Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14/12/2024, 03:03
General
-
Target
2024-12-14_ead1fe5746bf59e91ea0959a39ba069e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ead1fe5746bf59e91ea0959a39ba069e
-
SHA1
2186e676d2c47c2f0f42e22826101aab76d58a73
-
SHA256
25e517521ae9fb8fc16fe674bf764391d179267472a839c5830b785d767ec637
-
SHA512
0c9696084af25b999fe24474c55c3a5b1be65d30ff6f1ce6dd3112ebebdae01ec6426b0e09f59a04b7547f6a68e3f99aa047a0e7d6b09803a6ea4d402879a3fc
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibd56utgpPFotBER/mQ32lUE
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_ead1fe5746bf59e91ea0959a39ba069e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_ead1fe5746bf59e91ea0959a39ba069e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\muOqjJY.exeC:\Windows\System\muOqjJY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OglVenb.exeC:\Windows\System\OglVenb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tzkPckr.exeC:\Windows\System\tzkPckr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VunMzbi.exeC:\Windows\System\VunMzbi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vUayYUp.exeC:\Windows\System\vUayYUp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IGysJrd.exeC:\Windows\System\IGysJrd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EOUxXRR.exeC:\Windows\System\EOUxXRR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AiqeUHd.exeC:\Windows\System\AiqeUHd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BgiqlHV.exeC:\Windows\System\BgiqlHV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uonPSQf.exeC:\Windows\System\uonPSQf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tRbOaHS.exeC:\Windows\System\tRbOaHS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mnPKSne.exeC:\Windows\System\mnPKSne.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oRJPkCU.exeC:\Windows\System\oRJPkCU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YWXVhEv.exeC:\Windows\System\YWXVhEv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\huwNBtt.exeC:\Windows\System\huwNBtt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JeEZmsg.exeC:\Windows\System\JeEZmsg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NVtlBOy.exeC:\Windows\System\NVtlBOy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ibIQzBH.exeC:\Windows\System\ibIQzBH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vJRhKAB.exeC:\Windows\System\vJRhKAB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NWYXLcO.exeC:\Windows\System\NWYXLcO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wjuyqin.exeC:\Windows\System\wjuyqin.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52cd5d961686552cde4a9b4d014836c1f
SHA1d1efd1cccc41f4beca93ef4b83f4d9665ca1a966
SHA256a7e931f3c395744377e216acf46a8ec2bf99b941663dfe875f7fc39d9fccb9a5
SHA512b64667871d1ccf1241b0f53cccca3ecf639566b0626fce44e08f46cbca98261ea2fca3e2245407789cdcc60c2540eadaa98288a918b386c6a24c308302f35781
-
Filesize
5.2MB
MD5f58c1140ba7a1df5df2441aa013f275c
SHA18fea87c34952d0bf317f3365becb0fbcbfd2aee8
SHA25659f8d3c69f7a6297a7e87d3286b6bf980bcc38fd025236b7d5bff88861432910
SHA512542249007aaa5d6d6473e38d333e7ec369d0ce9ee399fab1f5a0eba5a53803546476b0339ef94a43485a7785a61c900c9cd21310ee9db99bbc479b0d986bab32
-
Filesize
5.2MB
MD5b30113204e33ebcf5c1dfb8c1e7189b3
SHA12d62f04678d9e3914b128d4751bbc5b803ec7acc
SHA2564e6ac239f4ffd6b133a2d09acba1e35afb5cad521a8a009ef548998c8d8c3b85
SHA5125989979cfb812da76f45fd71b6797ebc2334989ebb3b348cc3c87c1d56939b7e1b5b2edce387dc9d802fce549dfc7f6848470095f9aebc2a4fd39bd63006fb3f
-
Filesize
5.2MB
MD58ec2dcb3ad4d32d9822c580df7b075b7
SHA103021b269cf570d2609e6b9de9c78d44ba120d89
SHA256d0961e1ea7ea228118d8d2c50c696fd6095ee9061304b7a4ce433a8bb4179b93
SHA512673e2bde253e4ee57eeb17fb5e390a55e4231e49de6180575e431f652c62af7b1926ab06613852f9685231e55d242cf6f74905926856961dde91c7d637708af8
-
Filesize
5.2MB
MD57c412761ebc4d2115b27b7984cb423a6
SHA123dc092b731df997ebdc06cbb4695e67af0bd376
SHA2563ec6b01d1d13a2bad17008625366dbcf94c526a9f51c48d2fa566dede45043e9
SHA5121329c0141c6155608241131b7b631c4092a53c0777a6bd835921c191b55ee4693a980a17d3ce16376f591de7665645fc1c2fbd48957515250dc1751f41ce7cf0
-
Filesize
5.2MB
MD5932a0b7428a7aa6d92cbbb66d94a0159
SHA13433a02cbc2f83ff68b22f45d94014072c3e0428
SHA25681947420c90e55dfb2797c95f08a69d13837edafc5c7c49d2ba3215cfa14d827
SHA512660a5eb8abfad07874f148a14148cde047c30a3bea4a3299e3c373ec3909206c15a2d04fd7fef425cd3dc4240fb46ac65d5c16a8b8b026df38238b8dd8dcbcc2
-
Filesize
5.2MB
MD5968ea21ab747419720de3b987f968906
SHA1dd6e5e0a33c35a1205f662023155d544b5aab622
SHA256618021369de8d10e7a1767a9bb521cc2ab72a9498046e7278f677802f3b021ff
SHA512c3622557cf56411b2ef2535f9168a703c32db7f77d03f22bbadff9727fb4bfd3a75aae2be89d1b878337217f62602934544eb0d965125a3ad6456be1341efc93
-
Filesize
5.2MB
MD52bbf825d67ba1e0ffb2e07426f5aa2ae
SHA15049f564ee79538d921052a2d02e0b013b84f766
SHA2569d7c3e090818c1dde36ac9b250e3a438f17580cd0a9dfa83b2ba307c4fe93d62
SHA512305f4cb4f4b7c6e56bdf561a8157da270f93eca4f11fcf31c43321c75bf3e16033d6768ce462edbc1bf9c253ec411d8a44ebe22052450e2adef6807b257febe0
-
Filesize
5.2MB
MD53ccaefb949f179369f569dd2a9e72cf8
SHA15d6b6640337c5495487d64642236bcc13748e6b9
SHA2569940d1f257f588bbb4ae98113660f339decde8a6b52d394a5f5a1f2cec0e965a
SHA512c6a8d0c705a20058ee78ad3ad96ab44d7b24544abcd4d64c506aa05baa9a5078f30c43102ff86befc743651ee08c3620050d74150151b13271d77e5b0de75996
-
Filesize
5.2MB
MD5b79bf1c5d481c644d1766b9c8d2fc22f
SHA16fb2f4efd01f80d3cc9d315bf1215439d981ebb7
SHA2560294dd2196fcc9723593d0393660d9104bb4826658f4c9a256262ee03fe5482f
SHA512f2d94827e9702b09bcef7b5e58d14844a1a699c412954e6706e2cd874d949a86f8b940625c619ed07fdb9a839c89480a3e4662177cd26fae6d0e7db536eb2ec5
-
Filesize
5.2MB
MD57a21af9b0045b3ffc7dd382c84f6ef44
SHA158bbedca24ddb911f89552fb9fb204a0bf17b2d8
SHA256ba19dd393f0219588b640f11dde11e98a298213a782d8da38b23d1cab0251293
SHA5120811faff945b7e3e6c0ef3436fb10174ffdd5ee0b14dfad79c32b24f113361ffa89947d272a26690a6f79e5723067c7d6b270b1a385c4b9388d219f1452ff26d
-
Filesize
5.2MB
MD50cf8638420e46e166cedc6d8b88e6690
SHA193b1582c073a21b7c88bbe312f30cf6636870e4b
SHA2565ed2b0fc9543b0c843d9788125e2475448c4c060bb30c23dfe0447de471ccffe
SHA5126d23ea861a640e836fc6372f74b1ec9f94b8b0ed70cb60b530fe0d1ca89df2482dfa2b25fca10d4adf7a61879a3a90360e10b6051ca6ef77a90218653400c227
-
Filesize
5.2MB
MD5eb2975530767f1af107103a7b42122ba
SHA168ea4db506b7bbd203d3d70779a30ea4c6286ff0
SHA25628ef82d5bf92240123600ea9d92a5904959506960b879a7b569328738f4036b1
SHA51261f8e8a116701adf1a816c86de6188b0ce74c9268e33bf1ef539f44a0f5a00c4e35bb8c4f7292315eaf4262fcb351aa425c5804108d97a5bf27b32b888f4059e
-
Filesize
5.2MB
MD5e27beb670c3753cd50fc37bfdae635c2
SHA1dd06ad8872d13df48913454cf8192a868b1c115a
SHA256829d310ac19349ce760498f1d14745974c39fa75148398a2c843e9c8e5980826
SHA5124d1b17865d6b47ffa42bc8b9f1555cbbff2f13a09872f31b2720186c1f5a4dc940f547bc47af656b1236dbf4ca2cc21cf1d35514825f7b1c399be291dad3b2bf
-
Filesize
5.2MB
MD59df23bca70b774f86fb8fecd91456238
SHA1b7927b314885155b47f1069ec6e29bdb74fe141d
SHA256b038b42e3cb053f183a67813087a178e52dc88d398c2de7cbc66a0794ffaa622
SHA51249d7a486eb2e7d05a4d4c1aa148bd3c35e2c908621a49e18261568f9f1a9c0780f3b9b7e6c86b01d50018a2bb4e54e74e855774a35c79200d8c639600531cbb1
-
Filesize
5.2MB
MD555afcb218eab8a4a6c0f8617b6d2e40f
SHA1c5ac3997fef984804f6385625f48da65140b9fcb
SHA256ba3327daa56193959fb2a2a3850efd953d9b06408842214925dbf3c6a0ca2346
SHA5121f32e735bcaa6d725d0249faeb4309d8cc5ee762c032bd7bdc75e20a8ee8ece55f9ef1a47ddfa6a8627ec90e69f0e86473ff6880ed2092dddeefc8528a9f8cc8
-
Filesize
5.2MB
MD5c18f0b8c4843888f7d68fc3ae2435595
SHA130750901ff940fe6181d1b95563601f89806e82c
SHA256ff537b5e2a78d27207800bd1064ad061aeb6f4d69b6a31f230b2bf1941b2e5a2
SHA51292a7ee717bc684d11b07e264b705e45f886dc6ab3fda8dc7a145943260451f57fa1ad139347e36380faa323ed3d9c49b971098ece6f0a0a678473b00721712f0
-
Filesize
5.2MB
MD519499c538c87e2ad412927bad256e491
SHA10ab2c4c19e816dd2909b49e30d7f6347b01bb7b7
SHA2561ffede9f4e2ba45ad8632a4c3c27dd4a4d93e19a834f2a47fbfe73b9ae465c6c
SHA51239efb28a2971b79e8b0f043c32e1f61d80ef1a3b4d723df31024c0248b93946e8b7e4d18fbaef88897757e48f9c34dd0a8635806047c3067a13660b68a09ab17
-
Filesize
5.2MB
MD5dec3d5ebbfb15553b1d189e73fb77151
SHA1f547b08f496ded7ee48acaed208e535c994d35db
SHA256694a833b50e7b8b81cd3fe20a3677bc74b48a7240d7fbf711ad3f0ca5798d7ae
SHA51215309eb2dee28e54063e9835d614996010be5f6b3a90243d301b2066aa7c626f63f99b6d39cfb3a90d80674295d7043fd5f80d3eb7a26251e0f752e566ee321c
-
Filesize
5.2MB
MD5184bc1eec6648ac87ec81d6aaabf26fb
SHA1c181f804c2396ec43c66a50343d53757ffee005d
SHA2560e7bccb327bb92ef7854a6742ef2f5902ae56d0058c1462c91e8c44845b47474
SHA512cf91c59857606d1f74e4b0fe982e7fc7ccad0b3512baca7cdb7f88ee58421b2d913aea53a164b86983c28363c5240b04068dd872761cb84a8d91b9a37391554d
-
Filesize
5.2MB
MD5d0b4f5be996c3ba9057c2d468ae25519
SHA1339e9e54401bfa51ee4023205696480511d6beaf
SHA256605026960181431de9d361818d31e64846230c623c8076ba409d771d0fc954a7
SHA51222ce0f7453bf46abc1cf4d89b650d7654f61536ccb3fa96e5d479725402bbd06d7fc027b5cb0a4119eaaa9478d76756c75b8f1cdeaf35b4368b4c3eb6d050578
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB