Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/11/2024, 02:06
General
-
Target
2024-11-18_6162fe22410b388d4480995fb1899bc9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6162fe22410b388d4480995fb1899bc9
-
SHA1
a98651592d4a549b2d2ee859e4f641f5f8d1076f
-
SHA256
e1676f64843d656f0bbbefd3caa1968b781b6f96c81559ab8c6691d288b47e2a
-
SHA512
6def7146ab9dadb093d76eb217433a33c77e4f9c31d51298659b1da6f891fe05b51797cd50fbbd81148410b7487d9a3aa76d26c8c04d05801e182caaf47c83b4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibf56utgpPFotBER/mQ32lUp
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_6162fe22410b388d4480995fb1899bc9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_6162fe22410b388d4480995fb1899bc9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\iTVmPDV.exeC:\Windows\System\iTVmPDV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BzyNLGC.exeC:\Windows\System\BzyNLGC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WrWiDkt.exeC:\Windows\System\WrWiDkt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hEEqDVU.exeC:\Windows\System\hEEqDVU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qkiDqFs.exeC:\Windows\System\qkiDqFs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ocIrQUe.exeC:\Windows\System\ocIrQUe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jxbneOA.exeC:\Windows\System\jxbneOA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fyjtDNd.exeC:\Windows\System\fyjtDNd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CPqvgzW.exeC:\Windows\System\CPqvgzW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ModtUXt.exeC:\Windows\System\ModtUXt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uLDqwNs.exeC:\Windows\System\uLDqwNs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gjsVqfo.exeC:\Windows\System\gjsVqfo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vAyhbjK.exeC:\Windows\System\vAyhbjK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xoQPuPR.exeC:\Windows\System\xoQPuPR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QVKpGoo.exeC:\Windows\System\QVKpGoo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XhgqBGj.exeC:\Windows\System\XhgqBGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\teIXTRd.exeC:\Windows\System\teIXTRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TkmJruX.exeC:\Windows\System\TkmJruX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lwWocze.exeC:\Windows\System\lwWocze.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PBBzXSj.exeC:\Windows\System\PBBzXSj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gsABJPv.exeC:\Windows\System\gsABJPv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b2757ce450861a2ea226ea3e297afe22
SHA1cc8e8e7a9cf52500ef033e60a6dc43f7839c88a1
SHA2566b123ebf706e28ba6a6de603fa2408d7fb2a0de9bf68d2514f38b30b721725d1
SHA5126eb5f0ddaaef646ea249ae03a92edc64c049707b38f876062f7b0eb01ef0434e841f909a434fbcfc6c63c8a3496ba17e93dd0829df19d4e099c2d738844c9391
-
Filesize
5.2MB
MD503e95e3b6f9a69a0bacb6adc4a3c5329
SHA11394b69f66e3e3ae8e1e51b2cfa9c8632db713fa
SHA256b10060dd63fb4548421a941f7c7957babfc31b8852d83b4324046a740c6386e8
SHA512532b90e7a757ca22e6a21c34a5c1328d56cd7676213faa19b6358af39fee3f75d41f6d8a7d8b313a9b2b31106283c47a041ba7f9b15ada120dcb5db4ea34fc0b
-
Filesize
5.2MB
MD5c1c011331eb42da50f60dfe1b6241a96
SHA1fd4005482cfb03b815aee33e0549cadc80989039
SHA2561048151813d02375e1d7d6b631823bd0df80a5bc545cc45dedd862b57666a653
SHA512a93334a0902fba4c519935316b1479e11691f49bd4693cecaaecb2bef562dbc8c1f903740b2e79d5298453521d171099cf170b3008cd6fbd976b8bff6dd1b342
-
Filesize
5.2MB
MD5be93e714d7b76cf3b008374435444284
SHA19b4286ec61ed92a5159e1cb361ec208caa19e1ec
SHA2561c05ea302034be8f8f9fa8b38cdfd01a954ee7fbb479c4318bbee49ee2b59546
SHA512c8f3c9ff620cb31b924f17edff8bc71967b89938d538f994d1c7cbfd1a534403c0d59516072195660fb443eff70eec4d5bca34e0d2bcb8f7c237db415176aa26
-
Filesize
5.2MB
MD5e75da8604d4f6a2b3dddcc1bafa3bca5
SHA1099afc4f804bd3a243345b6c384cdb2fa97c75f5
SHA256b16ff6e4c6c4c5db0729ed66bbea9850ffd7bb344b3bdceca66c836aa56d511e
SHA512944c3ded9b0cb7479ec3a0fde1aa81a6f41a9a1ac4b3071bd10e0fc83fcdf35e4786b7866efde841ae73d49d57620a31e830715852139a0827fb2348944dde07
-
Filesize
5.2MB
MD56c24c73af3664bb0469d7e88d4f344a7
SHA123e4d1d033584af24f0e9071dc5a9391fba89ee6
SHA256a08c6f2312e9518c62c50334fcefa50d7eab1bba379f1026a0a0d6ca9097a871
SHA512e1d1f2d6d340c103c1090bff00998f2eb40a00c0d40d9059df8a51cb3f6cd6735394ed296a07d0f1c1a4f5527155fce50cc03cb0af06925eabe002455058ea8f
-
Filesize
5.2MB
MD585fccfb0854ac427814703eacd000b5a
SHA1fa21302b9ca592b054a6c3333db3cb424b76405f
SHA256411494586d884bd485dd14f6064185b8302b6953764fee72b9609ca22568bc2e
SHA5125380009a1d63ee7d1516fe1a43b32919d20e63ac29703d12c4a7baf498eddd5aeabfbb9d27589d599ae14902a9ab8c065e76ebe4f6e5cc11d93af2d6c373741c
-
Filesize
5.2MB
MD5544840fbbe016837a23118a4e8b59f82
SHA1c22ab7baf53e3a895946f02be8c55a4c8d4a1a43
SHA25663895cc840fb9e76cc1e9fc75174af29e9102d539d130f22f96c2fcd9f5bdb57
SHA5121ba12d1ac64fb6e469ab092573d915dd3ee434742dd66348626bf6cb9d59a4ec38e67b6dcf237569614067a49c9416170e6937af50563e3d8106d2a4a4ed8882
-
Filesize
5.2MB
MD597f5bfee3081c9cdda0da0b2828e4aa2
SHA10ee592d3da4ae847f8a3c0e6ba1c3413ec58d64b
SHA25623c9c3aa352c4295fa2da6f291051b18c3f7bc69d537b5038de45e6c4ba5dac2
SHA51292dd01b9ffbabdc06257edb0708c8ddf461444f2f6bdb3e908b049729c7c1dfa1f406ad34d2971307b7a339feb9cbff83dd8d97a9cb3f686bb69dfb2ac6be060
-
Filesize
5.2MB
MD5553e9e41d69a55469b0b4fc3b8e27719
SHA114b87746c90a25ef3dc05252ef160bac84390da6
SHA256ed902752c64ea1d94c3284971ced911948dbc19f428ef2cc42154244ef5d80b7
SHA512a5c6d117f80305f93db4b7294942d4ae8a2f6dec15219cb2edf68bfba003a29f95418ed71a8626cd5ede56860ed5365a3d9ce82930162e5cf271b39eee06b758
-
Filesize
5.2MB
MD5f7a08c47aa28e5b6f76d13dfd6fd64f8
SHA1fb61c4ad03fdf067d78fb6b6f5dbce2e569d2d96
SHA2567b4313438206dd9b1bb6805296368d0e3e9b9a25cc4df9ec8bb11cf6aa7331cb
SHA512830bbdfb0104f57af69092dc1af0f7387fe5912cf42b55ceaf3b06d67bc5926b762256c7e040e61537bb9be37bb3e1332d810838cfebc58cc99c2a6f7d0ecae5
-
Filesize
5.2MB
MD5e74a4754aa085cbf4bfeb19f3bba56ed
SHA1bbb881d10e4134835f84bb647b4936951827e822
SHA256d198c941a685a7486529a7eaea97e722f682a0596fd2f8b3962239f4a4da6dae
SHA5122887f1945617343736c3d2d2894637bc0875eb607283311c07cb3b1ca3ada1e24788e8384da1211bf609ddbb68bf496e8f39ec5fabf902a6c8197adda920c79c
-
Filesize
5.2MB
MD5045a80dac0c0c12317d1d8e7d5dc4132
SHA162aaefb40a89dbee235ec6f25c7c9e4cccbe0381
SHA25642f8308cc3bd3d8552907192393f859089c99f80022c35ab0926f2a3e6fc81f4
SHA5128d82eb916b4f84105c235b2b877232ee374745167c567a7410c1079be838f7fa2f7827b9285ee0363b90d69cd45974c2fc1031e6dfc027129dd9cd78d8592995
-
Filesize
5.2MB
MD5b41ffc7d4b0da60a902577b13d85fa1f
SHA1f4f6b535273da2108f88cca049a59c7cadf73e98
SHA2560317f2b9c4b6d01f0549225f698a22bc19b827dbed0086fd309b151116f9056b
SHA512db1ada253bec36e28e3057cb8dd24f6d5266430b1fde126bc502061ac192bf86f8063ecc70062d9e25d7210ed286deeb03dc6caa81578064bf51bfcc2cabdc97
-
Filesize
5.2MB
MD569433ad2f795d42ace4c01b730e967e3
SHA13b17b592c8a088685f0742eeae48a5e5015d90e0
SHA25615ce938a6b6c495735571a2487485ba00545fcc31671f3a38271206a70b9b04b
SHA512b9cc2a49a4e52744a02bc31ec4af10d951ddc35caa852afe11360d495061e5b1d831d5ec65f01e509fc41f355d9c98e02bb44e5bffb76e61433438f3f1aed0a5
-
Filesize
5.2MB
MD522f613bd7a43cd5ac761d60d0635f85c
SHA114201830049e4238840c3a7503a3eaa0c8c6ac9b
SHA2569e0c03892fff90c019637755af106aeaa6bc0400f3a2825c782a7d20b4e3fdf5
SHA512d2e2c61d61372eab5484c35964e78ca26f8dc4fc45a2b3921f44290ab0ab706a703641089e9ac5410c0a5d30ae698e1843fa55a40fc765a1942d5575c592f8cf
-
Filesize
5.2MB
MD5600c1176a3822d4d90fe1fc346869ee4
SHA195af60055e2a3bbc84be2220b7fd5ecfc213fc1b
SHA25665824ffb3f44cb116c28802b7f5cc71de91205d510c78b149ed857bbcfb42abc
SHA51281352eebf14ebe5af09f4986d88d89844c85682f9e00d96764c7db76a6bc442f0c8e832af6da5511e36ebbcee98009547e9355e2e9640b9b7ab59abda9921b56
-
Filesize
5.2MB
MD520f18a83db0ef8cec619cc34a1fd48b0
SHA1cb3fa1b2a7888d500a9b1d31686e1b3213527819
SHA2566ae374da002c2d159297aa7beb6b3227c8ccbbffd1cdc12f7db14919aa767a72
SHA51245f219cb4e2041368196ecfad4d1e2cb4b3e34068cf03e85ce75ec08860f41fd420ebcb80a30368f14209d0bbf2454cad670a92e2b958279518c85cfe5a209f8
-
Filesize
5.2MB
MD5f726c3841da38b3ae29aa2f4f5d0acdd
SHA10512d6f9a39ab98f2f4ddc1f8e4508f01c7a09e5
SHA25630ac65b9be176224ca5742864397ad29a895f3aae1891a89c36b73b5bc40339f
SHA5129088a33689cb6b37ad7ee38adc7b2f1b2f6a829e3ba8a693fd8250567be7165f8485b402c541677e93069373fd56822ccadd270ca7f94f31556844cab5a841cd
-
Filesize
5.2MB
MD5fe3bb833e67edd18c6b6a3b04ca7add5
SHA13fa4d0c88ddb0d25d87145a30ea89df994833c2d
SHA256d4785820923fd3f482295730247cd055574ee03c93d7c43dd2b50a0367217c28
SHA512b190dc0e7509782af130a199b8e276c387834cbfa31b8289ebd6809411e659fe22652d9777b95833728da073ecd8a8b06dbdc780966e271fd85e9cf9cd210416
-
Filesize
5.2MB
MD5a337e794a1a81003ddbf3730bd340c96
SHA1177e1532f3da8dfe3da0a15fde18f17f8d0dbd75
SHA2566c6d6fd57fce436f21dbc62f01c73a35af8cae431663dcae7d6d1f887d3c90e3
SHA51241fc3d77b71130a0e489bd499db5d22fd2a26c477d98ea9d1529ccac568d41dce65d4b01050e43c05a18a90813b09121a37bac22de154dbc77cec3dd02bad9ca
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB