Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/12/2024, 07:45
General
-
Target
2024-12-12_4b57988bd5cb270ea671971356ee3fba_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
4b57988bd5cb270ea671971356ee3fba
-
SHA1
4ed507f4f5f0d0828b5aa43a88704a8c12423544
-
SHA256
4ed38df069e4dde3b0d43c6529b8cf12145ed533ab69764d73ebe727ab26f8ae
-
SHA512
b66ed40d2f96baa997abf1678e289c0785aa5c451a5ce6bbbf41bca2437a59e9168b6b1b88695f241197f72db4805871202ae2f3cf5d1c76096217c1e8110213
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUA:E+b56utgpPF8u/7A
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 58 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_4b57988bd5cb270ea671971356ee3fba_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_4b57988bd5cb270ea671971356ee3fba_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QDQSsZZ.exeC:\Windows\System\QDQSsZZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sJaOEpt.exeC:\Windows\System\sJaOEpt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZHQAywB.exeC:\Windows\System\ZHQAywB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aQgwWXb.exeC:\Windows\System\aQgwWXb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MVvzvcR.exeC:\Windows\System\MVvzvcR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nPhXPlG.exeC:\Windows\System\nPhXPlG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lgbaDxR.exeC:\Windows\System\lgbaDxR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\flpdYCG.exeC:\Windows\System\flpdYCG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QsbcdQA.exeC:\Windows\System\QsbcdQA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ByMERFG.exeC:\Windows\System\ByMERFG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kUeSwHt.exeC:\Windows\System\kUeSwHt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CcKEemB.exeC:\Windows\System\CcKEemB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uIrSBuw.exeC:\Windows\System\uIrSBuw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VuNGOix.exeC:\Windows\System\VuNGOix.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzMTNpe.exeC:\Windows\System\WzMTNpe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gNqwuxR.exeC:\Windows\System\gNqwuxR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ImCuNFV.exeC:\Windows\System\ImCuNFV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jckEHfg.exeC:\Windows\System\jckEHfg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IDmOPkd.exeC:\Windows\System\IDmOPkd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iXImLuk.exeC:\Windows\System\iXImLuk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bTVjIxu.exeC:\Windows\System\bTVjIxu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5b2453d3599c8b09b8e5074831ca33914
SHA11428937361a4ad2ab8e5602b5fe9036c93e9fcd7
SHA25656698f48d504b049fbd562c49abf8fc8adca89050551644dec388bc7397faa88
SHA5120ea21e4111fdb72b353aed2a8c8889844272912093bc2f315a45b6c6e8687f0a74f3f471169f32332e8c01e711602c553519104452a361673ca19a2457b922ee
-
Filesize
5.9MB
MD553aa1fb929e5affb7f8e686991f8acd6
SHA173a4ca966002c879a96dec9d0c17ebffbc383a8c
SHA256c8c9c958904cdcfdbfdb8c00a1ea144da328fcbb3a8d0facd4548c1f93478a01
SHA51253315511fdb00d3c5eb05f4a5cfaf50d89be7aeae15e8e8c1d5d61d4f245331414e0f85ae681ba4dedd1beda77c5bec7e045cee9bcaffd49b9fa4d30cc34cbc3
-
Filesize
5.9MB
MD5a3256f3996cc360f192c6dd1dd0a2903
SHA19d2154ea00323562c0ba534fdbdbcc8a30322c1b
SHA256893b8670f83c7447bffd5edd550ee2f01bc29c3e5df09807af299d27281f4300
SHA512bbfa1403499cebfb0f35cfe668e0b7beb794e033446850af3ed672ed04be194b21e52929b4ac9da834e069b82b3ea4751797ee9ef01daeff348ee758a9a006e6
-
Filesize
5.9MB
MD574903048d12c84254cc18dd83d214dce
SHA17d9ff832e3ee38080295010585c8bddad31e90a0
SHA2569611ac25e38911ccfe96ab2c76f5ed772f0926f35a77bae967bf0175b2302688
SHA512605ade1010ec38afafd7b32ebd295eac8334bfe40d1ca930f88e9ba07b655f83401afe98dfec2963eb7eb97b179d22667a18b2a7630a501fd3f2ef7aeea6dd5a
-
Filesize
5.9MB
MD5e9b69b455b6efc23224945cb2b12d88d
SHA16099fe5a828344ab5c4cc376e7593aed6d657300
SHA256c50b08d8df62d51473bf6191e50deeeeb8f7f81521090a16bd97cd784b841bde
SHA512f55e91a1b4ca666218a65c3e0dbbbfca47dc43d78f3991507c31a897ebd6741fd2fd2c7f8b3cc308822d4bafc8a8066493dafc40ed19033680a9bd7d59ebe257
-
Filesize
5.9MB
MD591cda031f3b1ee789bfa78f82f0ff2a7
SHA1b4312b28f889a40a95e9ab3e1c930ab2895aa788
SHA25609372180c6317475a73a8fe2d62db759dcb24cb384ca1626904373fe60463146
SHA512b7d5be32d2bc445cc30abd1515bbd07966b5e2a416fa828a6753c2aa5b108e65ab90e9925869d48e413e0eba41c45f2409a0be7ce2f19ba2e3e49f66b30e400e
-
Filesize
5.9MB
MD57617f9af9270064b426c600ef1732359
SHA1dea3e4ab9773f6af3e7171f677bdb7fb17db904a
SHA256888ee27382fda71b78651cfc644e19514d552969f920c9a2b7ab4420e4a08f78
SHA5123b865c321f167620b6e5a7a50488ef1384003283ee766e316682755f18bf6b234e4091e80f4cd3b2b13b2ad587746f09321686f7f8b3f59c064649d1d5b8e183
-
Filesize
5.9MB
MD55652d62ac2173324ca2f7acc10b70317
SHA1374a8b18a80c9c699f6b13456fae226b55e89c1e
SHA256d61d745b0d92120aaff2e1db7bfed0f14004b1d52fe5ecb1a7ab30fe85d77b19
SHA51257df5be9dce62cf4c2e4e3579834153280fc32a67b808acb9d9f9f85de61b3da95274cedb5e1028b48cd1bfb16cf7dce2a1dca8642883c3c7460eb2d33a03d01
-
Filesize
5.9MB
MD5795be66db5555c7a4935ed0e85e9e2f3
SHA1c452d4278f1dd7d7b92929202c4b1eba650858ae
SHA256a50b4ce14fd96553e42db4d69b3d6bdc73b10344d8b33dffe3c805322cf21501
SHA512198c4bef52b06587d805e8e88a7e52503aaee31c894b874a8948042b0e987d3c08291c8dac6adc25039f3906bc82623fc93647fd8123e0342eb3447823510a01
-
Filesize
5.9MB
MD525fd9ad4eb9f22d1c9e3e81c363de8b1
SHA12ec1d0a8e6008a17ed52b188965f0f25b42ec370
SHA256d1911bdafba5219069eff773fff612737d0aaf72de58366d38c63d769e70babe
SHA5124f98a314e824351279b946c2142f0dc075ea9f5d0c3f94928ceef2b537218eff06bd96883aec4f346b20a1d54a33ec58db1c2f58c044718bbee5b879edd303f0
-
Filesize
5.9MB
MD50a93ccc6b2b466284e6cc04e07116752
SHA1d44775d2558e247302a9ea6485d98729c274c3bd
SHA256a5362f3796db0bb167a6cf9de5bb87b80f961930596adfa986be054193f74da7
SHA512e59a7dd6713265a62e7856fa6fa43aad114d3f8659566d042ef6392d67b804b41c53d0e7390a68015037d0ee0ecd749441c44d2cb7f8bb079b7f9b72a068c3d0
-
Filesize
5.9MB
MD5f10b25546207e5925f69f30541560094
SHA1b00e3e3ccf44a177219130c886837d0c183af7c9
SHA256f98484dd7bdd050d9e0cdee6722fa04bd969b90dff2d82d78e080e5b79a6fa48
SHA5125e2505a7e95beadadbad1720e48d63abfb8b13ec45cd163453045121f999f5fa83a1e81196396b48e343f4bfab119369da5abd0acd0510e20750db17c2723918
-
Filesize
5.9MB
MD53763f3ca940fe7ee11086b13acc35cb8
SHA163bb29a62b9cbd6e6cae1c6177f5b1ccbf11b098
SHA2566a79743a72182957909f48cd954b0fbfb5fa6065091c41eef20ff6107f402612
SHA5123b2a10e471f5344c56f9648bb7e3c1ee8fb812f297651ab87f4a9308257e995403e8f7dcf0ce161423d72a6bb656c56a88cc7bf91c1cf3217638cc82b513a54a
-
Filesize
5.9MB
MD568fc7ae6ad041a943797bc864f6cede2
SHA10369f3acb7dad0cb9bcfaf614ba1f04039fe7405
SHA256f29304fa08cf802beea1b0804dd23171d185b9c1a61e8c35526e120d3d9ff59b
SHA512947ae0175d9004e10fc2e3d7a78bc9e62a89d1749e49c602a2d0f68a95a045072452d4bf29cd1d6e86ed6f191ea4255c1c03e8139cff69704399e8f6844ec927
-
Filesize
5.9MB
MD5466796e1355fb005dbbe3eb759b8f106
SHA176e5341b5ce2143d70998a6b5b32bbe4bfab5ed6
SHA256dc1c4660e06e756d88eeef0ef8393bfb535d3840335c2f3e12a469df69be5c85
SHA512c95db7d1808b63d3780fd2c4c40124a38c0619d1b5c8b4859a107f9a99c429e4eafaf6fa071bf709e056a78997e09fd77a11be8274d10d0465900ecfcb80da5c
-
Filesize
5.9MB
MD5810d541edeb2956a7c57410ef759bf6f
SHA1cb12741c240596f635536ed3b8017cd942f105ef
SHA2560fccaa37db92deeb755bfe0dc29832a60d499588eaa26c765b878f11ddb62e3b
SHA512fdc9e312b461da8a3046d7146f05afb1ec37e60b69ba03cc16ed9dcb12fed733d74ac65517594e71418ab074967611506d09644d26231092e8c7c0bd4c7cdc13
-
Filesize
5.9MB
MD5646189ecbbd03a2cde35116314b9da5d
SHA13ee62abd0861b236a4784317015365308d549620
SHA256d65a97760142bb2a83a9b78ec72f3534201ee92ad1dbf9fda265e63ed5ddf403
SHA512dea3dc8e8d183b2adb6f980f53d618fc6de157858524ebbadbe6c8eee4739d4c90451aa2e95045ac019a38ee0f71f8803fc47c226be5062ada1f805359544628
-
Filesize
5.9MB
MD5295e02a187b3b7b0f3581912a3a58ab2
SHA17875b731675f0e4f972684dc3b7587cd3fad21aa
SHA256cd795efc45d9653af185ba4c91fbbcbb370e2c7298261fa78a12906c7cd3aa6b
SHA5126e351f492a2df93ee6f57df55579d27060ee6e69d1bfcc4ac1a4fa1db5938d6a993403c965f05c1466a712b3d0987f4361396034520d8ab1258c35ac23e95f43
-
Filesize
5.9MB
MD54a02a8a9d92a48f43a4043e1e9fbe188
SHA16fd7d5647f75a19cc1ffc4ed6bd827e9a96320b8
SHA256173be0f2f1dfa00346665443922b92038edde7208feba5ac89c7fb9ba1a3f624
SHA512df9e85db69aad315ee090af6ba968ffe4f2ada59db83ab9d26f9538e888e8336556d71d41781eba5bee4674e20cafaa3afc0620ac7a705cce3cecc950e7fbd6a
-
Filesize
5.9MB
MD50eaf4a8a18cd06b26d3ccef57f846625
SHA1b12fedb11e77f1ab4d684fb988558ffdeef02d2e
SHA2566c92bce364e79b024968058cc32397f4fd7ea08d5c1970c62ced83effd7815fb
SHA5126a6bb2263b7ef101acee2e6cdd50aed1ffd3e62f0c7a78f81a6de18f8f0ffa9ad54b83ef19f101adc629ad517c87207a48c49a69e885023c7230cc02b7f1fef1
-
Filesize
5.9MB
MD51b9659ec8646b270cd5e213e24354ba8
SHA1a8796b3039497ed37e7e87a691ace5ef96791669
SHA256fdc6b70f48e6c5137d999dea879f92e73cb84f5fccf126db44a43d91c85d90e0
SHA5129145a80196f4d10817b94d89cd29ffbed22ad8b6a77b55dd7248568f8302229183c97e56f98a26a36d431fa524f6b8ed30d69c3836434edd0bed0ec639a56818
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB