Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/12/2024, 11:45
General
-
Target
2024-12-12_143b45c046f1042933d766b130f9acf1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
143b45c046f1042933d766b130f9acf1
-
SHA1
fe175bc1b7ca5d12bc35d64e2170ed6c2ae79b72
-
SHA256
0966f905fcce9734bd957aa356aa9cfb639f9835524fbd501979d26a5bf47616
-
SHA512
a83668c58ca0b4f015a7be3cdbca1bb69d43d8a686a0a5dbdbde772cd2cdd2376dbe0f50a092b043d50475509725802e2c04c7f45596f8ec24a9787ac43fdc1b
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibd56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_143b45c046f1042933d766b130f9acf1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_143b45c046f1042933d766b130f9acf1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dZwSCDz.exeC:\Windows\System\dZwSCDz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NgeRDeX.exeC:\Windows\System\NgeRDeX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UHhCyKC.exeC:\Windows\System\UHhCyKC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NsdjMTg.exeC:\Windows\System\NsdjMTg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zdLsEja.exeC:\Windows\System\zdLsEja.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KDqQEtm.exeC:\Windows\System\KDqQEtm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xMEgyTm.exeC:\Windows\System\xMEgyTm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YjCzyMG.exeC:\Windows\System\YjCzyMG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ypqBItp.exeC:\Windows\System\ypqBItp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cqMVzAB.exeC:\Windows\System\cqMVzAB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gNHSzaB.exeC:\Windows\System\gNHSzaB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sWscwut.exeC:\Windows\System\sWscwut.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qmWhNgp.exeC:\Windows\System\qmWhNgp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EaUlbtx.exeC:\Windows\System\EaUlbtx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vQGTGbO.exeC:\Windows\System\vQGTGbO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rZDsPVB.exeC:\Windows\System\rZDsPVB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DDTPGMm.exeC:\Windows\System\DDTPGMm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\soAwUAy.exeC:\Windows\System\soAwUAy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RLzipsY.exeC:\Windows\System\RLzipsY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bptraBV.exeC:\Windows\System\bptraBV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NgbQdZM.exeC:\Windows\System\NgbQdZM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58b86e55545378244e2212032276bab31
SHA1af2e2979176cf086c6ac89a46bc5080a080495aa
SHA2565dc3115197a44d995c9a39a6efa0a4a9ab11f79f4314f642e6fc93553a5fe24e
SHA5125f3c2e44eb9f844ccf7e5ed569e24338eea03d57d37527d59dedc61775e371f84250555b4dd3ce96f8438162948a0025d22292f77747c6ea22e7c4d8fa726b40
-
Filesize
5.2MB
MD52d4d40f1a8960717682455b797bbf9f5
SHA17d811995632e4c8f67ec857644b61cdb6c317aa2
SHA2561f897734e3c92e0581a9f5015305e346e5f39f9e6cbd4993bef89799ed78d3d8
SHA5124a37d66c3058adc31c3d5a00cb3926ee8d132033e6df7cec7ed30ab02c044a5c5c1b83a42eadf8b1134741b4e63de46071e6fe2358008d355a9f936bcd7cd657
-
Filesize
5.2MB
MD56337dc6f3255a0aba7d233f9fa236ad7
SHA1e4207ec00dd2f79807f44a47137e4c945fa947f7
SHA2566c77648cf293fd9b9f8232bda7806b9d38a9a04f9099a6196fd03767414c203c
SHA512801d60824aeddbbafe83da05f10313bae8046ffaf0f7d93d95cec29972d1cd313e47e8806f4d05c9f4c8b40f2dd81d72980b5d82ddcfb6a4c63a69b23e3cf78b
-
Filesize
5.2MB
MD5492d710404ee5f5ba36a661b2d425aa2
SHA15d1b469f11a100d1eae8a97f2c81c06eb9960b04
SHA256af9031f3aad617cc429028a6838310da80a42bbd86bee4b53edce2f5530d7669
SHA5121a46c8d0f0c2209db8354a9b1bb207a31afd12e1d7c3c08f290803b5101735d331f0a193a45d25999967f1c6c0aa8225b98e6cbb69d1d84990452df53b30aa2a
-
Filesize
5.2MB
MD5f42b882f310b4a6350a58e5f4f59e412
SHA1101fbb82e27eca4bc11bd30e6a06f6fe8186238b
SHA25697064749f0b2ffce83d07a66312c417bff805b76e8319be72d227fec81f82306
SHA512866b06f042cf9160c8e7d8b4c7fc2e9f25b5a77a891cb74f92372d727a1b68f3ea4c8de3940d7a38e4fd916a9140c9578cfbc7028d45f5f3251c19b67ef171fa
-
Filesize
5.2MB
MD57ee52f99b7393c146dc5f31de9c15f86
SHA1ee5dee8ab9247353678605bdcc607b7e58329309
SHA2568fca9b39f523dc62e581219cd2621c176cb8234bb05d8e93a2a632fdbbfa9176
SHA5120ff82c28d75074b84db341d358190853c1de582e69a9290d32eafea6fb57a2ac4123614d46110e57c2d65bb14f0ea62598197a3e9892715464cc152ee433fbaf
-
Filesize
5.2MB
MD5e621573970a72e00fbaae4647bc746e0
SHA1b6c31f1589985094a7f7b143fa8675fa5b8352e4
SHA2564afab32fc05c6d1dd76982d2cab1c9706087fe8281a9a45307701f864f617c87
SHA512665457c586e5613f4d4c4717ee8d5630a2fd6effe990ff50ad0d37ef23488c2c83d65cefa92ed016f95538cd1e760d3272edd79ccdd93b427697ad1ebbbab066
-
Filesize
5.2MB
MD55eae8973a03c92067e293ba02f717a0e
SHA15bcfac070a000128ac5b60e6641fd3b9be13bac5
SHA256421488a716b3e1c076291eec09473e79ae1d77d54c5f0fec3ced2cbd3e303eb0
SHA512f7245d3a6c39e82d564aab14b890c5e704464ca9b1dc62fb089087f30b69c023184c660dcee87f803643833ee35db848f3432e27147d791b00cd8e6551702d21
-
Filesize
5.2MB
MD55123f705830aca8cec1153990fe1c0cf
SHA1d7143936fb271947a5fd8009095615b1d7e056da
SHA25649a5831e83b080f17af92c51acd0ff32786c4d341316db04ff20c05e9734b184
SHA51279e0babe37e907744c9ad39b8fcd0ad27a96e0c1694c2a8d473888025ffd50ed1f2681131ee59fe67faf7d14d623ba8e9f42cf01bdfcbcd9b85ce0f459f73d57
-
Filesize
5.2MB
MD58bfc68d8866bba3cbb8b406a3ebac401
SHA1297fcf131ce0ea78747bd937e807610942574835
SHA25656d24ba60a00828204cf57ace30d0185298a772740618feebe7d3ea08122d3e1
SHA5123f081e70019311914c97545147b4d7e673fd8cd3a19e115d261bedbfe7c7d04c1a8ced39285d79a5e4491803136cecce5dc44d5d05a0439f15dac79acf0c3443
-
Filesize
5.2MB
MD5ce2f78f24fa96bad3127b8d536c06524
SHA1f2a1e91a25b64fe82573410fb762a90b4e1ff67c
SHA2562e6d0611002d62353ae0f3aa187fab45d62fb67256a3949ccf5808aaa527c7f7
SHA512fd7b6219219a0a773fa2fcd8ea108708ecc21d096a8225bd1124d3402c70227fafbcdf8160f0daba07baa84a0bad409a9fbb72bd87532d3168d6f30361d852a5
-
Filesize
5.2MB
MD5d5cd4c32075a958530d41301be52d523
SHA11e499015cded3cc7200e01bddb03fa6acb7ad79d
SHA2560ac6de87efbf34b344eb8c1270ae45ac90c33d14d0908ed7df64cd593844a860
SHA5126215b2248f24e664ba3ccb52149fe467505587e1a1dae712ef0f3760dbc54cb137b9f161ea634e30272051687ea67597b9e1e7428202fae2f20deb79d1c00ba6
-
Filesize
5.2MB
MD53bbdda2bdaab90ddcc84502aefe71550
SHA18ae2225cb79ee8f248c9898434d5dda2f1cbee73
SHA2563c6b1e7f5299743d5892e1748064f443910ef8b74a0c6a6f35cbd86b75b48359
SHA512daf3b0a67b7b37887af4661622889ade1f95247463aaa2c014c53515c194d2fe21e0145b6f7bb3347c4a4c699c928ec0b61fee0cc2448ea7948545c443cb53c0
-
Filesize
5.2MB
MD554292f00ac983b6d1ff0172cf8966fb5
SHA1590db5af84de591885c8da43353d9d6993db934d
SHA256fe5d91d5c27aa21fcd95552bd69b2165f6dd34f641b0c817e329cd001b3eb5a9
SHA512b7be7b9fb60d157c38a7273857135ad1e72d2bbe1e65cf57b04111dcc28bdb2efb3e6663cc2e384f673c8eb8f8e0aa97381279dada971ce6c5c1ce8f40679fcb
-
Filesize
5.2MB
MD52b17437ab74815714562724f1fa04c2f
SHA1bd388fc9f95e0716180f4ce0567125b1ea4257b4
SHA256589949c9acd9bdb2db319a7244de9f0ea614d134dee1108d870d234b4307acd5
SHA5127b9fe1cbb352605c1716fb1b40491d4aaa394497c8b3adacbdf978fa5d0c295fbd296e2727f5718b96231864f0c06f431a37d90d0b381d47bce8e310d8e0c4a5
-
Filesize
5.2MB
MD5ab97f16fcb2a547c990069ae1ab04571
SHA12958a08de5edf456b36cbe64ae16cd30a7bdd7f3
SHA2565813436c3beeef87b3bea71970d9cb0a4289f6f8e17f4b3e170acea5a69d6888
SHA512f3719aba912dc973fbc0b4f295b70850470e47e58df413b9fd7dc0a6d895dc610bb265004831e69e8f77b1484db3ad7ec446f0c265df8484bdfed84f37b1f5b2
-
Filesize
5.2MB
MD563dd976de6e315f7d481f56a3b35e849
SHA167a658bc0c2ef3afdb8bb7416124d3da3e8a537f
SHA256f857d5d5ff795d18dbe755c04316f6be85182f05b1aaf2c7a6399105e8214ae1
SHA5126848c439e909b0c12c9635f7be5d2789a4263eb6f63472c35b76e12510d0c0c291690c4713f8b93c8f46c64a13fdbdf05da2d6c081ebcfbb0735e316a03b2fdc
-
Filesize
5.2MB
MD567e5a2b697a79a2f063d2943b4a38d18
SHA117eb4e8fcaae7d581d384fed0b6894c02c77e65f
SHA256bf3031a57607a54dc38727bcc182e83b87523ae945904a1b55a14adda31bdc10
SHA5127ceaa811686838d16f223dd0b6bfef7f3d74d12ba7a97ec5e37b196db24e438446b4ffc3b3cbc51bd5e4803992645534b656b02cc92585af8f560b2e894f0eaf
-
Filesize
5.2MB
MD5a527d297642a8e91cff074905ec04687
SHA1e42dd4705f209d10f162c6e371081ffbfab17b67
SHA256bb57319310dd7041a13deb0b74b4919062fe73c9dc0f46fce2df2447c5c916e5
SHA512fdec415c79f17b9230bc1ada2bf467639e1b6203d52f129d58d35666daf3007e00eb1f6aa672448365252fb70b7381dd1e0dea4869b85058d5ecea001d0e2ac9
-
Filesize
5.2MB
MD5385c80d8bb8e34f5e7fe77c88e802453
SHA17a26b695385186363482ff27218663f708636954
SHA256c73e06fc21f7c67205fa0826ff8f01f8abe177db5d1efeceab332f2119242fc0
SHA51219363071d4824f257bbaf36ba30d73bea19e982f8e0ec38d4ac2d53a340f2d26ef849843a4beec4e9610fa44c58de6b1d48e267d336f80e3bd71c4a15820d3a2
-
Filesize
5.2MB
MD5e90b8c09104ef3fb20bc8f57e40df45f
SHA1fac40b41d48bf46bdc4cc8281d3cec1766c7f5e5
SHA256a9580e07b513cbcbf8db8eb899d23f9dca96083857b2d0a3638a3fe3c1c7f099
SHA512185cc199c59641a2205583346ba7f5ba9c9f3e43b30b68d85be7d9b687a9783a5498eae0d0a7655dd608387b5b3fd5e699e366a6b3e330a163945c3940fb2e4b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB