdc965c21
-
Filesize
5.2MB
MD5bc6cd25c08550056b41fa39991b29ced
SHA1e91a74c73764a337228c49107d7d21f155887c7e
SHA25685492b195750eba2cb5ffba82f81bf4b0e35283776d46c9b18bf056d46f01876
SHA512f74a956e972c2e188dd7c87eb1d46d1dcad581ebc195366bc2f3e101b0b292e7ad4f661015fae017ed2d16fa667d41f4958de9fa00ba1de6f6ea161d6dfc4000
-
Filesize
5.2MB
MD501104ace52fbd3877db7b98f0b4a7295
SHA1cf4ad0e3ab7aa7eb701516e625a68256c3f8aab9
SHA256971ac1c2500913e1ff4e167f76c148d4ffe5bf68dc1c7d06260a70d080cddf1d
SHA51230f8ea58f2e0ddb4b1478ac134e18df5df77b4b23a062e867708cf94fd37bcfecc1c55aafdbf53597ce0be026a8e80c1625012fb0e726e4fe29f4a78d0ce7646
-
Filesize
5.2MB
MD5f44f2027c723019841fae14baba41616
SHA1ec1532d30109e9f6cc31e5b91bec317c16b08938
SHA256dd115cb3379a0410e69e9e0146aae75edd92363e70e64352fbb933c08fbc82ee
SHA5121d4352fc03233328a2992a74fd870c4623f6d0a8db2b6b9ce7d1482b1129c817e87e2bacda0769073f38a2bfc6498170a58c58cfc669264730990fd8467bb502
-
Filesize
5.2MB
MD564d07c73566747083aa7c780b8abbe90
SHA1600c1aba9981a5f5c84968980acd9a9ce0d0e3d5
SHA256c009d9345a19e4495cbddbd0ec9a64f2a9c594eeedae97b20b3eee7c213e9b44
SHA512afe647ea3a04ccff52c6ed931b446aa576e7e16fb705a241f693dcf092897363ed32510f2629bc52c42475c19f16cfcb8444a03ef3a049fc66b790974dac7b0b
-
Filesize
5.2MB
MD5bc26845dbd27d9059ab11c0679dc0b43
SHA1fccb702b99a68e863d4fb2c3e83f9b874da7db8a
SHA25632831731d65e6b28235e9484328defd5c5fa637ce2f2a5ce122277fdeaee6575
SHA5125f00e93b75fd91138996b3360e1db3f682d7a0536ad102d37ef18a93d409ca79bcd6d9832066d88a5ef24e02f69187f38ebe30104d50ce90f8cec409a1b68201
-
Filesize
5.2MB
MD5987b63d226fbf38e5c02287227317ba8
SHA1546a65e152a543a6939f6b305ce041c9b695a66c
SHA2566e5ee8059af138a74df81f77ec524733358bc97b12789294a98ec14dcabc6193
SHA5129d2521991f2442ed904275750c6d45eef400d14fd9633e3c1cca5e3c80b1c3567d8a206a4ada4b78c3ad6135338a7d0345f3ab70fb9f05a853895014eb2c1bea
-
Filesize
5.2MB
MD513ab9f6f5ea0906ffe05871f3a73bf16
SHA150ba1366b1359c1d8730f5589684ea5a4eac1a50
SHA256e2631f85c38ba81fb9b8c239cb670ea5623cd083328b4edc3c72576db68841d1
SHA5122d69680ed1ff76aca470fe4adc4f656321431985530766c1fb5bbd0f28f97f7616cf3ad7dad7fc82118c1499820b17e143a4790c545982a94cd9a584d4e38e50
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB