Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/12/2024, 03:24
General
-
Target
2024-12-27_8c065b9be5951b9f5bc1227131a3bc48_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8c065b9be5951b9f5bc1227131a3bc48
-
SHA1
4523c1911e7e558227b14ccbd13162a0c4e237bf
-
SHA256
497d3c955bf27f60465a952aec2bb44f8e70069a4eb820b1d95df1fa32f8f139
-
SHA512
e2bf6bd9ba2de236a868f3dc18864d14525ce6946a0854a75f29caf603b37fcab3b0cb98800827965ac13095e791c590971094e80fe2646c0d3c4696057c5080
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibj56utgpPFotBER/mQ32lUW
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_8c065b9be5951b9f5bc1227131a3bc48_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_8c065b9be5951b9f5bc1227131a3bc48_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BtvpJZl.exeC:\Windows\System\BtvpJZl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LcnfgCy.exeC:\Windows\System\LcnfgCy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CfDYcEr.exeC:\Windows\System\CfDYcEr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EfYfJBi.exeC:\Windows\System\EfYfJBi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aTPMFFm.exeC:\Windows\System\aTPMFFm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dFzAWYj.exeC:\Windows\System\dFzAWYj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kXSADBE.exeC:\Windows\System\kXSADBE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xQewADI.exeC:\Windows\System\xQewADI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yGuuoTG.exeC:\Windows\System\yGuuoTG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ATntzTX.exeC:\Windows\System\ATntzTX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xlRAGzy.exeC:\Windows\System\xlRAGzy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DsOeoLq.exeC:\Windows\System\DsOeoLq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CKygvrF.exeC:\Windows\System\CKygvrF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KjSLuLz.exeC:\Windows\System\KjSLuLz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HBoOPiU.exeC:\Windows\System\HBoOPiU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UjWATMn.exeC:\Windows\System\UjWATMn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yKOQeUS.exeC:\Windows\System\yKOQeUS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\irtQsFq.exeC:\Windows\System\irtQsFq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LqCXqlQ.exeC:\Windows\System\LqCXqlQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aIAYPUf.exeC:\Windows\System\aIAYPUf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FgNcYew.exeC:\Windows\System\FgNcYew.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD559e0a0898622b310f599138c8a145626
SHA1d259a70c1ec893f254fd514f1dc3cd3a78d3b75a
SHA256c3dc2e09aa6391e9b885925a75af4c2be0e48e9c74abd9d312bd7173b8950579
SHA51265771dd32ef95e364c901d817650676034defedb188b1b328dcdbaec3d9dde10772d4706daf04173d486b126017b9c2993b65bc69d3b1b80012db96823878dfa
-
Filesize
5.2MB
MD5eab64e0f33900b67a91b799b2bed8cde
SHA1bd52ffe0f9b2834aa960eb664d6185ccfd2bc212
SHA2568d04bec75670a3f4453849a5ac8bffd77694f52ea286b5917937a00f6cb9dc38
SHA512590afe45e22aedb3131a00863bd329afc7c2c75e717f26d5b951e44ff390a92cafd778d7b3173bbdb38bb13eeaa73ac3164fc77bfbd4a378c2fb8f6a9ff0a9d3
-
Filesize
5.2MB
MD585915636352fe5c51d7a070fe4fcf150
SHA191ddf041a637ff66fe7ad388eeea0f788ce2b2ca
SHA256099d761ab2e3c1d4a872cd89d3b4344fb8c150138ada0169486634f24a54f959
SHA51265695479970a35233c56238091406dace16cdc51ab3fa405fd03d2d84f26738c653a73b7a38d5d7aa601936a196259d1424ca619e17886848b16ea68b8f6dab6
-
Filesize
5.2MB
MD583dacc9a0f1cf8d97c265af6ae63c70d
SHA1e1956aa2fe34d3cee20fb03cb69962ba30fc9d4b
SHA25616f75c37590a34e579f8ffe2a55d707a7de1c9ae57cad323ad06aeb3f99cb399
SHA512a38f22a05c63c9b30fb94096699797e176986d160e4b2b89bb017b5869cb63ff94e2548418cd626b1604e02473e8bf04f80372d2aa180b0ac1384b3eec209bd5
-
Filesize
5.2MB
MD5d7d3a1bde6d2258f129c2a0af9c7490c
SHA1b6198ee94f85281dd3b011084a3e48fc78bd7451
SHA2560eef69a1146a32b609bf0aa6d6a76288251258a8b5e303748a9dee95caa8476f
SHA5128079057721b4144c98c419950f256f6bdd2c4caf29395bcbbeff22512d605fc31e2eba5e758769f56849fc2622d9004b779c98fbafddc63b73c1e8e2d8c286ac
-
Filesize
5.2MB
MD53160e637937d11b27b96dc0d1f397ac2
SHA1447e878c805c6f47d9d104cb9ce4e6a8fd8e549d
SHA25609fc5aef548b269d4ed1c0fec50885fec24213428bd32c991a57daacf3a1a486
SHA5121eead60ea7f655c781e5f182021cac2db7cc5315b5f088eff9d39e26b139727d439915a09f17a58da146d06b32a543cc6a857fc7a0ccb7a45847004c20436bfe
-
Filesize
5.2MB
MD51f09b5773a4fcbd9c59dc5995d888371
SHA1a3bf560101283d99d73f62ac389004b590b911c2
SHA2568cce3df5a80dd92760cf961c9756e74181af80731198f8087503a6dbb3d4ef06
SHA512f3a479831a359939715f8e65bfa39c4797f68f62440fb1e3dc841b65a8e7db6af243c8d931515169a11790d86c92916ed0b26d0128435a9c7e38cfb00a65e9ac
-
Filesize
5.2MB
MD5b42a56e97dc4f1ac7e6ffe6eb7c00b3d
SHA19923505ec4441a04c3c2ea3466230f6f53b0b075
SHA2568d643f5b2c8a80df8ff5e806cca87d13369819866baf27e92a9cfa7eb5869b1a
SHA512542df72c2017c4ab25d4c1085c4d46e6ff57336315ee8a78c790416a129a05fdaa80baf08bbf91b9532c555a095958521f7988ded783623ba3d1ca276de54157
-
Filesize
5.2MB
MD5c28f422919cf0346e2ec4ebb664d3193
SHA1e759eda314728b7c4450e53929de97a262684eb6
SHA256a01c891bce1260a5a2c3340a84ef2a24de6bf62db253b61248855d7021a9b191
SHA512b64860caba448f428243e9004965a2b35d63a61a462526a81d2b9cf3907b3d75652b12dd48fb3dc489f2d6a6af757b00952a5281ceaaafb74cc32157c77557e7
-
Filesize
5.2MB
MD521d8a3457d7781c1ab5b161448f8cf02
SHA11450e8198d8facbd29ed15f5c624e5c3cd9bb9a1
SHA2561a97b50158deacadf865c5106fcede3fc0c43d7460c63dedeff9d416028e9a92
SHA512a0bf65498610ed0c2e0bee2c8eb59c26de0089f36c4545026b2a31eee60a17497d19bf9d85448b4ddaafea44db90264cad89520c49c22a892367bbe2e83f1b79
-
Filesize
5.2MB
MD5edc53e35ba7734cba25ad06b73895841
SHA16502d56b5c1e13a73c255eb1e7b6a9323d9fba27
SHA25687c0b8f683f095146b9e043e9c976f86304113bacca421935158de83126d5007
SHA5124791c1c01b3cd1da47a5c972d56b82b39e20a6d592606b37e2dbbb88e6f5d4de67be64c25c0cffdb693393d997da6f0f262e4b43acc22f56d3660f789c9f8ddb
-
Filesize
5.2MB
MD53b8143b8e8aaa889617d290f047d40ce
SHA179412b33926b5a5d243e7e0fb213f7a81c50c6cb
SHA2562415c7798598d395c37dca2970eddfcc60199407d14bc006f746c4df81b3b187
SHA512673a971e60e7fdcfb91b9f220d1c8d725ed1a0849fa447549047b1b952efc4e16660343135b42582503b52d727b0ccdace47afada2d98bcde2fbf6900a0be575
-
Filesize
5.2MB
MD54575c8e5c59151723ba01da116f75cfd
SHA10e0011d6e950dfe7370d3b2260cb79684ba63d90
SHA25600dd85e5e6751e99e74b870a6f1dc1d0f0d041ba7387d00cc3c9ad8950ccbdc3
SHA512d7ccf3d49d0ab3f7a598f57aee567e3f4e60be57cf943eb14bf2f3bd99f898ed29f6236d2adbb34a0f4bab5120f03d9cb325fc4b70a96df9ce0b3d93a31d6ee8
-
Filesize
5.2MB
MD53a356206fa7a4eb01fed18af949b04fc
SHA1049e2d2046197de049614c75dbb8a4ce3bf67747
SHA256e779ada72e132de80a0ae792289ad86fc9b9b592a6cd2c805226cf91802ec0b0
SHA5129537ae34fda6feff6a90c3793272bad9d908b13539a0e4712090807fd4fe3595a8c075fcee4682b191610be97cf2c6244f015e2b2f53c6a73b85dcce8561e098
-
Filesize
5.2MB
MD523ce90f22f71a043e2168d52797e0b55
SHA11b65947b6cf3243f1000206fe5235aea08400a73
SHA256f584d439b78cbc9d2737140569be55386ab12d7d48318795fa72046bdda2f732
SHA51267620b779a6417adea1b452bf48d4608ef07cf1ef943666aec62e88da534254b0b63d5cff2e9b21dbd1964f03ba88d6f38f15f91ae472472ff523a7672f5132d
-
Filesize
5.2MB
MD51816e0261c74a1afbe988e54923898bd
SHA1b1bbaeccb4600128d7be6f5669c6cc41673c2507
SHA2567b5efd108efee39ef815cf78f9db993461afb5d4ac2e5e31955dd09fb06fbe32
SHA51276e1dd318b0a4cc6b024265eb873918cef728919d96732aae4c61e479313bd258e80dca6aaadf177137514e02001a049fc150d5e7d2761adce376f41f0f36aae
-
Filesize
5.2MB
MD54597b741b0a64e4beffc528fec854bc9
SHA1c45a66dafe13e57a85de9ab665833b96af71edb8
SHA256a0e114b24f9f4a8df6dc2aa90e18a2e9456a3110fc54ef2aa2c66fdc5b0fdae0
SHA51284834c096b5d88c703a158d924a74b0c51217a3f245219cfe232df40f21dc0b524fd6a0f35fb297b05d7852e001bb28e24bf3455b14352c120ec1fd1e78f9cb0
-
Filesize
5.2MB
MD59da90ae97d8d3c7be871128819dac645
SHA12cd6bc9e9937b9cfdff13387d01d7af61212f11d
SHA256e3fd0e9d01a492e562e54abd5479e04d44e41655988d4bbd9467deb1396028c2
SHA51256985089108ae3530a9e23ff95aad468fec9d9fa9cd69791db6675b2c26158724f0e56f3f735b214da9ba7458be1a2c276ab69e5e15526bbeb74a8191b137d31
-
Filesize
5.2MB
MD5d53af5e7513f5747b9f7948b5dbfbbe2
SHA1d4b0d461cac00faa8ad88b01dc237696858bd824
SHA25685b7a3db453ca0af3ef5ba38bd07d6dc2564d2385edf13bd8cbc2cbae4769036
SHA5126e7e958f4850115ac022b41b0892baf37d4bdc03f364e41e4978e78d1ea87e777c34eb23c252b507f26fe4008a2be27b4e53372df156be3928c4a4b6bfdb022e
-
Filesize
5.2MB
MD592f8eb219ad0bb590e4a604e3ece7075
SHA136fa6b30335dfdb497db703670221c71343e1a21
SHA25676b67340ff2a81b3d4d0c15392d14789e73c45bcedceaee48edafaa5583ec9bc
SHA512b218bd89822c46c580d2d5cf1afefcaa89c3743b6bd031159fd1da1a7299d8d34ecc6c6e52b5229391efa2999247ceed12e2306501f4d987a1f0cfc1dba5b14d
-
Filesize
5.2MB
MD5a914732f94832e42d069a3b6ccfe9ec1
SHA14590ceb76e0ed6db71e2411afce0acbcbe44ae0f
SHA256dd6ff38726b9157f14132960a73322f479a714d7d01b5de9789e95ec09df897e
SHA5129c953d9a08248352063c409f5670fb0bec41444c1b835ceb263cf70a368fa52e6c2cd7537a9e4ba409e6d25f8817cbbb3fce782a576a1602e667c886c52f3aec
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB