Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/12/2024, 07:47
General
-
Target
2024-12-12_7b7afdeecc5021404977de2618c3944a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
7b7afdeecc5021404977de2618c3944a
-
SHA1
b01a38316821e0ad45a8f3d6e098b119db663a2d
-
SHA256
109be621c47912815a91276f8cea72ffae1436a96474b4abc515110ce3878c3e
-
SHA512
88e11a869598e540aa1322e0804ef4166f9db4d38e44aec836c78fde5387d9d1989345ad87823695e73c732bf0113047e0527a436aa1070d04135c649e1af77f
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUd:E+b56utgpPF8u/7d
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 61 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_7b7afdeecc5021404977de2618c3944a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_7b7afdeecc5021404977de2618c3944a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\sadvanC.exeC:\Windows\System\sadvanC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ycpxcWO.exeC:\Windows\System\ycpxcWO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JUwHiJa.exeC:\Windows\System\JUwHiJa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LDuOrJv.exeC:\Windows\System\LDuOrJv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zlIZRjt.exeC:\Windows\System\zlIZRjt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VYZwoGM.exeC:\Windows\System\VYZwoGM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SLJNyxt.exeC:\Windows\System\SLJNyxt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KXAgxTo.exeC:\Windows\System\KXAgxTo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ieFWdCo.exeC:\Windows\System\ieFWdCo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QYKMgCY.exeC:\Windows\System\QYKMgCY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\APqBish.exeC:\Windows\System\APqBish.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MFmFycF.exeC:\Windows\System\MFmFycF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eLbuWNn.exeC:\Windows\System\eLbuWNn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mLyqnvT.exeC:\Windows\System\mLyqnvT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zcltwLS.exeC:\Windows\System\zcltwLS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BmUTgHn.exeC:\Windows\System\BmUTgHn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vQvRERi.exeC:\Windows\System\vQvRERi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PvPvZfn.exeC:\Windows\System\PvPvZfn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OFSzeNl.exeC:\Windows\System\OFSzeNl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DBgyQzc.exeC:\Windows\System\DBgyQzc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nxSepoB.exeC:\Windows\System\nxSepoB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD561fa293ee782feaa882f863bdd103483
SHA102bac584a795082f5b400d41a56edbbe58912d45
SHA25635c183a322705dc22724d99cbeefdb74cb31d79b1122a1a8f986b6e3aa8ddf74
SHA512c96721484c93c4ce04dad77423d1f829db4178ed22c05545cbe07f1977429c1926c5006c16c763783fd6972948752efc75261e67b7b497c97765e671ff6dc132
-
Filesize
5.9MB
MD59ad0d1e7d369f97181bec1a5ea9c44c5
SHA19507d1078cf1b55645fe66725689331ecd920785
SHA25677fad02819a0d7bb696b40467b6ad3c6ad94e43a8751ef2e27923ab8c19bdb13
SHA512abbc7e0dd73642c06790340fc32e784f10a9ef21140c6ef36052c0b65b8be17b8733b42ff39203e7a9df4e69cb50980a1fb9d71355785215ada7379a6471e33a
-
Filesize
5.9MB
MD5920bd88b63c4041ab4023025bfbab613
SHA158d2ae1591c28e1e005f9ffde4a4c800d0c91c61
SHA256d58aed719f4c7c2fe956c1d769ee8283c6c6b5c63e65b4191d744531e7ab85e6
SHA51259abf4bcdfb16bcf3f170bcd551b9b9cb4870007ae81e43956bdffda6035d3437cc83dd0a314b00fa6351502bde6687f9684fd21b70d28ea62d72ee1fd4fb4ed
-
Filesize
5.9MB
MD53021e091893452543532a5e5e71061f7
SHA1f73d24bc288d246d5fd8bad66d23093ebb2af075
SHA25623241bc1f38299c6e729190d349bb051507aa68d411c2b89f38944a4b4f1fc50
SHA51205b5c0066abb8ca7e77f8d1de741fd9c1698bc487a878de1e6408b5cf4a361537f75be0859e5544a2264103534a61dbfbd7f1fe60a6397386a2d153e5b7674db
-
Filesize
5.9MB
MD573888051dfdd5ff750f3f166ca42b9c0
SHA15baeabfab0322a0978c3a41ddd22918897dce11c
SHA256cb7658d4888d2be2859fbdbda81160123698395045d111af8d35a50d2b6b3eba
SHA512f3363e6ed94dd86bd0af121e6c7c40512da911eea0208fedcd36ccfffbbd94c2cd239a7edd31127b669fdae1b1fe076648971efde4a25fe1212c893a6114e312
-
Filesize
5.9MB
MD5f6c5035fedf316799d36f419ce869d3a
SHA1378c146047cea80f4abc750f2ce3d37893825b98
SHA256da3fc52db32f0a2a086fdc39c0cbaea8dba933ee6cbd21570496a2a2a3266522
SHA512748b8f71f3e2861f8566700042024bc2fa4bac7786897e8f1569cf702b7a4693c54f95533665050ea5bbec309a1539b55848c6dc4f512634c780f867166eddcf
-
Filesize
5.9MB
MD5c1ca04790f64ac7e8e79caa199485d4a
SHA1bddbff075ef8348397b39acdbe6efb6e8a698bc8
SHA25653cebce19ec99d5f80312f3e0b85dc539a54c92897c9eaec97b2b16e48017264
SHA5120220524d6f4749b723925743a9badd5965980b2df91b815811ccf7b7996a32b4a4c42415e6134bbba7d530ea29252fa034a9f391be394fe4dc7c6f6b6e682fdc
-
Filesize
5.9MB
MD57f1b0dbfc64aed91a677e92b14d9eb6d
SHA131dfb7b82f7b16118e83ed17e30e50ec6cfe74c7
SHA25687c4012e0231b84c57461ff65d3915d2de9c7888787bf1b4f11b60fb968f1420
SHA512909df24b3c4b732945bab0ef9ac401db3ec2efadcd4234fd0d0b79b3f9ce1feaed7601971969b4ae739b611de4c206aa5b10260ec97a9939b3526b951ffd4b13
-
Filesize
5.9MB
MD51ac031326e56c9a3361048af7eed70e5
SHA1ec1d5c72fa0943340dec3af931363677894f3737
SHA256440c7b2a3f92ce288bbd259415f866339435f8a271c8d63c61c6ec2830123fd7
SHA512ec21e0b4643409cdeff597f5bdd14326c92fc8d37c3c322bed2056c8356a00ce950d83c4bb13b353d06bd61e62ba041a08e3153cd5143f3db5adfd24f2a4f111
-
Filesize
5.9MB
MD5451626389dff50ad0bf25640f765ea89
SHA14c2c8f64f8f7cb903d47a29b4167d8893b81ee66
SHA25604e3eb30847d2a54c8d5986b99dca9adfe6137650eff4a525ea9869a6352408b
SHA5120786c483cb8261cf5f1eb02c09d175bdce5402b18d1929ee0b8f9c5d3dfc28ca29372087d4a4d1aa664347851aff10cdb17cec3c84d81e1c0e9d78ef06d7ca21
-
Filesize
5.9MB
MD5826833227f6c4c26c69e2fd4125bf699
SHA1a199f7dcd3aaccdd4ac1d2c87fc17f7182d8f157
SHA256e00f53f00596e76d52bd7b6a8096a16dfbbf6b6bd235d100e700f3f5f80eba00
SHA512f30fe68918cb9ada5b5ba523565ebac236dc1a368cb2293b62c2dca8da2467e622d9b786cfd4483e0e63e6a499ed8fa7451bcda874bfaf4108a3f93e3cab1581
-
Filesize
5.9MB
MD5bd42d3175ac31af97fb34354327a8b14
SHA1a12d0fddb00e077bb5ecdde28cc0fdfabf884e1a
SHA256b1dad30a66d9dedf0a5e9898025d17d5131115a7ce144e82554cf547603f434c
SHA5122d0ba51dd4216b784e5897f1a0daa2bbffb82e6f24539d490327fd0420efc7a55bc68dffc6840955e7ccb12c8c44824b2df93f267ef50a7e9e7966a5e67cd55c
-
Filesize
5.9MB
MD53ba8dcfa664628991ae0e33c545cdf7d
SHA1e4b7fe29dbf09231e8afc5891c253e4aa9bc47fe
SHA256bf3ee26ad860982d66245da83184a5eaf340d4151eefdc360b41de4bd0a9da6c
SHA51219e511bd46d932e9d7015e90d3464f9cf2a3ae6b31e4585c7154812e64ae166ad9858ec827699f2722763a6c41a70487e75ef4a6fc1b4adacb598afe75b7b029
-
Filesize
5.9MB
MD59832115b9a37036895202ee8be4e15f5
SHA1e55d42df4b1fb75a8c336ee021ab6bb3e4b2c8cc
SHA256853910ca399205e8c9315fbffee61c461d41df8e8ae8c509d3261512f5c8653a
SHA5120609320ecfd280092821d3936bd01fcd4e54e40402be12b105067f45676c94129645eea508857d679f4cf3416216a121dd5c7147076543110a5278eea4cef00c
-
Filesize
5.9MB
MD5667aba6483395490a86b1f188d9bbca6
SHA1c7ea2cbd08f62be9b89f44bc55cf5d0f01301e2b
SHA2565177650ed2dfeec02f53a7d2e31a664d2547f5dcb06d5601567b8baf41c21bde
SHA5126419645cd7cf0e994de3cb28d650c62df2fe5d31e785da3a3dd3eeba45c7d261471e4af9689fce1cf80c11a2f589ac090e5d037c31fa04fc4d94103467faf9f3
-
Filesize
5.9MB
MD5926823a5d030f8aa34ce84961f7e0be0
SHA1e752bf22489cc01f0875ed3354eddb75039221ff
SHA256e6de15d31dacd3f8cc9c3afd15c9cde76e7585ae786f2eaf06121c02b3bf7914
SHA5128728d1f14f138fb55feea149c2e12111c9e5efb2b5cbe4e086d56147acf11b30d4962f6aba640ef2358a29524f00476a5640cb9114b116147dcf59014eb0ff52
-
Filesize
5.9MB
MD5b94d6b4bb92dac1ac9bc7cd4da5060e8
SHA13fe9beb6416afa2ff3a7af7a5d5dca8eb444caf8
SHA256efa81a4548dae54e6616521b9961599ab63780f0853316c8c376f52fbcd410c7
SHA5123354dd9b8eae836cd651ea915622848a47d77d9432570d956d0a852b1cfe4bcb899148683356ccf08bd0e3c2fb21ab90734e7727d94a0b9b1e64d6339111ee32
-
Filesize
5.9MB
MD5521bbe067240cbd6505921dedc4d8ec9
SHA1558c1f27959ed593b8acf3fa3aece0c602616d31
SHA2561df3a22117b64b47bff66412d02cdbb852024f4f63fb474c9fae6f9eeac54dfd
SHA5120b645260de6cbdfef33e2f7e32d330b0506e978aed99fe27990f58fa4293d50d5261b6750eb849adafe609eb46e64cb1a9db735be75f1d206ccb49dc2dbceef0
-
Filesize
5.9MB
MD5f778f0f49c716de95fa5ccf4220d51a9
SHA12937c0bcefb549a74e7192c1078e76bb32ea42f0
SHA256f80f127a573f237092ef5241d431ca54f4ecc740cf982ec3303a9c98505d8562
SHA512fa6815818d6dab46828317808178a746eaac5449c5756c17c77db233a5864cbb6f6ec374beefc0c3ebc7c8180d2c25c92d583ffb1a7de7f0dcac4dfc7bab053a
-
Filesize
5.9MB
MD5533591fdfa8edeb6793bee89e7b95614
SHA1896dc9257247420d8a804377ad2360f3a0cbcac1
SHA256bd8dfe627b439ab04d9f2b04d060ec40a9b8df2036c13893d1d6c661fc421ca6
SHA5128138b5e25310f986b4ad7f3ef02c30b28924d2ee61f57cc26a6b2c7e9e43492e2eabc3c405788912a60638f4217873f23487e8e9aa298e4bc7194f5c1eda2d6b
-
Filesize
5.9MB
MD549354617adee8e64a77674d6199aa250
SHA1ddcf8c043a51b91fb9ce6400f09e4a822cccb80c
SHA2568e8d6f2ef40d59b3b1ac2ef97032fce073c47b2fe3da79940f7d2292686caf93
SHA512a84d9e8fa4039937d82b7270bf7d69c998f3e4579ebae633a0a28e7966f160cbeb09c7a7a1769526d4a6ba57584c18bb36b9ecce48ea9a935a2f9d2982c089c6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB