Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/12/2024, 04:05
General
-
Target
2024-12-19_6b644b34cb4dace4ab654aec2d112036_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6b644b34cb4dace4ab654aec2d112036
-
SHA1
c30895f800c0a211d6a151db64c361022d755da2
-
SHA256
5b2ff3d35d1840383524e2cf1ea932e1154dac81d56e948a4df3442c90fc429d
-
SHA512
3a0434db696574299d1746fb02d393ba0aa8f5a03fca6aefa21ed5b962323e142f936852c1f1f48ef36c3d05ba6b89f16ae1efdf5cffce3a2e444b36c5a5bc29
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibd56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_6b644b34cb4dace4ab654aec2d112036_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_6b644b34cb4dace4ab654aec2d112036_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TtvmODL.exeC:\Windows\System\TtvmODL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rjxFijl.exeC:\Windows\System\rjxFijl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mUBFSmo.exeC:\Windows\System\mUBFSmo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AaYFqDK.exeC:\Windows\System\AaYFqDK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SLhflok.exeC:\Windows\System\SLhflok.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nWzjEyO.exeC:\Windows\System\nWzjEyO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MVfNvbP.exeC:\Windows\System\MVfNvbP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eKZjHBV.exeC:\Windows\System\eKZjHBV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gsIGVFU.exeC:\Windows\System\gsIGVFU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IfrHhFS.exeC:\Windows\System\IfrHhFS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UOePENi.exeC:\Windows\System\UOePENi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AqvLmKS.exeC:\Windows\System\AqvLmKS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YsWIKOi.exeC:\Windows\System\YsWIKOi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hFJCyoi.exeC:\Windows\System\hFJCyoi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qEyiZGj.exeC:\Windows\System\qEyiZGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ShmAaSD.exeC:\Windows\System\ShmAaSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sxJCfQr.exeC:\Windows\System\sxJCfQr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oHIPAny.exeC:\Windows\System\oHIPAny.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SiNhIlf.exeC:\Windows\System\SiNhIlf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qzeKBgq.exeC:\Windows\System\qzeKBgq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BCnnzoo.exeC:\Windows\System\BCnnzoo.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD534ac18319dac02895839b03cc6e9e02b
SHA192b11c9b78140862e59ddde52c9c16665461ae63
SHA256b34ae026c5bdb7ea36edef775fc1e0f7952d01f57990a86ef03c449aa848694f
SHA51248a5571e5a3b10473e4e03785679436cf8d322c8198d6a7cfb9c179bf7faaeaca776cb74fb65d63e266d5ee9eb9bd661caa735dbb91792aa5d7b6d0a77d1f825
-
Filesize
5.2MB
MD58f1e76f2b54fcd7b5692274c41cba4f8
SHA1099b34117e3040eba25a9f33e89ba360f5b231f0
SHA25680aa37171e9ffff89dfe65be6d32aad9ea67735e90d38d804aa10813e219feb5
SHA51278f4af6d4b588b139685e80dd39baa506ab8f6f53030f845d27a9ae5845541bfbf5c3549613d4d77241eac612875608a1b4ca3d0a69a48d4d0d289768e2da18e
-
Filesize
5.2MB
MD5f2a8f2001bcfb54e149ffc6faae40184
SHA138ef679217a7377ece929fca790dd625d4ef1482
SHA2561cb802887758e75b962db398c73cfc89cf387389d0bb898c639ff53df975ec6b
SHA512fb1d63d594ad565fdd2344ac76d2381069a32b67a6881d47f4b39d164af029d9b4fe717140aecf305812e83a650de515086eb25a257ce7b21858547b25556b15
-
Filesize
5.2MB
MD5965035a423b6fba022eaecb5edcd2754
SHA15143e26d646eeb4e3a71b1b59bf7bdc8f5cad806
SHA256449fef97252b81c4fb923d7c670d02a6f11a20ca6e7df0737bde7178c0803e88
SHA512ce3f1a91e8ac7a6a99ebc297112ddea191313f1cdad07d3a9748950df161cd7e4dd0be5cf02c9ced1d2da5e0c83ef03a2d991836cf41cc2301ce7b85a7415fc5
-
Filesize
5.2MB
MD565aa90cc8ca447de96aef7432b8c1946
SHA186c3f59ccd8f09b3e8bc26e884fb17c0e007ec81
SHA2565576f22306e19038266701a5da406b562037ea2155e518b9ea5547a4d87ef8e9
SHA51200f8ae2f7bb99da80767aea140c79209254aa982ef74b848d4ea4a3b3de579fca0ef27a857b22e0e5c789c48efbea21fa896ac598ca5e97d3f521316c4337227
-
Filesize
5.2MB
MD598f49823e225675bcea4215da1c2a651
SHA18100fb92ced1770f83659d887d7533d674dd1824
SHA256bd8dd3d35ec3846ababc81ec72761e892ae71729c2e875d54f44b03b35ddd9a0
SHA512c5fdce2ba71402de4d5d8f124653bed51905e8c097b9f1f311f64cc63255edf1e6bcd1c3240892a6059c41e209431de8a05b74eac0406abb2f56e55843877bd9
-
Filesize
5.2MB
MD5bc072fd2c70ec6e3fd49763ad7d2a796
SHA1b47d917ebe26f798d670324eb9436800a6c1279c
SHA2564f305bb99f7190645421c05c541a5f8130e30a6ac4337fb4848094e348dbb6a4
SHA5125d5f62b16c3c4fd39b0105bfb5eb02544dc609b8d9eb25c35bf46aa21832f07dfd303de3d2544deff75d16ac9b0b55dde7f17302195dcff2e2dd06107bfce18e
-
Filesize
5.2MB
MD54d45b60369b2b7f622577ffec93230ac
SHA148a967490bc06bbd3bb826762277331fd80c39e0
SHA256e919c8491de6e1841a8d05ebc4eee341f0a9e93ac681b9245536c2dcd22102b4
SHA512a1106dcddec1ad56b35f0bbc3fbed352c2178852199da0b924e0519942c30f6d3bd2edaf589b85fbbfc9faa040fe56afd8d8a20ec42c1caa18437749fff608db
-
Filesize
5.2MB
MD51cf9f5ba07710cd3975d850e66e9bf02
SHA177ee69d421b45510a38f724055ac7f79dbdf050d
SHA25646d2affe6cf047c2a5a39f913fa7ca2d04bd889be5fa840df676db52835530ac
SHA512b18e4342ce16f28938213c7a2ed327b14cb50f7c93de033ff02195c4b72eb1dfb99debe7070fdc3170364c5339c0b6e2c4f06ab3ade88a15de73155076c65c27
-
Filesize
5.2MB
MD565717bbd28f2c2e3aa31e5b35cf4348f
SHA1ea87faba514ba66df4a75928fe1f8c514e433cf7
SHA256bfda004941127a1f7aa394d03e124e89ae250f914b0ce918589b3f5c6905f113
SHA5121e46aa2244d1b10617323c56e9a55b5999ef5e2524922dea1c5d09fd209b9de06a2805256a4b2fe234fc30bcd9622876f2387836facf7e1318940336e577f3ed
-
Filesize
5.2MB
MD58bd742ef78d6910445831723f53c1b8c
SHA1c862cd8801ca4bbe90b844d3432aa80e1605dc48
SHA256a5d098b865f1d755f9982686e4c2470535f53f7e85d9ce83ab4eb186257c92c3
SHA512e589ce7bedc01de588402360aaf8da544907d7d5aebc1f5d6b65cbacaa13788fafe8a71425025602edc9e9d083981fd0df14ea43e914edb5aaead40682f46707
-
Filesize
5.2MB
MD5c0a8a64fdfd8f493b6516257f949f7a5
SHA1dec8024737d56f09199792b84d67789f90d21cd4
SHA256d10522ca86f988fcfab99a58691bc0fdb7fbd482dad2003f9faa5233c1ae665e
SHA512030425d7d637f70b674783b61410248d11c241a3587f363afd6cea2b793a6fc4cc5b17d7177a9f735bd1011f8c95e907880cfc2b077f6d8f65406fed603083e9
-
Filesize
5.2MB
MD557aedb8c3ae5ae1eb7418ab7e3f7c836
SHA18035bafa7edf6f294928bb75afbda8a8c97b781a
SHA256e0dc7aa4209402754d385b4398e97532706a3ac22682722d2d4caa22c59f15be
SHA5123f96b6b5b69e2a96087a10fe7222e13a01115a1ed946c89f3473b9da0d375408f0ccf38ccd906a4d4e9575278a79984cc2db2f8306ffd2a6cf00a5d4d1590480
-
Filesize
5.2MB
MD59c08a305393427d9fffc554ee607302c
SHA16d63b1cec629c0e1af6421b4df72ea77e3464b5f
SHA2562136e30d8f7c12b837620d0cfdb72a6e5e0e1e5422769c04e66d32ec339600e3
SHA5129afa0f6d67ae68fbe74902daf542f042ee7580acc871f34b2d00077a2fed25bb6197f652b9ed92a9b2d9932e7aecd13bffcc680c3ea5fb3b7b62c9ff6e0d02a7
-
Filesize
5.2MB
MD5d1108b209ddb2c8aebab09564da9ff52
SHA1a78b783111049f5eb23456feef28994bcc77d446
SHA2565c3a65f3434c4e37ba92cbf02308c4cb3ed5b61919ad1c98e87300a9f5955214
SHA512af12ca5ff94b481a38315877c70ed3b6975e38af178407309a6c2b7547d0618cf8d35756be66db0ec11d87ea88b28da06e8559824bd721735eca2ad6de36bc1a
-
Filesize
5.2MB
MD5be2bc210846604741562a4d1336fc9ee
SHA1a35b53519249cab71e39408754b4034891ef1255
SHA2565eb14c8765c67118bfefb3e51bbbc6e58b3644e52b97ac04b8213a405eacd490
SHA512381e3633af1853dea8e9c16f7de1f381aef4769139ca8d515bb474c10f4d711c55d8a11a586ab68f8f1e615bdfb42ca50dd3b64201bec8edfaa2bd53c7f941fa
-
Filesize
5.2MB
MD5dc2b8841c4c464bd8fd46bd7f6a849fc
SHA12fdb32357f56dd6f46cf9060feb15f3040d15637
SHA256ebb633619e477596d6116b87a6613e50500bc52ac81cf2992f69b1f997224194
SHA5123eb618969fe0c54041753179c6c2560bf91162c569e33b5fcaf18c46f794c194d543d74c670079740b2b6c2e3a17503698b022cc85edbfce9d53f5d97603f493
-
Filesize
5.2MB
MD52680a28e92f018b2e6f614a74c550daf
SHA1b5bd6a7e3a87c422ee205f93b762efc3dc70f808
SHA256319774e540e6ee89837b6aa200e3e1ffe3c7272c6951945f12b949bc5d705df7
SHA5124bde2b8b349deaf790b5f1cdce36199f7b5f5fe53c05f5931cb7c9d474bbb186bbc2f7f28309c6e410e3ad1c5229f7adf1b901d950986daf0a8c6377b7c61ec6
-
Filesize
5.2MB
MD5605b2d627be06ccf0d88a9618c9e72d2
SHA1c35aca31ffabe88d3258147cf69690318d7198f7
SHA256870ef775162aa2013e13748f7a5055436ddebd9f9d1a5e6da44c73575b2701fb
SHA51272a9e402a941aed1215b5e7b1b08fe7651589a830339178c25b37183a7ed6116e28dda4b4e41b14e3df40851e4bda9cb3d963e7bf82550d26d24943e2bbe03aa
-
Filesize
5.2MB
MD5a1dd5273fa076e1289982dcc784c26c4
SHA14a8e50b416a0a86e05bd882b3c54b98762e1a0ad
SHA2569459620f47b97f7cbf61bdd896f7ac729992d6e27d4272edf171468a94469e95
SHA512daf6fa146cdf4f49cfb39ccd763128127522c1133132b081dfda414328dea23cb81d42a86fb90f77fec968aa75cd999b5a1c871f21bb467e81b93bff07c7f7e2
-
Filesize
5.2MB
MD589dbe43aad371e4ed5fff3df59a5bbf1
SHA1dc9fbfd3a1cb6cd93df1d7cda8abd4ea34713af4
SHA25608f265a4f51f70d2797c604b87b3a8021ba6cbce0d9e74928c097e5f4ee81aa4
SHA512c105412c967c79821bd79b1dac3a332a4bd622453989bbacc80e0480451024b3eed7dc638a31934fa155016dee0ff2c6586450a142db1b3e53280c178df2da53
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB