Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27/12/2024, 03:42
General
-
Target
2024-12-27_4b6668ec395d332c7dae0b6e7cc25e8d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4b6668ec395d332c7dae0b6e7cc25e8d
-
SHA1
3ac69c66c2c500befb8ef76cc94c87cb6ab29782
-
SHA256
312fbea17ce94b00caf957452b8b9e2b5b0d62d47fe096e627f2e625b86a16ef
-
SHA512
d8d7156393ad7dfcb64ae6b66a5cb9e1e31e5e007565a83716d6a8f35463de874fba989a7634c8614ba57ffdae0484ba96e967e3a8971b7ab3b14dbe333d782d
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibj56utgpPFotBER/mQ32lUZ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_4b6668ec395d332c7dae0b6e7cc25e8d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_4b6668ec395d332c7dae0b6e7cc25e8d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LORJhrx.exeC:\Windows\System\LORJhrx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DWoFFAb.exeC:\Windows\System\DWoFFAb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UIPjdkS.exeC:\Windows\System\UIPjdkS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CRUnSMh.exeC:\Windows\System\CRUnSMh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eMBCZSw.exeC:\Windows\System\eMBCZSw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sLQQtnb.exeC:\Windows\System\sLQQtnb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oszWVPf.exeC:\Windows\System\oszWVPf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oYlfYjm.exeC:\Windows\System\oYlfYjm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CifNgiJ.exeC:\Windows\System\CifNgiJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dronnhm.exeC:\Windows\System\dronnhm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RJuUVPf.exeC:\Windows\System\RJuUVPf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OXDcrDx.exeC:\Windows\System\OXDcrDx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zJePKHS.exeC:\Windows\System\zJePKHS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zbTJMGG.exeC:\Windows\System\zbTJMGG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zlsaviI.exeC:\Windows\System\zlsaviI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tvfkWVt.exeC:\Windows\System\tvfkWVt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ESPOxMC.exeC:\Windows\System\ESPOxMC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XDSdUjU.exeC:\Windows\System\XDSdUjU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gXQlcWn.exeC:\Windows\System\gXQlcWn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GTJpGTI.exeC:\Windows\System\GTJpGTI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gPrZqvZ.exeC:\Windows\System\gPrZqvZ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD561fb03b232f158dff9df1cbea1ff1ead
SHA17b7bf63dfce64547a328714466610ecbec367162
SHA256f8d239a4856c9e0686ec0590804b2b92d8471ed54f61a1f44f7e52b1a6c90b1b
SHA512e6d7ee6d3b62f9eb59876a9181487d8c07268d6b08056fa35e3468b70230070473fa352366ea28f5ca2526d5b142f9317f7238ea7a86e3244a4abfb7d225114e
-
Filesize
5.2MB
MD54469ccafd3331a35e4ccac71cd92733e
SHA1aa9921702e898d3839543af191c689177773b97d
SHA256c708e0e7cbfeb37816356a1a3d0b6369fdbb2e5dde9559a27f2607b81f59d0e7
SHA5123c7d19998768f25b97cc550f49b2465e85c75ce052d2982fdcd2b7c56b7433883ee31a9a5d04886df6905604826f23625703450716b495cf5084f2810b7b4988
-
Filesize
5.2MB
MD58e2893268375cbc462f9ed1c9f5eb972
SHA1c668df24f4f5c3ea29b97d9b606a41b9b29370ad
SHA2561815523d5df6e74008d1b082f25849a1f7cdf04c1f2b64358cf6cdab3ac760c7
SHA5128fbf29f346aecdfd6d0b69ce44d5f2bb6b419d56e96c8fb03e3acf5540c1c8bc8236badb8bfded50d7070e789dd6d66cece52afdbda90317bce8e3537f09ac20
-
Filesize
5.2MB
MD5b485260abc5f11ce7063307fc6ae0fc0
SHA149804b7f736fbd79371a0c2f1bd63c083cdafb8b
SHA256c30697c48d52c8be2a680bf7278329a1bb7309243fd6df8b48e06bad5dbced5d
SHA5129aba069cc3da94c4b270a794b02f5fafbcefa6f903ef1172183c6223728cb76bf85a8f2a545b83cdeb640139c48c86253f3be79f6851d3bd2818f8d7e9787928
-
Filesize
5.2MB
MD567f310ed712daa836ffb3f45a37c4ed4
SHA1e8e8f52df2f33db2b1b3f19b515c422a57a0ece1
SHA25652be52c8d2266e1243dc458bf367601ec818e37a581c461a56243db052f5a2ba
SHA512e0733254daaed33bd1bd90fd380facd3f92e46f8430e2b552ff593f6f75ee23bb71b72ea12d38d7fe7c6b3e11d6d21cbc72c086be18d495b6f26c0fcef669396
-
Filesize
5.2MB
MD54e28d574928e09bee1c00fad0803d53d
SHA16b8e0d02c5d0b2eaee665a20a09c9d79709cb553
SHA256c01fec0e9a81017e6098e6268e43d1164226748a0f0539af30954b8fe62e8a8c
SHA512744363f8210faa4d7a69173799c5bf6c3aa695799bf7cd9c98057d001d1603e149411832e33ae3c6e42bba7b3505297f92171d8fcd781f290c793e37c8cf2244
-
Filesize
5.2MB
MD5ada94070c165170796e42c33122ef018
SHA17aa67275af69bda040e579749b7c90f425762f4e
SHA25648d3c2b6ac0f658c638e53fcc3bb6b2a6ea51abd9d61277b5d32521c2d90826b
SHA512482ffd24f194122a71c23916dcaff80beab317b96a91ea1d8d152af2248d3d89182407c1833201503e5225e3816fa997b12d345113dcfc1d9883da7c4dde5615
-
Filesize
5.2MB
MD59da89b34648eb48e0b945c2c768f7d12
SHA15fda7d47b83e5f7e08cf057778470b664ee23092
SHA256b020026bde374de6995aa490fb5e070560fda50d78d23b826bed012fc377a3a2
SHA5129144e09eef79eac68cfc284359524e9a234c78e7e025efd54e1402e8dd93d3f75247639dabf9f9d0587f84b72031c1e03ef17ab285e396b67ea9b3827b0e1fe7
-
Filesize
5.2MB
MD5e55e2593e3660a3097f1d145778a828e
SHA11576db439b5d390ae570eefbd30754cb148da083
SHA25664e6eeb5268c0ca76bbbfb45af1c1f100e58d643c091032100406d70385788c7
SHA512b996f78acb2f63fa87e4b24023c3e74cb14e7e98950e60ab063b686b94530e7b6786fd9a37b848ffe23c7b0bc3b1360ac503ed6cb3d730d8c6c783e7f5d9340f
-
Filesize
5.2MB
MD55919f40dfcdb542dfc163807384149f6
SHA1189f0bda2d15c18a6529ab0e91ba2066d666dc53
SHA256057ecbc27aa67dfec23069c07b74c573629a4f344331650489f1979b6a85e7bf
SHA512a225d6e0679e780b5b49a2458e938668542742e93886fe0ff29e36de66aa70c7930ebe6c9cac07a5aa8c6a63232cc249f817c00283853508d906b133a055aba1
-
Filesize
5.2MB
MD58c417c5a919772cf277f79a13e8957cb
SHA14ecf7a8060ff506dbd738c57d6fff9cb4c073137
SHA256688bb58a23657a05b2d67682cb54069dd618f3c3afddf6336261e6c1640be7b8
SHA51264431dc9816f1756b2b968eb1074d289b3e03e10e36aab218028a42596d873d216a5ca4c796722781606c1f849b2c68f2ab204cff9808bd0dd70cbcb78f46f82
-
Filesize
5.2MB
MD56fdf308f31a352d1d3234ab4e743f79d
SHA145937e1a5d7ddfebd2a715dbe29f5c4fc949882e
SHA25619898bcad9b5776f4dcd8386ce892285028d476f0cf071a65ae1d1364f9d16d8
SHA512281c15ed0d403c1e283bfa2b598c835ebda34dc47716dc88eaf2afc987778c5d0ab3dd1b7e61baf2a90ece3f84d172c31dce7e5b1b7be5953d9233dda50a4e31
-
Filesize
5.2MB
MD5c9ea45897f4954bb10adb62bd1870713
SHA1e55a61bb7662e6b47e65cbcfc4af510ed8d3818d
SHA256a2fda11c8933d2773dace3d5e4ca481f0e6adea4da0951e8284d0729c53cb230
SHA512dc6168f2f803c7aac4841933d7b8b88c47d05bb3b2512f56d643d8d4af6cb10f2bddb467a48dd8704c1ad246bea81661c21b7f0c5ef24f5432598a9050e542ce
-
Filesize
5.2MB
MD5da73db57b7de0f847bcb99e452d751eb
SHA1564f38ce0e7e374a17347a3360c5d06c3c8574c0
SHA2569eb46ec9a820d71b26f008d458e61c2880a4ea6db543fdd4c4379bd6a4a3c8b9
SHA5128a2baaba78997fc6e65c91a5592fe8789abfdaaf722747731ed6e09113229da52afc92eecec5b41c425dad8413a06705900c92bb839add76573bf1893d733b02
-
Filesize
5.2MB
MD5f47c8a1f22c92ae47abb37e2094336f6
SHA16c7039614d1cc19a1f1d75bd3f32228f1e1a9f0c
SHA2569095d0d817ab4b4489dd87041267fccb9cecff19c3456154b9bb0054439053b2
SHA512a61c2204daf8a348777b9f6f4d6e496bc8c21bbf24df0ae505c93d9e924f2b17cad969d0781daa4f31ba654824f3b1a9e43c908afcce89646e3b5217888d8358
-
Filesize
5.2MB
MD513b5c03ab0bf2c7d4eebb80f47c62c9d
SHA11e98268ebd2119a250c5047828871c3e454ec960
SHA2563c98e7b77e0ecadb97c090038723f1b1cf6ed15ff39cb63d3c858d09f63329ed
SHA512406cf8daa498d10446a45b5b2fc19e451d15868d6e9b0d18581f80bb3025877fef66102129f19218f66ce53f21ccb8ac617a37d20d3cb356deab6534d72ecf36
-
Filesize
5.2MB
MD53fcfd77e0855042a70f89fc056fc0ea8
SHA10733e6d316d74732b5da383206bcaeec79dbe7b3
SHA25618c86a7fc30ba5e9599e23bd48551d0d0c24c839d8d18a3f7194feba954dd961
SHA512cdc92ebd4483d5b196b4b5b98d37409211e03dcb3e177f53d6f18ba41ce2e67d6082fafb41bd82cb3cf59eb322efbd7c3ed52875757e55c8278895a6c7defd48
-
Filesize
5.2MB
MD5a75a283d2e64f07d3c9cf4e20309ddcb
SHA169fbf4059cd5b9591561689f8dc64608374cb700
SHA25636aeab5c8373c6dc7e4ae8c8377e842537c58619220572482118d9dfe675d595
SHA51238407b21fd4ba5b55c9a410ec9431852b34788a0c140ce4cadf9c26b2df37736343ca61c8397f46347c79bef61630e28b7f7d3797337cf4ea6c7538523adf9eb
-
Filesize
5.2MB
MD589ec5cee2fab281422c4b534b494afe2
SHA1ead327536c06e85dbbc94703c506f902a7e400d1
SHA25602e354e5b6873d1f1d96af1b32b450a9d6cd00ae0f9b2c62eb0d80300cc25f85
SHA512ca748fc9ba9d50e935ce256a6fec0d824b2a2916d3bb843049e5e29bd92cd1d6bcdfdc455b1528bab0106c3700fa30f28c27eb2afeb9b9bf8ca6bd84abff0d8c
-
Filesize
5.2MB
MD5ca9c9bbe4ae48764d17d57f50045a847
SHA1e3bb14f6c59991f42ee4494c6155a8810bdc4a93
SHA256e3a5f2d4d5d0fac7841eba47f37aa9548abd962ebfafb82958a42fd7578445b1
SHA512c56cd27cb0c8c5ec8414dfab7c2131fc68b78e7b890a5a8ef4cc728301f823f44d2cbb98e1564cb1fbf82cf8b9258f6545c806278f2bea8d617bf7ad2c064148
-
Filesize
5.2MB
MD5902c53f784e9efa8641c926f6bcaa356
SHA19571b9dde3f055c056d090e7758eba826de9aaf0
SHA2560b192f25a62c66550641d0773d0c6e03f26bd744d94e39d88ba8ba91383c06b8
SHA5127832bbaa3ff4af6f91bf15ca2932a1c8279291b763dc82c47c5aa6d8f117aa4984808f923f412e08ff9682397a994016facd7dbda4c7c6ee0dc5962f3bbbccb5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB