Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31/12/2024, 00:47
General
-
Target
2024-12-31_24044062239469c9bc1f0344e098cb1f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
24044062239469c9bc1f0344e098cb1f
-
SHA1
d78e6da9370015cb8d654ce8afa32b187aafb26e
-
SHA256
181a6a77b365446cbbe3135234e2c57108f939c74e9e639facccdc38b22c1b44
-
SHA512
3a92866d5a88202924b627f1958826522c6a3a9922547fe60563cbfe49342f63eda739c68cb90e68fa41c6443359406ec78abbe38bd553e7d9273328261bace0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibf56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_24044062239469c9bc1f0344e098cb1f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_24044062239469c9bc1f0344e098cb1f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KylKoux.exeC:\Windows\System\KylKoux.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QugeeJO.exeC:\Windows\System\QugeeJO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oGlIAQG.exeC:\Windows\System\oGlIAQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SaJrXIr.exeC:\Windows\System\SaJrXIr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eQfyePn.exeC:\Windows\System\eQfyePn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\soJCWzw.exeC:\Windows\System\soJCWzw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TLWBPUO.exeC:\Windows\System\TLWBPUO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uXxwlky.exeC:\Windows\System\uXxwlky.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hxnOZtr.exeC:\Windows\System\hxnOZtr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qAdgMzI.exeC:\Windows\System\qAdgMzI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HOulnnJ.exeC:\Windows\System\HOulnnJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTBHior.exeC:\Windows\System\oTBHior.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NtcMJzc.exeC:\Windows\System\NtcMJzc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RGlKOaU.exeC:\Windows\System\RGlKOaU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bggaado.exeC:\Windows\System\bggaado.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BfVVaiX.exeC:\Windows\System\BfVVaiX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fRPEPtW.exeC:\Windows\System\fRPEPtW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qBePZTW.exeC:\Windows\System\qBePZTW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\USeBSOt.exeC:\Windows\System\USeBSOt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xmkLjbY.exeC:\Windows\System\xmkLjbY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TmyffFL.exeC:\Windows\System\TmyffFL.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5fd28318e12ec5275c267a3316855382b
SHA1ee97904f8fce23b7e9e6b9954e91c3d44a8b7ce3
SHA2567e3283ebdc08b0417407e78bae61a89027b551e54dcbb701cb900262ee819b40
SHA512bc7a7ccc1991cc3a3636a294802e191a336b6fd3e752df36d96d25a973badec369bacd0618e229ca5c55da2907c1bd44280156d1e7129aa596d918629b9a1d19
-
Filesize
5.2MB
MD5ddc7fffec18824725dfaa8427abfef62
SHA143ec086cd852a94ec73d8f5f0d03ee84162b480c
SHA25699ea8f7892a6fdb204a0c8c007bfc5ce9226c4e100d429d5f77d794c08fe9f46
SHA5124fa61db58c3c0df6d82c8b9cd3bce4b680dc5a02587ca1b35e801b503e508f3689828baee4771f31d61b056791fa8158919af013b2feb252bd44a7b841d474f7
-
Filesize
5.2MB
MD5d68be58b8593c7f0cef8cdf143f7925b
SHA10621a13601dbc97f34b57d926fbea801ef6e29bd
SHA25632a97d589b6bc100eae73653eb8ceada884c2c6ec094936bd1cc21fca1bb5162
SHA512fcb8fdfeb68c4fb42f38280d2382e74ba77dee31fd797809fc0efc3daaa4cf26bb95d29aa53358f1293727e73a6d1e7bfd1b303e20dd7dab6f6e206dc5eded20
-
Filesize
5.2MB
MD5fad13208aa5dc45e388f11efff039807
SHA1bb418b0cdba94029acbbdf40c599c99ae9e05e06
SHA25660ea0f802801e72c026e5cc323c6de0d198cef9c64eed1f04eea48cdbfbc65ad
SHA51204a35273036886d4160c629c2571fcb54868e8162e264b0c597d1521c97dbb967ddfb011a7892c4b5df14ac164f72e5c7f4b3b6e65be40f6ddff2fff428a6347
-
Filesize
5.2MB
MD5056fefe4df2cf47926cab958407b9c22
SHA13b3bea97cbc7fae86ae5d56acdd3153fae305f46
SHA25690dd6ed57302d841011dde9d4a39d3cacd05f50ec7c116d9d9c998dab3ca8e74
SHA512ea82c5fc418df72f5876edf7d195cd85012aa47e6cd67708cadeeaa31d5d2b49122e5891edc320175079e8d0457bdce32d616861acb08b980f660aa06ddf5fe4
-
Filesize
5.2MB
MD54631e8d9f362c7e24ee5c7124ca57df1
SHA17af796e399510caad29d5555ab7295c7239d21f0
SHA256983c9069203ab5d25e1999071a23eb3e97fbbb7c7144742171a6afd2bb7515f9
SHA5120f46370059ffcb09895c8727a7c4c02809e7a29cf302bf6619568b0914daa21180e12b0a75fcbdd2cf25145f7b46caec64c2ef0b1bd68c9518aa0a13b728d155
-
Filesize
5.2MB
MD5d4efe87b413284bcab7a8344c580cc62
SHA1319348988deba0980576dbe569808e6598d15a2f
SHA256939a2470e5e00a8a554112783461ee04b2a33fa7816369dd9c4f7f398b08b0dd
SHA512a2077bba9d08652a7be1d5a8664743b3c1a580795e4918e7f2b1a26ef5730547d08497b907643cfa8aa1cfc37e2cde975d7771eeecc76f652042cf7f5bc87f2d
-
Filesize
5.2MB
MD538a87669891a76cff6b3a484ca06e5f4
SHA13ef784f20e3afa3aed388129d53f13a39c43dc48
SHA256e0879e04e2bd2feb943c8fbd6ba1f04220e44cd3823927f5bddf4c1a99282d52
SHA512164c7120bbc75306d05c98c96dc25ffa3a56e36b6c39a9ea9b64408a57a81d32bbed95005b07a51fdababdbc47f9c9b5d0bed9f064de7ebe245354eafc325582
-
Filesize
5.2MB
MD5ecec30c1dc1115ae2d45684c2030270d
SHA1b218c80ea563bff8c8dc0e676bbc09aefb61ec38
SHA256eae15e6f20b6bb038cfa4d1f5640cb445f094452ab9bc59a1d67f12acb84265f
SHA51287e75098427a0a9f3012109ce1ca5b6b02f9e87a159e626a2d7de563b3fa226dd658ee53607b06edc36bbb54b2993bc8eab85d756512a9f7a8f2b4253e74cadc
-
Filesize
5.2MB
MD5013cdf38d35de6f09b681027f6808d10
SHA1fa7d730d9059f3c377aed2e710449edd9b63f35d
SHA2568345910c4e8480adad4f1ce4e0e805ca9d4324fc3097bf85155fa50285e58976
SHA51227d663d8f84a07fa208f87afb66284e34c530cf32ea10e68bdc55d162c3ceeafb50488f8c10e4c536bb6b577b885e471916dbec18365c8c0b81ce63ba5538e92
-
Filesize
5.2MB
MD5cdfd97c5f1e92f34b386af28782f9727
SHA1e8321bd06e8c18ebe2cc33761475252d944a4320
SHA2568be478138a3ed32aa525a43322f86f75993dd36fd0ffc21a0d6298d83ffcc57e
SHA512edba621ffc57734ddf76150405b3bc5f51f7b3fcb41aa645f8f4559465f5d7072e3e3e7c267a8c3f84dc31074a7106906a67aa716d82e94afaa4be6536722ae9
-
Filesize
5.2MB
MD58ce02dbdad8bcfd7143ddf27b402a3e7
SHA1223761e39fee502cbb9a2c947bd20bfa3dedc12c
SHA25688b24964459e1614036b998888e32cc1b1491eaa5ca053381a3179f6d3ccaa17
SHA512025e5d7ad21ee069e95fb87f81549f16a7b9193037ada4569698959a5d166a67a1d9fb479c380ec8059ed07af2cd01f03fe38325a2a5146af77f21f352806625
-
Filesize
5.2MB
MD517a9af45db324819f6031599fe34ab7b
SHA1484326b66a8ab996d88c8e46da374bf4d7c59774
SHA2561397ecb0b34a4f2b62239ea79ba2a4a7650e30a465395faedea12c0edb343a43
SHA51281bb6577407c6844b8b57495e028344c3045250c1cebbd3c628c4dbe2c378acd1358da65920c6b2fa5b3759c8e2a6a9722e176df5cacefb217b1447d3e94789f
-
Filesize
5.2MB
MD5463df0984eebd87487df6a5016619686
SHA1cf476317402a295aacfc2b2d2834f60d41fdcbea
SHA256b11646b5187a98f64f6e7c0c56495ba3c40666173e9a00ffa6349732287822ac
SHA51288e483079029723d4884f5d306bda0dca4bf87fba84ccf9ef52548e5fbba6364276db91a1c42cee0b2a219a45a73d2016ac812d1f35ee0ae4b41138ff54c69be
-
Filesize
5.2MB
MD5f68028911ba0d3826681516be0f4c01e
SHA12e334d37e1b784977fa73a24a9187a29480e62a7
SHA25673f18cd3df2383c9b03f9cb5d070bc584b4b7a0d12690d2d3fd5cecd8f304884
SHA512b5982a094e3c8a3eb8acf44fc71cb6dcd6c5bf157aab7bc7ebc110178b2e0ec4aabdefee6af4e3cb2a294e0209550070401ac1928d4ddacc24bd2fcec59a215a
-
Filesize
5.2MB
MD5e8908b14af84f95a2a7b6f86f27e2f2d
SHA1050c4b7bedf53f5bb567d155cb09a6ad6754dfb3
SHA256d8ba5838d1f3c082a285e033f36a79c8e96885b46a7267159404c738e43c0d5c
SHA5123ed7c9d75a2a238319b9944ff82e1e5fe7a094ab5b4d0d19014151078a7c2c0dfa2f5d2dda1e97fabe70cd0b0320189c534a7c9c9355b1d845d14e700307f403
-
Filesize
5.2MB
MD53315347a1cf29270637d4af4f2b5b44f
SHA1abff156deba06382ee1e247d0c48ee04d86caae0
SHA256e92850972383dcfc4842baf1e9e0d001d1a343bc3a2119ade3871d774ccc47ab
SHA51285defc0b8f7c25f527ab01a5fd65634a292cf27b1db0dfa1f419453612f2855fc51d19aa7779dc9ff34e088794c312af89a08f82c3801c4c07d6618e5beead50
-
Filesize
5.2MB
MD53a89570d30e2b27bc3d476e335950df3
SHA1a20267d272946df7323610ec6dffe40854fb7cd1
SHA256e87a934c4c0d4d827bdb9ef6b672f61eec8e4a1e6cfe2c60b50053b92234233e
SHA512d57a660710ca873991fc199b77b03e99223f9cfb0fdf7c3c882797392ae372950d587e484b78684fb87c8ade3532cc6fa4632e5d40a3ece387efe2e573f80a05
-
Filesize
5.2MB
MD5296e36a18e1c48c9c307858dfc03984f
SHA17bff9537186dad0f4cb86ebdc2f741fe63028729
SHA2561608f3e4e0ac0adc965549c17bb8e2b21836ce7fd65f043679fca1c6e24c513e
SHA512a9839a42245db9e45d80adc12b18b3aeed9a406772265ca5074ea10bb71f66e850e8d29c6abe249f571286baf03252eb554048a4e8941974b02706ff78b3d27f
-
Filesize
5.2MB
MD5af0d54919154c0e4db06056e4de769d9
SHA1251ed80f9b319e6e782b98f7c202e9bcc78c1cce
SHA2566f53acb619d279aa3806f270135114945db73cd65179e19f8b55f291715c0586
SHA5123aee77dc77d70aa714c50e2dac1015eaa68ff9464891150f466e6d70aa261627d367b44ed765f6a76bce841090b2f6774e7c29cfff8cfa8da3a0372432a6156b
-
Filesize
5.2MB
MD584cdf63e4ee3e44c5bc0a9bd1c2119dd
SHA1c363cb2e748e89d0df7f6a16365bfa557eaeab30
SHA25604aab104a7add69e01da30e27ffc08b57914aef835476972ba1957cff080d843
SHA512faecefdc1742899b13c74c47c5f6849d2c56d2d2e350857aeb3f435aec894f05b35fa11effd60db77f984222e5b6d0951cdd299952200012c0d911c8658531d5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB