Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31/12/2024, 00:52
General
-
Target
2024-12-31_4a15e1781481dc27c90ed37d8df4b393_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4a15e1781481dc27c90ed37d8df4b393
-
SHA1
a5345306f572153395e1b4072ff1b0912658c130
-
SHA256
1676ced20f9fa3e3a9a35af56d26055344cf81d5ce586a38eca931972562e1eb
-
SHA512
4fe2dc57a8f74e6742511455718d1496b062f150e1fd939b6546401ec46c22e6ee421e513af190f4729ee7e2cbceabb92fbc7848adb7f6edc8b7cfc89e2e3237
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibf56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_4a15e1781481dc27c90ed37d8df4b393_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_4a15e1781481dc27c90ed37d8df4b393_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oOQXKai.exeC:\Windows\System\oOQXKai.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NgFkLtJ.exeC:\Windows\System\NgFkLtJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ajMrJMz.exeC:\Windows\System\ajMrJMz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qJngjiw.exeC:\Windows\System\qJngjiw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\atlRdAi.exeC:\Windows\System\atlRdAi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AtdoADb.exeC:\Windows\System\AtdoADb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rpIJqcg.exeC:\Windows\System\rpIJqcg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WlDhWyF.exeC:\Windows\System\WlDhWyF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BkrdthN.exeC:\Windows\System\BkrdthN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wWOGFuo.exeC:\Windows\System\wWOGFuo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SFeWNzR.exeC:\Windows\System\SFeWNzR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eNdurhv.exeC:\Windows\System\eNdurhv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wPDKSYl.exeC:\Windows\System\wPDKSYl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\feLTiFd.exeC:\Windows\System\feLTiFd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UbAszCC.exeC:\Windows\System\UbAszCC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vfggHSG.exeC:\Windows\System\vfggHSG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DnkBFEN.exeC:\Windows\System\DnkBFEN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YVwjfDb.exeC:\Windows\System\YVwjfDb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BTjLKpA.exeC:\Windows\System\BTjLKpA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EbSiyDy.exeC:\Windows\System\EbSiyDy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LVGCrSD.exeC:\Windows\System\LVGCrSD.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b2b8e5f645b07f381c2454cb14b62c80
SHA1ab4cad8733972cc0a323a1bd172505e320ae1b56
SHA2566c48dd6da85c77b5dbd16588d083ee61b5ec8db79530474fe7c8ef0378042e40
SHA512cd29a76001bfe18eb43a179249f35f8f19bf47155f14429afac508889f90e1ae8659d9e345213dff6ab13b126d2aed645a77f0190eaa0ce9d5730649febaf4fe
-
Filesize
5.2MB
MD57c0df8e22631fbe8f37edf6eb40260a7
SHA127d03f5a9b0da48b3ac8d23742cea1e2f3e3555c
SHA2566e2e010efcf4e73260827348c227f847a9aa45de7688de753bd0a2c084b9a2b0
SHA5129c64a09a1404b521a9920e9f30c590ad3851696eca2e9efe0a015b11d9ba36ec1b219b376bb062adeae347a0f922ec950b1977a7db573f8494d246e8c115f826
-
Filesize
5.2MB
MD51c8b898bd5cb2d46a514dd9c6688ac08
SHA155cf97480f8fdaefb2f5f427f3c6bcf2dfbd203b
SHA256f549553c12f8809b0ef92933eb11b8f94675ee0c03242eb2cb310ef3d9542dea
SHA512b3f2b397f85edc221d429a567e051d9cf98d2dbba6fb88a7472105f4e9e717ef654b81bcc44554a4da2b2f5896daee74022fd84449e9bcc4858ea8e0962bb8e0
-
Filesize
5.2MB
MD51fb265ea10b6759185d7f3002d42b95c
SHA1d8613004d54204c1dc335d8a4dec6d815ec314d6
SHA25689cb109b202b88c2f459a1b9805e63363bc49a22a4b05378183dbc840fd8f53c
SHA512e68c9592f1c0105d59f6160762f977f917f2bd2b9fb04c5ac7ea91ddb8bcf5d076b6892eedd38bc439215e715dbf9415a8155b965b11ea15982c6b87d79ee114
-
Filesize
5.2MB
MD5c0afe9c839e255f1ea1c3c4135d27dc3
SHA118a39272bdf5145170dbc506577b87dce6ae1df5
SHA256e21157acc04cbad421ee7342c31209c40ffd42cfe9770e7295c868e18a111d95
SHA512c593687ac6ff52659e3e4fe47fef9a84ef807a56f83797cf5c3ba5297089e69d2f50dd1cadf236b48261f575278a1295855aba7402bdc7c3201fa314ba1bfff0
-
Filesize
5.2MB
MD54eef3a6617b159ee0a376e17933f2bbe
SHA1e8852b1df7686924ccf3dd8e281b68565cd1ab61
SHA256360814bfaeee0e2a02a33e4ec218a4ca5c8adae874c323e19d5b1240820c5e91
SHA512bc851231e46132e00e113a9138aebf1abbb730c6d16db645bd62be9223d1eeecea4d6767a1b92e2b685f0b90ea76184046ed7560d7dbb499d34cc89b5a653f1e
-
Filesize
5.2MB
MD55ec640de762c8c30387b7438790eba76
SHA138f4da8052fd5e7da026d41f10dc76e838277f64
SHA2560ec8730b7a2355a9003d66ec8991bfbfbb200ddfdd4e7cd1a85d12177d510e2c
SHA51244fa5afe4fd9f6e8d03fcaf254d1d20bb9a4c9861197e71d4d031bb7b04efba7e316ce41b062bc1e67e37b337b97c80fabbbabf9a8c960a7b50cbc5895f089da
-
Filesize
5.2MB
MD5f8ccabfebc720a971787315dfa7b8731
SHA1456f1e99857e7c03685bbca5361824fb8a0ff4d4
SHA256b716273a8e3af6b44480227f513ff75dbcb9a744e4a62e72baa430f255ad54e0
SHA512ed5bbc6df56097484d67bb800d9fedc434cb1be509ff4ac7474e5188e175a5eec5f156f974312dad045544aa9b0918d28c630b34a9296dc9258a50734258ef4c
-
Filesize
5.2MB
MD54d35d00613b466763a1c897c78539022
SHA1cceb9396d34651f9d1b04c40593e88ce4bf9b3b7
SHA25620bc5b14271ba526fca6f53f138ed74ebda040dbc65c3b9620f4da9a447dfc9f
SHA5122a5008898a53d14c7bbda1169a9e9b2a7179874d1a18014f7e42b596baadbbf0d093ccce038d0fdd527829191acc547df1bb698ee599f2d59575c0621f49a9f2
-
Filesize
5.2MB
MD534b0a690888b17b818824ff1e2b303bb
SHA1012c756e0b383a0fd6bfc4a1034a9338b6e4e3e5
SHA2561470f58037ecab8734b028bdbbd9e7b5a0a9155a5eb6194998f520eb258618e3
SHA51289bbf5aae46d113af5c1abbdcdb61be4bbb0a76e7c44ebb829b6d1b7ed75d9f3d03c95edd36d174b5982b309d6058abfb764bdebfc2f4576427fe1c6e18d6455
-
Filesize
5.2MB
MD52a377a577de6d3155932f32d839aa24d
SHA1271ca849751041db4eff053383c267face77443f
SHA256fba4ea441958c2aa79525af281e02f7722c1d6db5eb44f7525467034a8c9f3b5
SHA512fae92d2ac554dc63501c9e7ff544ccf21218aa8ee91cef4aac8184023c8d5ecfbcf736e1f85d530d2ff5e944b78a2b6359b2f574f3ac90e1b4d27ecafcbaa087
-
Filesize
5.2MB
MD5a279db185f1d856c9dadde82800a012e
SHA1602aa7e937a725dfb9cc2363eb899a40fb74237a
SHA25637fc6bb4d0c531f0290e637feb6f3aa6cd9a06a1607f6c2cf3b0766ecbd6daff
SHA51268b862ea6d7dfadddb49caa31b011b751cd1f9b2c56080cf96f1c243a2049274c77b0be9a840589b6c6c57b3357f63595ed2692b68fe2dab306cd430c8dd40c5
-
Filesize
5.2MB
MD5e77ecda2b6cd10ceb66c047ef66b354c
SHA103aa828be7b4a859376ed5a86daa7faa69547dfe
SHA256cc712d064c066c91f5a0eff8f96b1eb864aea3c3095bb033597d5445c9c8adfb
SHA51206eb2d5ed86bed8577bf5dd2cecd3a063af9dbab1258aa9427dc328a822965203930cc0b89dcf8e268fa018f5a036f5d4ad8e3b72e60e9b5ab5a44ff8bf70d8a
-
Filesize
5.2MB
MD5226a85182e21aa90288659b2de48c34a
SHA19ea069a271723e4f6583ce2873d8eb67e4aedf60
SHA2562cf493e8bc4d388d63f30c535fa0b7b7835abb594a1655e1df6a375793f46a0b
SHA5129778a985eaf05afdb582ea3550862b5743a733b8e76afafb47f8751bff950ac709eba7dd3a4ac8a3ae91bcb784c8bc2292397daa680e8e08c3091f2620cd2a93
-
Filesize
5.2MB
MD559150ffc7b1ccef86fc96def341f09ec
SHA1d73f5fa932cf1f92f9f0c0bb4a821ba52da245ae
SHA2568ae44ef29fed4a79d5f89d9cc609e533aebf0084b1ebe875e82da31593a4cdac
SHA512fb31aa0b44a4bc959fc935fb08cc953f1e065f345f880c78401676604cf3e29bf95655c5bd96b8b422b378cc9bbde53cde6a5d14bb74c82f8b67dd560b5a6b61
-
Filesize
5.2MB
MD57f12fb43e8faa8d5126042e8bb62c6a3
SHA16456061ac1843ba8fbf8685da3977eecdc130dd6
SHA25667d8249567f8dabc495ad5cbce47be6219898ddfd482b8d19be24b4d539622fa
SHA512a41e18dbedb601a75f334d017b1513f91c1e344f83ebd284fc5d458a3e4a960b07a7200751bec3494b87e479c5ebed59aa2ae6580f47713bde57890a55f35fd7
-
Filesize
5.2MB
MD5fc1f20c8763e02fc15299ba0d74a3ed4
SHA136307d04ea0dbd7584b83aae9ea070f7c4906cb2
SHA2565524780d64efb89a11d86bb7722b197a486dee5b5fccbd4235d8abeae9cb7088
SHA512b62b357c3ae7afd03d85971918fd7b5fd020f4751d4b4354b91b58273fbbfd8159c18a6b6f0546ff6e1a5d21a002f0a1e70815ad5094055e2d65e0f2b96625d3
-
Filesize
5.2MB
MD59e01115b6c659f439206de5dd9ec1994
SHA1f3c0ba0ca0c22eb213a079365f0e5395a8b9d300
SHA256442b43ca340429096a531a75bd4d09ab52b3bdea7b17444e80761ccb00d91f0a
SHA512c7ba7f61ec0389f63eaf1226eacd4a316594672f180a446fdf032fd28c9954cbe3531b50cf0c88a805fb91366acfa5f0347fd75316bd7346dd3ef488c856773e
-
Filesize
5.2MB
MD5ee2782c8fc44f8967734f13ff9a0621b
SHA1e5a20e54fe6fd703b6ae9d21e006952ca128e553
SHA2564602e3b1647c59a0e448c0cf40df974e32098276f6fee81a8fe0421b49cb3526
SHA5123a38546dffb4fe798224126b64f66e96c91b36c3c2a73f7964087d1d302cd1c73d3033c3f9ee1e1d5aec4d6449eb79aa581074d2d3e378c7d7547d333705dff3
-
Filesize
5.2MB
MD5a4af93874514ec025fd9db71e0225a49
SHA11c493d7be597200bf7f45bc166bec1fb4052a878
SHA256f4529e1441e7040a0cf0476718eff3c7c3f08cf8456fc9face2201ed7aaa6f3c
SHA512337b8644e3d185b9b606a5110d305a240d7b4e4a7080bb14e37ee1a44bdc505d5f49e4cd6d7a25e3599c775efa5050c6036d11a56ca3a6bfdeb9414ed1d46488
-
Filesize
5.2MB
MD59f97ce5d7e3d830b572b8ab30d932e0b
SHA11d9e67a161258a2757d03e3fde0742961ebf96d2
SHA256cf71c87e480d4385e5d2a07a682d718410d3eecd31ed4bc0aa55a258d9346d4e
SHA51258353f4961540d993df2281d9c4d31a87118e3813a1df1ffa9cac50735e83234b93148c54c2a8e1db2e45a9645ec7c0eec1fafc6ba6d01e65e0a4dd0843166c9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB