Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/12/2024, 11:48
General
-
Target
2024-12-12_65d760b3462d23a111eecc5dc5527a36_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
65d760b3462d23a111eecc5dc5527a36
-
SHA1
69deff511aa8a5c6515669cbed4c12b18b74f2a9
-
SHA256
12543f833aa6146e1234e79df28e8988ba826e69ed9e99726d511945dcc747e6
-
SHA512
a4281db427e9aeda1801f3b8e7a26c9ade54eecd9116b35385417330c78f6f268c3e39ed0fb71aa5971f491e5f14deab62cf39c91b10c5b71ad91e8fd4b3c339
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibd56utgpPFotBER/mQ32lU2
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_65d760b3462d23a111eecc5dc5527a36_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_65d760b3462d23a111eecc5dc5527a36_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hwbYPDM.exeC:\Windows\System\hwbYPDM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hEryTux.exeC:\Windows\System\hEryTux.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XKdhltz.exeC:\Windows\System\XKdhltz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GgxaWHu.exeC:\Windows\System\GgxaWHu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nxQsOuE.exeC:\Windows\System\nxQsOuE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rlBfZwp.exeC:\Windows\System\rlBfZwp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hAxUcwQ.exeC:\Windows\System\hAxUcwQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PCObAYF.exeC:\Windows\System\PCObAYF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iwEkuPF.exeC:\Windows\System\iwEkuPF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AGpFgyF.exeC:\Windows\System\AGpFgyF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xgrMUfZ.exeC:\Windows\System\xgrMUfZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eOhEzbJ.exeC:\Windows\System\eOhEzbJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QxbUbvY.exeC:\Windows\System\QxbUbvY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ndAbWRG.exeC:\Windows\System\ndAbWRG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tTAitmw.exeC:\Windows\System\tTAitmw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qoianhu.exeC:\Windows\System\qoianhu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UmpEVyW.exeC:\Windows\System\UmpEVyW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CwZikMo.exeC:\Windows\System\CwZikMo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oaBnGyh.exeC:\Windows\System\oaBnGyh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VUTOVvH.exeC:\Windows\System\VUTOVvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TnMDakU.exeC:\Windows\System\TnMDakU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5058a6282a54b4a27f9a39c3f2604d460
SHA19c718ee95d802a1527ed034584ec9c3251ac6216
SHA256469f4f1a849f96572b6a1528a0912868ec24a15173b30ae553aa29c0bdfa57ea
SHA512c5098154948933987a4b1b3d14b3d6de86f79124a2a9b9fbaf1fc2a17eb887a6da0715b4f9ac288da4a98a26218c8817d7c1dffc819fc33f878d069b6b22da2a
-
Filesize
5.2MB
MD580a5a7f798baf725de09c0f900325b1c
SHA1239d0ab681b77fe988b3e241a1a182a6b494d3b4
SHA2569761b871e0d4b8e60e5cd3bbb0363d213e67e415baef5ce1c8a1a16fd8c72842
SHA512e08a0b9e96fc4594d66ca63375757d8a78cf7e58eca8af8f619e6c5a839d5a29170100151b0bfcf8cba897a6eabed60ef2e47815ba58ba81ae4e4980bf3f0674
-
Filesize
5.2MB
MD58b65cb49a02363983fe71d196105178a
SHA17f12f97d34ea05d7b7e3e3483162cc4a0d7df5cb
SHA2561082e8d5491724bcc55b0278b5b295b253353c7421e795dd4753199bdfee3bc9
SHA51296d6bf7873f0bf82535597d67cf741443f238d9e1d39950e71e4f3fd1276f10536a17638ca5128972152cf57c44a18ca2b7b9f8d8459c5fa6ffa4db50e8eb396
-
Filesize
5.2MB
MD594caa1d6f4a239da88dce9a2304bbc6e
SHA1cc7e68ce3a6641e4013d2788b374d2d04e5741d6
SHA256ec24924becb888042d8c321618f243c1b6dee3a255d6caadbd83f2ab6dd21b11
SHA512a9aeb3684a4c581290e5009a7857d7f9b7fc47971da4731bb12a8eb5eac8dabf32cb819edb91b756dfbd753fc318ad30d4b6384abaaf87dbe9a8b7ee67f2a89d
-
Filesize
5.2MB
MD5a02dcec6a68b106cd869925bf5bb9e62
SHA14773300724a84774a9f996394e6337938e62fd21
SHA2565106ad188bf8fa5f6f88dfb7a201b0091e78fd2d30ee9b8907932606aa93ebdb
SHA512e41c0803494496935d255f05bc5123cb7a30e260a1dab2beb972d255c4184b8b9df1a5aeb3e1a27bf5c29234f104efb6e08ba11f98c2cef17591a225551d6fee
-
Filesize
5.2MB
MD5018ae6976d254b0fa99a9df1fec868ce
SHA118aca6d0a4e94d2b5ef47f0daa7bd48bc29d9bef
SHA2564c4da358266e5d85d69fb3aa5f0aacbcabba2d14f3009977d79757197c5b14ca
SHA512a4695f65e6e1eaea77fdebabfd3ff95412b59b92dc287f37463f49b838ddcc42782b5f8f77d0352a1b3d436e07316a5a9e1f1ecf0ac25c4b9a141e834e7a90b0
-
Filesize
5.2MB
MD5548039f117b21121a1ce26935f19fee3
SHA1483d4225095876eea734d825d948e1031be179a6
SHA256f5029ea6813cf5cd708353cf39e528161a0985dd57027a56b98101831a00e0eb
SHA512ed099b8b31ce405f7d8c15a0dd4270ed069717f932031d8b9e383e5de4063d2ae491e43efbe31f16b9e71f3b72f67a602627709683f9dbc54e770b30d169dc77
-
Filesize
5.2MB
MD5d44fd4937adf7f7be66652f5b565afb8
SHA135602ef8937cc06ead7bde33fb67524ee9ccec97
SHA256a827cbaf27dd07fb8c2b14c0e01094d4f57a3f1e3028f4a56464ac7af197d0af
SHA512a4391812e1c63d78009a6e25d6bd37d870e30b1b4583d76c5e7116565b977a057c18d9a1817c096a450db120ddd77c21774b557927d149ab8b7732ec66c81ca0
-
Filesize
5.2MB
MD515143877c315e8152c10fbe322d08b32
SHA19e4c7548fa73a3112fcb902354d7b44eccc8a07e
SHA2560ecb6cf474091a88aff1fe7a32116e8eb7e467fe0d9f5ee16b209e76ec71d41b
SHA5128228f8370675a7552a437cf4510c7ee8d4ccdc8491e23cf897570e9a8f06c4aa90fa20589faa261568042004c5373ed674cf02b522a5f28346c04dcd8531d5c3
-
Filesize
5.2MB
MD58398eee1e6113cb2bd1d738510e88c4b
SHA18c1eaf8fd60da5d0d2b8d01b9c9705d39d93413c
SHA25668731729c2dbd1ff2da5538d6ca2d4c5ead353f9cdf6e0e033a2d338709bdf26
SHA51286a25041f16333b455c08b09fa874887430d7f20881d57bbc35757e6884bab61449b1da97b07cae71b4ec9fd40a68791e3907c56fdaee02c2f0dcb0e4f96cfc9
-
Filesize
5.2MB
MD5999c70ece45adb6b0b8169677c52ab3c
SHA1e7c54cc40a5092543fe6c27ea5f533b27057d7d1
SHA256ca5f1755092592ca71c5e4538280363474659811e3a162e50a26696d39653fa0
SHA5128fe8f28f1e27292c42d5c0a5cb6f108a53cc60919a8e6018666eb772927f80fd29c45b4bf9899c21be5349b7e75a9b04b7cf82e00c3eda29e39ece4d2ae45b9a
-
Filesize
5.2MB
MD5b1840a29baab2733e62945ba510054d9
SHA12231c5a8a2318defeb0c6d5d560eaecd0f4bfb39
SHA256386b887b09f167a77e3dc76868213a988f7d9e56d035785d088b5ebe7dc1b2de
SHA51242c5f27b09cbf0e5602d68d395471dca42bf8f568a04fa3084c132f9d2401ae6e0bcd775f22c3347876da5a0e8ecea30cab6a29ffb7f68e1538b6afbca920ce1
-
Filesize
5.2MB
MD57eef1be463b5c650bcfff24641fa3fbb
SHA1f64af38b4cb85f288541fed513543ef6a4b27737
SHA256fc4af6be884acd0cfbbde24333fb599c593e685f4feabbefd276456cf0024dc3
SHA512d6d6f3608429a295ab3da7973ae0c83125e93e7876a2f04e853253dbc50afeb13122d739a9b3daa3686c7df7fc07191112708050a66737a3b2ae0d5481483f56
-
Filesize
5.2MB
MD5bb7e6c5d77aeed6e7b3a3da7b752b363
SHA1a929a02d8a6bb88133bef563d125e562cf73352f
SHA256c1192ad9206c7797bc6953ffb64f6b8d5a33c2e3c67fc11c92cca4bea087c1ff
SHA512e5ca1452a346c8bc48f85c4f2041aaa5f688f9456d036cb8dcb144952a2909ecd34f79eb26e22dfb6cc67d7c7864438255e6fa6ee09c2f7e618cc3d38ec6cce0
-
Filesize
5.2MB
MD5c4d8b12853dd9f8d1f4ec7dde95d854d
SHA13f40e4016f0e481e1a7978e045ce74cb98229363
SHA256b7f94668f4d2a6332fa3a93d180713366faf8f66088da509255340fa6fc6ea0e
SHA512a1b68c6f69e36ca1fa8cab0f00b11166e4e401bc70e36193ba7774bb08ff3b4b112d4dba54965fc8929e887a9de0737ce3a2e6d0549f6f6731de1a70ca9f9858
-
Filesize
5.2MB
MD570ee63626415c23c28f09185694aa5f4
SHA1f5435edb168faefec265bc342a10f68e78a3216a
SHA256b086f8ae1ee76e699c9db5633ef0c2a6a473aa29d8af4284c10e3aadb5b9938e
SHA512d3a5d7943b43aa8f4e1caafc1567d506adc79055df6b05777458e7d5f5439740976eb4f4003488a1a34249dd70c01cd8413c1fba2ad1c56b7628979c2284001d
-
Filesize
5.2MB
MD54468ae3cadaa39d724a6dd1db8f3a45e
SHA1b2d57db7223596892c9f536759aef5ed8688424a
SHA2569cab83b01c8b362ab69433adf4bd4ce4ead2420cf102eaa9a8bd61ee612d80f2
SHA512f8ea08144c6c91660f6e5a85fae02f7ebeade1af966ca98287c5b98f6b6df90e53f945a36f3e7c760632e6c89888bc1e1baae9c3542b55c8fdf46fd3081f225a
-
Filesize
5.2MB
MD5da3474330211a92254eb700ea871f7ad
SHA10f6129461b556d9cb6d705418462d886e80b4b67
SHA2562465a369f0afc511c38076617e5d786782a3b24fcb536d53d82de71218ba1276
SHA5128d9b3f45ea89af5ff35ddaef7fa4a1d00203c493cb73574502493e641a8aadedf12174a39c24963cde987f03c1461f47c77a91a88686d4aaf8f35c33e9eb49d7
-
Filesize
5.2MB
MD5ab6c3d23d5977e12a296117eeaab5820
SHA1ec14b3cd434268d36b4d75c3da283c0785297e8e
SHA2561877a673d9de1cf6d32b61d176deb6608203b9797cb8911a26e21e52e5f79660
SHA512d9fe18cfed9f330e0e8a3dcfacc8514e7d0cfc6c7b275ef2f00cb6f9979f3d68c646068a6d99c429df27f019482cabd52dc3448690d72ac22f0e855398d125bc
-
Filesize
5.2MB
MD569e0d3ded1af4a0dbe7d6f8c025619e9
SHA13b6e39d69b02f3186057857d4efe1a9319572b38
SHA2568c0598d48f53f20937107ca047a627ce74c750c6c635e111aff8cefe04f2a2ae
SHA512f82f8641a7d37fabf08186b8d35f539720fa5ec543b027b3eea188b8e5eba17eda5c5acf52c743854557b1e385da213597f3a19b4df0eeeba58d53812a741ee1
-
Filesize
5.2MB
MD583c5f4c707bb6b2a006ec15a09d455e0
SHA1748a1261873f009d121964414e3e0a3877277ae5
SHA256d4573dc03941c0964d076196560081859e3cb6aee9fcef918c5ce7f73ecc48bc
SHA5125c2e26e7c0c664dba5605a67534bd9f4bbeaf4d153704cbf1501fb8c6198a5d4cb2ba9fd4e38db1c4e1c5428ef0d9e520c6bebddf7be0799aef25fc85845ebbe
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB