Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/12/2024, 04:19
General
-
Target
2024-12-19_c96f1fab16ad6195c61814e86f7ac0c1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
c96f1fab16ad6195c61814e86f7ac0c1
-
SHA1
8f0d677b8cf206d78bc0f1c29573279e711829ea
-
SHA256
c22f7e444297c0bba817aa59470acefe8f2e23580ad738d1f7b264d8222c7670
-
SHA512
52ea5d2a66389bc1b5c4e033a1892d12a7e07275ca91a61467cec0d7ee09ebe7a3e1781a931a18e41cf4a5cf61d2830405d00569a65dfd4664e7026755d91541
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibd56utgpPFotBER/mQ32lU0
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_c96f1fab16ad6195c61814e86f7ac0c1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_c96f1fab16ad6195c61814e86f7ac0c1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hbxizNc.exeC:\Windows\System\hbxizNc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qIUzDyO.exeC:\Windows\System\qIUzDyO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qZhTclX.exeC:\Windows\System\qZhTclX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xUameKy.exeC:\Windows\System\xUameKy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iNgaMvv.exeC:\Windows\System\iNgaMvv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MomdZRR.exeC:\Windows\System\MomdZRR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MCVFjJd.exeC:\Windows\System\MCVFjJd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZpjyWtB.exeC:\Windows\System\ZpjyWtB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OIvbHDZ.exeC:\Windows\System\OIvbHDZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FRvrqJo.exeC:\Windows\System\FRvrqJo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VHcEEbM.exeC:\Windows\System\VHcEEbM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VeJOCzz.exeC:\Windows\System\VeJOCzz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZQKEZlD.exeC:\Windows\System\ZQKEZlD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wDqAKLb.exeC:\Windows\System\wDqAKLb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rYmLAYk.exeC:\Windows\System\rYmLAYk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WOWrHzW.exeC:\Windows\System\WOWrHzW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BxojUIK.exeC:\Windows\System\BxojUIK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qsfZOIB.exeC:\Windows\System\qsfZOIB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EarXjVm.exeC:\Windows\System\EarXjVm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JWRgnps.exeC:\Windows\System\JWRgnps.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ACRNfqf.exeC:\Windows\System\ACRNfqf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD516a8530372e0bffc0f0ff5d96c12f7ee
SHA106c910db066ab15acaed03f617381a7e356a6c6b
SHA25682b57f2d3307e62ce9a77eb40d78b6ec3b88214f5481ab86270858fe6b264306
SHA512841b720baad21da8ce2d05cb53ccce22479cedbc1193f443f27bd7276d328572f88aba31b5287b63f8817e95fcfd37b81c554987ecb8dfc620d613d973c2a85a
-
Filesize
5.2MB
MD58617e61ea11fe45fe83d6b33528c2d3a
SHA171dde796784ec9911c424dfdd5b384f3b30d584a
SHA256f98e13a72ec4b1161fd241f1854b83978c407e1f529d32d080a4525b0a935fc3
SHA51267885e03d70ddf9ec3e43b8d32c5a5c969e0dcbca4b9af72c68826df0596e0410f4e6fd714d3e3f9cc8e61d0bcaef686ab53fc8f9911dff43b75e5656eb32884
-
Filesize
5.2MB
MD5e0fb7f97eb52023f084b3c90d456ec1a
SHA1444681356016061f32b977ffb50e6d0ccc76f47c
SHA2569ca1be1dae9c563d5238bd2106cd81d4f786f9df296620becd827f2205cca372
SHA5127713ad71fe53096bd0e3ce80e80310f1a4b66e5281bffef558ebb63e2953f2f96305dd88d270ab53efd69536f0e57b4246077692d132305f4c0363b704a4549f
-
Filesize
5.2MB
MD592a6bf9bc8be52c9ca94e4b8cada3315
SHA17baf2b64b8135dcd3c36e5534a274659931a61a5
SHA2560919754dc659e5813dd1774ebc6006e38fc91f502a51ffa4cf112599d2364ad3
SHA51250c1744bd2449830f178c536ea481ca8c3b74e896e02dc93b210ca9a11635225e43b5cd95e53e75b6b2824683c6956f0e88c8f73f09afaba591139aefa26317f
-
Filesize
5.2MB
MD5ee64da34347205a6a8c46268e5c5a1cf
SHA1b7c83ce2e82ebaa89c3d4223082c8eeae2e23922
SHA256564afc3e185c312be220aaccb76c56aaab09562e28d26e8dc03c7b584eb08e58
SHA5124b7e0617c41cf3037b9db5f35a2022ae67cb6c3da9bf525b747ee87419da89a7d8f4c847e110ad7b268b0039c89423df00331d629fad87c737c83f4b9b9adf0e
-
Filesize
5.2MB
MD5ce450f6ae49dc5a17c294d470e35e00d
SHA135fa4028c10fe361d995b48872a143bb0a5eb1a7
SHA256c2b8322c3a5e6f8a0325333bd262f99d65a16186e91f6bd90603ee791973fd54
SHA5124e8eb46fe3579e3070ae8d21ae655503ac1b33c2eb5b0a7f9b394befe2a26df95f53df1023cefc03d2a95af4e8fe2254da6fe3ebb5d26641ac093e47860f2eef
-
Filesize
5.2MB
MD5111ad4136a47c784bcefef30f64540d4
SHA1c2366e20ebaf9d59afd3f6048ca64c5ea6cb944f
SHA25662ea4e7abc1a1d0d32dd6ff068575e47400fe89e459a4d129ca76c7f1b3194b4
SHA512c89369dad1d3ff6fbf88fa568d29cf12d5cec67cf31513ad1e7713dd7f3d8c41da4d9e7e615cc58d9c3bd9af00cf3c66d8d66487469cc52d9ae035cee9eeff98
-
Filesize
5.2MB
MD58fa7207a4e74d6a627d2bfa05f49391a
SHA113c7280c8e7452d58e99174d9f69d41223697f68
SHA2563ad5943c784049663559ba856f8d3be724dfc51add542ccbca84dc778bf2725f
SHA5128e865b9f86edd3d75061f741f98d05cc14d68959833cb2a4e4060d1ef38bb0dc7848e8cf4997775bb37323481ae63e93f9d34cc7c02829c550df0ce41c511081
-
Filesize
5.2MB
MD59093ee4517003761d9295b7820d8bcd3
SHA17000aa0e89121cc26ec506170033cfaa4d5dc32c
SHA256e8afe147dd38e12d6dba48bc5e59189800a495d3c2fca07b5466ddbddb74ccfd
SHA512ca7316cbd7a45c8670a8f1cc308fdec210beb36bb4683dc8f10b22ca228a18d66230e587616b4629cfc8b213936c26531858ea84265b2ae7a8a67d5454d628a6
-
Filesize
5.2MB
MD529369004a4d9407ef22a61227f2bcf93
SHA1709dbf497bf0f290ffd44a259e9a79415426cb29
SHA256010f5f81161e434e8fc6b17b24412c6159d58eaefbbe961058b8c5d4c1994021
SHA512219b2013fe79fcbef0c88e11fd811dc0609d78a86a63894b541f29b2bffc73deff2a23b6351aed27d6f687fb5cb6c37947c2fb2c693a12bbbf7290dfd258242d
-
Filesize
5.2MB
MD573c6766a0015858af20e1be3e89579c2
SHA153dd43916e3fd0ad2660554c549cc5c1ad114148
SHA256dea656e391006280a9eed406625afe1cc265d563fb85c0aa78c9e4caaa44260d
SHA512d89d7acf7b27c1a3170bd7355ee4158d664414240d974a156e5f93bc74527940c5f9a6c539700469048dd0cb4a6078b428975179fe79daf0be568dd02d17483d
-
Filesize
5.2MB
MD526f5e3b2f82b1b3461e4fbeae3520f99
SHA1292e814cb4c017952b894eeb89708056f49c461d
SHA2565987c4f4b1a1e9abaf1a1187497f6edba3bc72158c1f7a0e4bdfa79e795cea8e
SHA5125caeb20555293851e22e9013cb6d5de54b93029823809436753f57b006e937862cf4297e08200dda6113c609485091d57eb50ef3db4482f2cca8407071e892d3
-
Filesize
5.2MB
MD5694b9a03f4f4c7bcb92b2819ad075e64
SHA16031e2d3ef935c6019601e3a99e0e92cbb257772
SHA256f6f8f4d4265ddc89248a20e5f694ecafe1c9e0469e03ee57afef53c5f17e1c18
SHA5126cce6c3f203a38de4f3dead976e3ae61d6d8cd22a37999169facdc91a5dc0c4c95de4238ca2f6f168a366327fd328c55d97e274d83c37641374b694682459b0d
-
Filesize
5.2MB
MD53f1c617bc8d72386ed57503b54f3afcc
SHA1ddc2d6ad87231d8e80c22e46fcc239d85e96292d
SHA2566c3aaeaccf2ce0b5c43cf58c69d340dbfd54a91ef01b3f2e5c151bdd685bf65e
SHA5124eed78d59f8abc3d94503e2b582b0a5b1255dc28c3554abba9bd62fe550afcd474dcc1ec8419a7e660976155e2407c5a6763900abdbb5a80a899975d638e71fb
-
Filesize
5.2MB
MD556e31c0d3de4f992b59f9bf89134e59e
SHA1634f8590a1592088ddab7aee762f3b596db10719
SHA25691c13c9a43d16cdb43a0d5f1ad760130a1f70dcb59f06297fdae329eb70ea81f
SHA512b44c74da09b59b963444aaaa9219b4402faf6a1e2d465d018660e6220fc44e802209ad8c52400dfee8df2edc63551cccc7d903335efbb92cb13238fda218967e
-
Filesize
5.2MB
MD5689b4aa6e3a9e4838baf4f03a48917a1
SHA1f36ee0449b5dfd04e78c807e340450faf358f841
SHA2566de0b2ba1dfbb5b022470942283c6645b1c25e89b7d5d6e7ec171fefb7a5737c
SHA5128f7743f65d86741ec6acd010d21f6e36f7e833a50ad16225c9ca4cd44a0617098755fce511c9827d529dec537029152ed0a275870f86b58a0fd1157d1d47bcc7
-
Filesize
5.2MB
MD56abac97529c9cf2fcca0c5fa20e9f6e2
SHA199cfa14eccdd67c6870e9f1d6ae9a146b3acdb40
SHA256a1fb1164eeedb7b5b0e5e5776a7b55b936f877f05861d7c79ea1292d9db38c9b
SHA512dd7e1297ab6b9130d2b347e48b163139034b34867e8ba8aff35e5c5aa664ab30a4b72f6c67dfb3295fd81d100984a655cac67507dfa25689fa593e8579b18fc0
-
Filesize
5.2MB
MD59f666ba4185bf448d411f5bacf86b7cb
SHA12d757a86354597bffbb8269adbfe74c7f61c909d
SHA256155297849039d678eeb68dcdf65a13794dd3b01197757d7a4a2f1a0532e67ea5
SHA512161865ffc295207eaa98a3ec0781d7faf771decf710d7a9db01a8136e6d8b4624dfe926c870b25f1067f696f9d58ebb27be604e36072ab2f5e5ac2ee67713f2b
-
Filesize
5.2MB
MD5ee147de2415c431dfb0f907deb94cdb6
SHA1b6ece78ed9050beeb6c1e759ae63b29ceaf52d94
SHA25658d030b3783f6cbf9046b60ddf5fab6c1c2c97e9cd469032fb26eb618a523a00
SHA512a5dcbfcccdbc72accf2c32626d6c8198a4a21bf44bfa82f902bdc6b2897573ec2b5d5eef3f83af808d29f9813decc667561275268ea024a6715dfc597d62cc68
-
Filesize
5.2MB
MD57891dc51357d8d4392567c2ce40c1b59
SHA1d77c207ca72f0020e3720d628c93096ad7d609b0
SHA256d1b36ed09e894bcbedbfba9420387c96aaa03ca9281d204dbb271d14d63cc1b8
SHA512107fd2dd38f312cbdb8192f20d493099d32c0b87555cc915ad20f7981bb0c9876d3fd4a91097000f4e54f4d17c89550bb82835bd99abcc00ab4b7d277793dd4e
-
Filesize
5.2MB
MD5e16da82b678b22bdcbd3a436520ed1a0
SHA16ddc0683d8e904f566267c8c2756f1d2a384585d
SHA2567e4797979bc21800c1e3a1a5d19bb95402a0db0075ec58e48aa6956c3e84ac6c
SHA512837f9185546b41e143648d20b7734383d554e83f14f21c71279aa936f80067cb8d009509def75bf19b45fe8bfa4c047133904d683f4789491e5b993d98af204d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB