Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/12/2024, 11:48
General
-
Target
2024-12-12_65d760b3462d23a111eecc5dc5527a36_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
65d760b3462d23a111eecc5dc5527a36
-
SHA1
69deff511aa8a5c6515669cbed4c12b18b74f2a9
-
SHA256
12543f833aa6146e1234e79df28e8988ba826e69ed9e99726d511945dcc747e6
-
SHA512
a4281db427e9aeda1801f3b8e7a26c9ade54eecd9116b35385417330c78f6f268c3e39ed0fb71aa5971f491e5f14deab62cf39c91b10c5b71ad91e8fd4b3c339
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibd56utgpPFotBER/mQ32lU2
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_65d760b3462d23a111eecc5dc5527a36_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_65d760b3462d23a111eecc5dc5527a36_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xGnhoga.exeC:\Windows\System\xGnhoga.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QfLGeyC.exeC:\Windows\System\QfLGeyC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aNZgCCX.exeC:\Windows\System\aNZgCCX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\woxrWyq.exeC:\Windows\System\woxrWyq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XstLRit.exeC:\Windows\System\XstLRit.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KEyWzAy.exeC:\Windows\System\KEyWzAy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WFjlggu.exeC:\Windows\System\WFjlggu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ECBPtHZ.exeC:\Windows\System\ECBPtHZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lNWYHRH.exeC:\Windows\System\lNWYHRH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XAPERSu.exeC:\Windows\System\XAPERSu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NDwPXqA.exeC:\Windows\System\NDwPXqA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WgLsTji.exeC:\Windows\System\WgLsTji.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ofMbnfV.exeC:\Windows\System\ofMbnfV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YTjZAJq.exeC:\Windows\System\YTjZAJq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gAUOlzE.exeC:\Windows\System\gAUOlzE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rSMCnus.exeC:\Windows\System\rSMCnus.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zxanjAW.exeC:\Windows\System\zxanjAW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wmPphQg.exeC:\Windows\System\wmPphQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZWuybvW.exeC:\Windows\System\ZWuybvW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kKozwdX.exeC:\Windows\System\kKozwdX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QGrGEeR.exeC:\Windows\System\QGrGEeR.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58e5729d37b301dd55ade97ca768f122a
SHA1891fd3fc9b76558fa1d697308ddb0eb4d3c44a11
SHA256ad793e36daf24822b0be61a258e32ea2ff61202b6358df7a640fad30af36d3e2
SHA5127c7be7cd2c4042fe66b564be2546127cb6452e3159a672457efa377bd12cc24eae5d6d83a6c1895173e093365be7b0368e37e6ffc79b64846f697a047faf5bf5
-
Filesize
5.2MB
MD5d4302a26c3d1d78317567e10014ea5dc
SHA1beaee35ae0c274de209f87dc05d2904246d63d40
SHA25688d7fee3ef1ba9cd3e7c60e20b83468f0b45ffb30c7ef507e09936d92277af77
SHA5129bec4cf085d1c0190b05890a9dbadfc9ed8616995722318b99432787969e0958e639643a8f1882a792f4fe477f2466209e17323bd30487dca12c4d621bff08b8
-
Filesize
5.2MB
MD5721f19d730e29221848e312934844ce1
SHA1b459da9fc73f99c5584f156c66d754d12a8a1cdc
SHA256357962f52a5a09dda2b83c6713c85caaebf675d63129bed62baef167ea76a233
SHA512f34f401b75c81bce0825866a6e08405bfc68f6514981e5ab973c897a960711e90db459657b5bf4e5e08ca9f2f74e3b1daaa7cb8771d1830be0f0b9d5f3605b4b
-
Filesize
5.2MB
MD5c68f94d35ca2e7342116d58acb8feadf
SHA144797681fd77a9c95222c0572715f1a93c993479
SHA256df5a745760375a4ac0b0c8f7a7c2867dcb1785d888882de37995825d1adb1120
SHA512ff5dd4e535a60b277e80af60c2ba3192723a577a6454b0e4e5432384fe5f3bf754f904681e6db8af89fc031cb8152e0f6bb5c3aa66c1d5dbfe6582cc33c36e34
-
Filesize
5.2MB
MD573f4dce0c3d1ef1592eabcabeadc7c43
SHA105a5cd283fee352a05bc6f4b2a78479b6e8cf379
SHA25676c3d048c03aff1eefcc11f6f64cbcf54f4e9882ad435a4b157d3c35f654684f
SHA512794b4b5169533760122c12c745d11d8476e96881b9509afb9cb5b77a33b7f0f11d7b476131808b5b5090b8253961a6e90e3bc0463c8f84948ad789a3f5f7a18e
-
Filesize
5.2MB
MD5c21b83aa4e0903b4352769d5b9c2f62d
SHA19c11ca7ea0c743c80056ba8801d38d30c3fd7385
SHA25697a6e047decee25b382240e4c4c847a8e43413f066438a55d98365a927476ad4
SHA512c1ca961afbcf0c41f0899e07059d990e9e484e2744a570dd5d7728412b75906573eefee64b09d2508bef4834d574f74a909c9072a26da66f5b92b94a60bc9318
-
Filesize
5.2MB
MD57da9c6094c7dd82a3b59e5897dc55d2b
SHA156bf2bf3551bea12ab41cf67c6687ed8e8b665f4
SHA2566ff3469751713aa123b6e312b5d6a0404ca96c857c81749b28ce00a71637a060
SHA51292460ca5b2f101a5328fd40bf5dece48739cca9add15ee62d21a36aa2bc8502246f16d325115bc2906ed4686ca75c2c28104bef5c287bd9dfcf1b857f8806129
-
Filesize
5.2MB
MD5a2348cc3ee90396f39340f7bcc950091
SHA18556f702a90c59cd21756099d52b3ac0c203fa3e
SHA2563f94ed17b82aafc68d6c125980d6fbfe1f6e1f6d67f757cf905f227d3e4572c5
SHA512808839ff7389b206a1959d339131bcbf538e8078bce72dbb6d2176baa982d8b37588ae007c279eeff2b1c67e06bffdc2dc9846961a9c6b9dece0b9daac77ebc3
-
Filesize
5.2MB
MD54f3aa7aa2b460aa3c0cea7497bcdf163
SHA1cc68bed6fb91a53e58c449f685b08f1c754e0476
SHA2560f171e3395e29625510b27e529afbf71f54aa3f387f0d34902b6afa544a4f31c
SHA51291341aa442ca6011444e09f7587b35cf84b5adcee9683f21ac8f20d04e7f2b2ae1978b51fe8afb26b99d86d4de49c95c405b23852815c77375da72420d28ba27
-
Filesize
5.2MB
MD561e53b2908f89a42fa53c28698341c3f
SHA1409630205364de050fa93ee2e3f326a8aecefaf1
SHA256e1ffa6c41039b6ba86176bea486bcb9fd040704003145411d5f6f5d0010c81d4
SHA5126894081592bbf4fda8e2caa6514a0582a414bb456e375633515c10e0e35933e73f644e9fd9e421d013994f1ab0d2d1aabafde65c92b4daac488c43bf10db4d52
-
Filesize
5.2MB
MD510a8e67fdf0995e85f87d90c452b29fd
SHA18cf7a937df82137848ad0749b4faff09afda3544
SHA25603ce0d404fff8a371aa704346b5d8ef3f175cd2b206143bb6c0026534f2b03bb
SHA512a6747b6635537f90828ac4dc1f1bd396e6b74659de8aca2c1784243a2a7af26273050c392b515eefe9729b6eff66994efe35edc12105201511044198bf6d1df3
-
Filesize
5.2MB
MD5a6c769de7212451fab1c8f498edb69e4
SHA15539b2424d0db251d9c3916e3351021b0e65a9e1
SHA2568ab34e94782242a3c4d97cb6264b2fcfbe18f3335cff95a348f0034fda4067dc
SHA5122497892f1da1d46fc26a6335492cd46e62c91bea64a1575d6463cdcc9e9da4f93027033cee581115801ff5191f40be40ac23f311990e56d4ad7fac483fa5d14e
-
Filesize
5.2MB
MD57276ca355ad0ce084238f38ed81385c4
SHA1bea64e9764ef7a651d47868dd723eee784ecaa40
SHA2564892f3d9a0c4cf5a1ef1fed22313ffa3d0e76837a13626825e8837d010c453a2
SHA5123da992e6d787afd155cbbf69ec77e38c0134083903b94d64ddbd72337b72b915365dfffed00fd439d9a2feb17feb8a72f3ab95ead0984064868c449f955b8a43
-
Filesize
5.2MB
MD5fa44d89343fa843508d640426e539d58
SHA1e134f5cb9c218cccbe06061222545d3d8bf660ad
SHA2569a2695f7662f41e1459ef08529f9c706e712e15f7d8379b19b21600bf48eb579
SHA51282ae18562f736198e849839d1765484657edf370760830b0f404e3ebd21b23c660573139e7b41112877f9023245ae827f177d275300fb778b7b3dcef200356fe
-
Filesize
5.2MB
MD53bf6cb3da632c92bcca5d0e8948682f8
SHA1f1ed4cc864025bf5f5994d5597b4af1eff8f9171
SHA2569bbc96fc73fd750b963def9f8743c3e7a9529b9541ddd568efd41423163af75e
SHA512b159d10c8f820a5325aa17eb1f1685513d7df9fec71d3598af8a4aec11f0c5c1cdc21d80b805476112ce9d1e1aed4a3649bf82df6bfcd0f03950a4a3874f4ac2
-
Filesize
5.2MB
MD58f3d60a50ec891f6781da748157bb0d1
SHA1e3bf181211fba6da872c3fd1237ccf641989a149
SHA256fd2ec6540cc08269f2150ccb5a5f7bf50db5932aa585d3bab634a1e7d70f580d
SHA5125b3179542da76448bd2c374a3bbb4fac16e4a0617750be6d435fc7301f0422808b24835b9a0b0b2899aa328f2b047270fd8a1d5450e37089d67b0089d0ce54c8
-
Filesize
5.2MB
MD5fa4181c4f588bd8de025407d9b3d7ec5
SHA1df859fe7b8d76e2c9b8c6959066dc90a3b48a8e4
SHA2568cca274233531ab066ea936b6f43271707dc29a87caa72dcc93a28eec2560d54
SHA512ed8fc328abd1f7bc7101100d1209e7f94495c2f3b9414a44263451f2c43c5141d98e2788242e26fee0c414ce1d4cd0929427ac9c7e32ad3cc7b226ae96423891
-
Filesize
5.2MB
MD5ba5429341c34e60f7fba436cbc823a27
SHA1e0ac40c0decefd43e9b5473754827e58f9c61129
SHA256529bfd67817ea38f9347e040179a89d725acd5a8f9205d842caf5a04be3be7d9
SHA512933ccaa279afcf01577d19b6b6c0accd989d92e96cda60608d39977f3858df166af5bf82e5ff30ccdce1dda29bd606ed1115addc26b929d44c7fb87bc7c0df42
-
Filesize
5.2MB
MD501212f4536afc33c21a4cb51435851f8
SHA134d99336260dd64475b2f7ed1cc3330910e9a4b6
SHA25651ac518dada04b9354d56f4e829ab0ef9ec8936aca6cbafd1c99ea91e08085d6
SHA512fc1b7d0526e5e315984421bf767206ee8cdb70524280432cf6b9c209003cd85e4724aeab95e815dcc508da5adbefa6c5405ba1d3f142bdab8fe754501990bfa7
-
Filesize
5.2MB
MD5da3594545f114448af416554e6de2098
SHA10d47749df115cf58d554d559817c6e8c048cb13a
SHA25624170e00f141abd33dce1d1ed8c492d94c9596eb140423722aebf9fcab874255
SHA512e410092efc159b46c2a6101bd5d39fbcfe5b72366a46c74c30638927bec5a1a7ed70aefdb02f28f4b1bf99d5d64c90d2b31a82df72c95d197d2b7a10f455618c
-
Filesize
5.2MB
MD5434bb6fc53cc8734c503add55926aeab
SHA138ea68d10d81570d8ca0fa674960e973ebf04a41
SHA256125d54a6c709e5f62d7079339abd48bad3490ee45322f0c14fd62552dd8cc983
SHA51250461adbd3d8a93646936faddded528eebe1c88f7fd05aa679e4ccaf267c30ff918d629febd92c2e1547ff2c1c2b4e70059be00adc2ccd29c4d862d3c9852845
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB