Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/11/2024, 02:24
General
-
Target
2024-11-18_f1385ec367f9bdae15a47ff6261fbe00_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f1385ec367f9bdae15a47ff6261fbe00
-
SHA1
d84a6707aae4a5708d9790d6594a53fa13b0596b
-
SHA256
cd7bcaaa615625f009c81d5ab4a4814ed266fb2caa149481a938c00dc9eab00d
-
SHA512
4d176038b3130afbabe3823b0e324654a56a886c8c3e10ddadd34cb3db2cd24761422b3d33d08d00ff0ba2296fb9f9bf2ea0d82da6ac600bb52e2010e8dab2a9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibf56utgpPFotBER/mQ32lUR
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_f1385ec367f9bdae15a47ff6261fbe00_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_f1385ec367f9bdae15a47ff6261fbe00_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FPcrBfu.exeC:\Windows\System\FPcrBfu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QcSuAYn.exeC:\Windows\System\QcSuAYn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ImDGVOh.exeC:\Windows\System\ImDGVOh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nqPxsve.exeC:\Windows\System\nqPxsve.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HpAhsho.exeC:\Windows\System\HpAhsho.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NkrTzHU.exeC:\Windows\System\NkrTzHU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\auppQXE.exeC:\Windows\System\auppQXE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BzrUeZw.exeC:\Windows\System\BzrUeZw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zhBfFxh.exeC:\Windows\System\zhBfFxh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tfnekJT.exeC:\Windows\System\tfnekJT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\znEhTBE.exeC:\Windows\System\znEhTBE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ayIZhwt.exeC:\Windows\System\ayIZhwt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JhzLadi.exeC:\Windows\System\JhzLadi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nSworYt.exeC:\Windows\System\nSworYt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ENyradA.exeC:\Windows\System\ENyradA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pAnqorA.exeC:\Windows\System\pAnqorA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OxnOeqi.exeC:\Windows\System\OxnOeqi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GpflILo.exeC:\Windows\System\GpflILo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HrlAtPi.exeC:\Windows\System\HrlAtPi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DRperCg.exeC:\Windows\System\DRperCg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CKRexQv.exeC:\Windows\System\CKRexQv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD529dbe849d65dc0ddfc4ff672ff5c72e4
SHA18c233033cf51d3dbe36d1fd9bac0bdd8dcbe1418
SHA256e920939e4a5ec58a02c628f24b505cb5b40d16d17028db57429bb14a7140d754
SHA5123b613e9f29593b7286d4185bbc1f9719c8595591d59d33f46857d21c95772898585ba990bc6f63027bfdd392dc599eeade41214f91a7e0584922859a943cb588
-
Filesize
5.2MB
MD51271354cd9db5b3367ec45bc70ddcc71
SHA1aa5e6f94a55af4fa9ca175df96a7fa393790a1bf
SHA25643ce2b228e82dc1f437d219f0ec308d36cacc93037dbd3d4f3b180c0f6c84142
SHA5129621018db00e51ccbd7c2b7309a8a2f82c3b6635cbaa4c47b9b1e6a7fbe6a1a0d57c04a91c8efd042a3840ba01b02ed875e0aebaf0069e1cca79a86d7fceb558
-
Filesize
5.2MB
MD539becf0e65db115de22d3e7e66f838e0
SHA1e0a1224bbfaa75471d11d22e870cbce379009261
SHA25638a7925f8063af71a8c0ec0877a914103b86ea9c6b8cb66847401fb71c47fafe
SHA5128604831f8b2368bb73b4370a2244615a92e816b542898090de8705d8f647ca53f3994aa93f9e56e027480c661d9301bf40c432a44fd4555f5fc42bb3983dd7c7
-
Filesize
5.2MB
MD59519bc1f7f2facb8c0d1d58f459fb746
SHA149a371ea909ccf7d4c7cd3ad5690c2f66b22b83a
SHA256af163fb2e6f1a28df57d3bf760eb808a2557fbc84dba215b2a5fc8952c4294e0
SHA5125743f66b22ac3dc2ee7bd28d205357e8f80ea2a91fb71ebd6e0cf9cbb4e2c77be1c83f39c310744d54b7ce20783a6c7a033315ac217827d06f6f214125f48561
-
Filesize
5.2MB
MD54c491e84409b534f1cc7c912ea640618
SHA1d0b16167fc220850dbde05170879af64aaa4c62a
SHA25634b5581278fdbe86921648070ca64779f53cb9ff2cde4ae559d2569d424b7a13
SHA512703e4157665cb2174219b204917bf5d4e482bb6a53004643ceca745956528c2426d348317eb0caa09f0759a45a3405c9b7fa1510061483028879998c48b04954
-
Filesize
5.2MB
MD5496157bb3920d102b36e1158eaed408b
SHA1789c69a740764dbc8ab54728ff730393f13a15c1
SHA256e318a3e4899b731aa2d9e9eee5bb807a3f30a5a3bd1dffdf17770abb84cae2cd
SHA512a0f42974180e877055cb35a1687c5df557ec4ee1905f56465e844d0699c10f87ef9a7589df1c997cbc710ddac5555ebbe4c3d8764512a6f8ecd3faacaffc8abc
-
Filesize
5.2MB
MD56fa88fcc45064b02867a8dbda42bbabb
SHA1eb5ce79d6469b0499860c4b26be23ecf42172083
SHA256ffacff621bd4f6a94564d779603605fbf855d1f8ad7d53a8e824d509a0bc4b3a
SHA512d469e4a724e32eb96840db6b1521bb900bf56175f677ef16f6628232925a5fc31f457990ce647d03d3f0d37da9e84486724535ed4ae128633d763b9e85573847
-
Filesize
5.2MB
MD576ec53f1142e8de9da0d3cdb5b6500ec
SHA108be381269486238a526f5cdef71d7d130150f2b
SHA256ece1975e3305d4dd3374f0c605be0eacf73d5cef01fa1c0066cba5ad2023511d
SHA512d41f072faab0db3f669e02b092552fa5d7b6b71e9f704a98d1e6e49e0cae8eff78f37323250e69d3138b4ae54d047b9adbedc365ab3770580c9568834d102cc9
-
Filesize
5.2MB
MD5eac15dee75fe4e4de438319fb240dec6
SHA15952d82867264e0ee23edd0961c9284266fd188a
SHA2561368b0f16932b295d6d9d8da7c9fbd6e960015bfaf98ba3d80770055e595fee1
SHA512f4dfffa3744fbfc17d26548c7f55ab3d585bd2724654f562169735269c846a5a105bf0b5017f5e884b566b5f64712930ff72ff584fe29286818004bd27fa8dbb
-
Filesize
5.2MB
MD50ed0ce41ba208815f472997e19f7774c
SHA1aef97edfee43ac0c7f22d38b3990b7b4d7fc06a0
SHA25673f91e3c42dc97d5fad147ca79637703e403afe6ed81523258ec5554e563344b
SHA512c2924b1acb566c93214854ae151e7a3fe6e746562a1e5297b3ed521b8914084503d394598d1c7282120f2ec4d55fab13daaf8e91b356747244a6c44bc71dab63
-
Filesize
5.2MB
MD5f9bbf2f2c68f90ac05a5aa0aed3e7ffd
SHA1db7594f836be941840a02cbaa9d254a5c702d711
SHA256b49361753f3c6bdffd25063e3c2bc3f36807c6d496d53f7927f762306d211253
SHA512b87e33acaf58b311721b2282b40c6acd7e7a3deff14c2c649da03d7fcf5e3e5a0d11d2ffb4990aac9c1807336a98a1e2f19c10fe45d1d2015a16e5bfc006b58f
-
Filesize
5.2MB
MD5be9a5ddc75b85be21ee35e732f1ff451
SHA1c028010e02c99d6687b9ee5928405b36625364cd
SHA256e111b2617f0b278080400f0b93b619b1e60c5222a64176fdaa96dd868730486e
SHA512ff6411e770a244d52788212033c3b49cc7e6b4b11b3fce5a339390922f76b33c4e8d2d5a41d9397119eb5c66b6eb31c85f502985b3bdfcc19e07ed0cf8704caa
-
Filesize
5.2MB
MD59e4bbe5c066c1cd3f5615fd1180ad7a4
SHA1362b9b2b97c5a21d854a4f3e0ad4096a22d5fb85
SHA256388d71713e828f5cf14b3e45ff44f1494190ff7654c18d2181393cebb543e0ef
SHA512c02a73379b3c8d166b835ad5c57009fc10ba9d94b07bfc04c82c6fc9f6fc804e83cf59ecdd53b6c68af165c382f43dadbbdacab7f9be345034a1eedc78b81bbf
-
Filesize
5.2MB
MD53bdb1f5ab2005d1167a1fdb5b3cac785
SHA17bfeed124bad3e2cab9face21027137063ae039f
SHA2565bd74907ce0fb389c29633387ee2ca983d2925a2bc0be22ac0320fff511a7d6f
SHA5126ee845f35f25d635beb67e9ac7916ca1fd84198344f6a9c6fbbefa3fa36b0f456310a6f89fc7a1654fd4ae6998c5a6d10f30ee3fde44663e3512319432c6e5c7
-
Filesize
5.2MB
MD5f99c3c202a3cbc626da66a63c540f6f2
SHA19d568dac1a999b42c7aa6b68fc58a43fd29a4ad7
SHA25664c9f32219bd04d4249ae12efefa1a2f40387775672533675928906adeada9c9
SHA512d0eb386bb81c29bca103293d93ffd456e1f7b5fc9a4d15f4e9e626600c28af7b117b9b7b5ca74974f444050694e403c8a7695d1a429b5e96e6bf597339c95697
-
Filesize
5.2MB
MD5b6194dc15ebf85206625a6b804d83279
SHA10ee67ed2f6b343942045f52eb5106cdda32215d1
SHA25690906942fdfe0eb7071651106cc563e3f287d65c62285aa53000a23f0b80f5f1
SHA512cf15df8c7a79806c121159222e2e311ca2b723f456640d40004494055624316a70097b8ad4be5fe1f9727efad05b56205064fee59d1d7db1757948ff59faf5c9
-
Filesize
5.2MB
MD5d5470450d5dcb0799239ebb1c7e614fd
SHA17020dbb9c34f503c28141b278e5b470fa51f7f73
SHA2563c733513830a5d9f54e9514bbfb9ba4af5b2a914828f377e7959a1c499ca722e
SHA512cadaa2846247f663752ee04ad1cd434e86f7a861b70d3022ec7f4c0a633af207c942f6a7d842423c425cd2218c13c4be05c3c344371fa74cce8e641a592e551a
-
Filesize
5.2MB
MD57a4ae5c8db2d3808802a7c037811010b
SHA1d62539884ab90f5e6c20bf354cf45eeb5a91a971
SHA25646a0bbfa77531be539c2b87cdc671d05acab9b947c3d017013453572eb533564
SHA51225a9c16a652e63e68ddee89e165e83253e86f60261fa47e2c12a174eea0e83117ed4af521b7968a2e6389ca3fd3933ea62bf26cea0d0da288d30963d8a985fe4
-
Filesize
5.2MB
MD5de59356a1837eb8958eae9b32c6a2959
SHA1e6abe760c1ec0043ab6cdf96dddec16ab6fa8bb8
SHA256f225c6ca5c48f5314e345a120f8e14b2314ebca3ea4530a1c52489d7b6867857
SHA5123fd203e583e5c04c8ed76d9023cb98feaf1cd1a0fc434b768cbe2ec1bbe77edb48ff0cc34137411f1f7ab16a464b48528c96a6eb8f2f685dac0d85036b0ebe68
-
Filesize
5.2MB
MD55394b20ebca7981acac1595d3767132e
SHA18638c760a58a29cbfb11dfdb3ba1c851e6f97ebf
SHA2565a7336c55f1e20fc838817268c9fec5c68a1c6e383ff99b3d815aa4474702be6
SHA512a99067070a3c00d5ccf1f6334513a1be9f3b63ec633f0d967dbb017ef4bffa945f082317b03cab1b060a9bf8a4c68fa61513d5a00059d9e8d71ef38a2586d6e7
-
Filesize
5.2MB
MD5ad985a5ffcda33d5de2dc1916fc7ab17
SHA1c330ba99b0cbbfa0b4eb68ce687e3d8d09fa2f3c
SHA2564cada73e90d987471d9d503d4fa7ccf69d4fba5c9dba46d91e347f759ad9738e
SHA5128a5201a3942192d3d402410c08c8b33bf5c9c4705039404cdc620dcd1d46e9b3eb77289e9d58dc71467305dfee057bf08125fec43a274b4dec075b27116f6025
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB