Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11/12/2024, 15:34
General
-
Target
2024-12-11_51b819bf8ed9ac93dee53ab6b9d2e44b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
51b819bf8ed9ac93dee53ab6b9d2e44b
-
SHA1
140fff7662a62a765001fb8be8b1a4bbb698be35
-
SHA256
ad8beebdbfde9ead13b0cc94c4de44f3c59b3bbca8d8e299f3dfad88ed8addd7
-
SHA512
c02827c440bd245b44ba7c426d23963cd30e6751093f85bb438dbe46566323dcecbecbb17f95a8749d1550c412522d1563fec6c87fe59cd8ace4dce56cb34605
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUf:E+b56utgpPF8u/7f
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 62 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-11_51b819bf8ed9ac93dee53ab6b9d2e44b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-11_51b819bf8ed9ac93dee53ab6b9d2e44b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\EVJKQJT.exeC:\Windows\System\EVJKQJT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sOFwdnd.exeC:\Windows\System\sOFwdnd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jAYgczB.exeC:\Windows\System\jAYgczB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ObGtEYN.exeC:\Windows\System\ObGtEYN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gycyKQU.exeC:\Windows\System\gycyKQU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YnIprIm.exeC:\Windows\System\YnIprIm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FxJSMXi.exeC:\Windows\System\FxJSMXi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EacVEdC.exeC:\Windows\System\EacVEdC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rGrhkSG.exeC:\Windows\System\rGrhkSG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wHljFbu.exeC:\Windows\System\wHljFbu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WwtxJgJ.exeC:\Windows\System\WwtxJgJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xXpVgXo.exeC:\Windows\System\xXpVgXo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dBigoai.exeC:\Windows\System\dBigoai.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tslrVRT.exeC:\Windows\System\tslrVRT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DAVEntg.exeC:\Windows\System\DAVEntg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LyTqxrS.exeC:\Windows\System\LyTqxrS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nkglhTF.exeC:\Windows\System\nkglhTF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DZnCuqZ.exeC:\Windows\System\DZnCuqZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LNhSLkA.exeC:\Windows\System\LNhSLkA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DdvBBWj.exeC:\Windows\System\DdvBBWj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HefpmjC.exeC:\Windows\System\HefpmjC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5164cc81ac5191679a5c8d3dfdb17794e
SHA101e9dd2e76b2cde27f0ec94ba66165d26c3ecbb8
SHA256ce2e81b5dc183c815f250c0064eb2b5fb39177366544e38529a75545bc18675c
SHA5128c1930f32de4decf043f31464c4ecd8d2aa9ace519600e41290266dca84c909980d5900540099622c642745d5a233b84744d86f290f80da91b1522ed095b4808
-
Filesize
5.9MB
MD5005b880256373500f9a91df83dfad018
SHA1e04694de9b72d2bcc2f2a8feffea44aa8898afeb
SHA2564d5d3fbfc886f93ed120bd95374ceb4cb109901b016c571a6018cecf148edf09
SHA512612cd8e5ff5dde14ffcf93d7e3c75172f79a0b38e7983ce0f0a2b69007bf4a323e0d8b55dba79ff873c68aad27a1b8193acb2f8d2b780c36dc6b5e8a0cf1a19c
-
Filesize
5.9MB
MD545fed83a5d7d499eeff84397600dd7e2
SHA16144bc54e8f5aef22932a60096c6c5d026f0db5a
SHA256b8e9a369b656bdfc611a70f6f3a1732e42535d56293f94253fa65f5bb072cab4
SHA51222d61f06d31bd0e4a1fb25a9edeabfd2653b8c154786b61d1d9b366b23c8cec2ac0136126d4fe89df6ef754a5eb10fe3bb11d4bfda3e3ebfb70fa5e1c7a71a2e
-
Filesize
5.9MB
MD538d63c4ac5f70abcba3283af6ce152d2
SHA103b853e85bb963e56bf6d66c3d5c0c862cdb32d9
SHA256ff18d8dd3dcf5dfc13ba3f865751016fa386b5d9816c5b235016c052f0c60f8c
SHA512afcd6b0088fe5c97953e3eba5e3c5edb0b7e938568c38bab5460b68400c09677b4e142494458053d5244375773e2eff3f73448e65890e9a84fd665348a5d4506
-
Filesize
5.9MB
MD511d14da428ac84c752b28d75ab3a0084
SHA1d1025ab11368db7b26e2edbcf4861b88b9fe72fe
SHA256cc623ee09da26b2dede4fac71a13796cac0cbdfa88aab7a17d1caa9dea046771
SHA5121822a423f1ecc615718c7266db48cf52ba9e8e9645dff256ef2985ead12a09cd10fc71b3d6af161a608e0d4007c4a9505bb8f839f5bcaebe211c0eb940db23cc
-
Filesize
5.9MB
MD5f1a58ac341b51be1e00cd6530e7d07cf
SHA18d9a50e81ece4ff9dbe6b4e42eeb7a6fdeb3c4d9
SHA2567f3be1a6b4ece6c2ce79d888cea5b400bf13d77ecc0d7fca4fc89426ddba893e
SHA512275875dba0d5c42ab8278573f97be98c9bcbadb81e9c12b5a665a957eff332a43b63165866a99d46f2da5b5b9f166c195b4ce203452babe43747e41c8b4f0aee
-
Filesize
5.9MB
MD583e22259df638ae8894622e8f89cbc79
SHA14f62746fb3b45ab1d27eac8a78f5a91992cf98eb
SHA25662366cd3467ee0e772840a890ffea38aa18f32001456e1d606e3cbd6bfa2250f
SHA5128c9ca0bf856bdcc4cf3d6cbea121e044a22e18d4a7f5840d0572929c80d7ac11e0983c0e788e90572d01ca5fae44885abd3e5a3603d942ed84e227e650497f4e
-
Filesize
5.9MB
MD5a1e42a97ea188c9c016b8d02acab71fb
SHA1649eeb988849a418cb1dcb986081e5f750959fbf
SHA25668771922c1b7c76f01eea9bf601085d5408aad1131850fb683ef4393de854348
SHA512a3236169485cb110e3e1721cea430b6c68ed6c0f04a9545027a092e26ed5c8e742b05ae18999c76a2c0f4556c4fc64fd421b6753d354668aa38a333d187c238b
-
Filesize
5.9MB
MD53465b38bc10937423fe37fe08207a362
SHA1d5e8f1a99f0275a173d3a86b43ac7293d9836cf7
SHA2566551b8f273689e6129b04498fa43f353cd017d5ef4b3f6455d815a6378dbd947
SHA512d60a5b09904808dbbff92d76bfb1d419fb1757905afff77064dba812264d6809cc71cf353bbfa3b048fa70a961a3532f1392358c58ca1b862b3fc637608f9f65
-
Filesize
5.9MB
MD5706ad92e9f8c07d829b52834ab8984a3
SHA15031232e4f0821e5bcbfa21888560477e9d29d7e
SHA256fc8761dbc00cd69743cf69404a2b7ba3ece6abdc1927c0ff223e94d1cf386a0e
SHA512f2ff83ee53c1331608809460eed5dee16171bb4efcf2d4db0d45908771fae9af0e1c5405df5e01352be97d12813ec217da1ace3c74d001efad0cce8d5ae03a32
-
Filesize
5.9MB
MD5c3c04af2e7de9e0bc3066f5f4c4b75a7
SHA1c9449f4f31a8dc88fd4bf661415479b5f79bd831
SHA256d7a13ae8b9628521cc9f2e0fcf8dbefbf2227afe649f5767ab33d66bcd44f71a
SHA512b8a4a2b94e2ae46a0efe2fae2c0c022cf472e05b55f720eb58f1cd3f6f376b917713c288d26ddb2edcc15e955499860bf3b91bf69e5d92c6ab5aab78b193afb0
-
Filesize
5.9MB
MD54277c54ebc7f6dc3112d8372386ddf87
SHA1e2a6db76982920c592d77e1f466211fe6f2c5404
SHA256cd1719f10ccca6f27b9c49b5f9fe93c7ac3a1dc779e9b8c3c19d550cf35a832b
SHA512ba0dcd6a312b83ec6de4655c1187f152fff7fa106d64af8fb29830b04290397dad0552a938ac9d27dfeede848c41abd9e4fbed59258d045caa84be5ee98f8c47
-
Filesize
5.9MB
MD57b96661826e1abc9f7edd3848da07f4d
SHA1a364a70aed2d853b540d1ba43f76979b82eddccd
SHA256dea9ac24dc1f601fecace5c24263b75d6c7c8dc42280db0b33d2c42506306cf6
SHA51231357f84258b9849db9b49d8ed68ffce2e339dba01805740f6d8bfd98a3ee31e840ecc0936d100b0d5abc6050790a5d7176d334878d92f9c0fe0576357194a48
-
Filesize
5.9MB
MD51397882c6536eea177e2f4e7081e9ce8
SHA1eb99392bc25ff4a7e7d267270715a34819cad76f
SHA2569a04af156abb490be77f6dc78cabdb35b7b88d983b95a7146f70d5eccd79f7bc
SHA512e98253de4b3ee078b299848aa5f093d5804d19e1f59a78721b88dcd81e201363f0a0d6469d35ecbac108ca92d204350cf8cea545ea40aa313e8896c6a5df5977
-
Filesize
5.9MB
MD57fc75522f5a6aec5cf8f1455623cfcbc
SHA163c5969e7eeda71bf66b8f49a6fc4b67cab76c94
SHA256a077f4665586cff55a3f006590a8370bfed24a6567b7b96834a28c0a3f80d297
SHA5125d0fa63654f92f232cb51030fa7a7551a462b20502d42e806ec11116e0abf0223142846e3751826d5368e7e6ae0666e63bfdf5b36bd518017f8c3ee11f4b618a
-
Filesize
5.9MB
MD5f1f755261ddd76785dd59028db0b96fe
SHA1aad39455b519d3c617c8b650f91369a48639dc1f
SHA2562cbd25e929170634944ade4fb46d8a935547f4e8b930d8aeecc66f3bdc2f802f
SHA512504a4cb6869c43d323363b97c6ccc5290fd341a5fc8e83e1f09c44a62960af7fe693d2bd0239964415282075b2e3602c7567b0bd1124e35e0fce03242c91a0f5
-
Filesize
5.9MB
MD5c1a35829a84b2eec89709c62e616384a
SHA191ebf45add72db641a8c67a939529468f1fd5a78
SHA256ad026fd46fd375b5173a40aa0ff2466b98fee691dd97ad3f0bec3ec9416b9289
SHA51230f593a4c69b2aa0add341b2ee5179f65c6c7f2c6e5dd000f98a29ebf06fae391b3c9b56ede7be7867415649601afe1b862cb5f33c44773d17f987afa5c48489
-
Filesize
5.9MB
MD5e75ac1c5f0f02320096e211e55ab9a68
SHA15f278b2f51e6dfbd45889b52aa3670553d8897fa
SHA256470a3c35adf3ea886fbe797fc931b952173adfa95ec713d8c03e7194e376e7ab
SHA51232bba07c6ebd908f84357f31dd57764f02c389b3e8ada22175b97b7a826c34a60673faa4665bf2b852c724839af3a0d97537e5edc69f1e8180ac18e381629938
-
Filesize
5.9MB
MD53e39c9735b86385d5f86c7ba09f42675
SHA13613a70582b90bbd1dee4000a61db7117a37e461
SHA25680cf8cae2c0218fd136946948f5d202978df5c2c807cdee9236d696c8b6714e1
SHA512982e58468c674a8bec270e10a9bd6b47c48a1ba981b5044caac04f6730885a6fa62309790e7f7e87e8b5c134effe58d22055e5af598a5e66a2667ec9a042bce7
-
Filesize
5.9MB
MD5c6e00db74b8c27a234b2c876a4d1bef7
SHA1354748c2b9990dcdf54b6b69b3d2198ab741d7a2
SHA256891366a2a6c0ace4a976fe91ba08acbdc586c268c717dfa689c49f4513916c51
SHA51263ea00e2f1e19f886b26118172a2031ca1c17b77502d43dd31b76f86210dd784436d45e6c0b0d9bff9fcef81ad46965e5be062a0fb4f10323c08fe18eb64e0c0
-
Filesize
5.9MB
MD55124fc8960181202199742e05cae7c3a
SHA17f819eb495f6af35c0bb231ec7d232c59059bc55
SHA25622520faa8b12b909cb09ba07be1f9ca36bbbc21cc6c687f7e56171a1a3d1d2b9
SHA512cd68a3123ad62c19dd97f9bb020df47aa218de364e0192928e82bedfc78dfb6ef43b1d461f5ede4699fe8e4d30a904d93dc30e696053148f8d067a5057835cac
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB