Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/12/2024, 20:02
General
-
Target
2024-12-27_a4105353cb4e931dd44836ec40bee483_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a4105353cb4e931dd44836ec40bee483
-
SHA1
4aeb1979841731cb0063ffb88297e6bcab340161
-
SHA256
7669205c5a9d3853792ff640a7aa52045f6b3e387618ee24b1402c9236e3267b
-
SHA512
a504ab3ef408972d7e8fe69f43ef3c5bb68b0dcbaaefe9885f32c9240019fd502a3d2eb2edf777dbfbcaa150676e95ebb686091f6156dd87930641d06a64e0ed
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_a4105353cb4e931dd44836ec40bee483_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_a4105353cb4e931dd44836ec40bee483_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vzgbTzX.exeC:\Windows\System\vzgbTzX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XdsRoxu.exeC:\Windows\System\XdsRoxu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hlEDMgK.exeC:\Windows\System\hlEDMgK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ifTPMty.exeC:\Windows\System\ifTPMty.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gXfpKJt.exeC:\Windows\System\gXfpKJt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KJCdQXE.exeC:\Windows\System\KJCdQXE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VeltKnU.exeC:\Windows\System\VeltKnU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YIYHCNx.exeC:\Windows\System\YIYHCNx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kjmRmNR.exeC:\Windows\System\kjmRmNR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fyKwhmk.exeC:\Windows\System\fyKwhmk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lgnFiwP.exeC:\Windows\System\lgnFiwP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ccDAaGW.exeC:\Windows\System\ccDAaGW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nRZYKwA.exeC:\Windows\System\nRZYKwA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gXVjORS.exeC:\Windows\System\gXVjORS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bPPkMgb.exeC:\Windows\System\bPPkMgb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dnGVPsT.exeC:\Windows\System\dnGVPsT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GWpJxXz.exeC:\Windows\System\GWpJxXz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zCHEFHC.exeC:\Windows\System\zCHEFHC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZEdtQJE.exeC:\Windows\System\ZEdtQJE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EgiyecK.exeC:\Windows\System\EgiyecK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sphZfGY.exeC:\Windows\System\sphZfGY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a23e74762577eb48ca194e6de726c6da
SHA1354cb9d9b935094c97b22e15f80e2fa3529e9acf
SHA256c40c9ac4b65ca7dc32b9fe578c24514c66b1b4bdc413b470c6bee6facfa21056
SHA5126fb83ea5a279e3489ce1791a92cebf47a18f826aa544f3f51acf2e6985887cc2934d796a93ea8c2747a51a76583a5226d4c3f5fbce6c72e6d726e20473768289
-
Filesize
5.2MB
MD59232ee69289caffd0678c0257e094c1f
SHA1584efcc7cc76cf2a4d29a0df098b4357cedcdee1
SHA256878559dadf7e96c99dd4617836a9a45e80f734dc77ec0cbf34db4a26401859a2
SHA51298ef98955f948cb08f34ce74ad0d4285a907bcefc11d21775d0d4c8047b562fceef691e174b51d97b2f6f8195cf49fbfb074e35ce6b7c465243d43c737100230
-
Filesize
5.2MB
MD53fc976d141af55d548ef982932d7d49c
SHA1fc757ecec44f8161a4e4f04faa004389bb1607cf
SHA2568f114444f8dc7b1573a444b1b298de9cc5c1ee994ca2634d09ac5b76e0f69d33
SHA5125384b30d5ca0b06dfe549e32ca58d59bef216b2d3b1c34a44df9d8d2291e666d132342319d697d6225857eb165c0c23a40db24c1dda6e4fba87b74ae8f304d16
-
Filesize
5.2MB
MD50236bdca1da97304e74438da574bb214
SHA1c4282f0548f8b573958b501b590e6cf8f8cabe95
SHA256c22c293eadfbb369ef99cafa918d1636d5f1ccb716c28d29a97a12bb7d1d8b01
SHA5127ab57ac052ab68ea2267cbf0edbed22b4014fdd8cc402112f7db25c3c6577ab02460b52b7a6761f5b33b15a5cf4f16e097edfd407e5fb97498bcfcfff5455174
-
Filesize
5.2MB
MD549b4999eb9a01f9e1e2a0449179d17ff
SHA17a4c8b664cdf269ccb2dd82d4679dc0a99af539b
SHA25694f70cbf4611f9bf4b6db33cf1c59de9aa536c46da19d715414007094a5a45c4
SHA5129675d7704baaf2dcc295844ae0be14e693ad0372b8fa9d49201f64d36725833a5e9048c7c71b83a28472f2fa5392001189d7c5a6801101d49ef29616f05fb563
-
Filesize
5.2MB
MD56d0455edbf3848d006794863deeacb82
SHA14c4708c80cfaf64cf0fc3ba9c7afb3b595a29526
SHA256f2ad1159d6d2955297c7b99315d82177e563565ffa3a49690cb273f22dd858f5
SHA512a57f979163da807baa35e2a03c00a672d1e2766274717e0933e8b54f5ba4190011f351c52125944be334583b677055796dda2fb8f17ed56a4bb0bd3d97a9591a
-
Filesize
5.2MB
MD5df497d18d5278bd8d64c13b58f695e66
SHA1010448fe11ca6e95fd7e4e65496660fdd93ac95e
SHA25660440d26c282f60602c6ef5b7cc27bfcc85d03dde17c7276c3c8d59c75277397
SHA5128120b2d624539cf245f1bc956bc3c9a37b359fe83e68e2aac09291e251e2c3c5cd3c29a0298eed94450340dd11fe0ca06db3c0864b8db6b4c0e81c5bfe645bb9
-
Filesize
5.2MB
MD5e62545440bffee7964f5ce1139e8de7b
SHA1e1fec45863fc9fade33ea9e6150aa6f3860dd076
SHA25642b48b827737577c7abacac4f9c0836a1356fc84ac98d985e28d3a4eb0fc4e22
SHA51240d03d56ae4be8ec71be35ebbe6a759425029b770292d334699c2c262a1e874727188fbafc3a6cf9c6c9f503340fcc868a93005be8a0289d78f12a609345a148
-
Filesize
5.2MB
MD5876f915e13ee099adb5a6d1ba24ebed7
SHA140195b9343445d735c1bc43ea603be6370fe1224
SHA256b34cf58270e3ef4843adc9899c657c1aea7e3037c706c9b09d9e78f68b578708
SHA512775b07756a2c7d600f34fb579a4280ff75d47f9b725d52d95030e75913c36b18636f14aa295f63c7075c41d9ca14850b199d83b85c53e45a87efd1ca840c46e9
-
Filesize
5.2MB
MD50b8697450bfeee06ac4a8e68accebdd7
SHA1d8514b61f58c2236106dd04297e8a7f12822a236
SHA256ff666186ce258cd7cd78ae93ba818bd65dd5dca60d8f3819b92276c0f3c46957
SHA512fef853d3a80a9a058d51e3ac8c2d830222b455cdc95547fd2872651e5e07657fa31879d17b8482ba44b554bfa5f12e7f4df323adf65e49dcc566525da4d2b695
-
Filesize
5.2MB
MD51aa5de98336693a28dccb5f3c0c6ac06
SHA1bca12b7a3303aaf2f0e75c17fb22521c86550dba
SHA256e938de9ff7d48c318d02517c9f995d837e9353bc5e40f49c80f6b913f3b43d67
SHA512813bcf1461708097608a66ef2493f47c002ada66c08a2604f51788ffdc5e24719ba3db890eb02d8a26e91d0095edeea9cce6a634418b5c303206b632df0acadd
-
Filesize
5.2MB
MD56f8f82c2a5b0e804211fb34091dfd3ac
SHA1ebd07c4d685e06dfff0e06bbe3b6386ee277b70b
SHA25621c5f3baa751063896c06740ede48fa889b312f4d4deb7dba19972250e3139e7
SHA512f7558a6b6a8d090fe4b8f79d3e549f01951696211da984a279205cf5f0ae7a4d8b699e647b0a3b760036718d8be50880291569cbb96926d1e11e8698e1ae913e
-
Filesize
5.2MB
MD5dc5b0ac3f35adebd72636e9c9d764aa0
SHA1a21e1d378aa285a376a736d99144de7c788f084d
SHA25696f2328cd6f473d83548e3220faaa5c858c4a0ff4009d170baec4602276b3bf7
SHA512a1592ff1351c01cb54bbc006959bcdabcfaf5f1a966e3cd3e4f50ae91575814ba56e7efc3772a8e973b095daf98595345226716fd2bae47672ec88f19af24049
-
Filesize
5.2MB
MD5800128cecde51c1d74d1e585a00d2028
SHA13a37a31d5e49670d927caac12cab2090bde00e8e
SHA256bccb75c8eed91690e43f2e5820fe000cf111e79cce0805410999216730254a29
SHA512b066195e172f2ba0aaed2095ac10ce01abed5310c2938925bb890c418b8b16663c9ee5506a1aaa197cc2bf6df9a01c2364eaff9fb59df4bdeac91a0653ec3f7e
-
Filesize
5.2MB
MD56481e74d4ae990198c9d46a6aa77fd1d
SHA1a2f67e1dc832a4aacf5de7124d1019fd2916f244
SHA2564b80d54e2d34596f343c30856bf9f2bb51b0dc417987908fa86658c8dd03eca9
SHA512794f16f18b70d03486a4be949c6e349ecb721083fde31ba5f6c071b3a2c8628b20a9d7fae8c314795006ab1688ea4b0b70293d53dc59a59a38705c4e4bfdb1a0
-
Filesize
5.2MB
MD5ac4049aa27abd7de1c67e6695ce7cd4a
SHA140c0149ce5df3269e36ed8bf5d1f53c2e301e8c6
SHA25626555b4ece5fd90f98bbbc729515aa5fdab4d2fd72931efe8e2c60087e7b7494
SHA5126e60cb215e69374a7bf1afab4a00e3403fdec0d1670c0819a55152d3badc7e7fa9f17781ca47a933f9b1fe50050bcd05b2348e52eb63ad327ac69c6b6d4eecf4
-
Filesize
5.2MB
MD5d2b1b3b431e82556f3261e9db53ec52b
SHA1dea494e482e59f8ba9dbdb8e9e93825e0689c9de
SHA256210036ac9dfbf09f826b649a548fcfd89e1cfa88eff4e9f4b07a389da10caf3d
SHA51224e630e1ec8958c48199dc52b3e53198a031f8ffe3761968e8538218450b815b66a5a38956b48e3e4d4f556f98667667bd4ce1d464c32ac72fdfa5616b261f88
-
Filesize
5.2MB
MD5c22a27439fb81dfe04267780a4927b06
SHA17dcf3146bdfcd7f2c2f22cb61da1cd43a3cbe78a
SHA2569f2c5f38f1f051057b33f94d749242733105caa26990ccd2abbb032bf639d711
SHA51235d9fe314cb3fe09f087012b40ac5d4b756cc89f2387596d6038fdec5342a6bb320f513ff19800e75b4fe9df57fc2dead2e9f2a24daeb53a350016704c2389fe
-
Filesize
5.2MB
MD5abd13f4cb4cd0055c91500418c33edd9
SHA18bcf5a551bcc09dd94127d8422a69e99fbe365d6
SHA2568f6ccd8651ab036f5b7d5716ef459d2f379971c89f66b9eb36c0f0d7f61910de
SHA512892fc011808d7c509765a9afa59b1bb71c1ac86196253cf98bfe7a837796606c481bd325e187a81e35e4e70f912192bdcb272494396d2c90b7d239d8a9e3c431
-
Filesize
5.2MB
MD5766b88c184ab62ce5e194b562c692783
SHA1a52c91ec88518866ec851d6c777f2e7889990494
SHA256b2ae14fe7b3459b08df371a60507afe808e78ef3838be74c84b2964d4d9714f9
SHA512064af7c391251e1214c4f8ec163da2f02c313e6adf5ab096979d0c759f6a0df90d2f26c8310afafa3b0515693ffc3fa32246d9cbb70809906b00088ff07a8329
-
Filesize
5.2MB
MD5d2e0b25604fc673f134ba259438068dc
SHA1973e4a6f160ae69154ebca5da88c058d154e8bff
SHA2563d1cf70c553fb8daa6ca22ecca9be625855d11010d0d6675951a953065383af4
SHA5127550a33df78a34443bd6f04cfca7615164fafa28edd20e2c8e6ae1bf3019c6900436f4211852751fda3103ba3edb16082db02898e1fb37a56fdff181435ab81f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB