Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14/12/2024, 03:44
General
-
Target
2024-12-14_2044a8bb0d43de0b69f371d1f27ffc5a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2044a8bb0d43de0b69f371d1f27ffc5a
-
SHA1
e4e9d3db039df36b9ccc28c06d66b020891617ab
-
SHA256
dc76f09f3da7e0e011038ac2d9fd47a355e27376ef3d66228a56c6d0cb94cebf
-
SHA512
e567328c1ff141edb801a937595b87a12d0260d7d9efeb84ce06e3f47447364097c56f0d70915f0fc0ddc2ca5c22a951ececde2bea9f19adf377f2ec4ad7902a
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibd56utgpPFotBER/mQ32lU9
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_2044a8bb0d43de0b69f371d1f27ffc5a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_2044a8bb0d43de0b69f371d1f27ffc5a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\OmEWasS.exeC:\Windows\System\OmEWasS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WVLnSaa.exeC:\Windows\System\WVLnSaa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PHfoJzk.exeC:\Windows\System\PHfoJzk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sigcXuX.exeC:\Windows\System\sigcXuX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uuRickV.exeC:\Windows\System\uuRickV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SSyqyuk.exeC:\Windows\System\SSyqyuk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MZuCyzm.exeC:\Windows\System\MZuCyzm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ifdoiEm.exeC:\Windows\System\ifdoiEm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ASiKOxM.exeC:\Windows\System\ASiKOxM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\olrgZcg.exeC:\Windows\System\olrgZcg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OKeYBWx.exeC:\Windows\System\OKeYBWx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ThgRhGz.exeC:\Windows\System\ThgRhGz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HrVxlYD.exeC:\Windows\System\HrVxlYD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bcPDhaP.exeC:\Windows\System\bcPDhaP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EPTsxVv.exeC:\Windows\System\EPTsxVv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SfcQxFg.exeC:\Windows\System\SfcQxFg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kvFGKnt.exeC:\Windows\System\kvFGKnt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vlotWrV.exeC:\Windows\System\vlotWrV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JPogHvc.exeC:\Windows\System\JPogHvc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XnqyZry.exeC:\Windows\System\XnqyZry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\APSjGTr.exeC:\Windows\System\APSjGTr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59b9bee37eadf1c50f6169fb244a9a04c
SHA1fb10a1d0d05511a7a94bbf7d5cc5e8b8f274a6de
SHA2567afdfe70ef6f08ddb224b3478142e4aa3b876ee5604051de2e4afd887e6728a2
SHA51201a32135f06efcbb702bcf8c4711bc3bf01d65501128d7f9e260a2da4fa796ccf4c32264ce0f6cc56e24a39f4dd806a4230f473a01e357d652072f9496dba126
-
Filesize
5.2MB
MD5f56b277427ba70019ba52c17767148d0
SHA160b3f8a3f7679dc22d189d22a243406a5afc3bb3
SHA256f12498955244c23248c20098d0a33a3afa1a8abfd35445693d3e0cd4f05ada7a
SHA512964712f3356cc97487cefb273afe5f2b5709dc9179592c5a692842b80a11d2aa6662aeabc87595afbe9f9a70f87fa76a42b1be1e432a122f4d2f773f3d9b4b50
-
Filesize
5.2MB
MD537b4ddd063ac208edb4e6ff79d703f8d
SHA16cf78f82db72e0545836e9ed4c7c363e5396594e
SHA2567ee6c230f6545effba96263ff744b7cf972eabba247d0160e7ccda92d8d2fdd2
SHA51284bc3ea6bb98b16604898138f03c721e9a9efa5e10b3e2ffb5438596f2501abc71a1474fa16a2b2ffdf720c1e228602d7b31889ba39ade096b55af30f19fecdb
-
Filesize
5.2MB
MD536b9110895816ba3d94d2445403b1ebc
SHA171ea15c97db38b77ea2028c850172aa4bc48ce6c
SHA25682aa3100b40a77181ba263ac269999c553d107e623de34d67dcf11bf78574d75
SHA51292fac5e295caba59dac9ba6ea6e197ccd035838cb6c03ee5651ccd2b2985cb7b9143b05ca715b30ac881aaf12663fa085c5dd261444cc2d01a8a7419c7c8f365
-
Filesize
5.2MB
MD5f86dd21439e898ef49b15cb4e8b6ed53
SHA1ede57a8b74ba9a4c88d0c788ee559579278bcc84
SHA256e6149741f90cf65a49a54e836652d3829ce4d9857da30b1a6f6678687da9cc0f
SHA512ea60f54be3f158224691eac778d5e73df7497037262166ca929c88f478156c0e9546dafe271636794b7a403444e2e3e3758eeb51b7165c91cf0a9127af7fed67
-
Filesize
5.2MB
MD5c0decf581963c05e9070653631b7c502
SHA1db58c284f8e857640769524acf61c4f1b321ec7a
SHA256a46309f33fe2458c713d5798fd103f1ba4918f093ef76ac5f7481c83cde36d18
SHA51258379188d8a04f7edc7a471755fe5fbe7ac03e87a9ec8dfe4099cc4af39a4c534e25ea89dc4b4ff5c631a4a3927eaf6b009fc51adeddd87045a50ae0fc0c974c
-
Filesize
5.2MB
MD58c6dfb26c213a3da1b4ee0a0861e2166
SHA1a79d04d6fbf82468af782688ba36f0006b163a7a
SHA256b15922bc1d74e9159aeb6d8aed146c51a15c6ad2cd878be6eb41c608d87f1b3c
SHA512bd8a0bfaf9dbfa450b3f7ee6ec519986c77bdc8391bf6470d2c9e41b6e26828eb65164aae21506c0f60b51c72cad558593d7bf70a510433d8e582df33b00472b
-
Filesize
5.2MB
MD5d6a09c972a3dc16cb4d29826470656f1
SHA1cd7b854ca3e985cace06c982fd271b724e840a5c
SHA256802f66fb03c0c979084b844742aaf0fa898855e332eeaab87234196988498b22
SHA5129f190713a0c183476b00104443013fe79f08471615495c826e462a728268fe3c01c1b0c9671e97f08904b79e29aff2e692cf5566737195a5906dc06ae1f7ce4a
-
Filesize
5.2MB
MD506d28fc080dcca535d46afd3d56665aa
SHA1de036263238ca0ae35e843f1554c75e5be1da649
SHA256f05277a7a2b8c320fbfb2a032d18b2a749b31d7d7cc038c7bb7b196b17a2f03f
SHA5121d0744cbd242751c8c9017e74da2b80f8148a927ff29c076e8a16f9dc44e6bdd0c830b78fc937850f328adcebbd44f727a4eb785162acff039a26103098b5e1b
-
Filesize
5.2MB
MD5d69dbd5fb09eb045edd42954f53c8d89
SHA113fecc44ee65d366d9d6bd677f077152f013be5e
SHA2568d2d860c1b56643bc18013b0a1ee3bda29946bca02ad138094229780b50571a9
SHA51273533035960186e74f6e328bdeee4958ce818a8d88a86047682627f33283991ebca07ab7d89baa2e017ff96d8da765439aafaad4bc11a84461338823fe285a27
-
Filesize
5.2MB
MD5460c045093dcbc0e096cb3d1a07004a7
SHA10d5c2062d412e125c678c3ceeb07e221ee20e7b3
SHA256124fe0929b63de895f23d88bfc36a1900713169aa5e1ba7111eab4ea044c27f2
SHA512844186c506b3538160bf7580877e6a50818575e49eb134ff721f0319105a2e2fc7bf3b24120604b34a7eb4150d248ace0557f6d937b5993694dd7873fa5e4040
-
Filesize
5.2MB
MD5e451b48b685fdbc69a7db8e0f9551fac
SHA188358435128ccd411fb7be7eea8c86189b29b3b7
SHA25674cda285697e38c720501c708a5a6ef13335badee8ce1875b0a0996e53e836b9
SHA5123a6e2ced18dcf0ad6e79f11f512cb747cf57a1e6a89f17b17d079b6ccda0eee71e0efa57c751c0292c97bc630b40e2bbb2fb394e2b7bd0c1055faa6bf1b72c06
-
Filesize
5.2MB
MD53f3c7085a0cbc7a388a7c470dd0626d3
SHA19c9ec31ff8d60f8fecd2cc0a59a61d707ffcf316
SHA256c529eed13992884de13c7be6bd10b2e2553cd559b3c55ce38de7f110963c8735
SHA5128a1ebf72c74e18e5251bcb0d603e2ab632026c76ba2e5d8593c18e197d5656946b23f1ba42a1460fe563200efa370280bf20ee7d11b9ef6cebbc7bf07170672a
-
Filesize
5.2MB
MD514fc5051dd6e3ca9042ae844f9975d9f
SHA1d513e4d2b06bfec3afae0f730406ac23ccae0254
SHA2565b0c61532063d05296d4b3051e59d737c0037b7b146e3a4643f702c7f209169b
SHA512c4788fe963773efe1dbce1e9ce483c6e3edd8aec50e198eaff3482b27c216c33c308ec82af2c2cb1be99e3a1255ac8275cd32fef1870092d10360961aa9256e6
-
Filesize
5.2MB
MD5ff85fee0938beefba68ab2bb4e0f7531
SHA1df64876c0c4f61f8730bff5ef613b2d7b4f781f3
SHA2565537a135015b5a542719408b8b3ee73a89065a725276a23b27ddf140ed06af00
SHA512d43f987ce629e0e539795bedd9a8dc7b8d9a996203f6b514b563c8f36c1b04c42fe313ccadc8e94c31f81be310ff9c4b17fa7cb3fbca012e55c9feb1189b13d3
-
Filesize
5.2MB
MD5bd1059b02ee08c8614c773c8c81b7597
SHA134d44f78ddb5622569deb017a6a6285906e1f0eb
SHA256dd0c76de6c17fc719f2d0fc558943f571f0ccf92c69a2022bb458c7510ea317f
SHA512815629ad431d264998d7ec86d05fd6ca450e342e2dd32c79aaa1e0ef8ee58deaafe8cf8be1cc04ace5dc7edecb5103532ff154f49f6eaacee5f88667efc88ef2
-
Filesize
5.2MB
MD5b0f31b537b3b4a5c622e4370a2e206fd
SHA1159c2106c8c32e98e64ea9106e908819aeac958b
SHA256f31d5003836f4bbc61d23495c876a5785e0c6e37ddbb4611d0a93be1307e2d3f
SHA5120058c2da94c793d30e8370341074744d6df903a9ffe37c267194a6542493594933aa02248147221a848d40ebe35ff0ec5cfc23c1b30552e0e083f326206b6ef4
-
Filesize
5.2MB
MD51c746f6dfa55f1ae23f106c6e6100b4c
SHA16a4f63b1168b97d4de8149ba8f1265d9b523ba21
SHA256e8dbf7cf7b6219af9b9901ad1f46d74cf70f4d5f1debd1400c9ad7341577c363
SHA512548280b14e89cbe7c9500e9cb89c99d730a139d061be31fbdad148867df6ebbeeeb27ad3f89f46070c4ce95fedd38a57ce1ea5eb1170f5d0aad43afd8358ae7b
-
Filesize
5.2MB
MD5b22bd94093942f280cf7de967cf9e622
SHA161d51e77de9cdc186138322d2595ddaa70797672
SHA25678d78f658be5eee003f27e86a37f057946fd00774a52f762ed5bc38530935d62
SHA512d06eb6a9d8bc734031b280b9fdf72660176d4d91c98e968be1a6d3e2aa5f2f7412be2cbefe4e54dbccbd6741c6ab32439abe4056452c13fa6c9f19b77e3fca93
-
Filesize
5.2MB
MD506c0a8c27b9da9239cf9d41b677b73fd
SHA1dc4c8a63f1737e7db95c24e8018c9a413c10f477
SHA2561ad2da5ace6e50ff4523083e52577e2330b3e0eeaa02e87200f2011409d55eee
SHA5125d62175b0125cc068278dd6e7f692c37584e13e2e03a56431847dacb3ed0d02b5d84af5a00be683097b0f99e2648b6d914c8440757807f595bcef21f0dece48b
-
Filesize
5.2MB
MD5429f3054c549ff074f4820fced55717c
SHA1a5242738c981677572063ea6297f9204c7393d6e
SHA2569e37ef7b61efd73676df08faa766edc48c0ce6c49da074bc1ec038eac53b6657
SHA5121f0ec21ac88f5e787bf78b5558ecccedc42ac5b8d579aa5c02fdc00ab004d2ea9b14952e5807d15c839b4c383577d9024cea20369cb2beb301cfea1a40f57b08
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB