Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31/12/2024, 00:47 UTC
General
-
Target
2024-12-31_24044062239469c9bc1f0344e098cb1f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
24044062239469c9bc1f0344e098cb1f
-
SHA1
d78e6da9370015cb8d654ce8afa32b187aafb26e
-
SHA256
181a6a77b365446cbbe3135234e2c57108f939c74e9e639facccdc38b22c1b44
-
SHA512
3a92866d5a88202924b627f1958826522c6a3a9922547fe60563cbfe49342f63eda739c68cb90e68fa41c6443359406ec78abbe38bd553e7d9273328261bace0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibf56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_24044062239469c9bc1f0344e098cb1f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_24044062239469c9bc1f0344e098cb1f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NiNqHMp.exeC:\Windows\System\NiNqHMp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ldamgsD.exeC:\Windows\System\ldamgsD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PqUnRbR.exeC:\Windows\System\PqUnRbR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sanBsjk.exeC:\Windows\System\sanBsjk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\urctzxi.exeC:\Windows\System\urctzxi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DynqkgI.exeC:\Windows\System\DynqkgI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\doTmHKX.exeC:\Windows\System\doTmHKX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NeqsiuU.exeC:\Windows\System\NeqsiuU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jZedGLt.exeC:\Windows\System\jZedGLt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KanpWDk.exeC:\Windows\System\KanpWDk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\diaCiaw.exeC:\Windows\System\diaCiaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\olxpOPZ.exeC:\Windows\System\olxpOPZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UBsXdFO.exeC:\Windows\System\UBsXdFO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tTqpUFr.exeC:\Windows\System\tTqpUFr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aMRXdsQ.exeC:\Windows\System\aMRXdsQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KKKZhRS.exeC:\Windows\System\KKKZhRS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vSUvlPJ.exeC:\Windows\System\vSUvlPJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oyJPhsc.exeC:\Windows\System\oyJPhsc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NreNIhL.exeC:\Windows\System\NreNIhL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MXSpXXd.exeC:\Windows\System\MXSpXXd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\efyunQc.exeC:\Windows\System\efyunQc.exe2⤵
- Executes dropped EXE
-
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS13.86.106.20.in-addr.arpaRemote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
DNS172.214.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
DNS140.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
DNS200.163.202.172.in-addr.arpaRemote address:8.8.8.8:53Request200.163.202.172.in-addr.arpaIN PTRResponse
-
DNS18.31.95.13.in-addr.arpaRemote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
DNS172.210.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
3.120.209.58:8080 -
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
-
3.120.209.58:8080
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:5313.86.106.20.in-addr.arpadns
DNS Request
13.86.106.20.in-addr.arpa
-
8.8.8.8:53172.214.232.199.in-addr.arpadns
DNS Request
172.214.232.199.in-addr.arpa
-
8.8.8.8:53140.32.126.40.in-addr.arpadns
DNS Request
140.32.126.40.in-addr.arpa
-
8.8.8.8:53200.163.202.172.in-addr.arpadns
DNS Request
200.163.202.172.in-addr.arpa
-
8.8.8.8:5318.31.95.13.in-addr.arpadns
DNS Request
18.31.95.13.in-addr.arpa
-
8.8.8.8:53172.210.232.199.in-addr.arpadns
DNS Request
172.210.232.199.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5332330dacde1c6362a183341dd385be2
SHA13e576611396066215438f485a0c2533f48435bc3
SHA25665cf2e900942b0741d7460e270fd0a408914c8ccd29e0b9fe869a1fdec8d6f40
SHA5123ef2c5f86be4f60ab6a837090418cd3f7784df460c74b6ccdf22fc7b87c3395a21a874ec2c3b3d6bfcbe466ccd67048de5ec7b192fbfe7b2c58665be34be311b
-
Filesize
5.2MB
MD525d9a1b33fd69320cd71a01a1ebda647
SHA192c2d55e5cae6c925fb149743cd890402abf0d77
SHA2568cab908ba85689c9eed1fcf8059ede8c3e83447a6e1a8bccd3c103ce80d4ea88
SHA51244416451831bf0880eb91400d0c6f63cac551e9e73af3e3152f369ec896b86be4feeeb85ea3fe1e6b4cb84f6cb2b775cc3f324c5cb09ba42e9baa8580db65a46
-
Filesize
5.2MB
MD5679eeb6ed096a9e3f58abf1d2c168b5d
SHA1f62898057a2ed1fd813e5fd6a5a8b55ea00fbd56
SHA256e5bb8add1aa179914bc1f56dae0ddae94e3739368585d062d663108007f76a03
SHA512c122138dbd3f833ba72e36a7c4a296c731213e3fde3cd6964f25fcc7382a143885e0b5ea58747e34d4594df20e3e0c38f0df5139cd8088307b2cd7bfd8df6d7c
-
Filesize
5.2MB
MD5eccbe5089a2eb8cc71c6373e15f95230
SHA145d38777498c6d1be0f10205a7b36498c5abb46f
SHA2562cc3b248e5e075751204b09fb1c4276e438e143dc7fb21af90b6b426c968564e
SHA512c5b5a9779a48c3628d9feac9e1015128077af2f1c8c020981cc4804854058fbc29bd993f0d81efb3952a9ba7be9f73aabe3e6ad6be5cf6fd0ae300ea4f2a787f
-
Filesize
5.2MB
MD52fd1ec9ae067e486d95948040a0929d3
SHA13ec0f5b3dd3e62e522467ddbdf45492196e3d413
SHA2568512f2f1a95c4f5b4ebc61674eb92ca08f50dee7bd431c48ad1d3092c2cf5387
SHA5127ba3286d97e154d1365eacbbb457949de31490ab31f61a07eefabe0fd3e47177c8b541f61f069aa128a97ce65cc9476a72dd2e057d50b8ec3f4a3d63ed6923e2
-
Filesize
5.2MB
MD5ca7f6701385e60c91c6f8dbc8594c31b
SHA1cd12605f11708fb0e9637f58a23981bc34712e58
SHA256e767988cd4c9b674b1c6ff7aa7645872bfc7ff67a258aff358aad3d2dbc41768
SHA5121f5019c9f0a27af5bc52c8957e5346b09930b9fa2e316783c9599cf733c5b1abe0554ce6bb1550a028c88a76e8d16f2facb9293265be2ea0b88c0715e5f2002c
-
Filesize
5.2MB
MD54f71b0bc35628388d59974d6b77889ee
SHA105721252ea2b91abcf63f45f3e7fea0c7659d7bb
SHA256a169c3b32d8be0a8f7e9f252e89c3bc3e815f2f1f77629199cd0d6905c080bfa
SHA512358a82669b262769242322a3f771f734c56c5fa51d31c515cfb1cf771a50c478aa77594825308076a6a83f943b44125728f54bf7180cbcc0d49ab0328a8e7814
-
Filesize
5.2MB
MD58d480d41d1efe5219a4ca615eb799972
SHA1446d960d3462376f88e26c026c4ea34a20178f94
SHA256ae516268319adae6b3e0a0580199db3689f53e4cd0eba0975edbc859a13ed327
SHA51242fe07439100c9a7ffe6fa0f45043407241c8202cd74b5b3c1ab5e17ccece7ba3a490fe4d2b8e99800c8a4097f780c66259587a05cf69175e7507470dfb0b651
-
Filesize
5.2MB
MD53c069f78d2a838a548910ff8baa54bbd
SHA18a6d11ee51ddb239de031b727033e9963bc66159
SHA25675d0afb62b0586d39ef8d1a2f292964e012a68fc648be8a5ba648653bdf34c15
SHA512cb4de020fc07d54074d7e94e969d3e70abedcbc9f438dab7b1d434d430ceeafb0734e48402044ba149b7bee1b5a7f641adb8d12b35e79b746620ac84a6abc3dd
-
Filesize
5.2MB
MD5ed2b19c59ef759759dd3170b90602a81
SHA15db5701b41b3eb7dd018e4a0cf0c856114ecf19d
SHA256bfbce08f0fdaf609759311d76940710ddfa58dc777231c42a5e28e89c3750316
SHA5122e4519d8680d5296cf364f2b912ebe5117e169b0391d689d13867396a5cc8c7fb9d699e00b201a09fdfbe052a0c3662a5db6369bd0baa80ffc39ad0a6205ae30
-
Filesize
5.2MB
MD519ff25723c268fefc9d69851adcf3e96
SHA150ce82136f5c1538f61449443f5b314f991ca5bd
SHA256e568084c1707d30a1338698161fbdcf2d6a4b36c0acc09dff28414ce39015667
SHA512f76eeee50ba791a3053047e0085dfced87e1f47e9447a013189ef166bcaaffe4e4b7acb1dbdc43c4b7c610de5eadcb006ea526f3cf315289289dccc37cd0e8ee
-
Filesize
5.2MB
MD51bf9a44d64cb7d5ceba485695e415985
SHA184d209a366e2c4d78bf85b3ae45e98fb30f1f7a0
SHA2561ec113af4112b18c477cda059e0e0923acfc50a12100ac2b938e26a9c7c01462
SHA512855f4978ee9597695fe112429eb2a142374a2ad949cf01801c7bd8d73c3305ffd16a9bbf86c0cf8f6eba08b2fa0f014d7f58a35512fec4eb35563df08a430aa0
-
Filesize
5.2MB
MD5b2aa47503ba715f854b1b682f5802967
SHA1d98c2419f6e40b8bb7e8edb103490383f6187c97
SHA25696a549253b7df44baa78a05a53d46e688ecf8872f40f1bf3576b4897bec90963
SHA5129e7cbbef5a5bd8bee7737f5b5dd31ea01db13c1edafd6bc8ae76af55824ba2b2da6ef25e40124c6477500da9d85a888f51f3c04ba30685caccf82bc19cdcc090
-
Filesize
5.2MB
MD579f007c635e22a4496f32fb239306678
SHA1718189fa9466399bbc9515fa84386ef2b8eb0ca0
SHA2568eda6c6f49195b46727d6f0fea368f2cfd8743d88a9749aeea2da9ee03edbae9
SHA51203b40ca95927ea554ccc8cc9b291b74d1470bd811e4e36d9891bf93e9141aa39b54b5c17363667ae9ef15847f86d5d4b69707f449c46a94ff88c4b468c356d8c
-
Filesize
5.2MB
MD5a18937f7c461c7eba9552c12f8e955c9
SHA161007c7da6a1c361a4326a4b8472723b08928922
SHA256dff9cb0775cb927fcf060e0e094f02f1f8998791d4487b37557632b03f733aee
SHA512fdf6c053a3828ea6b0ab25e6d87ab24e18a6443d7895b6598b4c5db2e985da0036a1f135d0381ad2d4ca4d409abe5f7a9d34dafe9802f7af54aafdf031b2c3be
-
Filesize
5.2MB
MD50ee579310a2b556ea391bb65b7d2129d
SHA1ba7fb3f4306631dfe9340b79e106b70a41c9d661
SHA2564d1fb957e9b6cc321e2e708d53573490851d3a750d0aad81f610139e05740be2
SHA51213c22160fd0c60735bb25399c8c26f6314aae9c402e52b1f86b407cdf9b59cd3fffcb7f0fe929852b079f601e79f2ad253164fd776b7f0f438cbcaa0f1db8f00
-
Filesize
5.2MB
MD51b166e7db356c5f28b442dcf797c68a1
SHA1d9fe868e240b8408abe8fe1d005dae15ce6731be
SHA256073cd30a57ce55e71aa6d7983e66628bab52725c06d9be894333ec9208be4c98
SHA5127c8a8dc01485a910ba6a929b96376163975dda124cbeed4fa03d5a9a88cfcdd602acd8469bb87e87e6335e25ee06ac6d056b2540be587fb03a5b9319858b9572
-
Filesize
5.2MB
MD5b3a8f9ca582ef9586be754ebb979b49e
SHA1917ad76850820235160bda316b3409c6bee10dfe
SHA2568d8c306f294ee761d35da988de49146d2292081dc44e750241ee5cc294bd70b4
SHA51245eb7056d8faf92e006abef8cc80290cc5ead12a010abe5cbe3179b605507433a50a7c3950832486de122303d9bda1927d11a0b74c22dcee87b5159115025330
-
Filesize
5.2MB
MD5c88df61b779706038db4a6cf617076cb
SHA13be91ed6b13854f8c9854f27f2a47d5ad10e4dd0
SHA2560c89389a44317ba4c0dc0c69cabe1dfe937745770a1573df71e1128fd499094f
SHA512fa2ebca3aea57158365ea4a5f3c6a7a87359ac3dfe5930af269520b3ade9ec355a546f7088010113ae8bfb1b2755c9b14567b7f33976ea1082d0648738b13fbd
-
Filesize
5.2MB
MD5e51b3a38c910a5092b0024d0bd4ef051
SHA14ba7fb0bc109cf3f056f6cafcb289b102d062244
SHA25615cda20e1a262f9bc0597a3f8e04ae4335ec1a313550a46e9521201d837de32e
SHA5123ab19f6884b175b83c6675d1ec34e9dc48b5b97b23a98ee27d2eff27319d526858f975b42eccf6c0b4426d76ec29c13b0b65a09e5a4b9a77bfa7740ed8435202
-
Filesize
5.2MB
MD5e1760ece9574d9867ab5db3b5e681175
SHA1caf4c84274f38bc1aefcf13967de1a7f3aecfb15
SHA25622676c7ba657b05e78d47e85379812809b92282d532967de442169aef89d150d
SHA512b259ad46b335c6d064382468256386b1402b203bc168d243dde4303e460bd3bb76c59fdcc80b09ccc5fe5e2aed3668ddb679f04aad1309cb838768a9e93bbe79
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB