Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
14/12/2024, 02:51
General
-
Target
2024-12-14_68bdf67bf7dea2b983150fa6b0c83495_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
68bdf67bf7dea2b983150fa6b0c83495
-
SHA1
fa8f8ec1f70753ce9431f18b5e0bac7999e149f5
-
SHA256
b2cb7fc5a3539d6a5ce36d7f371e224fafa236534b01b999a74310a9ff9dfb25
-
SHA512
ec5b52c6e88e9d7a38ccd5d7a16d177ecf9e60cbac513a13bf45c0d6d2c85dfa71657bf6c747af6b13d57f06f4ef32f34101b95d6978861d5adeef1b1963d909
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibd56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_68bdf67bf7dea2b983150fa6b0c83495_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_68bdf67bf7dea2b983150fa6b0c83495_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rBhoxyS.exeC:\Windows\System\rBhoxyS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wJyZJZl.exeC:\Windows\System\wJyZJZl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IwTXjcA.exeC:\Windows\System\IwTXjcA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LVBkQsI.exeC:\Windows\System\LVBkQsI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YdxIOJA.exeC:\Windows\System\YdxIOJA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hIhjudC.exeC:\Windows\System\hIhjudC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VZmlpVa.exeC:\Windows\System\VZmlpVa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pEzDZCV.exeC:\Windows\System\pEzDZCV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PndVUEc.exeC:\Windows\System\PndVUEc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ujpIDsC.exeC:\Windows\System\ujpIDsC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tbWLWUr.exeC:\Windows\System\tbWLWUr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IOPSrdI.exeC:\Windows\System\IOPSrdI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dVGDYTq.exeC:\Windows\System\dVGDYTq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\opMHGCv.exeC:\Windows\System\opMHGCv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wzcMpzJ.exeC:\Windows\System\wzcMpzJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ozKRgMH.exeC:\Windows\System\ozKRgMH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zOyleWC.exeC:\Windows\System\zOyleWC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TFuufpP.exeC:\Windows\System\TFuufpP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PDmNvEh.exeC:\Windows\System\PDmNvEh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rQFdZiE.exeC:\Windows\System\rQFdZiE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bPzklXV.exeC:\Windows\System\bPzklXV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d40e57aba3756a9edf57a8e8c72782b0
SHA1cd5e256fb5ac9eecb8b04d77af25a39d1b4968ba
SHA2564ec9e8605b814fdc15aefbd274582deb1b1e1b6d6f39fad96d0613c17b8da0d7
SHA5122e89b36be0e42a01ca07158c1945e4c69ce3428e4afed55108271be9c2a50adfd1ee056347ee515ee4aa4c5e560b6c1c086177694a01e79a50fea14056989dea
-
Filesize
5.2MB
MD5416d4cffa72717d28f757863fb0a5a30
SHA10026e83d0ef9a3595f15f24e37045e15470c59e5
SHA256a981360bd81196e604c4fc5b95f08ffb631480f17527f3d9b86c6b637cc41486
SHA512d103e4a0d1cd9924f0902d32979988f3637d150edaffe51e598271a74323b6124c9707c49826f4348c2d199dae03574f7617cd86b38c6a171c7de8aaef8a603d
-
Filesize
5.2MB
MD5435658ff6c181bed3093d5801f1bc2d0
SHA16dcefbc9a34bbb4ee473fa8a74e46f3c5b9efd7c
SHA256e6bbe7d64057fcc384e541a5155f88d1e8cbae2c6165552ac3e0cb14ae119c72
SHA512385940fa35fc19ab8315edf69aec796607c332a76c43758c480545e06faf318862d25fc4a2e889c3527093418995876abbcc9e3e8b057abf3f97ebb57971e749
-
Filesize
5.2MB
MD54e213b01e43d8270203df526071b8c35
SHA1c21a62693a6385104457f14eac3e9cb212d0e201
SHA2564db7ce6a026cf7f3fef6f6eae2b4e2a1d65ea33b68f6fca48166680c0ddfccfb
SHA512bbb957bab2584d969ec40ad81c035ce12a88e4042dbfafbd23d7f6c4a84614679993425ef9a0845d48eae6a52e6d6c9f8e79ba9c14d6af32948008380ef77619
-
Filesize
5.2MB
MD51b838cd4234d815d0f5ed6a6342d3d17
SHA18197c18194d01d622667ac0630f2ac6989b22c01
SHA256433c984020b55e50a34200553c9073bd71b9e68d704797d252a82d7880f57af5
SHA5122d248d89ab50ecdba2e790b04800259346c778956a5182de5e7be7660ff9ccd0e21aeeca4805b1b039f34611e345abceb80f319a0709b46e96f35078b74edc33
-
Filesize
5.2MB
MD5b72f15f7af461f636727da12e81a7998
SHA1f98535086888b77428b17cd8ac6b33caf9e28e34
SHA2563e7b4f06df2116347f336d36693f3ec0b94958989160fe82f0f455daee80f8c7
SHA51222bd0fa25dcc4e5ae3f1394b6440baff83ddc4ab18847116d432917bb9e615c5e1f00a82d9735b48d71d9f63036957bcd66b6b07ef40c746ef2c092d908e0f69
-
Filesize
5.2MB
MD500949116a0dba423229c5073d8e731c8
SHA16448276c4bb56fae84fc74b9c59ad4e08edd7e28
SHA2567745e0c627bae1f9505699bd48d45e6b919a4809eb01822a3a648566a344512b
SHA5128d29fece7e4dd5031ec25cafaf1cfef99b2eb2ae069bbacfc1554e941f41863207d32e320992e7163f77c9d374027cc9e8b80a038b13324c57a54eee27963fd0
-
Filesize
5.2MB
MD53d7039c13455df7da690b18dc718132c
SHA1ea62351f34f7e22d229cb664748526ba71b9840b
SHA256f3d562032f6971a4c92023406422c1c3ab6abf9e9dc7dc67c0bb987abbc4b9f6
SHA512fec6494f045cf8d9a0136c0949f152c6f990ef21fc5fb73658fd4c871b7466e723be00652066f00ffc8fd537776bc5e638cf509044e84dd05504c9ebb4cc16f2
-
Filesize
5.2MB
MD55d53b5fb8334f2b24e0a313e244f350f
SHA19a6f18252dc90742a410247077e7fb56068d7cc6
SHA256f2522ee9cd40e111ba7b19a2bc0bb01b79d8268198b93e3f3b72589772e339dd
SHA512ac700f80265074004506abbcef1021adc5a1abcaa3b697a686fefeb004642b15ee4386d9d5e9c7933be7abc09ef226cb5af39e961a53e9cee19dd54f02ff52f1
-
Filesize
5.2MB
MD542fdf28b2b950c82a9acc5cb11d41304
SHA1e862f5e9ea55c17316abdc418f25163a07ee3218
SHA25645f1b2f42f8b3d07324dbed0db671d2254093ee71efe255432d51a9df3a048be
SHA51258e5a6b514091697fff686c409137849e920df3031b8c5e760c5883789a3690860cb1d6dc86da13073202240a4a2c6ec247d5807be0b1ae7050e0e29098101cf
-
Filesize
5.2MB
MD53514a40812835a4c21431449359a1a93
SHA1ff705a14e2e19e984115d4532a9e2ae231d66ca0
SHA25690630f1683c2b0044a53b431a186b81d8b92a51408c4d739e91ab69006bbb7be
SHA51252b1fd64c34fed894d038d484ec6f06074a964a308c438a6a662ad16e8136daefa31fd8254855ff475c30a6f89a4073df92b23a68675a7e112b9942361e9a9bb
-
Filesize
5.2MB
MD5d95b23665b4ac1a2908671fee59377e6
SHA1da874efa2c98027b9f42bb63efe136356b449285
SHA256c0370faf6fb66cd04943d43480ffbec9c066b16d170f791eb452483ae25d49c9
SHA512eb527d8d756e208c1f902154769d08ba87bd66cec876945e0fb01abafa1a12b7175174f991a2e8717ba37b8d66961023342c3233776118aea4b372a71e87251f
-
Filesize
5.2MB
MD5a352e73c02121616f0efadca6cd9ab24
SHA17a5af4cd5b1a53f925c7dfe9ae7e4fabf3e9efb8
SHA256022f4ade4122e12faf0cb1d3ecd1c90e08a027d2d619948e7fbbae931bfbf3c9
SHA512439250380e8eabd0e8d2d84f2e25f9b65cc67fc105527492a5537dbe4b6e2d875bac7a5747ae0ca10f28f8b1683df6f4cd445de28ae339db9cfa9b0c340140c2
-
Filesize
5.2MB
MD5438789bfed06e4c83e1ed5e556df5ab7
SHA187d79daee9d565c6f3fbb91195f6703e0a0572c4
SHA256536e1a91c87d03bf1b3e75c8a18141fcba65192d8129a225a8ead7b1496a6ee2
SHA51294d211f4deee6bcaad9a90becfcf1b63554274b97b05fc78295627c3c5f2b9accbb224dd55774095254ba5960039faa4ea4a61cb6d005a94b4865d9837140091
-
Filesize
5.2MB
MD5952717d75ad4d2a96371aaf68c42dcd2
SHA12610e33e6dcc07ad591f7e5efdbaaca1dd7b7de5
SHA256bc13aac6bed54dddf0ddc40a462f09c1f1c0bd1c784955d786937bdbad77fa0a
SHA512060f42eca6ddd5d8d7184e218cc0bb41d41828c8d708707cb397562a680674add04c772b13161805dba3f88da9f2591d87ef087bc12d9a1923d307c03d4afcd7
-
Filesize
5.2MB
MD52c0fe34481eeee04cad69f44f4489fdd
SHA1dbfb15b662742adadcf9e501c382874c60bd270e
SHA2561092b9abbe29b93536be0b4263399193760d64118afd3d37f285d0d7701dde61
SHA512083a8e6bb5efda2f11b55f209ed96f2f9ea3e9453df633e96eee72181a55ad6a81749f22dc8948f367a391820851eda6e70e6d3478d1e974cb5633c1b519de8f
-
Filesize
5.2MB
MD5f5ee12de81f78baa779aa8b56ae1c62b
SHA10d3a6ee9a207581f275062d44a3acfe0db673993
SHA2561fdf12224780910ea30fa96a56c23d87819510944cc892922039301dca54735d
SHA51231b64f9148a3db1be15cb249eeb8ecd1ba967b383053adc75de30c6917796aa978f44236bcc25fdde0437699dc092eb80b30f95b222fce42d45cc19639b768c2
-
Filesize
5.2MB
MD59a0926a335c332c8683e8a9861f96400
SHA17f6c4fd5b0c534f5600b79793891a895efa4c9db
SHA2564ed824b053d6ad93b744c6d74f70ba4cb5f52b5f36496d7bab29c7ff07079d5a
SHA51204cb6c0ca09524a6b252dc9c6bd763930946bc230734675b7954cc8871f90aae4f61fda645afaa376886fe2c411fd4e41365f0d1a8e06b215aff7b5363519de8
-
Filesize
5.2MB
MD5ad6b2d2a39639276313d2e24e51b4f07
SHA112b5bb6f17f0af0e36bf6c3327477bcbc0036b4b
SHA2564dfce250fd8673fe9e593486b0403213757ddf77303d3d4178ff9e21b9dfee80
SHA51228483cfd92612efe9cc2d6963112f1ad660a5f536d467811b1cee69b66ce9fdf2d7af655ce6799c2d73cea87cba50df177fb813a8dcb4ca93edd7e07edfc9cc5
-
Filesize
5.2MB
MD5c7f75218374a7a856f25276edfb42846
SHA1e03196f8be598f8464127a61b1c8c655aad5781c
SHA256568ee5a7e8bca18d09e2f3ed1b4ec21ebdc35a70478a8fb9384b472c6933fd90
SHA512d30b8f044959b46430ba52992947f8664fdef3f677b7e650e61411d3ce6f759c15629e88de1e66c4cae78428883d38a6fe63c00f88a14224d26708345b44ed74
-
Filesize
5.2MB
MD54102cca5fb1e29a179d6e86d0a47b1d4
SHA1fb922512abefa66bcf69892f9bfa386cb60cd021
SHA256c0ab4f0bc2d271ed423ac08895d2548dc93eeb61e515fbe6c758d95db7732575
SHA51239bff6e8eeb98ffc7f26bfb1ba181eba7485c8300426245016490809b83fa2d08d11eb64c460c03745a467332b360a4d91c58550059657424446e1744a785c7c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB