Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/12/2024, 04:18
General
-
Target
2024-12-19_c430ba7c5174404123fceb313e8683c7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
c430ba7c5174404123fceb313e8683c7
-
SHA1
61d38632295a7442ddcbbbab9ac073026c7fdf03
-
SHA256
c69e4ee68ae6f3a2a1603a3260097b12f48600bbddc37cf27de7ae7156e3817c
-
SHA512
2b5e9b757c125d41e8285187ed86405252683a09918afe814a0d157cf276c229514992421908259d73c15b8d66e905eaed2bdfcc7615cab44eff85cb0ae4d369
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibd56utgpPFotBER/mQ32lUb
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_c430ba7c5174404123fceb313e8683c7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_c430ba7c5174404123fceb313e8683c7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gaMNNbT.exeC:\Windows\System\gaMNNbT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dTPKUYd.exeC:\Windows\System\dTPKUYd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MVMTqcB.exeC:\Windows\System\MVMTqcB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AudrYuC.exeC:\Windows\System\AudrYuC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tZTEQlx.exeC:\Windows\System\tZTEQlx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SHtAlPo.exeC:\Windows\System\SHtAlPo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FJGfGgj.exeC:\Windows\System\FJGfGgj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ePvOumP.exeC:\Windows\System\ePvOumP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nVEFcRU.exeC:\Windows\System\nVEFcRU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HyNVZWw.exeC:\Windows\System\HyNVZWw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yUhukfQ.exeC:\Windows\System\yUhukfQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\irEzcpe.exeC:\Windows\System\irEzcpe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZrrvJbN.exeC:\Windows\System\ZrrvJbN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PbwwgPj.exeC:\Windows\System\PbwwgPj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XHtsdWC.exeC:\Windows\System\XHtsdWC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GPDRLUa.exeC:\Windows\System\GPDRLUa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QoXsJNx.exeC:\Windows\System\QoXsJNx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iBZUuJe.exeC:\Windows\System\iBZUuJe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tuCUJyq.exeC:\Windows\System\tuCUJyq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nKzKSbh.exeC:\Windows\System\nKzKSbh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jRrbnUs.exeC:\Windows\System\jRrbnUs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50f2db6500cc1fa5838843594d6323e05
SHA16a083439cf1a3a08d03e39fcbf63125415a7bf66
SHA256f8ed1ea8635168b350c60f25521fd398874dce1d0301cbd493c141e52592dc3d
SHA5129cc8e79efcbc5ca9fdb3dce11ca3593cc1291695deb43e89d439e653258b86149c4ee182d640b91ddd6a98981cd742a8f374344331c0d4025cc6b55d84ee82fa
-
Filesize
5.2MB
MD57671b53e3c63e8b5c7129718cb8b3ebb
SHA1e89ff7e5414426d61da7bf00f1cf029ee6bf3f76
SHA2565014f654e1c8c3db60ec19803908bfa1456c2696e254e61ed38fb01812a91218
SHA51222b2fc40351eb101205c53dab84636c1a868cafb115679f21e4fa451246179a9e5c6212eafdd26ecdedc2a538e1dc884e8df2888d7ba37bc7723ee695209437a
-
Filesize
5.2MB
MD5dc875cf9c4ec02129b20364df45632f7
SHA198251d05dac839449aeac99d6e5e2bcac3e54798
SHA25610630dd6245e3048d476fc57079ea38e424fb46686bcbc1935913c27e550a311
SHA512edeb4f66b25b6f4723faf56de97e3dc252e5f90b4c8110c3786771c1459df8c48093fffca11cdf3363b0830bac132ef28618dabf65abc2830d6263ee8d01ec9f
-
Filesize
5.2MB
MD58f56291f48a2d846feb51c24153ee2ac
SHA166b4d09d3221267662463337b5d30b1f5ea85b7e
SHA256cbc6dd3f7c429de218ef79924ad206aaf191168c9245c4b0aa59498aab850661
SHA512752cf3b8b9d7bbd943279c500b253fb17cc218549461f764a8ac5ba19168104b35627fea6ffadcf4c0a16029093eea16dc4b9e5b2a6b25c50abcf5c26c48a482
-
Filesize
5.2MB
MD56110451ea45fc4e6baf5f78ec9841ba2
SHA142915e4b830837d7a3bc04885594cd1797e8a00d
SHA25612b602e7fbcff8d2d2fadaac08ced98b51112e68ec9f4c997d0a03e7fa8135c7
SHA5120755249d0e658454799e204b3b1397ccbd85ab7bfb34df6575f5685ac0ef73d7eac4e92887608839ac7c9b4715c25aa8a485df527adb5b013d96220ef9b36785
-
Filesize
5.2MB
MD50d510a41e28f84ac75170156db0ea0a2
SHA1f5359dfa96cbd239cc50e39d04f0a1660358a6a3
SHA2566b7fb35ddf2322b6441886368ec75a5e3a50e9dbdd1b728b5414b7a92f3e4190
SHA5127ad7aa36d0786ab8375cf9461141de39ef49138aed2c8a5da9db25b5607ae67cc16bbfdc6ed2cc2b55810eb3457bd6422e39543ca88722a57bef4c8c4f133b20
-
Filesize
5.2MB
MD5bc4762a72129405138f0ad8fa60d44b5
SHA19d3b25026ec1815475861b52ec8757955e825114
SHA2565b19bf59a91c87e34bce826b9b468388544ce7247507a476bf37c9769ce64478
SHA512cae37922323c7407544d89b3f73070fbe7dbef2576285b296921424c9fc8101445f5a75322ae36440404db29debb95cc671b9ce65025f4f0f1c60457a4cd411d
-
Filesize
5.2MB
MD5474fff295d77e866f8d98cfe77e915e7
SHA16b27324502b15f821b7b5c34c32e5a1ad0347bf7
SHA25600a9c30121f9279ee9a49515cab7905a9bcfdea27708f97658babab694dc8e25
SHA5124995b187503c340250eaec0eb3ce92da181b9037987aa529d2daec1180b4b75ab90e604eecbbbf2f96b043a5bdf0887ae2ce9d52f9fd2172ac2d24363782372b
-
Filesize
5.2MB
MD52aa6927f45ab5a3c77929eaf3d8d401c
SHA10b77d3ce28ca4bf7423cf7500da259fe4df80d18
SHA2568f11eccadc5c9049e7c66899f44f7a6357a911d34343f0cac63b5f4a0e24d88c
SHA512353ebd1087a882f5dd95bbecf031bafa79f657c9300477fb8af6f45372bfd4a5e6d4efdddd5d350832fc3dab7853cb26b5e8b7f6b5644f745e5822e5ab69cfbc
-
Filesize
5.2MB
MD5f2626097a01269f090a9034950a014f0
SHA14f24d0c34e3ad8db45924b1c14025064b3cf75c8
SHA25619de5785027d3756e98aaff016b3f5ca874601593026e0dcc54cfe5cb338f33f
SHA51202fb13ba295e2742f8df939c20e040935a3706286ecfe495a68c536632e575d1816d5e3549920e238fa118e789afb7c5c07fe2588c449acf288071cbfdb52b1e
-
Filesize
5.2MB
MD53c33eae4725953bea267abbeaef5af04
SHA1efacbfc67910972d2c4c61cab199e508e256fbab
SHA256c0019a18a47295fef3348f054e11155228879ee429127f24317a376aac2a8b9d
SHA5123fcb60340944c32587813e3b56319907f851b5565661dcf11d82c33400d2a69ea51f079f07a7199d8b7e7c0635aeecc82b5a5b86045962639a601bbae2f4b3f3
-
Filesize
5.2MB
MD55f45defaf2b374f2f21f28e36a3c35ef
SHA10cbde1f204288497dd985731fe4652baa414b00a
SHA2560014a13caba54fcecf776811680231f0e290dbb3cea20ae22336e77d6515c67f
SHA51293ded887c924621e7811f00ee1dd7e8b3fcc9378402d81482404c76745d32537b1d794d95ae0a8a24337fa48d4e84b0dc87586cecdc210421bc91664817859be
-
Filesize
5.2MB
MD54be44be2775f21658f5cf4772c810778
SHA130ba1aa2bb5bef626581783ce038bd401015d0ee
SHA256465b8a1bdf27ac99abc168b7ba64b172e79ed326966b4aadd91ec645613434ec
SHA5129bcc061b89a966d1482ec0113d90ba51c8420229ce27d09a70b2f342428852ff35e6d8d4b05ffdfab08e66800280954f269aae6bdf05f7f2a8368371b7f4153e
-
Filesize
5.2MB
MD5798f0e9d723ce6ff3ff9b036bbee7a4c
SHA10b92b4470270d747fa2afa15c4ea73d174223604
SHA256bb0b43dc73da2f26041043e01fe90dccaf961e4f48cd4f107e362f15d359d19f
SHA512c38966df9956b51d011d24e2ce8e8bd3889f2f3708d8da8c794ca28a94b605c943ad053e809d11cf4bf4aef19cb4a38d987caf0a5f41a4fee504c6bae4e4ebf0
-
Filesize
5.2MB
MD53218a9baadf939db525720dc15e42f5e
SHA16dae6be9130b18d1aaa4cd7e7cdaca0a3489d94e
SHA2560ee7049621dc377cd7024e92525bc38b06e951e524395009f0d7f501cb924a27
SHA512bb1a6729736188b722251f45a49d74fdb498013844ac647ca1e23dfec0a2cbef16388f35e30cc34bf84f0f560c80d7af478e09afbeee52f9e66116b5a5c5e4c2
-
Filesize
5.2MB
MD532e2cd6449c28966857bc60440ebadbc
SHA1825a00b91868d0c025a4a5d0eaafd016d28a0341
SHA25688746921abe836707dbeb796035236e357db221451e7403d30e61085ae0d9950
SHA5127f787ffdcab825d9fcb4515bd55621897317cabf0c71b37dce70e2e08a9ec8f775f64e0f996b1e35f289292f2b1ed843da22003bb5b93ab57055fc7993ccbaa4
-
Filesize
5.2MB
MD533b276f97ea5e13e163d5d5a5557a1bc
SHA174fe029b8766546faf7d57f7292572775c72554a
SHA25607c20d92f6c20d9db6df2946a021e7e76f3cb5ef9ccdd0f206eec7717d5f7242
SHA512738aa3f33fb47c421aa911efdb33e3d9ee5b621f8f9c41da838ef1e97a38f1fe7f3c2566c9730cf5b6fd848459da7242909dc438982e21ad4f56a572bebb8466
-
Filesize
5.2MB
MD58dc610d26c92c3f065b1c53284fe521b
SHA18b9eb01bcb1bbf4c8f92605e081ce717ea9ade35
SHA256c222cee477c77d3b27b6f6016484908ace8ec644ad106eee9c7d84623fd11269
SHA5122bc6ff104cf1cf4445987695fd943b998106fcff37c2fc4b91f5d77cb7dd0ca5b3d06b17251465bb42e2733521261fc872e4e59e46a540556165be087270598f
-
Filesize
5.2MB
MD566872c658fe83053519c7e52db7fabd8
SHA140cd39e8bc5d62d8f1680f4062335075e2e146cb
SHA2563d1d3d433c32ffba5dcecf4be7adb88cd2785527c72a4487a7a6c9c7c32f8736
SHA512877cc6da2ac5d61e07ab82189b8952118ae02f4eb56be4ee2d92315721d1c5cdc156d6aa304bfe47d1b0b5f451ff0e214c846fa196d0db5194a465ce552cfbf1
-
Filesize
5.2MB
MD5e1f2877cfbcbf86f25536a6a252fa02f
SHA1097a7d988c33719e43746b837df599800383a454
SHA256e12757c13a4795cde7603fc23cba52d69609685d9a090d75608aaf019914133f
SHA512087f48adad5b9f283ec8fa59f79f80fa50a6bf781de60765eafd02513e2fdf523e7c9317ae6df4240f63908df28c1586d09f32a23b6315b0e343dde982ed7433
-
Filesize
5.2MB
MD54343fb6c8529662aac59cc91a161f02f
SHA12dd651044d670e299b8946ca75698c5c336e0299
SHA25676be34563503dd4c1f58ae850791e18b5079422180eeffdf1fe6ce451efa8103
SHA5126100e56ba897a8a2af926a271a49db98d4b4e77735aa2240d888be29f581deba6bae0c885ae6ae50459bb08d1ce94b465b640f9124246efbf44850a84dc261f2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB