Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21/12/2024, 01:45 UTC
General
-
Target
2024-12-21_b510eb0a3157feaed4e5a09e3d96d55c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
b510eb0a3157feaed4e5a09e3d96d55c
-
SHA1
924926a2c4ab2fc1f663a84c2dcdf7a8a42a3006
-
SHA256
f7080e38a9e8d1c06fc604859de5178de67813f634e3e7ad139f4eeadcd47379
-
SHA512
41a344e487b0c6cf2ca9af935111f8d157171eed6cabddfeba95c022c521440f8953ef0571359fa8f33ff899c4434223ab032f231a1432c2a2636602fea0c453
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUB:E+b56utgpPF8u/7B
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_b510eb0a3157feaed4e5a09e3d96d55c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_b510eb0a3157feaed4e5a09e3d96d55c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dTyaSeR.exeC:\Windows\System\dTyaSeR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rIrZfUQ.exeC:\Windows\System\rIrZfUQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gRVSdJo.exeC:\Windows\System\gRVSdJo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mugizBr.exeC:\Windows\System\mugizBr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AVEyIua.exeC:\Windows\System\AVEyIua.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vkVyqAP.exeC:\Windows\System\vkVyqAP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xLiNoRm.exeC:\Windows\System\xLiNoRm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KFCjMsD.exeC:\Windows\System\KFCjMsD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\srSvLBg.exeC:\Windows\System\srSvLBg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\boyibdj.exeC:\Windows\System\boyibdj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xzXuTFH.exeC:\Windows\System\xzXuTFH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fFNnNUz.exeC:\Windows\System\fFNnNUz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cyuVmIZ.exeC:\Windows\System\cyuVmIZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QWgBaZq.exeC:\Windows\System\QWgBaZq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\msMkrjv.exeC:\Windows\System\msMkrjv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fTaVAQq.exeC:\Windows\System\fTaVAQq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ycXoQWB.exeC:\Windows\System\ycXoQWB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\USProwL.exeC:\Windows\System\USProwL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FUyvNce.exeC:\Windows\System\FUyvNce.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KhthApL.exeC:\Windows\System\KhthApL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kcvjEqr.exeC:\Windows\System\kcvjEqr.exe2⤵
- Executes dropped EXE
-
Network
- No results found
-
3.120.209.58:8080 -
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD59bae54cc677b016cfaea7e40c6e3d8f5
SHA1dc90e07d1d9f2952ad9348e8c8b6b159a4cc75fd
SHA2564f1d72bbc147fdaa93714a06d0bcd6676dfb44eab0ba1c42f7adb66e5115da58
SHA512f1b773b55961570ebce7720131c8eab5cd25fe0a155e945f6bc93edd170c42022d176da99f655f39ef6f32cb854723eadf80edc2d0f2b0389f5c5fc54dfeacd5
-
Filesize
5.9MB
MD5ba903e9caca1f2c6e9e9e8f382ad4433
SHA1c4f654526c9ff053dc9099624972e4475ba7e535
SHA256d955354636667e098fed6782d66d569921cc855801ddfcbfaa79ce10e444b36b
SHA512557609adeb9c33f49c5acf8edfbd15df4594b7280e7ca5875f6bee28fe052fa591388dcdac5a9602653643347d8def34f6e6843830452faddc4c46b65c263054
-
Filesize
5.9MB
MD5f313b93dadeb97409ff33a750e2c7f91
SHA13bafce60005ef058600e99ac552db493c0ea243d
SHA25687538a9c328813f23f8bda2ff9d2e51d7d5bab3f97d3b164c1eec343b8697e78
SHA5121d87cf8e5417313b8910761a869c005ac1b0d887d98df7a566dd5d3fd2e356846af5fc3be616a67eddd8f47a4acd6e8194962cc7323e339b31c89c7afaea2362
-
Filesize
5.9MB
MD5e1630a91f97a79b851c89bde7d1f1058
SHA1f8ccb28efc8725ff7257c72ecfd2dffecb03ccbc
SHA2566f21bb04f5ac55ecd72bd1ca4bcdcc911da39478d9ec4d8fde11194f7eb9478b
SHA5128bb8303ccf17df2a05bdafa2e6c6abe0df8dfa30b5533069859bea2632265b5179939b5c7b8bd9d618ab7dca833eed34a8a62eb8e6003ad8d6149e7340a94f3e
-
Filesize
5.9MB
MD5cc83b53f2338fe9cf892c1d9a6d61113
SHA1b14b817d4f1932aee60c19531af2603cbce18ed4
SHA256102a18291f4523a591cb56fe018b35bb2045fcabaf3a13d4aa7f2c1504613d3f
SHA51240306aac0d533769f0fd2a49092c3bde20b81ed894516118a5b76f2e3e1dc0436fd06f75d15152fccbf1c88a29f2cedfc884c29099a576dd63eba79347f7f00a
-
Filesize
5.9MB
MD5246701cefc2838cbe09de3db1019d3dc
SHA1852913beedea4b48c002382724512d8b17218b32
SHA256c2dcb56f9dadf9ed4566f264579632b2e95c191ee9a0910d37f0b99c2b2854b7
SHA5123cd3094b5df8531ad266e193522c6ef2e5b2af006397111250d628d340ef6c952e79968c61d6a38950af161df3cfd19f462508bc4dd15624eb0e01bdabd46908
-
Filesize
5.9MB
MD5179ad363704980b50839ee8c65191cf4
SHA1f00da03ca8fe84406b6437292914c6b21a6c9798
SHA2562455b0f99851261b015ec4baca0e3bf9bc3f3ffa8a1f762bbc2b5daa2c3f8df4
SHA5124bf50ffa16069f557bb9384a182512723dd86195cec1d78fcda80c08541860c1d6e2ecfec90214643febb7701ca90c155082ca917c76e7f17bc1a3111efbb2e8
-
Filesize
5.9MB
MD5df1d93f29d08881e98cb9880f2bcfc06
SHA1df104be404ecee9f96ab977bc0a739239461daee
SHA25639d58788cc29c2dd7eff7a5d5ce173a9eea6912f8091a2e641d97a8858041585
SHA5122d27d82b0e4f25df656438c390064470e7ed6295e37d99b43fc27985cb6d09e19d99a39d2f86db3f80bc3ab014f49b510124ac38d6c498679a75f33601d5a7d8
-
Filesize
5.9MB
MD5927d62fc583e1eb1451ab335719be021
SHA19f6d429f87529212baf9fdcd95b68550857e26be
SHA2567e635476bd52dec5964a4cdb48da8b9050332b6556e8bc88300b23bd9fdfac27
SHA5123163bdedb803b91a03df489714b2d3522e3584a99f0acf6431e52beed2fb5e7f96f8e1a96339c114551a0d28f14b36e0cf1acb0e575de9305c57d840e2565675
-
Filesize
5.9MB
MD5577e6190bb4b300ed2bc3999f2230d5d
SHA12e6a42b7805459777f4650a888382f0908ec6362
SHA256ec5492444d736f57b67f5b7b3d3f589cc1a750f65c9c82da4111bf242430fbe4
SHA5125fb50fdde52f0a1745d8e67064d5a23e52da8868970435c7e3e24a01592f643dff844196ff16696bc017574095e15095e3401ad08f15250fd7b25e7d75772441
-
Filesize
5.9MB
MD5d743e548737b81fd6ec363b09092c4fd
SHA1f8a149b30025e80e14296a84f83b9fbe42755f14
SHA2560477eb9625ac6a617d61d5b59c8717252ff3a4711e4c6461d759232d552a8e6a
SHA5121025751571dd3f064bf2bcd3d0927ced2ddf12b25de3af07d0d51d77555726d2ea752013bc637434b2526af6b87a179ffa2b83439539b57de6b8a3ceddcc277c
-
Filesize
5.9MB
MD5b10adb041f2e0e91e57fe4090d38d04f
SHA1760406d79ab5add8aba7a63898536537c3670957
SHA2562b80e70a4d5b9c4cb76d276cf73e95a395a70be0eab7678d855c1811e13b3aa7
SHA51281985c5a5afe5704e75752cb288c55da8d1883596c5250a2e0e6b8b3712290fb0b713b3c7da701f213ef986d23a4b7b9bc719ce62577b2f2c25ed87d329b3b96
-
Filesize
5.9MB
MD563aeaedbf803fb5dc0d25666f2e0c07a
SHA1fb2766df27a90096deeafe3d6102c80830010ddf
SHA25655aebfd2691502baf63981caec4b29dd7b4d429ae3a73c4c0cd2ae7c4ddfdf85
SHA51248f7b848aa669b5f948b1d6422a7183a458c36ff2c5410fc397845a4ed5f2ae3901eaf2ed803087ab7b54459cb1d23f6009d04fdda41b727204dac45bc2ede62
-
Filesize
5.9MB
MD5527fc3745c39ba083201a52bf5a9433c
SHA162eec8c9bb77dd7632c2b36cc8a1a191d4bc935f
SHA2566d08a649fa039d2448e75765624da1b7836c54c4d721c08e11fead779835a813
SHA5124bb7bda48c1e2621df8a084d3ecdcc2a5c607a9fa0a342151ae3bc3fb376357099663504cb55e3ca0734a1a0c57deb457b4c84d375de1a08056f0133cc5c5ffa
-
Filesize
5.9MB
MD5e611a9249c9349a457f062e48d7d98fd
SHA194698fd106dc4b018d68dc8c9cf2aa5c3cbae94d
SHA256cd76bb0c4960be28cdcdb6aa80b7bd42d6b1530eac2e20fde20dbb6ea82c7362
SHA5121f43d5b8196823b5bdf7c1b56ed3c1218e818b38b671661167fa43f8a338d9c5f5d173946ad4116cf60b5cd74b5e59c94e2623d4f7f5b8cdf58394522cdaf966
-
Filesize
5.9MB
MD5b589d9418160052331f415f044812ec7
SHA15fa237f57bd04eb9e90051cd21e1edd51b9e54dc
SHA256960a2671e4e5c236d5082a86a961c9d80da4584e4a2d27661bb967414def245a
SHA512b99dc57e22520ea4eb2da3397214f4c108fad64016774519ccb11fe713cadf244456b42fded3464a88f0d7cedbc3f3d53c262d061a220bde696cc3a5fdb26bdd
-
Filesize
5.9MB
MD5153f8c4ad77ff495ea5239c183390d6f
SHA11b1c8d365bd00e32814f21a5c5fad467f9adb448
SHA256525e452c871d9af492322d3c210630c8862bb57a90816fb6f29bc19945d7931b
SHA512d11131dfb9a3abf4fb311cb0beb929deb9d49297d8a61ed10048e05075bfbfa285af388b7f15bad02825eb18ad6c06b4de0e179a58ef93050af1d79559ad0dc8
-
Filesize
5.9MB
MD53ef1a7b350d1282991e7ed9769b68c9b
SHA1b8ce3ad2f3f82c48aac270d3f9b4cc2d127225d7
SHA25666c57279a9f8c66a191a4c8243fef0231aa23d5315b1168c922193289891b198
SHA51222ffe88423ad2a2637c03bf1117333839ab0074d47aac39b2d2a08100aef48e75982645cbec343deb7743da31650ab610ea1542265bd5637234b17ac62a59629
-
Filesize
5.9MB
MD5cbef060055077b09e937e2fd18e4fe2f
SHA1157889340ce22ba242143b4b44b6bf86a24fbe51
SHA256de4a007d22c29676323f3975073bbf8e5331f599c60744c3acd715fd0571f0bd
SHA512dc59bff57cee8d59ef81643b056d3f3b46b264263b09cb80e97beb58510215c3f685aa4eda05a0e215fce8a223685882eab712c1a62a177a93830a782129ab7e
-
Filesize
5.9MB
MD54ebe29f1c29a5758dcc8656b962bf452
SHA1b649ef817257c5678210999cdfa475a7b25e02fe
SHA2567e698f96c3caf0dd9b18d3eeacb03ff18b23262ca09815be047e5ebfa07d36a5
SHA512f27d7fca3e1393234ef2ef5d4b00235708506d9c33301675b4e052110efa72b294ebd4e53b24df7be59ce3db8a772252dd1f9a744b681f0321dc1e9d7328772b
-
Filesize
5.9MB
MD538c2986bf199fbfd10c42e6dbbba625b
SHA12dea297af90067c77c5c2713cb988e97393622a6
SHA25696041f36123f4c9b3576af2971c7c8a11d9c34b6d9ae34b8392bad532e1954f8
SHA512f34a36406058be5483e6ec027a160e3e9202a0ada0056ae41e48308d31015ab2365e055ad0e91df23ee46abd27f27b56c470d8c65344eba30770c5f67cf159d4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB