Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/12/2024, 12:49
General
-
Target
2024-12-17_e0d2c1099cd1961a619f3f63c34ba4d0_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e0d2c1099cd1961a619f3f63c34ba4d0
-
SHA1
c432ee202fc21e7622c946306480007c39ebc4fa
-
SHA256
a89190bae83efc59360f88d59546ddc02566b2ab268b9be67eab1719f5d017a2
-
SHA512
4459ea5c54fe4f861a4b4de31c72f085d25e8664a658e11fc1ba4516a7f511cb6a698c5e4ee608690b5ee5221b9079e7d7d848d2abb6a8f21a7d85191fc2c09e
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBib+56utgpPFotBER/mQ32lUf
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_e0d2c1099cd1961a619f3f63c34ba4d0_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_e0d2c1099cd1961a619f3f63c34ba4d0_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HZhgfQy.exeC:\Windows\System\HZhgfQy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IsLkkFs.exeC:\Windows\System\IsLkkFs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MsGFGRN.exeC:\Windows\System\MsGFGRN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hnVwRPF.exeC:\Windows\System\hnVwRPF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qiRNwwM.exeC:\Windows\System\qiRNwwM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QtISEuY.exeC:\Windows\System\QtISEuY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OsHyfPK.exeC:\Windows\System\OsHyfPK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NpoFJxM.exeC:\Windows\System\NpoFJxM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iIwAfjv.exeC:\Windows\System\iIwAfjv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kVcKLrn.exeC:\Windows\System\kVcKLrn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BRnNwPE.exeC:\Windows\System\BRnNwPE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FdILRYB.exeC:\Windows\System\FdILRYB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mighouY.exeC:\Windows\System\mighouY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KQhupDJ.exeC:\Windows\System\KQhupDJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sHvyvUB.exeC:\Windows\System\sHvyvUB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JpUKYZg.exeC:\Windows\System\JpUKYZg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hEVDoGi.exeC:\Windows\System\hEVDoGi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xASUCAp.exeC:\Windows\System\xASUCAp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dTHLpbZ.exeC:\Windows\System\dTHLpbZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yRzWGlN.exeC:\Windows\System\yRzWGlN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kiHUjGB.exeC:\Windows\System\kiHUjGB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50e08588332a7ddb5c392710ed9470167
SHA1d9b80fe0961e80fb0d95ed535416f90f1e363136
SHA256f38fec89bcb5d195c2c4f433f1a19405c82ad0bcc72ab6783b10afc626e1ff81
SHA512a0d8a780655e1983d14ded228293d10ec359af0c42dd66b303cf1bffa1721fc13c94bcf53976052aece6780a182ac437df4cb6fedde828abd32d2dfa96a0154f
-
Filesize
5.2MB
MD5487970afcd55f657a78773243e673cc9
SHA11c0fb919e41d6112a484abd938e7ec5e5802cb64
SHA25629b46483fa0d79c18faf9825082255cd22725b4a23aef12614d7ba944e58a91e
SHA512a55d4faf83f1fc5b8c480c105e0d3ebce06bfb0f2303744bcef416f5bfd3d0686fff558067e0dd096ce50a6e4fcd68219932bcbb85234f5f1fb6a90323c86efe
-
Filesize
5.2MB
MD5de3d26774d10ced1088dcb67fdaa140e
SHA1572982cb9cfa7903720e6c2f83412cb6467b691c
SHA25678c86f8173ca45d2296f5c2d3ea0a8b938f82db6376fc7d5b338d64f26ab93ab
SHA5127030ec968cc3e72748cf311fadc978d810cafa9590ef82b5b0d23fcd7c313059bc1320e9f3e9a0ea57925ec32aed1b46392b40bc567fbd17c671d6135a5ddb9c
-
Filesize
5.2MB
MD574934931b009ebad282430096d3c1fbb
SHA14145268da6164cfb7d3b80f07fec3d01a052c4dc
SHA256660dedaa39ce0d7c21f8a1ea3db8e7ac6fbf6f94eed98e34a84ad3163f76337e
SHA51290d1b465cc60f24025edb43ac2303db7a67799485f102b6faf2794a5a49bba57df9b772f4f7a18712ec1c008a90a0472b2570bc93e89e4654986684e65d720f6
-
Filesize
5.2MB
MD5e463fac387286d233bf83e82404b3c9b
SHA1393532c799cfc844d96876800ae6517f29b99ea9
SHA256fd95de4abe781f10f5972c460c96057353e5bdc8e99e184922411ca594e6287f
SHA51208677f63c24ca5d6b7e9b47598b8e478df7283ea9931c06fa39b5d7b0b6d87a6308884376d867370501e9d11d42f8510b7352d197c26bbff0674f6d394ad406f
-
Filesize
5.2MB
MD552a3b86e2ab24999bb1e95d0c3f0ed31
SHA1d14e49c5c303855c6c507ff64b46b56faf36db79
SHA256df4a4f6cb6ad17303ba941be143219cf5553402f2ccbeb4538d2f7ac585b6fb9
SHA512344d6bfd6599c3c997d80e7ceaf7a5399dceab1fa56823c1e3dd204460580ee9d3f30b2622d7243b611bb1a9499f3ad595e5ce7de0a399a9d07e16471bb57af7
-
Filesize
5.2MB
MD536a731efd9bb90c69b206a8a3a0d69d6
SHA148c6c4b86bea8f0b2568bd26df30fa570860fe5e
SHA2569ae5987a097ffa00189683c19387fc7f7953e6f3b548e1877446ef531702e95b
SHA512bdc6cbc1c9f5bd33f2469903a308fb117b98029f3c1973a2d905320988cb01b7c4d5ae4471bfd26b7a8486061ff24a9ecb73e6c122bffe85f60f2ad86adbbfbf
-
Filesize
5.2MB
MD52acc48ac34066849888a9cd26cc92c44
SHA1039b2cf926951af3aa269136d13fedaa3328eaca
SHA256224a4043bac23ef49ef18bb9cf182d5213c05ec187e8753e340d9b4ff40235ca
SHA51276e217f557ab1e8aa6fdeb9794d0b4dabf99ad67755df157f08432bd2f71f4fee744438242f077c1fe45521cbaec8f9aafeeabead834a77e634db7783e274a1f
-
Filesize
5.2MB
MD5bc73860f0c986fddc5d5d752977ff9c0
SHA145a07abd31b040a3830f640bc7ce629053b7a4ef
SHA25616315ec747796bacd2f03fce7cc4db273d1f74b21e6d1f85cca491ad71f631f8
SHA512c75756fa4e158895ac80ffced3dc157c752478eb7e607d46f9b929d298b59cd0398a06d356e0cca747d2d71b440db746b4bf54de837e58764e58af7b0ff44d89
-
Filesize
5.2MB
MD5d659572e1bd3b7901797cc9064116510
SHA143b740e7541b5ad3fc0cbe3de05d1dcc71d0dddc
SHA2560bc5687d86138fad9b01030834d8c04cd881dba2ada11a63b229aa953e159f25
SHA512225456090afcbac3bb2e2cb0c424cee70f75c3765f2fde03f1a3db55b33b9a5a8d807ce4e570d98ff3fe80351bc183337bee89f1a18225c97b2ee73b35fb9894
-
Filesize
5.2MB
MD5f6f292fe5cc7c5d8bbfa6c23cc86df0a
SHA111ce211d81ccf15158b8a735a0e9956a52107be2
SHA25656c5009e607917afa5e0681142be8761afbe39a45a16c23f34468c1278f73238
SHA51245ccc5bf702cafa336674484fdf60810e498a3b76f4f7be5de735be458bb6462a9ac31a0b11fc7c709f8a868b34f5bf5376b74b7afdd3f9053fadc15dc1bd116
-
Filesize
5.2MB
MD52a154ef2535df9345d0a8c0485068093
SHA13221cfdc4b6eeedd15179c5169822c12a2be29c7
SHA2562ef94ff83fc9407f55ae152439c60ea481f643e98d5d47ad52cd1d892abe8bad
SHA5127a9ec9e00ee6e40ea1734cdf3b0f3159b8155a8aa20df9569f1f08b52b3a40652a60c4f3151b58d5c238c5b89f46e1a13268ffbd2346bd116a548cf3fa66dc74
-
Filesize
5.2MB
MD500e1dab3d8b3b7502d63ba8ce04694fd
SHA1d7aff87f6e8f7bb950650d354b17fe3662585e2c
SHA256a2b8a7f572d2d6e204880568833d02e1d2788f79ec5dfe899ffb0c70718c1ccd
SHA5124c8765ab4e61cda55d4208d9ad3f3fe4cae36fe7b8b5e9a2c914d701ae15f7eeb896084434ca5514e65f47a6b041c16e18a9361da2b7223ae7640dc76fe2d97c
-
Filesize
5.2MB
MD58345c71ee34af4dae2b4f7949943e64a
SHA1490e05ece5b36fc0b3faeb7cc775c2858275f5e1
SHA256eeff53e1f329edc1acb053b20d1140810c7bf7c0bfccc66fb5a43d0bf3a34547
SHA512003cd7c32f2b15774062352f126989a13c6a6062c39e04b9b87f4e02525b6b400ce0994030ce937d683a666e2bf5cb18d464b0c1f6aea455b3d59b3773dfd1ce
-
Filesize
5.2MB
MD59a8e8b2781c2860f571f468413d7f2d3
SHA1e8df6eed70600f757b03b53d4564955f804a2711
SHA2569acbdee14b322dfe52a16c5b13c3d13b9d52fce900ac1cad243e5a0b8ed446d8
SHA5123908807c9a07846045877e0b80b061fb0ec0ec196d9deaa3afc4278d78f62fbbe2768c139add3acbb3c6ce6e17001dcbf24e6497dce4f695c594b9741d6bd1ec
-
Filesize
5.2MB
MD5a40c48f75771280ebb2333ebef3ad09d
SHA191b7944f76bfecf3b177adb08f050c14d5cb456d
SHA2567561b9931b7b856c5fa451c0ee1cb0c58e6056447f82fc7b824b51cf6d4ee308
SHA51217af8084fdbfe8a434bca65d98a99bdf091a72c749e477cfebab41ecb320a9c681e577099365b2a09cc5832420596ffb78864172083b8c90f87efce286490e90
-
Filesize
5.2MB
MD569b528378e9804d81e20ebab8a9dad40
SHA197e96ae84b330c9fd2051f8dc17ea6adf36ccf81
SHA2567c0892b0a61a357ca551bdedb59f1d5034604f758835eeb613f4045c80bc3c6b
SHA5124eb94b7b41a92afc93d08dfeb6e61940a816162349f09bae699617cb17cbf68dfa9f1a072a72290ee7d049b8974e4e098939cfeabbac9001e2bd3a78b28e0a60
-
Filesize
5.2MB
MD5c8448ff7f67a06757847739dd53213d6
SHA103534c93204d975c0e35b5e316928a06da85c726
SHA256407bae896604835516a08ba0cb5072e0f6d8f0323c20480557e71efb948d21fc
SHA512cddd6e0ff2509c61f93595d5c932ee95f71b527b0b660c333bdd8ebe45899c78248b36b3cd6e76662e680534248f617f2df885db035b20f7791ae10cf1dc2982
-
Filesize
5.2MB
MD5990637a3e9684331e9380371a79f0125
SHA11e8aa23b37786b9149ad6331a3ed64f3e4fefca6
SHA25603055c6da75ae7432763c44ae93713449a81ccb27c0ac5a448f72a63173e6be5
SHA5126f94ac5f0856c3baf08ba0d85a7a9f8f84163c701cd202f97936e3ee9742cf8a8aca8332a2cde56e7437b217c0886f3b37fd9ba250c75fedfb125ae321227984
-
Filesize
5.2MB
MD56606f036d36eb18b98be83ca8532a6bf
SHA193475c1b1776f1e90a978298890446e7d1bbbf32
SHA25665ebf441f28a936b42e6e0b639f37eabb6ac325024071cc8d24c170b4d5fa06c
SHA51223d657359ee96b8815a5cb4c946bbb3de49c13d142b004705508c702f0f916660f6691c5b8e029807cbe1fee2cad491d0601bca6bd1fa0acafe9b71bb1abc9b2
-
Filesize
5.2MB
MD5fb005b5b74ef7db970321681bb1b37f5
SHA1dde1b28d34c91e6cf3139262221bd15f81180c73
SHA256302e2de2e63277dbb39f463e000a45e93b95d6616538eb95255d7f1db60a6e59
SHA512e80e9e699423785e9b88dc517a36be7aa163a76a0cd391b1f3793d64027ae1f4842df623a788c0c80ec0717fc8e3ad6d24bac2e2e708c2e6d53748d03afafb58
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB