Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
19/12/2024, 04:05
General
-
Target
2024-12-19_6b644b34cb4dace4ab654aec2d112036_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6b644b34cb4dace4ab654aec2d112036
-
SHA1
c30895f800c0a211d6a151db64c361022d755da2
-
SHA256
5b2ff3d35d1840383524e2cf1ea932e1154dac81d56e948a4df3442c90fc429d
-
SHA512
3a0434db696574299d1746fb02d393ba0aa8f5a03fca6aefa21ed5b962323e142f936852c1f1f48ef36c3d05ba6b89f16ae1efdf5cffce3a2e444b36c5a5bc29
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibd56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_6b644b34cb4dace4ab654aec2d112036_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_6b644b34cb4dace4ab654aec2d112036_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QJaHvcS.exeC:\Windows\System\QJaHvcS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XADxgAw.exeC:\Windows\System\XADxgAw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DcRaBcl.exeC:\Windows\System\DcRaBcl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SanvVbZ.exeC:\Windows\System\SanvVbZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CckkPGp.exeC:\Windows\System\CckkPGp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lFVwqQB.exeC:\Windows\System\lFVwqQB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CkidDuO.exeC:\Windows\System\CkidDuO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LDonKrz.exeC:\Windows\System\LDonKrz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eQJjpfS.exeC:\Windows\System\eQJjpfS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wwayYBp.exeC:\Windows\System\wwayYBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yCyqJSn.exeC:\Windows\System\yCyqJSn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AQzVGcj.exeC:\Windows\System\AQzVGcj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RkxwqJw.exeC:\Windows\System\RkxwqJw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ErDXsJM.exeC:\Windows\System\ErDXsJM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rYVlesz.exeC:\Windows\System\rYVlesz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IKyoTrJ.exeC:\Windows\System\IKyoTrJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cwvTBvL.exeC:\Windows\System\cwvTBvL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qLdHsWk.exeC:\Windows\System\qLdHsWk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hJMUKSG.exeC:\Windows\System\hJMUKSG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bPwgFkl.exeC:\Windows\System\bPwgFkl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qIfQrdX.exeC:\Windows\System\qIfQrdX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ed60d3eb17e9d0ca4b5f14a79059f176
SHA1fcdc1c36ae45c5b3630766f0da59f12d596de3c6
SHA2564b42d5755c9235471d0a2dbfaf85c0b7bc3ee43f87574fcd34c5b2f439c60e67
SHA512bcca2da6af4a1f1664bed88d9202ad950f02b9ac982440852b3b62c46d3ab66089bf461852c7e697af8175dbb5a41b5788d57220b083dc2cffda7334390a329f
-
Filesize
5.2MB
MD56484b9534aa17257b38a73a17a20a8e9
SHA1e3aa6866c61dff1053143f38ec9a9b97436c12d1
SHA256eca01bcbfc86a47db7bbbe6ff8d14538ab58a7fda31cd8e2308453e823402670
SHA5124fbcfdf0d814f5e8625f4fb4235b96e665f5ba07acd8b4f203746c3da39f8281c1ae12e4c8c7a410cf257715d3ba1520de9a680ce6242d9eb3cf1c62d4889ad1
-
Filesize
5.2MB
MD59727d98e3addc982e02eeccb417695dc
SHA133c1c4079dffedccb9d77e7e568e28e27d2f7a2b
SHA25663017e5200ecedb9ce9dac5cad6323d30602927867e999778faffc642631c00a
SHA5127e23eb6aa4f212f124292d9f140f6e9a875f18d594f398340cdf6ba0fd3ae770da584de39a88763f517eb2ff47c33b78ab190eaa70e9aa7069e4d2c8c629c4b3
-
Filesize
5.2MB
MD50e8039264fcba54858c7e1fd40e8544f
SHA1ac9da04dc3a4d154b41afa9dbaf09d5aecb94c5e
SHA25693e2e84ff3a241260686342caa0d02b212f58cf381c13b21a21e81ec4e62993e
SHA512862019b686e7bf77ef652facea6ceac348161b42d993c5363d745d83fadad062ccc1947a903dbe4ec8e8b6c2342d61d2f8bd561423825bcae4ce706b5edf9a6e
-
Filesize
5.2MB
MD5075b7c2c615da05c3140a59a9cf743a5
SHA17f70c006542118d56193c19949d60350afc60c0e
SHA256e3aecfaef510b0180f9af4a29742ad2f6f6dc9e6bea5c98cce214fda02acd7ec
SHA512e4c8f4673ba4890345eac71aac18a0021b50464da021a4451a2b9fed65b40d72a29df9f819d6f52d77f8d010d84ddc4a5aba97c67aaa53a2442b2dd6e2de1b2c
-
Filesize
5.2MB
MD56f382c609fcef6c2fc188757f3959973
SHA194cb754537e088c412aff2ac74b29852eff0aac4
SHA256f8a95fd1a0509d754200cb496ef72bb5ab6a4f17a727200c2069f22a39a2f4bf
SHA512fddaacfba6f02e62e667b00fb72ee4ef59aba9aca32c62202bf46bde5ea74fccc7121f549304c66ce371eee97d00f7aeba91be19c2b9683b3c44b3b6168d3f62
-
Filesize
5.2MB
MD549d30891682ea6fb2f211e51b84779f3
SHA1f0b2c04525e999925fd78b8fa0adc8e3e73f9390
SHA2560833867fcc475dbdbd5ceff1b023a83477a35e803bd1ef933f4b5144b41d24cb
SHA512d65abacf84108f846f92525246b6569bba1c23363c9df6ab80c58b6d50130563cbf2f18ec29e3c07a252f22ebecf779f8030082a3d8a8c7ed24f3e5769046a38
-
Filesize
5.2MB
MD50349a9fbca5350886a2e92341cdd7ce7
SHA1971260209cc5d4e8d344256bc801887f4ea873ce
SHA256396987e6f4d400aa9b196eb4ef09c67c9ad6bc0c1256c6d2d29b41a8fdfcb5fd
SHA512a74ed209e1014045b59f1dfdce8972ad737220680674a9fd538ac7d72d9e1bff2cbb99a17d68c19e3b9fb5b3827fc3f20174b4cd889ef6fe3ae5d29f45851d01
-
Filesize
5.2MB
MD59eb5649d6eba2dc15bab43d97b327c2f
SHA14c63aa709a1cdcec647fff91c317e63601448860
SHA2566df91d90d3d2a0197041a9d4c59eb7304dbabf4a22bf41762635a5f05b3496bb
SHA51240b3c3e870c5dd59bd5b6f637a01458bca07936c542da74eead1c2804574b5061324f998b0f97cba4a6d5ed9489a421e3b8ea5655e1276b1509830598a29d5bc
-
Filesize
5.2MB
MD53a270e155e9c99b75637a805e7834dac
SHA1d7f54de8d414054597d9f61801e79d372aeadcc7
SHA2564d38426235f5b1d70ba3ec08aa4ad2f6a0b5373854f37fe29d13f5e0447b1f03
SHA51212a5f4e3c1377c19839cef19b84c35b6efc79e00b266f12fcf91a5afb6e54118cd39fec927d60737531e00f790c40d0c61ccd371068b461c1576df1f7371c25a
-
Filesize
5.2MB
MD5d5ef696ca865546a9db8adc3d82f92ed
SHA1f927ff4b5ebb3308a8234da6cb2fd85b14251915
SHA256906e368b7bb3a914ac3ae05f0f6df45f93f6de451a5ac57e779b08e91c05a2cf
SHA5120282685bb982666c60d59859b5c4622c232b0032560b4bec066870480089798ae9319f3b704c666428918083d1997aed6a5952a212c20d521bb75df652ce2d54
-
Filesize
5.2MB
MD57fcb9be658864162585678e6fa8f905d
SHA14ba1d0a0ea3a8bc9b93fea565c3b85c633bfe048
SHA2565a3b31db4e6e315d02f32f28764a24c7f3e06a5b5f94d6f72635f20b9ae9253a
SHA512e9d51dde10a2b0121605b3df6e8644c49a8d8bcb5e67120c81129e1c62619227d8f62b77338261031c650a032488fcf896edf4513e25d35cb6042a3345b468b3
-
Filesize
5.2MB
MD5631c3703fc196cbbd028bc7591ec7dc7
SHA13d4fc78d9c0ba77a1843acd412dec46ff55f1be8
SHA256750ff48cd1c74b1fab5f6e4158f5b39b2ac1cfecb2d102a74cfa495d040416b1
SHA5129b5d946e3db2c1bc386d5ff3db44cb2377ce3f50e3727ff41109a206b811af383f8910d17c7fab7ff9a195b0f62884766ac4804910f6d14647d27f6a3ff48a5f
-
Filesize
5.2MB
MD5212b10a59a88dcb64ee155d7e4d4c078
SHA15b74ec5138bec2733854aa82b0a2134524107d70
SHA25613aeb05b8ae163378b1c9b0a0f8594939655602cc851e6fc234257dfafc6ad92
SHA5120189005891c5f6a73d2429f9d2a0b7b6c87c72756bf9b768d55423949057fbda8e344e63a133bccb67c56ebe2be62bb7561a212357574e5c1406a4c2dd50d557
-
Filesize
5.2MB
MD592940ecb98bfd4131d9042d23a29a1a8
SHA158f3afd554875851ddd1cbc9d04d3b63be0d96aa
SHA2565c2ceb0c95535b30daee60667a91937dc89cdfb8b346c32da7bbb72c829f1d85
SHA51239e73c43e76967d845e5a670221bdbb33897df8f25161852e6d71f88d42aac26a236d023413ce184e8b4ce9d33a09e5ea9d9828e41533f27c460ed61c2212f3a
-
Filesize
5.2MB
MD5828de78ee81b11e72265cea89b6ba682
SHA1cfe5e765b3fc0c80c327f3712e1575b93a01bd7e
SHA2565a5df670c84e67b61d595370d80fdd6895ffe4361a5c22a8b4ce15c2c9b92334
SHA512cbb81987dac7a5cf80679f751a54daf64646949702370503b1cea7d58b924642bc7fed8087e935ee3100e762e56dbd3e8a6b9418354555a5455428eed242bf7e
-
Filesize
5.2MB
MD56e65baa41b997b61f9e841d846bf4541
SHA1793d95161f7843721b69b057cf32966f027d9894
SHA256a92ab09aa48525b65df973a544a97e41963114678bc44c3565a2aa2e58673fd4
SHA512039d5960366427322404269e518e9fcac4a2355e33bc61f9ed7fb0ae84a9f2c9fe37bc702eeb949e24a0108cbec6ceccba12d96ac163a99efba587b4185ae153
-
Filesize
5.2MB
MD5d196946fa8bd417407e4d8428502aa13
SHA15afb4b1f5fa320917c13e691a271a3ecedc54eed
SHA2567b528875cf4c5884b63adb4be80585de1e2ee623787ebc346723d332de372f5a
SHA5128a687c079626419bce10c88613cef6e45a633a4fee97318c82ac2dcebbfc4e2198d2debafaac17fd4fb40fc32f97cdfd615b7d47e8f74ae7a5c846c2c70cb41f
-
Filesize
5.2MB
MD5b9b49a32b113a74bcaea9ca039f9ef06
SHA1b54734733c3a9677a298d9d1f7772eee8297c99c
SHA256fba4f9c914c498d0eb412925f2b82446cd44579a4244afcfed3a7fcf252ca5b2
SHA51256e6a22094b4c352874710cc6151d182af51ec77cb9352d1c3df442afe53f814bccbdcb137c498b32a519d67b96fbd62a0debd7f018c5f1d835fb3cf998c7b41
-
Filesize
5.2MB
MD5c0f68038d0c940a372478dbb4cf40371
SHA1e15bcc0879bc7602057762014c9ccc9ef3d7cb5c
SHA2569a3d3891d6e648ca37301ecd9a5fba0748698cf13a205e6d96d438c134c03bbd
SHA5127648c3f5b3aa3a69fade363431fafbf54378c049832023a976f0d3f79da3830a66bbe5f0485a284181f64a64a193917d117b6dbd1674496b16980777287bf2c8
-
Filesize
5.2MB
MD5c368ccc1d7993ad760b158290ce71282
SHA1c62f9c5ddfebc9e1154f9405eb0b73f77ede3a10
SHA2562bdd7cb4aa478f3bc674c559ec5a8d45e1cfeba68f1db8c27756eddc050b7432
SHA512692a9096bb62a8da86a341fcb7fba7381cc90a8c3847ba4c3cbe9c0142602cea21ecb79cbe9bd618c8188c7062088801ffd24bd819d850bc61efed8202bc8575
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB