Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/12/2024, 11:44
General
-
Target
2024-12-12_0551e7f97d5af20dece6a98fd28b539f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0551e7f97d5af20dece6a98fd28b539f
-
SHA1
3e3ec6d70e189e665a6f88317b65138cfb8ff97a
-
SHA256
1df6c4642d0a301ed01cd1a718f07febe3586017a1f314da313d5820ce023510
-
SHA512
f8ca16ce9ac58d8019d9b4faaf8d7a3ffb56b1499e903be13e6c4b5473c8549ad1a12d747182c0296386d02c9c5ee634789d3e8380b5846e3b166a3b3a6144e9
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibd56utgpPFotBER/mQ32lUK
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_0551e7f97d5af20dece6a98fd28b539f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_0551e7f97d5af20dece6a98fd28b539f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mVjvUtU.exeC:\Windows\System\mVjvUtU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\usycbxx.exeC:\Windows\System\usycbxx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jXFrCpq.exeC:\Windows\System\jXFrCpq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\riRUJqJ.exeC:\Windows\System\riRUJqJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GShyUVU.exeC:\Windows\System\GShyUVU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XOkDNgt.exeC:\Windows\System\XOkDNgt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LKgEpEM.exeC:\Windows\System\LKgEpEM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qneLWbg.exeC:\Windows\System\qneLWbg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VrioVZq.exeC:\Windows\System\VrioVZq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzWhChk.exeC:\Windows\System\WzWhChk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XZEWAHq.exeC:\Windows\System\XZEWAHq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xBadWjf.exeC:\Windows\System\xBadWjf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JlHPNuR.exeC:\Windows\System\JlHPNuR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EVqUPnF.exeC:\Windows\System\EVqUPnF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XjUscJc.exeC:\Windows\System\XjUscJc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DJlmFsF.exeC:\Windows\System\DJlmFsF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QEbgJdW.exeC:\Windows\System\QEbgJdW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\buayhPz.exeC:\Windows\System\buayhPz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VUDRuZk.exeC:\Windows\System\VUDRuZk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rqYxndR.exeC:\Windows\System\rqYxndR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VkRmAkf.exeC:\Windows\System\VkRmAkf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5cf27f722de24764755d47c807901bc14
SHA1d69d4ff2c3700302b109737f2bfc11de028a96c8
SHA256e6f6736079cfe53a53e1679bbc94ab53859c26d3465abdebaaa23ea9f6ab7d04
SHA512e28e30180ee13910dcce1f4319773b92e9a4e48470813b5ad98cda7f548bef7bcf783297abf82ac4a1177063ffc9869a6fed52d6f614eb5a1f988efcd6aca597
-
Filesize
5.2MB
MD551c86ccc430fc82f8f56e731edf0349d
SHA101dd2d4e37bada17c5afaffaa059898091db5160
SHA256ba4191aea040be40c5e1f7ecf43030f72eddf55f750ed880397aec65ae1f99c5
SHA512bdb13075ca262b61e23809cfc884a4d6ecc2082f05142bb4f25c819d7fcd4cd1d5142a66e4eba1c07f8fba7a486e1f8da0e697ca0a464e855c817d6326d0c923
-
Filesize
5.2MB
MD5d1d6dc98a8303f7e92b9eba70037b664
SHA15e759db60c358e4ff0d027913955544793fdfd98
SHA2564ebff290c81eb38d6d28696322c21fce245be20c4eac98968a6b90f2117c43f4
SHA5126c1a0c73904245f1f5a84ac5fb200f38ab54b240bf216575d5fa46cab64b26c657d8e84b9dee4d2145320777df0cc0a21db753fdd9c4cd8b785f9861a570558f
-
Filesize
5.2MB
MD58b1abf313ec85873005c3d53f6772ce7
SHA13aa9c7f04a6e8eb6a6eb7ec62bf8ad7a96fe1099
SHA256df7cce768d23cb2e1190743388bd5fa6fc9e92ce53b5eef33c4f2354a7bd542f
SHA5129f5aa332efa1ce3a18a6379f71623f4d1537d9cc32e2fdfcecef0b8f3a9cc5c29caa2c1728d19969e91aa7d1664b2775df33486aa388561f97a23ef7e3a1d962
-
Filesize
5.2MB
MD5d955557626f1b7fa6d7903dc58a23810
SHA1d68fb59c3592ae2dd1fdd8bd1d4f0441d5a57015
SHA256b3c1694b8d85619ccddd70b6dad2cacb2b4ef9c7c7280990ceb8ba09fde37be5
SHA5123b7cec7775469e91ee625552260f18a106901fac45e0b8022e0bc3a21f280e662b5deac7c551ca1eca896ab5435436180ac5cb1f30c0163464252e8ece93b215
-
Filesize
5.2MB
MD5d14cafe56b9054d12eaea7bfe8ad34c2
SHA1fb14b8eb26b65d10c6d9eec169276a9b90d7dbb8
SHA256f502f98d0bc521a2f19b6b15e9acd1c6b6700a8152ba33b0113537789a903422
SHA512e1ab59d63797eb3f4c22db4716337a084718981559c833c6cea28e971c8c41dcbb411ccf50d5fd32c883310c4904eb6105489ebb8b02b46931f152b9add9404c
-
Filesize
5.2MB
MD5b33270afd2f38a5a494405d291355a32
SHA1f2cb118ade861259b7c699a89ed814bf91290af5
SHA2560948726f8e389f76e11561aa782ae345c0f5f44abf192997185decd8668d64fb
SHA512195d686078276f1b741db0602ffb512d079e8a65c0affa7b00eebb7abe9c4fe1dab2f58de471d68ea2c2b3d308329c953a68949e35df62f053f77690ff735cb1
-
Filesize
5.2MB
MD5cea7bf40bfec7ce918ccb09e10776898
SHA1d0840bbec0cc3270d395bbaf0eab44c78b675ac0
SHA2568ec979d4c2a058c63f4b011b830c6b85324c5ff8a32c136fb51de77d4bf4586e
SHA512f0924b5e5da1d2f86dd4174f151a9e2debd195dc7ee53fa6371ccdb12e165b7603b7376a8cf1245127dfb03903dc71bca562916424895c3544c1f5b5fdbfeee1
-
Filesize
5.2MB
MD529a1beec150d9e7d57cb2de9247410c1
SHA1aea6a1d833ad0a0c307f52283231ae0d2b72e1d3
SHA256c621069a9a28774275453939d3b0ff11587d56a637e0797529498bbc744d9d21
SHA5122e321aee9606c492dd7e206d11e0d866e6e9c6eb073ab70bd79c23edbb2f315899b666b90f361fb7b587e076052a5422007dd9250f07d25457e751cfaef60fa7
-
Filesize
5.2MB
MD52255175a05b3cfe35d55caf82c1efde6
SHA1626ffb604246cc552a61c65eb4a89f0ef5c2a1ea
SHA256ac8a76f3fce438d6a699276c87319d7b10ac0b11a59ee1f562f924bff74c976a
SHA51277ed39ccd88ed53297f69ffe3e095ff8dc0e17d48ae5481888a2cca717807d980e411880cd53949ed20c3ac0d873791f8e20d04949052b207f9f00630024cf2d
-
Filesize
5.2MB
MD53e0cc9f9eb52ecce61975efeed2bb0cb
SHA16c28a0b229ffc5ca3f4bd0ca8d9f5bf96ae2ab26
SHA256bd7858fd9f18e7d7e65af70c7b17f8c48ddfb69a5cac30ccb7e9a46076d3a5d6
SHA51282693d9480c4eb47273ec3f15d79137e8c8f9a85bd015e86c4117801c34bfeaabde1d1460dd50eefea44893e8b8dd15e651eed1ff1290a8eb299947b84c3bcfc
-
Filesize
5.2MB
MD5e0a12cd293931e84da17d88ca279c922
SHA13c8c6f2346034c9d0e5ce04c969e2e2d9489adf0
SHA2568fe7cfa9c3bf11e5ec28d7227a66e1cf385833432ae6944c1942c8dce7a35241
SHA512b922a79a84a88bea2b4f9af0141aa113a46c066370e35f9302eb72947b793d6650b5221a3f1c4658c863a9a7b87fe9fb15572b8be5ff8ed8021b1588a6c2ad91
-
Filesize
5.2MB
MD58b0334dd3362e2a7cf974dbba359152d
SHA15141983726c7005ee68d891ba6698880ffdb9500
SHA256030d734833c9ad9e0ea2810741f76432fa1d1da55f88f99e68a37d3bee137c84
SHA512ed0884c8f4eee8b97c666a6981a13eb0ca438dcf3c1d982233d0a2e4f3da1cb995e6bc73fec557f9784cee1c188be036be2f7daa0d12540339027a2131d30cf1
-
Filesize
5.2MB
MD5252683b77a0d1da636b6e734a673f97a
SHA16094633f67f4638434ddfcee921843a468fd42e2
SHA256dc2291f4ddf381cbf2596fce3fd625e409d20d6782b0bbe40c691007729f8d75
SHA512eadff128049068545bfcd481c199a5779d6ac8abda612a0906b486dfea6410774798b1b15d82f552d5a21680b2eb8e9bdd8a4e7d601234b250ab1a8b748f820c
-
Filesize
5.2MB
MD579d69b9e1e12b8ab019aff95516ea6c9
SHA16e26d2ad254b05893a759981e7f01ad73eb6a980
SHA25650cc9ae7fec1e635afc02147fd2eaf1b659dde2770c5074e925e2930e1027513
SHA512258c8513997d4b3f3af7b11d103cc84e79d7c96d39c48ffdf5caa76b262aa34ce9e4f363f44857bf490f76aa1b81b7262796a314de6281c5f3e83ab82b65231d
-
Filesize
5.2MB
MD595f26c594039c66382af46062c82d6bb
SHA178f6ee44230910271ba3e0a98abc2d9e2f53d14b
SHA256b8b9e99cbec8e16ccde5e00b7414af7a836d46edad9db07d0b08982b0a034c21
SHA512f75cadbeeeeb8ca3f9e137cdcf4aac0246b71220fffe542a0b9ff1757cd50453ada70e0bce0990358384a4946e74e004dab06c9447401ad167919c21147f6ee4
-
Filesize
5.2MB
MD5fd005ac9b1b092299b4249aa37cbde77
SHA1238ae07b7a51fac2add104263108031be4d3a1c4
SHA25669b62ff84eef572839bf2ce3a5b59dce71c2b5931935e4b77a83777986e09775
SHA5129c3c470c375427330da3c12300b9fa3f591d691f0b027e4fd1ba9883a7c2c507e5498f3b678588b868ba1e7848133034e80aa2a0073b17c86d924cad33fa0a37
-
Filesize
5.2MB
MD5c87dd9ad975ba933e0c5055a4b423564
SHA10463c215c03e62bd73687bbd36450c2e8ad51477
SHA2565bebf3fd225bc73aa3801a15c5f10ba37ece0495acb334f7abf8dd6a81ecacb1
SHA512802d4ae3123715159898060d493e9e500d6cfe135d027bf4508ca41ec61f5fc477c90b06a7b8b05bda0a7fce4309d7bc0c0161dc879b9884a047d91cf7b17ea3
-
Filesize
5.2MB
MD5d4266aaf86f42f74f17b9fc21fe02b27
SHA1e349668790cc4e39a7a08345f30cafb737762513
SHA2565dfe6ec55d4ded14381cbbc9c6498483d32f533ef6885fad246a017eed9b0f60
SHA5125513c277fdada4a9a9d3c80b9633ca8c9996d9b033f06e67fa3aa94c899c7c7bd7c4f7cafdd423f5ad8757372990992d6e9944a3afdc449036b717a16f5a5b14
-
Filesize
5.2MB
MD5a13bc6a100af607dcb98a40965957c59
SHA160fea35b9b69347857149bdbdb29d88961ac79a0
SHA256234a37699600fd53ad3af8367b43ced31309445cbb74e32390d54d3cd6b21382
SHA5129e303cb677f3ae0f7b865ad9c2320adf7396edef2596af293ac92942a1a4f73c104cc9876e71f043a19cc4c5b79a0b4f7f516f5e74ed7cbb7f9050d6d20e9af5
-
Filesize
5.2MB
MD51a304ea38980adc8c9869f01a60e7f96
SHA1c43f4ef969b40867248a5d6abfd3159dee7cbd8b
SHA2560ce7aae056f8fd9be8d7b926aea6ed5903621266321a91564b9d58ce22f17c6b
SHA5121a78a7541012aa913374f723febef9082affc93360289a233adbaffdb0fa24f78261d752670bf74d6a04e62bd0ce9cbed41f9efc807502385850a68e9eb86f03
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB