Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/12/2024, 03:43
General
-
Target
2024-12-27_fc556d85bf81a5338bd0205038420ff7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
fc556d85bf81a5338bd0205038420ff7
-
SHA1
609314a3d1a900797e96e4d9d7b8d76ad24a90c4
-
SHA256
b045160f144dec819a41d71bcaeac2dac9c502967d5be1715ccd6ced420340e9
-
SHA512
f6ddde02ba859e753be788b7b5b502a13a047ad50594790d5d47a700b72d5af79992b3e585d5039a85d961a3a8ef85eac0d3efdeddcf408882dee1000dda8967
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibj56utgpPFotBER/mQ32lU3
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_fc556d85bf81a5338bd0205038420ff7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_fc556d85bf81a5338bd0205038420ff7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VqwPSCI.exeC:\Windows\System\VqwPSCI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yJZPLIz.exeC:\Windows\System\yJZPLIz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXzoioi.exeC:\Windows\System\sXzoioi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jFeVcQd.exeC:\Windows\System\jFeVcQd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uZQvLxf.exeC:\Windows\System\uZQvLxf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sWcwbkB.exeC:\Windows\System\sWcwbkB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\edGQNBp.exeC:\Windows\System\edGQNBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tUlsOKZ.exeC:\Windows\System\tUlsOKZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bEvOAyV.exeC:\Windows\System\bEvOAyV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hEdVFSZ.exeC:\Windows\System\hEdVFSZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uKgIWMw.exeC:\Windows\System\uKgIWMw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SzMzmPO.exeC:\Windows\System\SzMzmPO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kuPTBiv.exeC:\Windows\System\kuPTBiv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tylnPdW.exeC:\Windows\System\tylnPdW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Gxywhao.exeC:\Windows\System\Gxywhao.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nuZlfYt.exeC:\Windows\System\nuZlfYt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oudeMTB.exeC:\Windows\System\oudeMTB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AZUNVDx.exeC:\Windows\System\AZUNVDx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xWjfhuv.exeC:\Windows\System\xWjfhuv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CmEwATg.exeC:\Windows\System\CmEwATg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VgjNSuN.exeC:\Windows\System\VgjNSuN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5525d156287f443b880da41600662d271
SHA17af581df830653c1704afb77477bb31f61c6829b
SHA2562f436fd3eb1affdf6262efa1f2273d0e93dcfd7ea4b68b5d778834dd558684f9
SHA5129f9f26db23dac8083a45af80adf104a256081a6a28a148d4a691f5afb57b3606cd7a0550ea3cad46b6854decc72d98920d7273fa6da3a12f1101aedfd1d63431
-
Filesize
5.2MB
MD50dae8e9f8f7a0662813f8bd2dc44d304
SHA17d40c9bf7a59168ac5e49f2b10da542b303186a3
SHA256b7e665995c7f28a6baffb63beb520b5683747a8f9e59339cd6fb164135fce666
SHA512aa57321c03ff9ee830434360ee6af3c38b63a6446e13bfb1f753aa34001dcae5469e72e29750b2efb020c4a34ec6e6fde6533069314c794f3b1ebcf2d05698b6
-
Filesize
5.2MB
MD5b643c729061ee102064a5981e685fe8a
SHA1b5f08c7ba314aa3e902cdaa0f930658162675664
SHA25645f061b5070dfbafff29e55e004f24bc52324f70f82243253829fafbc9db35f2
SHA512636bbd500dac18f49032491103e15c131b7bb2d590024f9734d4e665fe3bfb0d6a39cb776f0a4294dcf045cd498d2162ebbd9451319b29f6bcfb2e13f3bbade1
-
Filesize
5.2MB
MD573d2dd478cf1da14ffa949ba80257b32
SHA18d04d5a5b0cc86a0d73c6f126e834e4aea5f13a3
SHA256f12d6e659eef739ea34474137139be95975170fb839eca0b9f4a7dbab4f7d28c
SHA512b9bde4081691ad2845afed42cb6dace3f2156f5dab1c68f54a54a4898eeeb32c448ee9925508c04e133a2a98eecce13ba4043956e01341d6f5ce8e67faf8f20e
-
Filesize
5.2MB
MD51e6ac3bfa15fb31027e2b2b42ed5aa72
SHA1b3dd33bb208725aed66d65f4cf97e0a1e2de6789
SHA2560c5ca10a36af2213ef89b2af23ba98d69d0fc34e90d183fd0054fdb143cf62b9
SHA512de01dc9db40a8fa1448ff01256be86fb1f9ad19e4a35f112ba8bf36a1ae91dfd9851dbc8ddf5dbcf30fa4efed008f1d6ddc0799d60cd11d72d6407e5827f8902
-
Filesize
5.2MB
MD523ac15113f69ad76d04275cb715f3e19
SHA15f03ad6908064653d3fd5d6a9a36d568424f1821
SHA256c334bf97041a3a8caa672bf377290df4dfb3a6b171a41900b1f843250fda9ada
SHA512adc6de521274bb422b1fe752513d00e80070567360cb0fe2e5572b60976daa72cb11052f0afe85f366800b9d4e9b2ea1154b1598bb6ba11cd407486223a1b76b
-
Filesize
5.2MB
MD5648fa66b2b554aeb543ab1984fe791c6
SHA174a69820330da509f52b2632b2b62d1939c4193e
SHA256d5c86b5c9c40ef132bf9db41aefb7de70e6c6459e65171a70226c52df5fdf30d
SHA5120e85b7fd616385ffdde7d49aa516a6d5270f045f0f1855507a53e73f88073c0d94d5abb5941b8ab24677baab9372552dccde273a138822ddb31f3fb82d1cbcdc
-
Filesize
5.2MB
MD528e286c1f7939a8bd56ab4765a9e56a7
SHA1a6940ba0016319032ef2b7ff075007df50542213
SHA256997245765b214d19e4bf8db7842ae5efd5598eb6a73f7eb8b16f10c09346290c
SHA5120657329f3a1e4c2adbc30ff001971371f40afa42ef5a22dfaf7dbb97a9d93581d56cacfd9bdf89a986dfb86df3b09b11eb5cfe4ee6fed3e40ad2276686566fa0
-
Filesize
5.2MB
MD567ba539233bf32c1733913980e9ca964
SHA16f9242cd7fadd2b1391c71836ba7e19894dec0ec
SHA256312fb43071bccdb349e9e8d398604ea15cb2d4a24203ace97ec9cb1934a8e3e9
SHA512e03a26a58b9f77c7c346b7b7652bfeba796658fcdc07d50653e2dea7dc21cd0fa93ccebeca318dae24914d47bd7c5ac33c4944a9fc1ee04089222c1e22873865
-
Filesize
5.2MB
MD59fe76f228d5cc343a39d6fd65a5f2b52
SHA1f208ac0aac7f6b52ed9e290bcea4257079cc4988
SHA256487a67cbad307217a614953da125c6c34b5068aec4ba40f02ba2277f8766930d
SHA51226e83a07e14357075f3fa04fcfbbc2fff910309d63fdabf61dc0e0070e2a05f978df146c6ade21bf89ca786de54f8d70b85f0ac6334de26e76e8c4287cab43e2
-
Filesize
5.2MB
MD555be962a1d56cd0b17097a56f741fbe7
SHA1e8508fe345bd47ab3039b64dc37e0abeecc8ff0b
SHA256c22894bae3272f3beb281df7555f491b519daffdd80a4c03d9e205d271098354
SHA5129143bf9188495d09c3012570bea16ab7f3f59e29a47c75b24531d06ab8b34be1aef9be1eae2938d63cfd4fae8363a45ffba66bedd25dbe7d22e4406e3cf05d39
-
Filesize
5.2MB
MD5cd4d183d51c77dfdf99c3ce618f9d49d
SHA125947c206f6d1def087e9f982c6bbe2b26fab0c5
SHA2561157ecb4a9d082a04f80159fe787d24d0c6f1a0226e294c6a5d7496d2ee1f7ee
SHA512e2549e08b8201029ea8727fea1184a11c28eaa16cd8eae59640f9320bc85b0948f3dd7aac865c2d26f7cce7c21fa39ae396d7d670fbdfd9b37203e3a3cde271c
-
Filesize
5.2MB
MD5c32d65014edbf327430dfa6b2729e7f2
SHA10f6c8ccb24c726740397c2f6091d1383c3561886
SHA2564dd5f2ab55461c9f96f69799f7096ed34351cd4a0ac2ce97ee0c1650f9bb2231
SHA512e47827541a72b9152753ced24a8b50cd86c2ee30760445f4ce55e9f5610ceee8a348d7486ca44bef22053108ad76c25082a790449b18d846cfe16dbfca4c51ac
-
Filesize
5.2MB
MD5cfd5227426de84924430957880636f48
SHA1d16c8c2f72fc4d6fb442526b79be0145423eedd2
SHA2563efe91edf1b52ebb09001c42d0d11c450771b6363a9c1ffd57d376f454040c07
SHA512071e5a9406da210fb1fcca2f19f396780ac2da088bd8b52784066bf17ada5dc0661ce0ff7d3d97791daa5f93056a4fe69c4c752f1bbc5891760f4125fee8c10a
-
Filesize
5.2MB
MD5e9f1dc6e640016aa2f4a60a91cf14c4c
SHA146ead0c5b7ea988605dbb06e2f91a8a95ab88417
SHA2564bf7f7ab95b1616df3700556faac4943950ce58ec48a31e0ec78d9fcadeb0d8d
SHA5129e9da40d1e7c4b1d1c4d8976e8d0f3e8db0005eafe7739847b7ad31e90914e705e83ff56bab6af82fc84fddcbc7a545e246017f015d77113cb67279ff1282704
-
Filesize
5.2MB
MD516f527c0ab089c0e90799d2408c1a5e6
SHA1d8ad5d6d15622ff9d62ce0919cd2fdf0826c060b
SHA25669e45c69075a2965d8ec746df231b4a6d47f248fc6554a381d5a7562624aee38
SHA512a35acaddb877c4f6afb129347a56d91bcaa9fe3cdea813e72f3b5df50d39af083689ea0d5cafaaafef7a46808f253de70f0e005b7d92d51d3e459651a3b24e8a
-
Filesize
5.2MB
MD55127ee5b3fc154b8d9ebed1eb24fe4db
SHA109fd1bb30262918b009a3737a94e84e3764e78c2
SHA256efb41c29f6e5f6e53ac9bef192773a531c7c6ecc7414cb39bf90fea06c9f6141
SHA512024035f5180d7ca54aecf7fea15791a5e53e835a1f742f3dbd8d0ccd878409e6a40377a62cc574f5ab4c7d197728bf6e63684d986a2f73c947fdb22855d6e630
-
Filesize
5.2MB
MD51dd03c63f843d54c9ce2b86bdfcb3049
SHA1b65f29c48ddcfbf25dc88158679fbec87f126aba
SHA256db64646f18de3d1d4b2900084514a4dcf277f2c52b9c1a6ccd83903be0cacd21
SHA512b2fa87aae25cac8a3957057024a8c6d8b89c2b7c96b014d7dd2d6be642374bb18352e0eb5fca4f4fca190ddfa222d5f7bb5d2a5b071f67a31242b35773396d8f
-
Filesize
5.2MB
MD58e64db673bfc53a7793477d074394d9a
SHA10429f8b0db08379a75981d4bb9849fc84c252cb2
SHA256a00f0d16742c3b23d7810b74b739b14715f605808a2f33465e5d1add85dc549f
SHA512034530353a382f830e3f812955c5f3e5eebd88f2be3184a0a98ecb15de2226b580e1d85541a26801069d4ff3c3476bee5ad332c500c82e4502f8f031938d541f
-
Filesize
5.2MB
MD56b9017cbcdb190764882ec83c420e7c0
SHA1cbae01fdc3708185928218cc9bc8b3b673789fae
SHA2561fcb31ca683672eea84ef7e81e83e963cf909bd031742b395baacaac2f335937
SHA512bb1fb9b7419ce3d269314a1c99f6318ab0ded21c88976f89052306e1257f7a189b2902607dc2c86110efbb9963687e506864f3d070d88a256ed08414de98c2c9
-
Filesize
5.2MB
MD55eeb7da332b4240b0881e869abb446ed
SHA1d08f1368a3b93dc2254163499a1cdb62f2294618
SHA256985fe71b57c42aba09f8b3e122d2b4dfd0c4ef1e25e556457fe2a2a9bd885e03
SHA51209b992e5729048da45eed10f0ee531fafa4b4110eb673865ca08639e3b4cc85185b3d32a209da2501ae4340b1514b27ff1a5ce7b8b2cf094cfc9a64a29ce02c7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB