Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
17/12/2024, 12:49
General
-
Target
2024-12-17_e0d2c1099cd1961a619f3f63c34ba4d0_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e0d2c1099cd1961a619f3f63c34ba4d0
-
SHA1
c432ee202fc21e7622c946306480007c39ebc4fa
-
SHA256
a89190bae83efc59360f88d59546ddc02566b2ab268b9be67eab1719f5d017a2
-
SHA512
4459ea5c54fe4f861a4b4de31c72f085d25e8664a658e11fc1ba4516a7f511cb6a698c5e4ee608690b5ee5221b9079e7d7d848d2abb6a8f21a7d85191fc2c09e
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBib+56utgpPFotBER/mQ32lUf
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_e0d2c1099cd1961a619f3f63c34ba4d0_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_e0d2c1099cd1961a619f3f63c34ba4d0_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QWFebsb.exeC:\Windows\System\QWFebsb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KsssrzL.exeC:\Windows\System\KsssrzL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FTzuxxe.exeC:\Windows\System\FTzuxxe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PuOjcCV.exeC:\Windows\System\PuOjcCV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uTIyIdE.exeC:\Windows\System\uTIyIdE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fdwhCjJ.exeC:\Windows\System\fdwhCjJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rjqvzUe.exeC:\Windows\System\rjqvzUe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RTDBITg.exeC:\Windows\System\RTDBITg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gFfBftB.exeC:\Windows\System\gFfBftB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bFUkfDW.exeC:\Windows\System\bFUkfDW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PJfURkp.exeC:\Windows\System\PJfURkp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xDvaRPJ.exeC:\Windows\System\xDvaRPJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FHkQELp.exeC:\Windows\System\FHkQELp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ioFiHlR.exeC:\Windows\System\ioFiHlR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hsCioEx.exeC:\Windows\System\hsCioEx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kYdeCTg.exeC:\Windows\System\kYdeCTg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fGuMKSg.exeC:\Windows\System\fGuMKSg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\opzbaPO.exeC:\Windows\System\opzbaPO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tAIxdfg.exeC:\Windows\System\tAIxdfg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kexInaU.exeC:\Windows\System\kexInaU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KOXdyfH.exeC:\Windows\System\KOXdyfH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58da15eaa8ec74748ec5355922acd12cf
SHA11666bb2cc8880dbdb4c8bf8eca1f78fc80524f93
SHA2560105fbc448466d3f6c9307c5d1ae67ce67bb87b4fcb1dcd650b551809338fb2d
SHA512e41cf8775707eba6b94a4b6b18e33f8f1391c7633b237dfb320d151825743bd3493059a880cae744ee23b427a0e113bfb2f63ce634819decc426cfac39ccf9b5
-
Filesize
5.2MB
MD5fd7745d06f911fedc90386eaff2faf9e
SHA191e9c67527165cf73066e385f1554f8a3d4ab364
SHA256b6e0a20513bccaa048ac81f59a9c3ecd6796b7fc189b0eac191ae1037d9158d5
SHA51209a6e7df80555052f67884f884aed2c2e00736c31b1028090b5fad02047d66965d07bd6009020cab1e6fb4ec948f15513029f11756f6b8005b40e95eb620e009
-
Filesize
5.2MB
MD5ab3f748977ef2da11b8c537d0d9d0b7d
SHA18c01d4fd22c9df9840545a4753bf09322c2e69c1
SHA256e7e05591957bf1641a73ae5be17112cbb6ae6c9c2d87e55a44a042d5e44fce3e
SHA5123a69c71129572272b99680dc1d00620fb715844f233f09584d24d058ea9dc8a9a5306ebdee6928a493f074b6241f8dd92732489b138a3da076be709d15c85cf9
-
Filesize
5.2MB
MD533574a03052cb503901d561ae4bd1d5f
SHA169cbb87509e50f23cb8a1069fe44f373d4081ec9
SHA256655c53476d45c637cb9f0e7f09276b773132122a366686febf7bff80304bb8b3
SHA51298386898f141b15e79a4b7ae7231f89c3dd7550d300c1bb125a2cf27250bc5c6640e80bd7b96b45b699284f42c7e40192bcda245ccee32337118fd1a61a6b6fa
-
Filesize
5.2MB
MD550d6463831a4e065829e890fbf7b38d3
SHA1593532749bd5b375130e84b8678c1111ca032067
SHA256f9d9dd7a0d7b836112810d7875f77af2d785ff2e12f49ee6817eafef70e1c95e
SHA51214fd1f868134b018b2a8bfb44e9cbb2fd26d03869f8875012416c757c8f72bbb967c468efe2b8401081b598b2d023229357eef7bc78f2908362aa10fbbd35b9f
-
Filesize
5.2MB
MD544238d43ec08ba6adce5e10716095d90
SHA1cf9a8fec923059eab3e6242372908e7adbf266dc
SHA256184d97a7c90210a7e9f4b953ae48c1d751655d912f57e33329a253a0f720b7ac
SHA512232dbed1c642b82ca626b808600047d3eb63a215f655fec46905ab6bcbb90d53931d061e3d1d1515ed85d071e37a30906b445edef0d1fefe8dc73bbec45fb8cb
-
Filesize
5.2MB
MD5abbda007ce14f950db042afde00490a6
SHA1cdec06acd65f43634146ea32cd9a19b2bc8446de
SHA25654e2a67ce3d48151880a57d84ea042f9f35956223ba561586b11a279de7b07b3
SHA5125f432760f51cee21389ae0a95aea09be7d0be4c5a202bbaeb0816523c9382462ca00a9df0dab9f3658f0a4f64434824972770156a9444dc864a9e9baa9c80201
-
Filesize
5.2MB
MD5083cc1efe8709fa3ee2023c57f887621
SHA15320b4dc535c5d43becaa6afca4756df7deb7e3e
SHA25688c05a4f99988775f588907e5f10e540ad583eb81e6ec580521fd268ec83faad
SHA5120a19f176d5805da8e2ca61d4788810e1cb0192f8019c599185a7304b9dbd8cfdb914c02e8816fe0bb8b27b3f4ef5a4f9cc4d5803a55257f1f252c3ed1a6d8c91
-
Filesize
5.2MB
MD5b5849f0297d8790e72eb77fd44e32f0b
SHA12ba006f0a3760899c307c4b8516d4096fe16bc0b
SHA2566bb9b2392b3192b5c932addda6a755ed32ac96b5a0bf7e76aac069bf2974ef51
SHA51221fc4a37df4cfc818839bdf5eb5d4075a4f331e1dec681d7cbb64ad852c06a28843d1daa9344fef8c2827d64c6ff797086da5ed311e6541d655d391d691b0140
-
Filesize
5.2MB
MD5dec86105d89086d970990cbd70a745c1
SHA1371b4133460af3605c8c68e14867539b258aa002
SHA25687bb39e11aa4f15f0dc6d1e57b33946d76e660743010add1c6fc348d09ac10a8
SHA5123ff7421ad8fec8e935cf4626fa30feb025b0154df470fa47ebe8075fd70037d28953f7ff882d4f594ac963a15b3648ce4a9c3ad8a58e74a76dc6e5dfdd44f65b
-
Filesize
5.2MB
MD5a536f1f679f55914a50c939fcaa8cdbf
SHA1560480b811426e999433dee7c759b55b94e8df3c
SHA2565a78e824b0b5cdd2e7fa9840718704afd8c4641ca0be08553f728ba31f33c9dd
SHA512eec8cec7855a38a8cea97dedf20a76fd57876990e561f77e9e8e68d888db64d39b49cd4794b9005cb42a648effa172387399b6a8dc0156a319532a48317703eb
-
Filesize
5.2MB
MD5b5f45783bda75b583f2b6001e6cbe366
SHA1b4e18c4181ae635c529d6a06a76b837ab38c22f4
SHA2564abd2028b62243ce8d6ff24e1d69ccd3d0d1acddb9d24fcaa16044c07653d503
SHA5127019ec0f7693c04754a1f9d62c40fc15531e5bcf3f51b3621e7c7796e606051399cf725a22239f68b2dcce9ab7d411a3762cb8e3e50295be5818b45cafc68333
-
Filesize
5.2MB
MD5ccdaa9853b72815b9e8f52cbae3cae1d
SHA146718b7e13361bd808904747569fbdb57069b6f8
SHA2566ecb077857558c74d45f6791fbbe8b0d3c801e22a89aa56da772d9ad96426024
SHA51289cd05a621a41a0f1562b2f330ff9d83d692dac98b5fbf3c3d988edb979a5a92809a14197455845f5929c7a2cab275b4ed819dda1775b6253cc17ed3a4b66bb6
-
Filesize
5.2MB
MD5952cccfb5a52eaa9253cb0db2c267a6d
SHA11e8e74f3397fd142df4e5d2ac8a6a43ae7d30469
SHA256c719f2102c6074380d965bd9dc74070f474705345c20e2d033a3b4f37db5a228
SHA512e9a2c3dcfa2a895fd206f72437e7ac1390b1c49de11edede26d0a9ec2c53b0b208d773facd714f04ff2e74899ebdcef4a74ba832eee60e823874aa06621dc718
-
Filesize
5.2MB
MD5c39bb6f467f333d5815b42f158285d88
SHA103b229cf2e3d1e43581df5ee31dc9cedf65c1d08
SHA256e65e58af85c27868cc31a42a0308cc4be5e7747867e5d68535438ede1e152d40
SHA51271f34e3cfbe65c8a207da142964c6ff34a553d286236acf8b1b3dbae3fb90719b9e7f7070e2f0086ef9f5da5bb66509b067acdc48079248dcd5ae6925b69ad30
-
Filesize
5.2MB
MD5d65cc7f626035d486048e4fa7c70dd0b
SHA1fa757ab35a73ff3afa4c34097505afa7c1ee060f
SHA256faa1b91485e2ac25f2c6f501356d2d11a7500360e895815d8ac2ce62c397a8d5
SHA512e998ff76e92a823ca6465bdc7284bc7eec452affa62a6f8b4bad65b278d6da50e2f9bde3f0561c62d66fe6ddf580769a813fbdd57d1f2c8fa7c5273a9f3a2829
-
Filesize
5.2MB
MD5b432edeb5ab9f8b1fac03a8dd6dadd4a
SHA1b4fd19989f3ce7c8392ff1d45bf8808118e480c8
SHA2565afa5cf21634bec179c742d024f1640a0ce83be66528954508430fa88ff6c7da
SHA51200c589b1d26acfde7a5301058b5afc7a4d6b98da7ab452de3ef9d631087eab0bd79d5e44be3058ae45f08d60ef3c8082a3ecfeda606163eea10ea22f3a2a084d
-
Filesize
5.2MB
MD5a8262e7a688ad06ac91b207d858f453d
SHA1a8686608520f29fd19ad548eca9a2662fdc35f12
SHA256879c7c38e087758194a30abf4cf2a4adf1c7a5d1655f780ec0a1a0b4959f0be8
SHA512685a1a49c84922938e6d19c3025a79c72531abbefbc0abc8cde3fc0f2a16e8dda377e0ccbf7996c9ffd6b9f775ef2df9604fb049687db330721fb0402b6935da
-
Filesize
5.2MB
MD5f73a96d28e7706384bfc266e29cd36b2
SHA1808ab7bf8700a3de48f8794c98e572ea1a337a69
SHA2563dcedb4fa1d180c7cffb1d3882618ca8e56a34cd7a72ca267d298a3117790cc5
SHA512b875e74a3085781d851860df0d2322aa1e909e87b8ee128eeaad1739f8aa23eb3c9e24316ea858347a384097e6906ffbb97a2b3e895ed470b26054246d65dce6
-
Filesize
5.2MB
MD55a1b38c5e4b4609f61d752be9645ac78
SHA14de031a972a2950be5f2abca2b6e3a214f494395
SHA256a2d0a99eaac4ec4cd018c80869e2f5bded598638eafb5dc3c8227b0a8cfd2067
SHA512e15a80363e5eadcbda07c365e2cb02c601e11eb5925e3302e8fad0c62eff7c575c2531d41176bcc51613de0f84afeea4692e993c1a9b5ad38a71c1927791b100
-
Filesize
5.2MB
MD5412b3821bbc8921f29d34aec6e8b5334
SHA14672e18c08995d6fdecb0f627951ad8533cbfa97
SHA2565937de20cfa0b1f97bee2f952dabab966cc74fd08dbe3cbb6d58a7503a6034d6
SHA5121351b56dbc962576fbe7527d81aac84b4676f2785a20cf40b154aacf3a942da5e58c203b1e8379393424834a1be064142400dc72100acb631a6a52237a3f9caf
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB