Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/12/2024, 03:46
General
-
Target
2024-12-19_044d3b2c5ac3e5b5e2853b70131b35ba_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
044d3b2c5ac3e5b5e2853b70131b35ba
-
SHA1
d3a1b49800e9b5f463cde0dfcdb70b7eac5815a5
-
SHA256
6cfb4a7457748063f10dbf8a5f8e23622f375595767e0cd330a940bef42b81d0
-
SHA512
17ce3919ffb75e0f6758e503a0ab965626ff3395d8034616c99729b80dc634b2ab27c1447be86701ece1779c06e86586b7a4cd47b42d884af9233d73f1134886
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibd56utgpPFotBER/mQ32lUQ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_044d3b2c5ac3e5b5e2853b70131b35ba_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_044d3b2c5ac3e5b5e2853b70131b35ba_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tyUHRUX.exeC:\Windows\System\tyUHRUX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\soZBpOv.exeC:\Windows\System\soZBpOv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dBKGLJx.exeC:\Windows\System\dBKGLJx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LeimwcJ.exeC:\Windows\System\LeimwcJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gPaWRBR.exeC:\Windows\System\gPaWRBR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dkjhTgS.exeC:\Windows\System\dkjhTgS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rJnEXzQ.exeC:\Windows\System\rJnEXzQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yqsHcdv.exeC:\Windows\System\yqsHcdv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HvbPRGI.exeC:\Windows\System\HvbPRGI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pbLajNw.exeC:\Windows\System\pbLajNw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vovCufR.exeC:\Windows\System\vovCufR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MNoZAmi.exeC:\Windows\System\MNoZAmi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LFCmOMi.exeC:\Windows\System\LFCmOMi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OtfpbaB.exeC:\Windows\System\OtfpbaB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vgLmwfC.exeC:\Windows\System\vgLmwfC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dmplHBv.exeC:\Windows\System\dmplHBv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LDLGYTt.exeC:\Windows\System\LDLGYTt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GrPoxAz.exeC:\Windows\System\GrPoxAz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EQSncuM.exeC:\Windows\System\EQSncuM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Cygovrh.exeC:\Windows\System\Cygovrh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hYzYdyf.exeC:\Windows\System\hYzYdyf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5edc7e125acbbc7e4621080bfbdaf35ba
SHA17494a030663f852d33d15bae09a65d83a03b874a
SHA2564d03bc95958875f9d8fc72a3d61cc44475a986781430a9881714c0d21bfc465c
SHA51203692eacac1e86d5d5d10d92cbbbbf81b68ef4031a6136527e5a39d2b116cc90be235e15a8abde52f6593c9610aac0a31da9db4e8b2496388d6bd6c8443f86b1
-
Filesize
5.2MB
MD523da1cb7783f5e14351707a1feef1a12
SHA1223d66af8b060e7e290861889921c0fd44941d74
SHA25623cdf53b6a4dc32fc2a7ffa44ab1239a7c28e1dcc0c361da0c3bdd00d65b246c
SHA5128ce72123418299fa40a344407094e29bca9f0e9305fc9512348086bd62c672fe16a7126759b874e94f91cb7af52787038c71fb40d2192acb7189b959ddcee306
-
Filesize
5.2MB
MD5300009662da52a133f1f11c91c470dd0
SHA17ec3a27e2beb9fa65cf0f633d60ac94069405bab
SHA256ef5896bf4e980299d9d223944958b0d3c38dd42787ae8335143273af96a6c36b
SHA512d4a877d6df8a4459fffc758a4497389d60d2b6ca0fb6b66d715ad27c27dede0f5e6b670ba3d7322ba8f820e88fa4ce013d9dad38f4a3d1f14502264840470f73
-
Filesize
5.2MB
MD51f1a1017efacdcdb26e97751812bed91
SHA18baf0057e9090ac0b23c212e632010df69f417c8
SHA2566cba67364d40cd516c1b062daa502fc0afac2f8f0eb71050e889e41611d282b8
SHA512b57f54a8959647bb83a6b0cda9ed4d9b812187acaad157d0f5f2397fe50c865a9e9eb6e9d47f37685e8f0ff4311f54321610c2afe707be0cbea795faf0d7e158
-
Filesize
5.2MB
MD59b61a311f6b21cb8e2b2aa61433a3833
SHA10e252f0f35da79419268962fce0f9ceaf657a861
SHA25675ca1e09e4a1831e1defe6f51ce38f6f1cafa5fb4ad5b86301394f6e35f81889
SHA512170ce4a812090a309ca0a5eef30e982b7debc70f27952777544d55de9d67143ef282b22c31321cdac7a5ae1097ca5b6608bad64a7a2f037339e9affb4173a483
-
Filesize
5.2MB
MD57604de2c993d9a988528386469523413
SHA19526b2caa51908c25f25d663885df5c451fc25b3
SHA2564d59061300c636caa5c4518d4f6b5e6f3d722c523c30413bf6d224439ab2a3d5
SHA512510c4e756ac31fafd8cf3544790b8001e5ea3bdbd00a229ba8c946122cec2adcf4e0644eb2e5accc97773b3451f06f73c0fac0431ce79820aa8464fc4700dc0b
-
Filesize
5.2MB
MD5bfb64f22eaf58c9a136ce81654e6cdf2
SHA1a217d56bd1044489645de9f011da9438e271689c
SHA256e48658915c3065223bbbd2fdb849fbd1a87062b9d7c74917b2f56ce51f2fdad9
SHA51274556e5784d128dba65834927bfee7dcbbb1c10607f2ca0b063af4c0d4a596d1ea1960827f571b47776b99440d94a6cff76f5c3bb1ccf6d5f0894e263ce353f9
-
Filesize
5.2MB
MD5c1b54b0bffde1d876cd9d470c5e7980b
SHA1affeb40162284a13e1f05f3a5842446599b45cbb
SHA256a95b583e469801461128bb1d744e14f781591b9b5181a8a5367b3918e3d22a94
SHA51259f8e5f8925ff430d6b59af0a8d43a30231cc8a568e40fca838e2b39ebc65738275ba706b2f889293afd0d684a0dfa31f0778f823f26733f2d98a073e801b7df
-
Filesize
5.2MB
MD5a07fa77912e2dcd3b80e0156fe09ef73
SHA177a5197bbc1313b2467a9fbcab95a940b6aee947
SHA256d27ba35c9df8154144a9bbaafac8bed51eac56594af6f914f62b3d8aa7bd0176
SHA51202eae3f4fbec2624de1a07e29e5aae4bc340ebf4eb5b335711660549e1ae37d10853bf4ad05086ea43783c12b0afaaa7b419d9d6eaf72bdaec63a2edc5f8c504
-
Filesize
5.2MB
MD5095ccba214f990878fa608ab77d4dc77
SHA1c0267f44390757b824075a794f7b66afafbd42b6
SHA256e3448d96d315292ffe802b0cf2012880dec89d94256351ce421265d17bac5c51
SHA51274c4de77a6b222459dd54222c00d1f46da6f8e333ba35b287a756260bbe1a3daf17bb76912fb8ffc07b74e6f6530da09f1a4805be93e922acd47e06b442cbf17
-
Filesize
5.2MB
MD50ba16dc3122ee3dc675868fb737e08e1
SHA1a33a2ac04d893ad342607f101d3c113675ff6ad1
SHA256c5569e529121ea1044923bfc6e58e54ba1e6165408162023bfebe2949fff6066
SHA5122a3efde898b52b3af734b122356d60a282975a439777cc4b556faeedc5b13bf794e883fe5aad70742cd4022940b2709283ba327ab79cdf4d36cecf085d77a5e8
-
Filesize
5.2MB
MD5b997d1ed773628d8cf6295c6a306bd1a
SHA17b802e872f2a96a4f836ac5f8de7197bb4552fc3
SHA256ed8e09742025273fd31cb18be1d916eb23934133f742482f78be32bbbd6315b9
SHA512a60e47f49e98627687c9fb0bc0c8d902ece5ac65a2408aadcf6ec131f27145f386a59db088238726585f926caab3098ad52cc81dc209d33417e6f000c9949ce2
-
Filesize
5.2MB
MD5594f114a942cb2f0e0c93fdfcc978500
SHA1b4ac2931e76f34f1df8ef1a67423618d8b6ffc5f
SHA256a074b0c70f7253598a35cffcfab730120918a4bd57647c9e3dd57fdabffa0687
SHA5121dfaee6dc77f45dfb7671f3de280c964ab01c89e3ea754039edafcd8ac3dec8e19664e5c2a4bcd9d04d804228f007b6506da31c7144938d6c966002d6ef6de27
-
Filesize
5.2MB
MD517ddd2002c2961bebf2b5fb53a0e5989
SHA13fe55fe118bcc5554089f9d0738e3f9c4ccd93cc
SHA25654cf90fc1420b2deac0efc54a5d1faaa1258ef67c7d3ed4fa26b6845b43ff5ea
SHA512917f822aafc94c978b3e44785b16700149f7d103484dcebbdaf9dd3261c23527d221668e915d1dab062f0958216ac9a58f8bf63db7663c5a86475df68933384d
-
Filesize
5.2MB
MD5d4b6bb62ef8b0cbdb511ba63e1e1cb6d
SHA173d7ec3255fe4e4bb43618360ac8632018a595e0
SHA25686e04a3917df17b62b5aa3b47e3668dc29d17fae74ec1707516e7892873d9718
SHA5124a45fb08b96e5e9dcc66c828c010ecfbfc87b375ca9a04cc1235b7265e982242c558c60b6af45dda79110884b3d5ac04b2f5c1b6539c68b89202b5fac037c6a8
-
Filesize
5.2MB
MD50be866437e5fc6657cb06fe3d98ee154
SHA10b8e7bd7f0c4fb30707af76b40ffeab4e93696bb
SHA2568e63d3d2f946ec232f256eeb20e2c27d5db6caa4c09c8f7168390381717d26d7
SHA51250828594d1456ef56b709c72c8c220a0b8e7dd42ab16684dc653eaf2d57e35357cb7a74bfe9780531cb856c4c721acb66d870289dc0d3dce7f01f96292c03f98
-
Filesize
5.2MB
MD52436b8ede32302678828e97653cb4d5b
SHA11858ba7a1ba62a3a93ab0b72512d22a3a19839f6
SHA25603e8a11dfb1e88beebb77555013bfa2da3f62635c7b6af90d526b1877c8cd039
SHA5128f8db08862907677d778c1e254286285d15c14637c67aecd1990072d3befe0395189a8241c570e1311303756e427ccb5251fe5a7faa99b3c79d80c380412f33e
-
Filesize
5.2MB
MD56cefc55f3f06bd57d9f19c8fafaa6d1f
SHA1f82b36aaf15c168a2ed12243abc1fbd35ce97be3
SHA256cc2cddc1330c1b3749e1d59688e66f4b6fde6ed4e7efdc2590cb0bbc4750db6c
SHA5121aed7f7e50466a0f013685f4e52477343420b2a86bf9557a4e92accd6966590e277e2f1be818a77e277786a556a26320c193d0abdd08fd34b3e22ad57a23241e
-
Filesize
5.2MB
MD5dddb4522b2a3bbb65a938a6b20dbe1bb
SHA1e7e777ad6dac5411b9cdcd75345a932577de7bec
SHA2568b40db2736157d42858971be1ccd0e742e96c4c11198ac31cbdf8e36622ce250
SHA51243c00cd9f2b5b9402c0b1da992046e76179ab50a113cdea33c5d4a255262252409319ba34784ccf77505088af42c35cea0eca6cb7a8115ca96ee935ba8eb304c
-
Filesize
5.2MB
MD558494340342fefe48fbd92e8a9064e0a
SHA17d438c99c9a9077e80335865cad5bdb4fb67e3f5
SHA256e7c74083bca7494ad56d9e3e505415c20803819926966840f6a1a47b9031ec40
SHA512a205d17acd59665c45bba3753e4524b7716bc75206e0539b647125e35cf19cf36c0e2ad75ce78466de53eaf9aa41929582b278f7d3db0478c8209a5e0e4c686a
-
Filesize
5.2MB
MD553f500efa2724c194cd44e696be9eaf7
SHA1017913040b8d6934aec58a45292fe38740cac9bc
SHA256664cd480c42f60dfa8ec1fe883b7df3916456888f0e3e23c984fd2861a7834e1
SHA512bf77cd0504e7d2c59845d89c06268aa162e83b53ee11fede97fc79635df39ad55168d5c0640947cdab16905d484bdaf1fc5ab135a91a5eb54cef6888f5e45b93
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB