Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18/11/2024, 02:06
General
-
Target
2024-11-18_6162fe22410b388d4480995fb1899bc9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6162fe22410b388d4480995fb1899bc9
-
SHA1
a98651592d4a549b2d2ee859e4f641f5f8d1076f
-
SHA256
e1676f64843d656f0bbbefd3caa1968b781b6f96c81559ab8c6691d288b47e2a
-
SHA512
6def7146ab9dadb093d76eb217433a33c77e4f9c31d51298659b1da6f891fe05b51797cd50fbbd81148410b7487d9a3aa76d26c8c04d05801e182caaf47c83b4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibf56utgpPFotBER/mQ32lUp
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_6162fe22410b388d4480995fb1899bc9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_6162fe22410b388d4480995fb1899bc9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ovgXFNL.exeC:\Windows\System\ovgXFNL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mukmxJD.exeC:\Windows\System\mukmxJD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rCegeBW.exeC:\Windows\System\rCegeBW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mnzSPqK.exeC:\Windows\System\mnzSPqK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mGIPpnU.exeC:\Windows\System\mGIPpnU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\apjtIgM.exeC:\Windows\System\apjtIgM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WofEgDL.exeC:\Windows\System\WofEgDL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UHOGjbS.exeC:\Windows\System\UHOGjbS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ptNEMnT.exeC:\Windows\System\ptNEMnT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EJjknBS.exeC:\Windows\System\EJjknBS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FjWTKPo.exeC:\Windows\System\FjWTKPo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WbQYjLe.exeC:\Windows\System\WbQYjLe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rhWUkto.exeC:\Windows\System\rhWUkto.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NHjmvFt.exeC:\Windows\System\NHjmvFt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BIuNmfE.exeC:\Windows\System\BIuNmfE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\orjizqo.exeC:\Windows\System\orjizqo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dFHUTPn.exeC:\Windows\System\dFHUTPn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DQLCbho.exeC:\Windows\System\DQLCbho.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KUNnIfQ.exeC:\Windows\System\KUNnIfQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SbSvjFp.exeC:\Windows\System\SbSvjFp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aWGYOui.exeC:\Windows\System\aWGYOui.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5df4e0366743bb9e2ef3b598244e99a64
SHA1a69cf392e1c525861ed216012e384481d70fd148
SHA2563ab726abb6ae69659e8a134a497cd11eb08d378e7934517504f2ba67ef131c7d
SHA512531dc5eda322a959d04323c88c568247d23213d2fcbbadc5bc6732d419928159e76d2e834c07861f8c428636d98805d81b9472d20ae769aa92bf43de580a2e03
-
Filesize
5.2MB
MD5d498189b96c41820549111217e4ce2b1
SHA105b1c49e9239c9101b1ae5a1c7fff6e022387fe4
SHA2566f84fb771574c741b75f29b28698f2a9d0c680f210b42d7b6248acedd28ec9cb
SHA512198df19795755ec6328aa8a22bf09243f656e46f6653fd90395caaff1a83adcf1e2937dfc6c64f2346562200f8b943abe25555113fe8a057d7dd0ea315cb35b3
-
Filesize
5.2MB
MD58e723394e4a802c30609d3ff89f4b0c2
SHA149d51777cd656a361c9b228cf5e33be4a175d276
SHA25689f6bc6cb39cc876b32e120b55a379415adea260560c127bf833cc5503d2f416
SHA5125c85fa554e5f56c2ac1bc040e5a33de4892653bea8dfc21392575840033c713c4edf3fe66583e756d3aa41fcc951cd758346a0d757f953f84ddbed6e0f1be6ab
-
Filesize
5.2MB
MD57c25cfe9d5072a70f73bad0c8822d6cd
SHA1125cfc510ab8858310dc4ca94fb16124ae0fb439
SHA256b59e669529e6a0623279f1b5212e0a8f0c54e401f7dd63f4a5aff1b7c750f1be
SHA512a1a4f950f27418d3115e10725806d543c8ead5680195205d177b0b4508b6cee2ed2c9fff34f9611cb3ef62a5115fba23101c34fb570609bbd1593f08432877b7
-
Filesize
5.2MB
MD558a581e1f14f3dd9195e4bb36e91452c
SHA14bd4a521d40187ac9fa87634c83d6a33a7d0ebba
SHA256d74c9a86f21cb32fae48a5937f3717207ad9965445e928dee434929cbefc6064
SHA512d79bece1ad2c77c8bce27071997c2e19c0ce74c563ccc1e6bcef7e915a77c6e9c6e9adf5f05b49fb52c74416db5d64c478bbcfa974f73b801c36ae67ed528aa6
-
Filesize
5.2MB
MD5fadc770774c3f5361195289f704b9a5b
SHA1567a6b91523c71d585a985c6e082fbf29134915b
SHA256dbefc12d823ff4b227a1fc013dae3fb57c1fd98a6c65d0f65b6c3d0a06eaf81d
SHA512949e67b162d5f3943fa764fd5f52d5c104ef7c8fa2b12c84303f566134d5e6f51928f719d4cf54673cc2085b5587789ab7d06ee629d860992564841374270848
-
Filesize
5.2MB
MD5b83df2fda9faee40158be8a004b8118c
SHA14d4574bcedc9b8f835363832ac51e6806b8afe96
SHA2566056fff925d7e06a89a826edca9628342e5f17d37331ee69d6fd0e3d3965ce3b
SHA512ee790eb9a332a948e15a3ccb99ec9915d14ed474a937dbf05749629866adc2de03780389b0f34de5243e1592e50dc4a25b927b9b36364257f45f319aa6f81b42
-
Filesize
5.2MB
MD54dee067e1f1e95b1f2bb1377c58a0f6f
SHA185296491fbc144738bc5c09d0770e4ee432e22bd
SHA256ea90567278c5f5d8e58fc5a159d5aa310aa2c4f9c4304f70857a9f15f8e31ef5
SHA512812a19eed3306194b2bad6b16980f8f197bd052d330d49db3111f2d7b0da3af044bbea4a74360205d92f670eae4ea181c52ed6fdba0f9c775e30ed47b70ee22b
-
Filesize
5.2MB
MD5ddc81f077e8686ce5aaeef1d69d1bafd
SHA12e090302d31570c7cc552ebe08ec0ecd3a660f32
SHA2566a2269331cb4a57129163af9c07f908c6558684a8858dd4f3cd01905bb3875af
SHA5120764a9a7db3f96dd215a7fc29f82bf6eaa2aec291154cc43604c9cb3b3584de69050e77641f6452c9e1eaedfcfc06eebea234b4bab162ea359eb37bced441121
-
Filesize
5.2MB
MD54564ff64f55897d63a30daed33e65d87
SHA1b5e37d46a3d33f737643bb0296d1203f73be219b
SHA2561dd176f4172f587fc97ccf0ed9757c7db2708e7f48d66939c7823855060cdd9f
SHA512513b5e1aaebb41a40b6c7f1d5e74ca9cb5f6c199cfca5f528f17f7e9099384be4ce436aaac22167bd926988d7fc25a4ccc13d0651d4e945b3a40a4862e237166
-
Filesize
5.2MB
MD5232b5a6647f265691bc83cd20000c5cc
SHA185268d5d8d2f83717cc2726265e08b3a3792488b
SHA256e8835457b05af4e8b6093784d18a33d5a437a0f22606cd7e59a58b46323054c0
SHA5121a7e8e05ee90fc3bd43059e960ec5a6d2499f635ab50b6554f863f6108bb48016d15aedac2c27fd68f722a839b08019fbc1bd739b9d9b239be22bc8918289d94
-
Filesize
5.2MB
MD541de476d4106fed193bc4cf372521dc5
SHA1306dba4df1ddc9dd1ebe5e62d316f331565fd38e
SHA25657d8d4889ba848bb2c86c8e2e341db1affdbf3e0c60254148d0fddd7783048e9
SHA512e730aa3b2c61da885c33eeff7c855ed9721ceebdbb47482112dc017c8dfec98e63fbac5ea3936e929f749f677ca0dc6c48b5346aaa4dda93f7051315ab0d1144
-
Filesize
5.2MB
MD524904fed95882e934e5f8ecf1336014f
SHA1bae2c0db6a657ef6a5ba7182cd07728f287b0fcb
SHA2565e4eba367416f476bda650dae2cc266ce734d4fbb2cb577c39d75a7c9cc26365
SHA512f7f855968327723462f035ba1d3b2159f609c755a432be73471585f8578ae2f9ae089298e6d1048349380451974767e4e8285ab53a268d948c6cb4987d3501b5
-
Filesize
5.2MB
MD5e0ba5d9cc8744feaf3a91065429bd2c7
SHA1c9b88d4154c8217b20da1f29f8c23d49c88fb882
SHA256be900f2e67357da3bc1509c80156ccb1ff3001de51198de2b4403a1f002ea0c5
SHA5128dc6a9e8424ddff369848f95639562145c1956168df40be41ca3e2cb89dd21545c4385989b4782731d71be1c0590c7404087607c725617a7cd8216f2cf88e7ea
-
Filesize
5.2MB
MD5f41de698ded689d02c28e1947593ad8a
SHA164fe92e3f63ea92123d6c54376338e5ce714d4c6
SHA25647856441c9840b59fbf4150b139de0a382ff7cb2ae275a5b27c34d0052c3dc0d
SHA512019b507fd01c952dbc49f92c1b328a402d1da17e83a1667f017209fdb8c357fde60fcd4b845124154ca34601c9d3def6f0b76d1fb2698799e01d030fa13b5cb4
-
Filesize
5.2MB
MD587110f4cc296af0a77f4a26b5af09247
SHA110e11134333417e3ea9c4911971ea155d90832c9
SHA2566eaf7526ddf90e8cc22815db5be02090f9646d48cf5041b84050436b06f7ed51
SHA512af99fef6662bba8a75b5a79cf07ef03eacb5c16f07b5ca21bcf1cfed3ba77bbced5fa1a6c74cd187a9e5f3fcfbd0e7cc183276e8c72f351255d6e6f64f2c284e
-
Filesize
5.2MB
MD5684de71e3dc41ee1f18aee3099d51ff8
SHA1d7e6ae3289b7075e9e22fdfe5eecaa2f2510e14a
SHA256dc66c16ce23f719dc4eda8faef3065e53633e17be48c8f0fa591629fad2925a0
SHA512549220f55e1511dac3786e19476789c271aa72510b52ba83274d5a454a23a4757ef34eaba75bf3ed0656d555563d734309545fc07a8d5426181c849ff6450069
-
Filesize
5.2MB
MD510f258501b64545d61192aafbcf53b71
SHA16ca9964d959e6c00d31b6c1b5da74b7fe4e941c6
SHA2567795584cf3ab3939d72619aa934fe8d9b598392cb8fd381458fee3964cf28672
SHA512bbb8e14a451578b81f23fdad99a8c6d43fbb11a7f970367c8ffffc389ed6432e7af65e7ce8f69c3dd73d6674b5e43b45017808928b23d6dae95767cd3fd6e46c
-
Filesize
5.2MB
MD5add34470ce833a326d1de55f68f27039
SHA1e8f11c4ab6fc74fa00f5c9a02ac307ba53518214
SHA2568ca38a727eb6eaee0fa8d30eb9e4daf435505a4310c0a24b1414a5f6de45f121
SHA512e46725708ff9be121372ee023b8575f701d78aad53e601741362ada669623ec9a63b1031bbef9a798d2947d84866b938e6ecd362c2d1dadc438190a4081e49ca
-
Filesize
5.2MB
MD5b91ee5a28738d7ec9139d4689047389b
SHA119e18118f6186a103769f5ca5080ba4fbf781454
SHA2568bcf7595658e30e1f7ab957ca3664eef520db1032b4a229451ad8088a6a08892
SHA5125f860d2a82f40200ef44ca5ed6eb14d7c6e7a4e16a0b588552cb10013ef1e6f09af59dfd5d3e2a2f56925088cd47b4c543a4922e4aa7bb438e028fc51eff758a
-
Filesize
5.2MB
MD55407049def7c55dca246c43a96a2e3a1
SHA1d4fe740077edfcc2f663feb4ee6ab2dc036e3e66
SHA2568f9ff068f2cc5dfadb3f51447d70d5e8d4700ab34bef5d861ee792a02e3aa5df
SHA51229a1180ccd5c55f4c09ee32d3becef4fc2ef0643b7f98c48234b1b5305aff6eea4f0f8a6e7b3d0944ec936d4fcb6284eeb89634f2e16a4f63ecd24df48bc1516
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB