Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/12/2024, 11:53
General
-
Target
2024-12-12_a5db4d1bd216e28713ed8a7bda8ce7b8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a5db4d1bd216e28713ed8a7bda8ce7b8
-
SHA1
21b91cf4daa744ca59984ab971fba39eb2a2a6d2
-
SHA256
261e08362e4a8aa8f2a0566cca0f243c04aaf3da528f8992ed6d60ee2d4ed68f
-
SHA512
0f62be2412faf1a6dda7dee8ed08b35ddca5573dd5eeb2d5dd1a891347502e6d427e650f284c4072b493c3b9b683872b0402818c273766e9e8fdac33dae45a18
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l1:RWWBibd56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_a5db4d1bd216e28713ed8a7bda8ce7b8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_a5db4d1bd216e28713ed8a7bda8ce7b8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lMqFOBT.exeC:\Windows\System\lMqFOBT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yrOFBRI.exeC:\Windows\System\yrOFBRI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PdMRWoi.exeC:\Windows\System\PdMRWoi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KccSJey.exeC:\Windows\System\KccSJey.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TGqXQWE.exeC:\Windows\System\TGqXQWE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xhCcnDk.exeC:\Windows\System\xhCcnDk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xDgLgPm.exeC:\Windows\System\xDgLgPm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uibqXiX.exeC:\Windows\System\uibqXiX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kuexUhU.exeC:\Windows\System\kuexUhU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ETnQMZi.exeC:\Windows\System\ETnQMZi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wzdSJfk.exeC:\Windows\System\wzdSJfk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aOgKVtz.exeC:\Windows\System\aOgKVtz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qlxkkTQ.exeC:\Windows\System\qlxkkTQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KnhMbCX.exeC:\Windows\System\KnhMbCX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FfXNFkb.exeC:\Windows\System\FfXNFkb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FheXiTn.exeC:\Windows\System\FheXiTn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iDYfccG.exeC:\Windows\System\iDYfccG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gZkZpSh.exeC:\Windows\System\gZkZpSh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PPMapSl.exeC:\Windows\System\PPMapSl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rDAnEvF.exeC:\Windows\System\rDAnEvF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DDHOplX.exeC:\Windows\System\DDHOplX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5162ee414cfbc105055de25eba187f9b5
SHA1bd6608daff9ec0ffb8d43459406b31fe747eeb6e
SHA2562834895397f4dff75c552c3aef1ac1f5301a0d43c54eb435617c174900c9ac04
SHA5129763c093a20136761850bce1e8c86d43377d4681296bc86c222e1e3f48aa3c5608e1e53327eeba6497212a5c1a379d1b77c1870d5a22f872228669fe18f2b277
-
Filesize
5.2MB
MD513092be8cda0bc556e8106fe048cdccf
SHA1520ab1430c526545036fbc00450f10b39a7223da
SHA256bb5a4ed48e15efdc5108f82b431f1d4d4f3347847ef126f237c42617d7eac34c
SHA512c370957ba60e2467f0a50e367a8dbac88f4cdc45a0967069491785bed4489eb60f1d66307320058fb7184aacc4ee339b500ec93df29b113c214975e1996fa034
-
Filesize
5.2MB
MD5ae22c209e0736126d417c0823cdeec82
SHA1e7bf6bc67fc1bb71dbdc4dbb5faafef2d56c64d1
SHA256997f5d40a8d839c8d8010e691f8373ae32ba923ee1af8aa828af8b0daf607c67
SHA512bf7c186127abe25a1a5596caf2b556057b18a4c9065dac6be091c5449264620c760ee7e67b8eda42675312ae4d09b8ea11c9a7ceba1b34d48d46c0a32e596b00
-
Filesize
5.2MB
MD51e7ef9d870f1a74376319bdf74401771
SHA19ab0347ab12cbba659309f759fe4fbe96548d2e2
SHA2561a2a87b0ccf33f5365470eb1b9336a6b08df46abf096026af0c6f63fb976639c
SHA51228483997ac7d968afd2e0831f677ab4f7ebeeee4d2a9377ed6a8cf5d00e903c7f0ca8c5f8da84e1ecfeb80af04a3405ee9a315aac123e53e7636ebc379705c0a
-
Filesize
5.2MB
MD567482bf0f7a0c66233905e2eac6b770c
SHA1d33795e0f2f415911ec896960b24a8e4eb714a6e
SHA256b221493d34880099492b7be3c04a50086c78f30a3dd14e300b99482b163adc8a
SHA5124aa3910b45036fe6c824a02a146d68169db37550c56c514de7303f0c5eacfb82371d875d36ae3651c2064ea9392f1aa5dbcbda96a669fb0774270e6dba59ebd6
-
Filesize
5.2MB
MD58bb429d522594efb3e0dac6108f8b393
SHA1d25393fbe312410ecb4b6cc7c524e7d7c52b2592
SHA25631d5303fa141edc71d77e5fa093cc92a28e972a02f2b319bc4fdf59c7f0d5a61
SHA51250d00a1dcb9bf646a0c7b399a81ce8c8a4653ff90c3b50f102f4aff3800358ddbca390c7b47ecbfaaf19a378b3cc7040e635f610a056a4ed32cb673522a255b3
-
Filesize
5.2MB
MD58a3e186c09c7efde1963eeae21794230
SHA161f9673ef6b21173909e23df2123ba3288adb81a
SHA25614412df7684ac1fd58acf6003cef573381555f7266484dd12e34b24757356c83
SHA512352b86aad6a54d32a030453a173a4cf73863fcffbd1f39cd80f5d9d894c42527006f2161f44978b730cbee1ede4de725a06e36e3d916d24c8b6dd65787cf0d8a
-
Filesize
5.2MB
MD551dfa077e59c80f6bac98d7e6c5cacd8
SHA1eaf4861b3ca32eb3a4de8fb69fbc520c8f7354d4
SHA256b02e50b8ebb0c1c88509559dfe677fc7f31053dd5902b8f761c3a7825a45fa24
SHA512142d84685fd24e26dbb917d8d85e881c555babed4be0f3ffd10371bb5b245bff6b615d689297a0d92990a26b72e65a07b64a6ce173f81bed0710ef19a6e2a507
-
Filesize
5.2MB
MD5bb7d0f644c58f329ab6f1e3c6dd23476
SHA15094802c1c9fec87868d5f1939f55cced479ca68
SHA2562a86aa802ef3a4336073b1da0f72e758a4d0d95d37ad1ec25975078ace3e66b4
SHA51213566cbe7079099b98fc23c118a792b72c96f1448e39f009c2416a2de99bd2daea353ca092cdc900eff3b183bf5aa60f9f551a70b4d447d6ae08b89d4af5f902
-
Filesize
5.2MB
MD53739b9329acc70e80e731e4a17b0e127
SHA1191a3053f741a2ecdfb84c9e33d71eb181cf9964
SHA2565fa4360d73cced5c3f93840489e109f58dba77294b144bc89459e772b4e8b704
SHA512dbf09f2507dc896ffa3daf344a9facd0c99def3ddf5596e094b71875abb13050b0dc3a5916e2642cb4facee0821cb457172ac2d8bf452209af99a856258d744d
-
Filesize
5.2MB
MD52277ba2023d59b5cf35cd7d0ce292f9f
SHA1e8b6723a5f01d455d4c777c857f9e34990bbeef1
SHA25643ef6ddc708f1746e2d6e659bde2d39f264e40ca217de0bcedb548859da44c89
SHA512be32c5c82cdaf7ea42955e428e7709b4dcf9d6a24dea48cd85f9715d3d5d045a84bd497a54b01c3a28d0fc429452092e64dc909b3fc110c92c2cf9cc064a07a9
-
Filesize
5.2MB
MD5367108eb563aa0e11abea1aedec9176c
SHA1d90293ca668c94c12292f285d152bf39515031ba
SHA256796a345e2b8e1dd8d6122df40e1f8589957bb2946731d9e9b8fbdc11c2b9d669
SHA512004db041e35d373221bb2d9f8c20578f08c42c01a0884d5b57a20f04aeb41f0fc212f26c095eb1f572d826473e6e74576bfcf659007ab4164fb351f9c25a0980
-
Filesize
5.2MB
MD501d972120d77212d9b280044b1dc7260
SHA17dc0139311dcf43601de1bbb71e3881dba404dd1
SHA256e75a3482a20b9b02f597dc505700546d650b0577320d8f77dba100dbde3a06e7
SHA5122b56591b06f7d2d03754704df684819833ab683cc95f02ab540411e1a3fb44e3f6de161d1e5a01bbcdf0b295edfb8cae3a7da49238a1fde3ca1d0e89c878464b
-
Filesize
5.2MB
MD5185f86a8472df0abc75f91d6d92ee1d5
SHA198f6123b9c1d2043790ddd2eca67af384a7f11ac
SHA2568b81e9c53a12466741fab382e18ea0ffba575dfcc524a11d40f86d8d846494d4
SHA5121d492516a4523376a53ddc5de04cda55bcfe7628569b88d482a5dab42a9049318316c70b41a1d80ff6d8fb134927d92fc986947f4536870084086af87a962ce2
-
Filesize
5.2MB
MD56595ba63255228957859a9e2dfe5fa6f
SHA15deef52d860fe31950ca51b9e0182d61ecb677a5
SHA2564a6e37913cbaba051be5d6f2e5ba10e663190a07f1b88b3bd82b298b977d3673
SHA51246add451484a3f6b8aa5d9dc1afe7cd5c941bd56347f62e4cbd6968844458514feda4a490d1798616cb698437970c6e4710b77671a3f4a9e3d37fd4106bcbdc2
-
Filesize
5.2MB
MD5f0a663285cd9f57efb93bb16409a43bf
SHA18e350eb34919aa0866f1ad44d8d32f7c88d8a585
SHA256b28255f6ff3547a281344704c407ee4bdbd3445b9a1a2125470836cd3bdcf3a9
SHA512fb8d5d58ed7477b14b32a0a24e874be113cc7325ace4f04496e4c8025c703b9634232d43980e1c432fe2e5051ed99ce68212cb3f89a90d0585c7b5ba35059698
-
Filesize
5.2MB
MD52b431dcf29477f1bd50ce7f203ebb5e2
SHA1786764a8f08303ce6a54da1ea117876e93c2b441
SHA256423fcac60d6c8b87513ad9aed3f27f33b019e66841089a760511421ccdec73a4
SHA512075de9dc4e835ef2c9006da4c75b0646c56bad2791ba3a2f33e2fe0c52a279ec7b59a3e0e7dfee02ee9bd8debf38f5674988d508d762e3aa740bb50c28526ebb
-
Filesize
5.2MB
MD5f982e0bd450df97423c81e133b09a771
SHA1aac81827fe099fc70eab3feb7378ed9c5f66baee
SHA256fab0366929d01d3ba54e5381a8cebaf55a8d16aac672ae40072eae52195e8a27
SHA512d6b47b06a65ca5c20d7c8fee764dcab3c410358738928ae5151d5861ac7b3733a64fc3797258cce8983d5e160176f237d014b5f994e32ad2c0054efb2e05cbca
-
Filesize
5.2MB
MD55ae2ef0a372e07b9ead2ab1e34138007
SHA15407a0a89c1ed67e7af290ea592328a9c3ac66ef
SHA256e700130c5d200c5d6e3f2f238cf1ce6df247a0267b1f4e6675f187fcfcfdd907
SHA51283813dc16a818200f8b7724e13db4c180ac9a202ccc0a3507b7c49a747ce339d62ea12c95eae8aa181aad5e1a8ce2c65ea1b6e6dbfd9730ed7ce172fea2c90e7
-
Filesize
5.2MB
MD5d33ddc16e9dcfeff042317d68987a6c9
SHA103aced6a57be9c213228f50fb2d6f7fb1754927a
SHA2567642bc131368a0e1e608cfc8c966c194a9960b3c4a40054509bb7ed6535dce7a
SHA512b5c97dceb0701434a6de3fd8d6bccdb2bfe532375a6974be1007a2da45ed56d2bcf1e0f0dcbf04569e5dd11ebbd0699327fcb786a3967fbf2661a1896c194037
-
Filesize
5.2MB
MD5055e8a593fc9bcdebdc949474fd5761c
SHA12feb47154a58ebc72d5c497c61282adfaedacc9c
SHA2564e427a130d724163d87d406a9544d149f968d75dc3247db72911610047448994
SHA512d6db23850dc24267c86be66bffb272f383e23b07d1e3a3562beefdb750e0c339ee4af43eab1eaf0bb3174d4d315a479daefd16f869f556c0d625dd6013eb2bb3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB