Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/12/2024, 04:16
General
-
Target
2024-12-19_bcf1415bacf01105d7ddad34bc6b69d1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
bcf1415bacf01105d7ddad34bc6b69d1
-
SHA1
0084f4c8996a69b7eea02abb74f49c4d9b41863c
-
SHA256
b5d3be6cba78aee7ba3df63bfb8b2c6a84024c2718969866e9061ce58e54616a
-
SHA512
0540bbd2a39debffc8aa5da0a1e6a1af383f7912f2e5306750dc0e6ebab2070ea32c58b44c29e11625107a660f8a0ee526b869527294db75bf42329a70c93c49
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibd56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_bcf1415bacf01105d7ddad34bc6b69d1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_bcf1415bacf01105d7ddad34bc6b69d1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YcAsEDg.exeC:\Windows\System\YcAsEDg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mpNmIYm.exeC:\Windows\System\mpNmIYm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TKexWtw.exeC:\Windows\System\TKexWtw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rEDSAAu.exeC:\Windows\System\rEDSAAu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pftNCCp.exeC:\Windows\System\pftNCCp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ttAVUDn.exeC:\Windows\System\ttAVUDn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pXPrLrn.exeC:\Windows\System\pXPrLrn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CNkAvTM.exeC:\Windows\System\CNkAvTM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rWKkosM.exeC:\Windows\System\rWKkosM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pgUHqpL.exeC:\Windows\System\pgUHqpL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tJYiVUk.exeC:\Windows\System\tJYiVUk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tvwiGmB.exeC:\Windows\System\tvwiGmB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DYieKEp.exeC:\Windows\System\DYieKEp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xhrnXxq.exeC:\Windows\System\xhrnXxq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zjBXhNd.exeC:\Windows\System\zjBXhNd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HioSlDg.exeC:\Windows\System\HioSlDg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AoaxGZY.exeC:\Windows\System\AoaxGZY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EEguWJl.exeC:\Windows\System\EEguWJl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HgxSlcA.exeC:\Windows\System\HgxSlcA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MSSUYII.exeC:\Windows\System\MSSUYII.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Jbjndtc.exeC:\Windows\System\Jbjndtc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b2412e2e49df4385affd879ee29021cd
SHA1cdaa8d9f255285fa118c2630f0365648edfc5827
SHA256031d21e2a5a88963bcd4a310c4077a434119206acea091e26ba05e4885986f86
SHA5121cc9336ea658df0851946f0565bc3253b6a6059f00826e040c68ec4a5858d122c8672d5898095e2a2f501f9ede0038acbb3f458a5b2d88266951af1755905276
-
Filesize
5.2MB
MD51946e25f2287886fefda4c3384f97e6e
SHA10b1a1ba7abf51c0dd510176c7cb11eb3fa22c178
SHA25608d48d585096df71004c35620de0b344c208cd95645a16cb6d3272da717fbe38
SHA5128108af3414ad8669c4117d315269d8b7044f981dd634bc90e1cea04e69938b5b2015e875f692bfaa111c53e119a7d3997301689f78be73f40c5edb01f5250ae6
-
Filesize
5.2MB
MD5faee07b28822710cb2b446f8c1b9145c
SHA1e9d1de1aa911cda2a5f97debf446ff67136273a3
SHA2562f07fa34540063ff9cad5f7d28116b13a7882a1f58ac22d530e4f8e72e05bd7a
SHA512162cd47f8d82be9c6b27aa497a9daa669c2584cec5e9d0d405fe3a4548b0c57710de7b17451ec268de0e29410646ff16cc7bdf702f0b0263728e3ec7641891a8
-
Filesize
5.2MB
MD55982483eebc0204846c22a0a5719b25e
SHA15ba931453f4aea79e1403e64aa60e6110d914e84
SHA256432dab810ecee6b5bc6cb6080e54d7564104d7368f967c7fdc11f6bdbc49b7b3
SHA512e7efa98bcc6e6b3f8353f4ce5d4c339b6b7ae2c898f26b83a5bf540a679860843e4fcbb8dd025af416a4dec863d5f33df6ebddc256c050179022e5c61700c4b7
-
Filesize
5.2MB
MD5de43c29e7f3381d93025fe31e0a32aa3
SHA10c2bfc87a1cd11de78a80354a79b7e2cc84b112f
SHA2562c2fef8a07c204b850eeb6fa502ff1ac97fd63984a4bb5e28c43addef4e12700
SHA5121fef74ef05cdf40389c9d4aa2989b520967082d2105cc2fb2966c4bd2ce00021a2a60678e3cfe4d637e26a7376fe20c79edaec5dea08c5bbc0cc9b1ac18a86b7
-
Filesize
5.2MB
MD5ef4a2b00db076c0187eb6f35d770654c
SHA14a0939adff42e77da43e0d7e758da88d5d7f7cc6
SHA2566ee929e15e43ab1e6b806e646565cc789e7d70c2a550eda044dce42f1f86944c
SHA512281437f0b1b902d5474e508d7fa392e078ec6eb29dd8053e87fab6f2258e962a2bb25c5720c8811e36fac51974bb780b919fb00950594ce193ed18feae85a7c1
-
Filesize
5.2MB
MD58a5678897b9487ff7660db8fc47d3154
SHA1ac07bdab748e225ed1a6fe4393e5402e7e77d3ca
SHA256140ed61751c2907b195418db7c1ef3fd337893d18857a14d8112edec5f85aa1a
SHA512974d9daff2343d5ba5bc9ca4d627034848fcf5c4e78433aecee3e4f2c585a6c7c70b83f1c5701a1e970a0b232c094d999d2983aa05a2a92fc6700f799aee0c14
-
Filesize
5.2MB
MD5eca68a2f0b3808eff49351803713e9ff
SHA1fad6a60d861c320c39a783c652fa458320c67c81
SHA2567bfefde6c3313996c77287d8820d299b92c9267528635b23fd7399a774db62f5
SHA512c682839528728eb7b9a6f1d14eeed738d783bb6a74a5d6868cab2fd3aee39362bbdcb8b7587c0abe8d2f0f544322f0749a231a57de836f12c622d7f3572184c0
-
Filesize
5.2MB
MD59f063442304a783599ac3c43f368c3af
SHA1f5e2dc31803f3872d2068b0207b06033a83c0efb
SHA256c4cfd743cf3fdbc36bf82595787d75580754825427c4b97b720e38271ad723c8
SHA51284e7e0e70485aa08d28659f1af930ae0c2357eae8e44f0869ed78c2802dca0fdc2ebe5555200b5962c316a51a6aee848f9db56fa6a12239895e0f1786edde36f
-
Filesize
5.2MB
MD5bd6bbf4e819d447ea9f3ffb5e76dc6a0
SHA10afdb1e359f5d2e13ff48fe24b34c908ce51e275
SHA25629ddb3c661a3f3d3b4b8229086b6c4fefb057e680a2641b1b7f976d5e88e24af
SHA5122a257286bb99e4933392312ef484efdd114480a9bc39ac9b66d80f8cc92aacdf395629c6f07695e37c1f371ff66bd5733ab92fca99bf611562fe80168b4de284
-
Filesize
5.2MB
MD57c86194897a861c3e04238bce44a3f83
SHA15fecba25b8b9efafb93df0c21ad9be8baa8fa334
SHA2569e891273a65041a351a30f14ce53d72a827a230998227bf43795e2e07dc59b60
SHA512b890789cec8862c689b9c5ffa357046b48d6901b5f1e2f3103f8edb27fb9af6ea5dc5c87142de624996f0008b7d3f63cbf59de172cfc18a9bed38b1c7f1c9f57
-
Filesize
5.2MB
MD5c6061820bf7a038686d2d04e0f3463d5
SHA1a8c9628ff9435746d0d53e8622dea7e52cf64649
SHA25686fd42027c448fa95b83f23e004b6b0e4a8f4c5caf41e3381a90685688f1b47a
SHA512ee138dc0a73c31520ac5482ba233c68a28ebba1ea8b75463c680323f3070b31795edf0cc3ba5d4b0254f7ff1cbeb14518e2b2dabe42755a7a01a1b845050c65f
-
Filesize
5.2MB
MD5206901e3603904dd481ecf769760d2b9
SHA1dc0cae603a2b50d889887e99bfad2eb1ac2160b9
SHA256e6e7eb4c27526218846475818a4d5c3e7bd4b6dfa220801c8c70c8b6480c13ba
SHA5121d5a212f40c2c4731eae6c9f0758ae629b8e2aeb3dd453cd13d422d0f0da55098bb638af1d09332aa3cceac2769c9fcfc90cfc12f440d160971ab24b38dee9f6
-
Filesize
5.2MB
MD574b50430b7e41a954d43bbc25f1a5d55
SHA1e61784eda6ec84924dc717207419972cbc8bb143
SHA2563abcf9a9164ecf547f5c932fcba62c6b4e2099c1b7b2afe7427fc39397e9d241
SHA512229e4b7228f6b0d9e8da233d8e9295f311443c1ebd7344e41258b52be40ff635d4e61c39779b2eb26c2bd17300f1ba22bf1933ec31f6ccf0809f251995b65c38
-
Filesize
5.2MB
MD5040611d9f400c62686c3ef01c61c0baf
SHA1c219276387ff9f5acae3ae59e0379825543a2544
SHA2563bbd4c273b2d5f17347f089e3c4c41b7efcd5a8815b704401bce7b50d2b2b05a
SHA512e0a35785826b872342b733b652b85b2938d00385d8753df73edc66de65fafdac8af89859a74a9797b61e8f2332493d6d28f32fad25214fc82523b5dd9beb8b4f
-
Filesize
5.2MB
MD568d73d8b4be6b00aed137f551e25c836
SHA1bd8f21cc14809b83cbb51f1635ba19c5f1aa78e8
SHA256cb2209f8bb3079ae48dc2164d44476519ca3985348c6a8f06fc372583fbcc164
SHA512c5f189fb45c0b63e949b50a0df5e5c7b46bab52b09f4f969750bf91a38fa7555a6526af4a4691e3b7b156fa5a5e266e15bec4cde8c7c07c1d18dc52b9e5049f8
-
Filesize
5.2MB
MD5d03a008109d2c49b5bf88a52eca87d5c
SHA1ba5c11d258744c76f07c627c6c9025dec2675151
SHA2565a1c9a404d4aa01729564250af667901658064394bf3fb2f448d30391ac15b6f
SHA5123e49a7b1818126775d63636937b53e76aafb84a6c90f684f8eb44e0e8d839eb4120f174185ed7d832ef4bf6a2d24106d729744bbb7bda91460a595e92cbc0fa3
-
Filesize
5.2MB
MD580b00d8997ebfcf6353c7a4c2a1c2fdd
SHA1310f1f9f41e2041d02548be2be712fbf3fef9bab
SHA256e513f39c3819f53fd61c5e57d21487f4212abe8a4cf6dc15aa6129c61052771d
SHA5121d2d959887d26b610a70b0dd0fc280129450473cbe0dba5a98d4ba48b5a228c78e18280b6d75911e128628150f2db061da4d0e68d318589689a5eb39cf838e61
-
Filesize
5.2MB
MD50cd3c86a9f85c61e029112c35d3975a3
SHA1404166be7d1b296ab0b85d8811d91e03e22325bc
SHA256f1b796034c4a7b26c8d1c5849180d78ac07cf57378c06fd5a199a2c51893408a
SHA51299f62dbaf9504f4a40434ba5837cdc028c08b95de1a3743f172c7990f269df46dd44cbfb40eb960ee92deafac370157f6ec8c7e57effd509b8faf9e5db47bc95
-
Filesize
5.2MB
MD5ec39ed162df0b4cca359aecd5245a3bb
SHA1631882e9a114fdd22578e65bf4a2425320a2554c
SHA25608ffdeee52eb892c1b6b5608204875e414d68a01c0bd1a209e4730a25ed52d1d
SHA512d33237fa8de791a90c3a47eeebcb294e19621486395c076863620f534995154236ab2d7204b670b8326394d94328751f04f29c78f1975433ae277460af26ca4a
-
Filesize
5.2MB
MD5ac909744ae3aee246e9c38dc6890d08f
SHA1352473143094f8102c6f05e8c73da8f857af4006
SHA25678645e8ebc94763dbe6c0e051f228eec284077249020662d5a5faa00e00ecdcc
SHA512c1270abc2e0de29f4b1b4baae91d24817b20552dfd16d9e4dc3f03546ee7a432aada67fe6cf979db03d1b27b6a24a2117a14f9d0f63ab5c3bb3bbb92fe8984ba
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB