Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/12/2024, 04:26
General
-
Target
2024-12-19_eca03fe7b307c971627ac3a3c106bc43_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
eca03fe7b307c971627ac3a3c106bc43
-
SHA1
e524a8a6705cb9761bfbf436149ac6dfbe71dd2b
-
SHA256
24a97b22d8dc9ea8c546228a3e2a3332f3986c8647f77d7c5b8630001088e686
-
SHA512
14e8b72b164456907b38159551cbae1a4b24a1221719188f45060981b5a87c0fcd662e25c46e78222491f49e9121aec610e929f7412e4caa8fcb8f9c4ccb4b50
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibd56utgpPFotBER/mQ32lUF
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_eca03fe7b307c971627ac3a3c106bc43_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_eca03fe7b307c971627ac3a3c106bc43_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KPeggsy.exeC:\Windows\System\KPeggsy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FiHJQte.exeC:\Windows\System\FiHJQte.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TBVTnLa.exeC:\Windows\System\TBVTnLa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tfQVSqL.exeC:\Windows\System\tfQVSqL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ATCOifV.exeC:\Windows\System\ATCOifV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ndgzavO.exeC:\Windows\System\ndgzavO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JiGPyob.exeC:\Windows\System\JiGPyob.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cqYNzGR.exeC:\Windows\System\cqYNzGR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hRUaaXw.exeC:\Windows\System\hRUaaXw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YTZJXoK.exeC:\Windows\System\YTZJXoK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ngUYLwn.exeC:\Windows\System\ngUYLwn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iYpJUsu.exeC:\Windows\System\iYpJUsu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tCcYXRx.exeC:\Windows\System\tCcYXRx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PTFBfhE.exeC:\Windows\System\PTFBfhE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UykvGzh.exeC:\Windows\System\UykvGzh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfUbBLD.exeC:\Windows\System\kfUbBLD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yBRCSep.exeC:\Windows\System\yBRCSep.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pWBpSWs.exeC:\Windows\System\pWBpSWs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BXfkcKe.exeC:\Windows\System\BXfkcKe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PoEQYyu.exeC:\Windows\System\PoEQYyu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EvWVRln.exeC:\Windows\System\EvWVRln.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD549c9e8043e9259b405f1801d2d677879
SHA1ae2ef9d8f99920fdbade33d183f25325ffa70648
SHA256ce6f7cb7e67dc0bbbf5704020f607a9711b6589f9d1dfcac7830a267bd5599b3
SHA51292df38fd99cf46ab6d1cf219ada39337a0ae4eb8954262364ad5af090b4ecf70c3267e5970ed0026ca0f96ce28952f54c67abda6d8944d626539299c4a6957b5
-
Filesize
5.2MB
MD522650c49b8cf2e8cd12597354b695beb
SHA11fdf8143e6593f8c136c2c0db3dfab02ecb08c5b
SHA256959c461314d81afe0bd6dcca1217e14b95b1aa2822d16181fd39e730d8bd8c2c
SHA512a766d804d62ca0f1c674d73de1404110bd3646c059724aa8986c515660a1568675f2b0430b36ca34398d47b17052d133791a5946100bd22f5587384411791399
-
Filesize
5.2MB
MD5e7dc3b6dd3900f379bd2fcf76ed21de6
SHA16b1225485366f2cf8dcc93e451ad9211a2989833
SHA256ce4fcf9a6321bb5a466063b5d28bd0b6016523caa12d61f4c6f1cfd9229af94b
SHA51277597f8bcdf77468b529b8225983fbc5d2c18904df2d72575919e3109585f98352c153b5e468a5f749a853c1569c3200e2113ba3d7e0f93f737a6aac4b655713
-
Filesize
5.2MB
MD5f68403eb6f3c917967838f8199047ab1
SHA1ad60cb46facf0f3061392ceb99a4df4d04ed4df2
SHA256572ad447dda4cbf059ddd607d986174da26790934be111d5aaf42d3a972dbe2c
SHA51231dfee9d139f07ea8bceb79d4de0a86514b34d4ecc53a87d5126cb14e265d8d51aa65a70f794609a9c43ae1c57badb9945565e9959dbb37bc1d22f2d1e4b4be1
-
Filesize
5.2MB
MD5bf8838e11b003fa752cdfaa1a9d976b0
SHA110f2fd4a480cb5796090e8871d2505fd4b4f04a6
SHA256d7d50a9f78d6e9d5ea245d320edfc2c10910bfe2ca667aba39b4f568f2d02cf5
SHA5120df70c35d6da248e8e8a59c78405ef8903cb6df0e3020cab5e2614b7ca00c538574c77f95edaf8f53c1f851855d7522b880460e2d60e9f9f15c0da36718dcc00
-
Filesize
5.2MB
MD5af7d7c0a598222d6de4e769dac8d86f0
SHA1a19d631884a68969d34541b148d360c3eb69cae2
SHA25693ade0c38f4a3df79db4713f8c00fee9a13dc34e322c1c59ae6455c1e0b51a5a
SHA5125d495f40e855b0568ab1fdf1fa3804aa50bae796e4c7dc48aa67e0e0c8a225de9f102159caab9232fda686929b261f3491fc03a19cbea51b5679506f9e45f594
-
Filesize
5.2MB
MD51d67799cf886d703214e8c56de84ca5d
SHA1c7c5740fed1d64f8af40008e2a51f11ba83335e5
SHA256860f334e8ee384186b21dc0da0cd697e369009e5f49ea60d928f76f6427c44b6
SHA5127474569ef55b0e6154393bd59f3cdce73158b243f5f9829476eb4268185a1b8a86431f2b0bd4f6b66214d5756ef6ef162299f9cb133548bb07235b3132bda1e8
-
Filesize
5.2MB
MD58d1852c402cfd0afb1b7bb656a9bf888
SHA12765b22899c0be2aaf38870f4b6383174d1b12a3
SHA25620ed2e6d677048861f89ca96e9ef738ab7e8a499f0f625ff5d942afb8f5ff8b4
SHA5125a5dc6ee80eaa2524494c01d6d4b71e24f6e8cb189a042b6018bca9ebea19ef23a7fc34e1b7a182685b0227606135bfeb7745d8904e1e1d3da9831d332c9e4dc
-
Filesize
5.2MB
MD52c35aaa98a00363fd77d917514d9622c
SHA12a1202c72c6d75d4e566f26237628faf8f66a39f
SHA25684fea15740163d1395ebc2bb066715c3bb5cc0c0aa49f24e0f5e70175295af54
SHA5126de79dc54c6c657ba1c866b2edf2926e1783e27746aceb83aae78bef43c2aa025205213c3e9e94a0094900c94a00b7bd4805f1595a22b4ad785b1235bffe48ed
-
Filesize
5.2MB
MD5cd04eaf0b008469e3f07d33b9271c2b7
SHA14fc0055e4e78356c1697caa7d647bd3134a32330
SHA2567008e3ef6af860588abe727107939889783413b42559f6637c7d57e4646b0ad7
SHA5123d8c3469d4664b2a63971cc5f89806e6ba4886b20ae15369942d4ac3087c2be312dd1f448d03f51d934e6b6b699139475732a15eff2359e04f08940cf1a3c16e
-
Filesize
5.2MB
MD515467b3ec05013d147b8bba1bad3e520
SHA1252c24f10494fb26f6d120fbd5edfd5360b30187
SHA256674c47c20124c473327596076f602b204d0f34d668098acab4661e94af288112
SHA512f4c486373d6d8127a5c326e9466a5da858d0cc6b6b38d7c75f01f1214a1b174cca20a89134f42a891f80f4adc5bd198ad97b2fb3eb27650e329958498844c3f8
-
Filesize
5.2MB
MD5aa644b0edabf71a05397cee65ccebbe2
SHA1eeffe13c3b513cbc33ceb458b756e584be26181e
SHA2565ebff2a8042045a62e25a3214dcf6ec9b7c5b3062ce1c05d9b89f6a862d8815b
SHA512688929ab7f376175a8092eebca663d36c98ab0d32a6f844628f3ec893a8249eccc6ace02b43bc4a3bbc4de0058d3d714a08b897c35feabe45ba7ef1b3e202c67
-
Filesize
5.2MB
MD5845528e7e0231102f7271044e6ccd4d1
SHA186887a5b1a7c89146b483f990ce32a782dc7d982
SHA256db8da5771309b90ca7030517d4898b212473d8b7f65c9c700269b8e725349faf
SHA512857e281c3b4183fd4793f8ffb894ed796e4ddaa7e3960974bdff7343132d8c04a625acc15fd6f1281b8faa90da31dffebbae7c8c978cf345925caa0a1118ceae
-
Filesize
5.2MB
MD5372d0c0fdd051e0f7275c27673a577a3
SHA13aa4a40921368b9c4bc498e4e0b70ce8fd1fda8c
SHA2562435370d3a8d936cf74561d9e391e6ef25633c95aa6fc119b69fad55b9c300f1
SHA512371f7938dd945ebd67a3404590c04f1033612f88f36b7015cf55ef75ce2583f7bca562836a547d7e94522218d6f98147a4fc9122b480d5b1642856f81b73a955
-
Filesize
5.2MB
MD5cefbfe3c68f0f6a4bde9a1af16d6d583
SHA128d3868a3fe86d3b04d56c4a05820f5cb1e3e493
SHA256f46243c66cae3d05ccccb7fe036b3819f5511d2eb521da2721371bc952b2ef7d
SHA512bbf648f1c0354102246f82cbfdba9341ece34edc0cc3d939ddb89e12f23346f7bb53f621ca5b49ccb107f970dce97a86538465a5daaf49179b5fc8f4a0073878
-
Filesize
5.2MB
MD57e850d5d64efa0ab8b718399834dd58e
SHA128396dfa780089926758f1a6c2b063cf148cbe3a
SHA256f0191e2e8beab0b1bb8ba886bce5b5d08d56b30931c1082514505c6b408b3518
SHA5127f1c74d59879819b5575652c2db52b9309ace5c4ca44bd97df20083fe4ef98e1544b1b96f90589f7815de40857dcd3ccba925444ab9bcdae985e2ac1d567a660
-
Filesize
5.2MB
MD593cf4322dfcc80481524a9524f4ee18d
SHA1c113ea7ade62e9993a41288d4d31d88a789bb3bb
SHA256f5a7eb039f99120770e4fb98c2c9d93df7ab2e1705892721d18e1f2cb75651e8
SHA512377ab60d4a742770b3b74eeecc314c23a59b4f1058cdd601adb234531eb753132c0a9cceedf7e80f17313d8067c79222a6af09f70c7535334f33cee46037d6df
-
Filesize
5.2MB
MD5b1c86c18ee64fd4791282fef9a6ce16a
SHA15b5112b76f3ae967949ee1b7e8d44dd346fac781
SHA2564119c0c36ba31e5a8bdb5dc49585f8dd21bbe156fffe6d8dfffce8be17940b7d
SHA5123ad507a70bbf62098a8b983bc9fbdce987f5ba8035b61734f6ef0d72151dec2537b3a95ef1f85b3a51136e2dd3fecbef765370d3900e24dbfba5564596f30a3d
-
Filesize
5.2MB
MD571d8eb6708533cdaefe8233dedaa95c3
SHA133f57a37514d747f4b692249fd65e9481b1d382a
SHA256a635aac9fe8b48f4844cc78f7d545a8fb319801f902dce3bd697c46aba3cc59e
SHA512cd2660b57bc81fb171c37096234b4119a8baee18ad68b9d6a03de30a4ab35095e11943bf85212bba59a9f406763ea8b06c5d0f1bd6212816b0040d87076af33f
-
Filesize
5.2MB
MD5d5a4d3662c960a913f4e9b38a6e4d049
SHA16b4ea7f367628c8080f1bc338a1607b20f55c2d9
SHA256320de9ea015f19f7e4755d00abf30e9161cc1785dccad11a4481386336ce8a41
SHA5124d1237fad5dc00f7f79b1ab58b1bd4a3e63437baed1e0afb27163eae3a9a6588196e72d25c70ccad6b41fe36e99b34a75b8fa7f60d013618964c653963464366
-
Filesize
5.2MB
MD59ff7def3393144804b7b6a8c22fb9836
SHA134ec0dc98fb0f925ca6767c10a10383bb1811ea7
SHA2568c91b01e887ab7afaa716c06920070f1dbc4d1895aeea88bbf39161a1809b22a
SHA51290014ddcb336ae501399d51f1bf0f82c43407164aafd6fe3ee0a95b4838b021b2e83373d04d8715bfd6381339ea27b0c2c04ed89407c89d8a373da747826ef83
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB