Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14/12/2024, 03:44
General
-
Target
2024-12-14_2044a8bb0d43de0b69f371d1f27ffc5a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2044a8bb0d43de0b69f371d1f27ffc5a
-
SHA1
e4e9d3db039df36b9ccc28c06d66b020891617ab
-
SHA256
dc76f09f3da7e0e011038ac2d9fd47a355e27376ef3d66228a56c6d0cb94cebf
-
SHA512
e567328c1ff141edb801a937595b87a12d0260d7d9efeb84ce06e3f47447364097c56f0d70915f0fc0ddc2ca5c22a951ececde2bea9f19adf377f2ec4ad7902a
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibd56utgpPFotBER/mQ32lU9
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_2044a8bb0d43de0b69f371d1f27ffc5a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_2044a8bb0d43de0b69f371d1f27ffc5a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SXhBtSK.exeC:\Windows\System\SXhBtSK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jEFvVJP.exeC:\Windows\System\jEFvVJP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yyGTSRv.exeC:\Windows\System\yyGTSRv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SiJnsVR.exeC:\Windows\System\SiJnsVR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KVOdxSP.exeC:\Windows\System\KVOdxSP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UjdeMcE.exeC:\Windows\System\UjdeMcE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WBjnqhv.exeC:\Windows\System\WBjnqhv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AmPknOP.exeC:\Windows\System\AmPknOP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CCiZuOO.exeC:\Windows\System\CCiZuOO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AUIxigJ.exeC:\Windows\System\AUIxigJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lWKwoJs.exeC:\Windows\System\lWKwoJs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LHcAMoi.exeC:\Windows\System\LHcAMoi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NAlJFex.exeC:\Windows\System\NAlJFex.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DhUinFd.exeC:\Windows\System\DhUinFd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DoEhAcf.exeC:\Windows\System\DoEhAcf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bKRUEoi.exeC:\Windows\System\bKRUEoi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BwLpgIg.exeC:\Windows\System\BwLpgIg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\shTteQi.exeC:\Windows\System\shTteQi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uxotyOt.exeC:\Windows\System\uxotyOt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mYYcWnv.exeC:\Windows\System\mYYcWnv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LIaGOeI.exeC:\Windows\System\LIaGOeI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5728f26e685f4f1c00fb539112fe471bf
SHA17d0f3ebfc1ec439298954a572b3b645c2d29133a
SHA2569283138371db71cbf33a1db4f2445f25eb5dad594e1b9d4317d45d9a8bc47ff1
SHA512ec8b714b85958aa832686a89c56edf55f2353d23851de08e323a0c791e2091a04c555b658563a936dea22e8c801e6fe6b55ee7268dfc7d4b89fe772be4730d58
-
Filesize
5.2MB
MD5209a9786046dcdeec9934b8e1496059d
SHA171f87e03895efa8c6a88b51414c626f470fbdcbd
SHA2560274e3a9b8e2aab802906a75e12f64749d93b885cab83d3c60f24692d806ec66
SHA512bb4d5fdfb8f43f4351479d540db2d0296bf66f3d24203c4e7ded4b1ea687c0e60bd9fa8af2b6a861d16eaacf2760436aab3893e68c19a81082801c027f120fcf
-
Filesize
5.2MB
MD58fa1e18fe1e60e4ed063eeb320b75ba4
SHA1f581fa0550ca73ce5f7672047de8148175983daa
SHA256c58d3d88b4dc56add06ee3484872965e418b3c3e300d2e740416e5cafd3ce0dc
SHA51292131fed693ba3b95ba60939fff4448355084cb251a8ae71e9c36d7d473a93645cf652629dd64343eb60f2d84f5873926bee401675ba9cca34465d3ad1e45f2b
-
Filesize
5.2MB
MD50f637a71060c65ac0ce279c16d280936
SHA13006a4d4159ca603675212f3c2aa307f8773d7b9
SHA25657e212e473affcc2cf0b123bb0c0453872fa00dae6930e167681b0f88b9733d1
SHA51221171afe39c23659ba2d5d51557f41ad98967b5a6672c5746503c2e01e72925e5cc480e8f4663d928e393eb80032a51be9844ca382cd5f194456c57ec59fd16f
-
Filesize
5.2MB
MD5ab7d577482ae9450127d8ce17edcc92a
SHA1942a3047ca430b5c05d11b938a9e1480bb26d730
SHA256aa000e36519f1493bad4e6bad729e1a51b2319e4431ee10f730c1e7e5bdb7fb4
SHA5127be84a8cc0e912c6eba324c4a972dcb15c455146c9279d193d7ab6770eaa320b31cc98e0f1930b454775d277dca67bf91ee0fd77d479978b0c23b394a71726a4
-
Filesize
5.2MB
MD5d0bfc1936094d7c2d990d18445bb478e
SHA1d2988f9da3f5c378f9b9251745fb66c4122d3bf0
SHA2562b421714b858535b0c0b3cec4d0baad21375923ec17d9923981665bd56ef0e5e
SHA5127357bbc3375736777bbba13e7e3995f4fbf55c51c379a23a9eb2a3e46c365a9c0149ee2ae27580d12794c5a1dbd848905194cd7f726172b3093cfc081acffcd2
-
Filesize
5.2MB
MD5dc8f4194bf00d1fea9b0fd3b223b39f3
SHA16012a1b01a9bdcbaa5d220c55d85d29d9defecb7
SHA256b1549a498306a511c4ae832c9ce24e493065388dcddb047053b86231b1d4e380
SHA512b10222c58a61e74780361a6a821a7f5bd7967d8fb7927e2fc55d598b30864d65758ea40e3341969ed653ccee1f40c753e16371bf0d854d9e1fd53833e5cb6f18
-
Filesize
5.2MB
MD5e35f3fa6b3151d3c409d9c6b960915e6
SHA1274bb3a479c07059d7dcb69cdb7af424875828f9
SHA2567b41e8dc281b0efcc06436cecbcc981db2d397bd3a0b901faf17cfeff73ae395
SHA5128721529157c13d097bd2a521aaea119fe57ed259f3c2f1cdcc07e63f1b074b9b4c90b90bf5ebba7a7f7b0d2b2ce82add067658347d1051810e7f8f3f509a3f21
-
Filesize
5.2MB
MD59d201e610a7d3fc8a7e08a7b62c939ec
SHA1c49dde78a01210cf7887baa5c7c48c33c6e0829c
SHA256f5bc96439d7fac7dd14c8f8ac8bfc8d2497dbb8307096ea76de34520579d39c0
SHA51288f49fb198d36c38c4c52e497b15c9c15f58be53d7648e6b9086c1f041ba06c5358bae7eab09b04d6c998dc6c0034d7f7afe5add0b108458b7f20e1057ee85df
-
Filesize
5.2MB
MD5dfded37d24873c287b89af016e81e60f
SHA1d8aaa927bd12f427db66de7a91ec39313ec71bef
SHA25660f862ed5f0b9a9c9ff34edbfed050e9b22d860073c3c5ca248925f17d86baeb
SHA512fa4021724dd1b8e264eac5728c9bd7d5e8522dfc0ad407feac329cef3b83bbb8ac0faab8554e6cefce0f011de50598854052b6640d61fc0cd39ed2e507119079
-
Filesize
5.2MB
MD56b69278b6f969aafa7775db8e7b15c66
SHA1f97b86ade532e270972a370a4aeb9d21690f9009
SHA256072b7364661ee4e8179153ee6935a8712bed276e106bf37d7d7ac3e9fa8321df
SHA5126aa85787ab6f2a1c58369b012e2c1062b5c6652920cae4b998519a632fae120f750c646b8995bcce28173bbfb82e4f13a59916785a7b40d4dd033563135e3d09
-
Filesize
5.2MB
MD5329fc667049e010856b6e5fe4e3bf066
SHA109d3e20cf244ca0f8beadeb142e95696d0ac97b7
SHA256a410401c27c905b331053d0f599da48087afa9a8e555dba0884bc5129ae95ab7
SHA512bcfc52bf1a0aeaf8a19a98b214e52f11c00efabdf652521fece23f36281799d6970d8d2f833c9a0d74ada50d41da4dd12e4c4160d8d11c8b683cd057babc7687
-
Filesize
5.2MB
MD5c566c33b10c7baf411421ce13bea756a
SHA1a89b3261e3ed332d4c47fccfe3980df6e47f4ca6
SHA256fef695c75b70bb9e28a65a7dbe14018fc1d1092c9d6bd37f8d122a3624fb3017
SHA512a4024e8da8a955c4c9de0b4d918a3e85f27d901696f22a634a8af2108562c37aaf01c205588e4a41014644c188279ab317be5bb908f3a831d2f27b3d952140e0
-
Filesize
5.2MB
MD557fd8566a30ef098edc56e162fe03ed4
SHA1d5e40d15fb6bdd330197619ffc7a7b9b9b893371
SHA25679dc42857cf33dd579ae400cf6b036cd6323b4e3e19b573bca37ce68fb43f72c
SHA512b77992e7b1972a2b0dd8a8cfbac4571d9b42956385ca81154cffd83ff3380d836f3b80e32fa55b53155ab7da91ba6a3843d5c89e667072d693b1990ba43c1be3
-
Filesize
5.2MB
MD585da487b875eae4d0a85c73342180027
SHA118f63d3954314119808bfe8b0ce2c2141b565972
SHA2566928cff7cd7b8208e5f9b8059deb0e62d052e606a8c40f47bc7b8319ac7c90aa
SHA512734ac83415730b3fc15aef969bd823d96b9023de44e215a9499ad5ab07943b63a30bebf8c7b761786764c88b924d605f241250fdffa30a3142d3a5367340f3fd
-
Filesize
5.2MB
MD5ca77421ad9ea77593edfa0eb5567e826
SHA1f56d59c5cecbd7b69e184813be44768ab2eb3746
SHA256d06d319ad2509a9cf9c7a94aa69b15ef43fbab1bb7de2b91cc123af6699a8efe
SHA512d1f1c8cec4c02f3a3eee9eecb017efc5c4977e9faed4b630c44d7a4371fbbbe8fe4bc98a08d618beedaa5755931585c22aa1fcccba5c556f034d92fb68fc4bbf
-
Filesize
5.2MB
MD5a792ddbc1027ae5718480a3fa4739699
SHA142ebf8515e1a7ac0384939e3983ce6b7884e9008
SHA2566f8665a7cf4a4a85f06ac9bceb8a7dac176b2a7af23b500ec1b43f2e5701099a
SHA51278ae7fe48a21d565edb56a0d428b7f9956b34e7cfc43a7112e2745e6e23530021fe934a0695a093081d1841a5ae26f5d016ab6d66f2ed43e743beda99d2fc1cc
-
Filesize
5.2MB
MD572b4b92c657f126cfaa27a072f34e0e0
SHA1238cbf4ed43d4776bd1ae6e895e89dd1b533b31f
SHA2565ef9ee44ed606b8274d2d10661e83af55fcef2110409da2ee18033495e7a35bf
SHA512ea2146efff480b7c51cff0ececd29d37952c6c042d60da9fc7f5924648601df5931b497e997d9c4aa9c7d8167260c60c1f93ff201fc0bbf361768530159aa871
-
Filesize
5.2MB
MD5ba44c28a92b70c6829ac9bcb2795ab44
SHA1b7d9c422740b0341164ff83c75d62c0edfb343f8
SHA256f89af73bf6b71253f96fccc9e3a3ab2544ab56a736b8cd0083bddbe23823de88
SHA512c701348c79bb68b79a44af1fccd52b614137340e3f8b902703f907f35ae7d48da4e8456ed32752825d10a1d7597e67515b98f5545a4c97d8eb108f53d4a4f475
-
Filesize
5.2MB
MD55750fa9ec5e46206cef61cea13a8f595
SHA13cb5b16a1dc4cc69187d8057677cbcae0c3f13ad
SHA256b9e008c34df44b8f8d740378cf75026570ffdcd2f8c51b4627873772221012e7
SHA51212832bc373d6a46b6ea76b38098a22ba58807c700a63aad209696a10a0ad5b0850ee5f993784ff5e2d09a1e031a6f5970fd19c560e4ceb30e5a88e4c9bb196c1
-
Filesize
5.2MB
MD56780acfe0a975a70ba94a6efe78b8242
SHA1c53db59d32dff8e935623930f69427d718d56978
SHA256cccdc2e80eff12f5067139925ddd6941a4ca57e76fba4b65bb12a06dd71a6321
SHA512da4e13f6c443c13fa6474846c88c4d8955c00d426876caeafec9e95924d02d79f3838fb8d06017502a5e5d6b6577fc3effaa6f4440aef07721d2a72786006353
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB