Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19/12/2024, 04:26
General
-
Target
2024-12-19_eca03fe7b307c971627ac3a3c106bc43_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
eca03fe7b307c971627ac3a3c106bc43
-
SHA1
e524a8a6705cb9761bfbf436149ac6dfbe71dd2b
-
SHA256
24a97b22d8dc9ea8c546228a3e2a3332f3986c8647f77d7c5b8630001088e686
-
SHA512
14e8b72b164456907b38159551cbae1a4b24a1221719188f45060981b5a87c0fcd662e25c46e78222491f49e9121aec610e929f7412e4caa8fcb8f9c4ccb4b50
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibd56utgpPFotBER/mQ32lUF
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_eca03fe7b307c971627ac3a3c106bc43_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_eca03fe7b307c971627ac3a3c106bc43_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XwXJnnU.exeC:\Windows\System\XwXJnnU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bShRhOm.exeC:\Windows\System\bShRhOm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uMqnwJv.exeC:\Windows\System\uMqnwJv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JnnTqxN.exeC:\Windows\System\JnnTqxN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UnitQBI.exeC:\Windows\System\UnitQBI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EfyCmSL.exeC:\Windows\System\EfyCmSL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wKvwSrE.exeC:\Windows\System\wKvwSrE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ybZEvfO.exeC:\Windows\System\ybZEvfO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hzvrHHw.exeC:\Windows\System\hzvrHHw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jeizAFV.exeC:\Windows\System\jeizAFV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\grsDTML.exeC:\Windows\System\grsDTML.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iZYPASl.exeC:\Windows\System\iZYPASl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TcxTHnA.exeC:\Windows\System\TcxTHnA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YFbUMua.exeC:\Windows\System\YFbUMua.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IGUdCxE.exeC:\Windows\System\IGUdCxE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cmSruoG.exeC:\Windows\System\cmSruoG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NMwCKTS.exeC:\Windows\System\NMwCKTS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mQNFzKe.exeC:\Windows\System\mQNFzKe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CuYjyoC.exeC:\Windows\System\CuYjyoC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PlrgCkF.exeC:\Windows\System\PlrgCkF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\peCtoVK.exeC:\Windows\System\peCtoVK.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54fe8dce3c613912c964dc1013cb7e42f
SHA1305d87bd805d20d32334d64544bcdb1fa68fdc64
SHA25677ea69d55c70ca75c2a9b394bdd45aff7e109322af9a5fc82cb0d6efd44982a3
SHA512cb5bef7770794d73ca90424734dc1884ec7cd84b190628134ec411cd09f61bf0eb852802e205677d8adf1bd8c6c57e11d2b3a9cc5960e70b88ee5636a3c5ab9c
-
Filesize
5.2MB
MD57a960c0edcf1f461a18411bcfd8008b7
SHA1656e864a7be1ff561da9cb4f398a906e22270fcc
SHA2569df060b4a8a57037fb66affba54571a166d2c100cdf6b6b21f08f8ffdb302afe
SHA512f57bf2311a664d9c02e54a492efa64e25103e6cd2cfc7298be4bbe76e96b09c5b0792ea613b1b8d14b4f7afa98e8f9fd854f1012e528334b9eea22bf12bfd2e8
-
Filesize
5.2MB
MD595ac4f163794073c1e692032e8614764
SHA15484ffd53569447b2d2d5922859ba4d4f7d5f912
SHA256ff94558cdf756b844863dba40bd5000eea9c86d7c12f24b4c3b909c630cb6f4f
SHA512dd80098642bb647880754cff30b316a4c12d73f38db90996b28393293389c37700f9837889de5e5c7464e2e097b7712fae5405a359d3ef6786c7576f57f9d89c
-
Filesize
5.2MB
MD5f71de6ba0ffc7cdb02a7a572b5c793a5
SHA1a8103e2fdc986423ad888aea0c97abbf5e8ea706
SHA256a2cd67264420401d05564038a2968535a1b211bd23309295b57a1e1effe25721
SHA51229b66b1b5162e4e90f422af0354d392da470cd13877a97db8b579fe9830de0f6e7e17c4ba209253b19d975f6438477999b90cd85123a269d39f8cf71c7eb7f62
-
Filesize
5.2MB
MD5756d4d2742ec3af7dc17673668945b32
SHA1a972c0e5754209e63e7eb75211c9f30f655f2d52
SHA256d17ed7cd6bf787648c63c1bfb2472ed7898d22eb062ae5edf4dd1cd97002c482
SHA51230b179efe6fdde64ea50ec68b8be15d1fea8a351ec7971df8affbd878d4f02ec549130f7dd5bc6444fb86dd122192ec8647df1f9927e112d2d02d24985290e14
-
Filesize
5.2MB
MD53d9b0fbf7d46c1486eb5db0f7897de97
SHA17c949314feed8af7c4c10ca3b9cbee7944035d28
SHA256d512c500d225e5cb53d9ef2b9e99874094fa61adfe679e5514d3b02afe3ebb2f
SHA512fd37613913ce8703d54923741579cf968569e01bf4a49b6b604f97d2d6a8bbb4d381624952cb1de80e474b4186c6085b93a17b930cc07a89b75c73834b642248
-
Filesize
5.2MB
MD55264ba475916abba5b5398d61166a5af
SHA1c1e356d8ef0e0c10ab96c7c392b9d900d6db936f
SHA256f4be61f29c4f1c02bc29186413d5e936cc205033f80694320271573b6d08a8b8
SHA5123a55669f0f1301c7c3f957971bb8ebe08da1e42d6931d28cf6ade37b2495bd6465d37a31e6943a7b7f7588e7373c0aa23c4b8e84b8adf8b0c1a4e9f7d658db2b
-
Filesize
5.2MB
MD5bc317bcba46cdde291ae15e93f925b56
SHA174747b293857f37f006403c999851dc516fc3d77
SHA2560e715eac11dac85b04353f5c73855296c7947177b9dc32d4028a8ca05d502edd
SHA5123e2db32bb2538bca28705b0764e663a16ca3cb7265fc70e349002c848433717a2789fce6a37dcf95fc398637db3c011d18a482afe93fe684cd693646989e83e0
-
Filesize
5.2MB
MD598a7219a22af2d30a708d8b690d3abdb
SHA13d56f56f983ac28233885a0b05d62933dc42e26f
SHA25681ade7c74ad507e93d106001bac3ea3696e0be05e0e853ce21540095c8139e66
SHA512ba22c50f79e66df50c7e98987194e36d4ee5dbedae0beba89fccc861c7e0f0c44650b44c694bd709ef4d3ba2b09ef1f63c9728700f582939f6d931161d9728e4
-
Filesize
5.2MB
MD5ceac3a509e75f41b275caee46fea7cd7
SHA12dca0b2e11a7f7dba24069e327dd9efc23de7aca
SHA2561be6e9a731d945f8387ab1ac8cb76cec4ee5ce7d21a581233649ad57eb040bff
SHA51284caa1969e17dbc7d2449d826588d98cddf98261c52a46f7688b0f228aef4f387928b80d8886dc1c2280abbedc035fed519e8cb3777964b2d4e7e61edae0d841
-
Filesize
5.2MB
MD565385adeb6f79404f428925b8925e105
SHA17f6061b8adffac56de83bb17d8ce34dab91e64e1
SHA256a60204e5bcdc029fad94e64febeff8ac0e72b90f312c1d74cd5d03def8187739
SHA512b6289da5959a48771dd21db39eff6dc9422f23e26a3b35720d49426e1a8923419110a63883408964e99c62cba289198fb35e410e3f19702958e6203e7a580d88
-
Filesize
5.2MB
MD552819b2588632c8a8a8ed3e6afce4d40
SHA192038e4599ca8f6571cb07170987c04e61a6697e
SHA256042305ede98b8e4b6b8ca3d40fe99a0ae12343d4c532a9a737f462210ba73a85
SHA512fe5f380d13c52480971e1b9728b612200695644883e7d3f61719440e1cea70a213ff0d7ae0968cc1c13ee0f80d575d724623ba172719b1d3f9653e4cf6963ae8
-
Filesize
5.2MB
MD5833687418fc43bac5a9f8a8e0b9b03e9
SHA1a9787ba8bed2120f33bdd7f876be2914c35626ff
SHA256ba908be7f3319e02091fc242eb02b629185d3a389a8a8f52be1b0ae7a0286835
SHA512fb3200c34dcd014176e71bdc99bb7ab8f526a7d3ef79197717ec11485c9f5dc1d74a134ad78a0224f0f6b7593e194855ff85602cbabbf0af12c90e9b68abdb42
-
Filesize
5.2MB
MD537fa7ac60728545acb98e591e9f96967
SHA1d4494a768bccf177885474f93bf774d357a36f77
SHA2561e0c7e71926c349c2a3ced1589378ad3cfbc97bae11d65254a9172cc88ba6d96
SHA5120d651c8bb71e79d59b3f827fc243dfd74f4fdc2507a80047499c5c8beba6e378bc059da3eeb758b80e5a8ea144b6022cdaf9216527f87881df12cf7b51c89c2d
-
Filesize
5.2MB
MD55f3ddb8069bb2288d837cfcbe91193f5
SHA1a3b74b372cad62abc7c9ab4ae17b52d5c0805488
SHA2567651d6aabbb35afd6551878e734c60a025ef090999766aa6919b6bee8f464f8f
SHA51233f842e6b37a675650b285a86edf07a765907a82583b519f2687bf85c0d716d075dbb459376c75a9d0d03b53dad9391953dbb4e58ff35995dd65cadb4a9e8e4b
-
Filesize
5.2MB
MD5a94bc9aee2b492d99726da77a1aafe23
SHA11ed99df860d7db7779b97ee4ebf3b80cfcdb08c5
SHA256e80869fd6af4983b852bda9773d41419adf4c812bbe8c060868836f33a8dbd46
SHA512a1ae879b1d4fcf81e4c592878f56b8165b8d66178ed1eb5f4d20732438e67f6bfcd674e7596e44347270a7135d70420d52f03f7c0d6db373ff79876af12b1e08
-
Filesize
5.2MB
MD57b7488cdd7ddc188bdd3a4994b9249f8
SHA17c6b58a6dc9741372e91db1da78989ed4e675ef8
SHA2568b7ca8aa5cc2eadd314a7bbaf10dd10f3b87c0746e332bea2db95b376cd5f5cd
SHA512d093d7535ce23968333fd213d0e6e5075a08d9cb370f3bc886725bff55450a7cf4f51691a1fba17e05b47ab1da9e655e8ae4afc1b646f5b85b9796bd09187c2c
-
Filesize
5.2MB
MD5445451a238e186d8b5141eb15ce08f2e
SHA1cc73a8064e0f5324943f7e01feaa53df0992a4f8
SHA256bb6d1a4dd10a873fdd18712528393938fc79f9c6daf45f0cd84cac46bb2a5408
SHA5123852ac54416b8b88c8db9f88e8b1c628bc61c69ee37f950df4af25c00b77a0f029e9442dcbd1e1633e2c5da0028b637303f3fa4621d564eafc00de7fa324d833
-
Filesize
5.2MB
MD54186ed1224e5dcf919529420f45f032c
SHA129a43aa9a54f2085def2318dcff203de0f644221
SHA256abf83faf815a32f241730e88a137779c75b7de855457d44acb1e5334838ed2c0
SHA51270189ac25750025ad9946bf0247c93ac658befa06fe0897ade808592dbf6831cd71ab51db3feaf017472641692d1e1ba09da7691e44d1a716fb747ec380325ba
-
Filesize
5.2MB
MD52072bac154cf9e0e8595556faa6fe01c
SHA1a9c01dbefcdf7d51c0d8d846995f96e9f56dd8c2
SHA256b0e7a0a58bc90a1e556829a0694bb2bc2b449be60eb36d485dd67dc4be391dac
SHA5120ae1e4f4ce7de4096df2f410957957802015e58665860f0e3b0c5d24cb78ca708410da1bc5a5a6cb84c682f3df69943a3a477e2b080f2dd9ef01f77b87b3bd8b
-
Filesize
5.2MB
MD58356bc0a9f13417a09149d4678f02b53
SHA1814016e893e8f67990ed7096d6809a00bc6d2731
SHA25691d9ef6e6c38d946750f8c55c88476e913b95c02c757fdbbad40cebecb602e02
SHA5122d9532baa303d14dde03b50bc28c12dc3437cb617ea44f114dd3000c300e915adb0397186e2ab599985a6fb6ae16592ddc7b3858b150c7e0c49756aad2350e04
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB