Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
12/12/2024, 11:50
General
-
Target
2024-12-12_6f5113af0bc35129b506aa5ceadd60b6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6f5113af0bc35129b506aa5ceadd60b6
-
SHA1
9175f070060b23b338b45082acbdad44ddaf8533
-
SHA256
86d715e487d4ea971f57d5edb2674a549afe3322a43257a1985998545ecb5762
-
SHA512
18c83a12f0d20780cbed260bc90423e1c0a0f92d1e5c7e52246729df9d2d017791922f58419e625ceb93ebd3678111492ae871fdde352acf59ccbca3c97b333f
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibd56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_6f5113af0bc35129b506aa5ceadd60b6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_6f5113af0bc35129b506aa5ceadd60b6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rArRCSD.exeC:\Windows\System\rArRCSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AnjUizg.exeC:\Windows\System\AnjUizg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ERpKIVI.exeC:\Windows\System\ERpKIVI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yqbPQMZ.exeC:\Windows\System\yqbPQMZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wrAWfMY.exeC:\Windows\System\wrAWfMY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hqAqMrM.exeC:\Windows\System\hqAqMrM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dVNvzuf.exeC:\Windows\System\dVNvzuf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RAaVFwS.exeC:\Windows\System\RAaVFwS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GxJevAJ.exeC:\Windows\System\GxJevAJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SdubYLH.exeC:\Windows\System\SdubYLH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KClPpQU.exeC:\Windows\System\KClPpQU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HTOEGzM.exeC:\Windows\System\HTOEGzM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SMbccVe.exeC:\Windows\System\SMbccVe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UeRhIZw.exeC:\Windows\System\UeRhIZw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ywVXrte.exeC:\Windows\System\ywVXrte.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fUsowXq.exeC:\Windows\System\fUsowXq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GWLjKDR.exeC:\Windows\System\GWLjKDR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AQjgweq.exeC:\Windows\System\AQjgweq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CDhuDTn.exeC:\Windows\System\CDhuDTn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AqtLztc.exeC:\Windows\System\AqtLztc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qmzjevT.exeC:\Windows\System\qmzjevT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57d9080d0e5c19d1574924cfeabf45d90
SHA1c6b44ed6b88ad51d9f12619a553c138a451234c3
SHA25631dd3ca87aad2b863e35910d2a110d9f36e5c050717e77a3bc07fa81656c05df
SHA512ffb0649d301a75f73e30a1b8cf4c5ccc46c97ed7ff102a53011125b1c8b69da357dea1f48df59f3fd05662c36dcaf0067116f976cbcf7897e23274fa12fccd1c
-
Filesize
5.2MB
MD51055ea8d30de9086eff0728261e263a1
SHA1d12c4daf6cc60910bcde54ba1de572f2b692760c
SHA256a31afba7270ffa38bd85cb8053e7e3fb0866310b6d0b84a98f3a47ae43eb8544
SHA512119405907880ac0e3229d425ffde907bace973a19ad4553ed1dfd8f1c7a905191a7fdb519eb113f14be62e511de5aaeed7c857bd702327947f74bb19d7e4ee64
-
Filesize
5.2MB
MD5da1965486b37fc12ba02432c368ac956
SHA1e5ddc496949a07cd4445847be49d39cd44ed92af
SHA256c326d3832d2ab9367cde2d0326d3a78cb35de8c7b408a0e7dcf885a9fdd15c4a
SHA512f2714f544671d79c62fa6e3c8cbafd17e680d85dd4c898088f95437dec634a011d788aa631e8f0ce580f549fdcc4261a1d56ac85106652bcc919bf70e963b203
-
Filesize
5.2MB
MD596e1899b8f34531e7109ecb5ba619d9a
SHA1a130ffc5bacabd25de214c44d55fa02c6cda18f8
SHA2562938c196f71516ebfd1c1ab4a80c6a9ca381741da4d951e363e57b075e616700
SHA512a49dbdc56df2c1b46ca058ab31e64ab967e48144a4db7572b7bd0a947ad05d17b7a5d393492809edb1887238ee2d266a775006497aa1da9d25fafd41669eb833
-
Filesize
5.2MB
MD5743b04f8de257dcfd0c1b5982f4bd55c
SHA1edea4b011efff494875acb9b56c658cc25c4c99b
SHA256f0292409d111aa2871276c0bee77038babe5bf4a2495535de5cf14ca665c4805
SHA5122a9a450c593c4a1c53596b35debbd509ec364c65670ad7b4e724ed745f7dbbc1c99734c1efa94a7b32d1cf04c4fefbf5880ecf01ff54b8ee26ffccc52fe99001
-
Filesize
5.2MB
MD5fe49198bdbaf5ff68e23aa0642860f76
SHA182b80b61d677209c44789032c71f93267f647d81
SHA2569e831cb2fbd63011f845cbf93ff4073941de435e66b2b81057556afee8559db5
SHA51286860cda6604ae655a8658c21f89311f7e230b6165fb80dd8d9ae79f965a9df516bc3d12da597ee7ea7420752a1530c85270cbfa0f79365e99df4325de63541b
-
Filesize
5.2MB
MD5a0304ccd2542791b7d5bc631922b90d7
SHA1ff75e59cbfc9bd794157aff5f809f4925175612f
SHA256f71782be297bf7c711a379d5b8119af9bd42801dc087bfa5782fc9d43b31b47a
SHA5126f088f987326280b7f83fb8320b1f0da3009ce4938ab777f80f359d33f88f85023a9e7394ec9bc992d6d15a16215c7e5298f5d26601020e7cdeff2a8b910aa74
-
Filesize
5.2MB
MD5969753ed78fdf90520611d5bb08f3bcf
SHA1d54c94148b8306b0c01600db874d636190d1e28b
SHA256b04ddf08895d5a404973661967b54db264257b6eea92a7f7f520c0363278240b
SHA5129a5ada7b1812a159272b15709d88f045aba0a2e5a0a62def05378e6147a1fbfbd09cc7d99b50fa247bd483f463fa6c711a5216b3958f90a689db9203fc2f8e16
-
Filesize
5.2MB
MD5ef7b797ccb62afaec36439678f105b64
SHA1733bcc9164cccb0274d2e68943d3d74db8b631f8
SHA25660acdbf776be8599881566820f335f22f9cb97b0d21b15d4581edaf16f4fc409
SHA5122fa248097f6b9e43001b09beca82d85f3b2c301d52504fbd702a9dc673bfc5ffad62eb88a3b184731e3693fe8d114d21b2c43af29b6102cfee96f51cd85cc6e3
-
Filesize
5.2MB
MD5a7c033a02c304782f295a12535c40d90
SHA1ef05d036e77acd2cdefcd467c97a1ca44f087d2a
SHA256f6e19836342de5605c8a991453974c306342e9582468dcd3079b8e2a14c20cd0
SHA51299bc0791d4311ed5a1692b010b8a7e1e5645d0af710c00dd7e233e048b0642f0aab71c141b326bede1056e738c76f0f56a2e3869f1f03d731a6e4ff766683461
-
Filesize
5.2MB
MD526842ecdcb001b245bb20d5fef18d22c
SHA1d4395a9709c4dc04cf51b1c7d5fdf48ccd4adfa5
SHA2568b1d0f436dbab73526072f50201714e053ca2021abd4128ac665d59f16e69174
SHA5121dddc104f865788deec61951ad2746ce8edd8089c01d4a5fb2879dc9a7c5aeeb906a62e99ea6f88691c6b42dfc43e3aa4225da5320fe6d64ef7125a7c962b6fe
-
Filesize
5.2MB
MD5d4150e48fa35ccf6a82606ea62018f64
SHA1c6b003b64498519f266951a1bda95d5841e1ae0f
SHA256c998a2a6b2ec939b9285b9ebc125173718bc8c1f6d3b5529da71449524ed2984
SHA512d5f1ed314626bf7d5c1e9cfbcd0d9665db5147f25062b7df6f4c808ebe7a52b11f7d542de966a6c9e4b4d6f74ce3470624bb861586bde967ff3fd4c6815fb545
-
Filesize
5.2MB
MD51d556ec774ef2c1d534e7c761d552cae
SHA1280a75883bd91c8f002b664924e787fce0595524
SHA25622356e2d2f78d040897817da9791fa649275c69ff0d810a272368ee2ab028c79
SHA512b8e338a390dfb15e3eb5d4c0d17e95c256b70d2d0873af00027d348cb4d09ff769e169c0c8edf0c2fbc15b9fbc7cf8441c8e19b14fcd5b7fe8b52bffdc6f7fb7
-
Filesize
5.2MB
MD5e061a054ee1e3a63cbb1525b256423aa
SHA1c95ebb3bb53f5ca1708350fc851bd1dcd68712bc
SHA2566c54c740c3910ed3bac150eecc25c332dbfaaa5c99b320b88932a4bfa2912690
SHA512fac243f11107521c34a16634f7346d57779ee4a442932fb594fea74d82e44ffd82339a61c1dc89f85479dd97f7781fbeae7a654117c610c36bc776ef813733a0
-
Filesize
5.2MB
MD5f1d178e91a12c5af1a16fc0d413a0b9e
SHA1feaac5c986d1d71e6af781978721e9adc0ba9d21
SHA256698548e5477e87c51c26922894913339b3f32f8086445fda6f79d75ba1062343
SHA51243276b1028037005e3c2ceda4e7c6c7babb1abf0bde888d8201104a9b323a2e7ebbd150bc93751135dfc914c6d13079c4bb5deb23ecc31760f7303914c64e1ff
-
Filesize
5.2MB
MD538621a22e20c486079208190fd05f3ad
SHA1702eddda88c1d3eda4efb1e275fa7ccf8004b235
SHA2562298769cf971602a7a8d9f6cceec922399aec3ff88700f01438a35066da535ae
SHA512f386e40640db27fa3d0cd7df3a50873643c56a3ef960a45d066b4b619a830ebdb5e3990a65fd921d9399cb8afa9bca11d875a656237a1daccf9d7d6267e21a86
-
Filesize
5.2MB
MD58a3bc0a58ae168399be3d529535fade5
SHA134ad69d34cd58a7d46b0eeca3acfaf53072faaf2
SHA2568a376c0729441484c8e5b2b3f2432ad5c0f31cfcb4a19a2d558a0fe1d37c1a32
SHA512cb74a3939f18fc64fb47773a84c3abc64dfcbc9ac08f44a5a254bef309814d68143a16de1e235d3c4bcd30f35688ba0e5f70f72e648f04cf0af93e3859bd8b93
-
Filesize
5.2MB
MD56da082a9ec080a7fde8b68fce7d9be43
SHA1ce3de26ead4e604c70134df29935744911169c76
SHA25602d37e40f636de18cdf67bc7fb0eb6ab0d8a2d9007758436252198188cedcc25
SHA51230fd595a73e893d482509bfc2f052f2397f3a2e9411799a4d56ab95c718b54a3b62d8ad682fa45a009ac0f68f9c5c13be9f7ac872699b606298b40a45d646487
-
Filesize
5.2MB
MD5854a3ad8d641059924d65eeb25375289
SHA1ec9b3106074bc531fc0a71103909a3e2fbde6370
SHA2566ccaffbe081146dbbd7c19b14ec8012db65d0e79b480823d2cc362a2fe4289e1
SHA5121fddaab76b980c0abadf2acb3c13ee058fccb6c183afb0e9ff0fbd41675aaf01a6a313bf7a85bab7e8831f94ea54b06e76370f93ac37dea4b817b237c72cdf51
-
Filesize
5.2MB
MD537c89f510a6943a50ea4016034cde7ac
SHA1eafcbb344ea4301c9f31b06b63328864096a866c
SHA25657a6e0c336ac4212ea39348db2f1183cf8dce21dc270163bb0488bcbd2702b7c
SHA51258806669595cf79948fb0b022f6413c4c3aca4bae5dfdf851140a9cd46b742103a42727e480afe47ed507a647b9fc3b4913c6e72b67b14d1539fb2124ccfa5cb
-
Filesize
5.2MB
MD5d489c6453026842668a84fc7706eb2a6
SHA1033708a47ddf4856982a1e96cd4b25ce3b2f75c7
SHA256cc424ac2f9e1c7f2b30bd23cd382ee24603b22f239c29a4ec4d0b2d17c9d0fab
SHA51293e55387127ff133d9350be800fe0d5105c40884f7b39edff163d00de8f65e49930e39519e2656ec7cb7b4556737d8d67907e5bd285f1ccaf402b823f81cc319
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB