Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
03/01/2025, 00:50
General
-
Target
2025-01-03_0a5d75f7aa211abbba09ea75b4296af6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0a5d75f7aa211abbba09ea75b4296af6
-
SHA1
41b99264acffdafa5e0df056a97af08105fa8cbd
-
SHA256
f34b16e73b937f647226c4a4745881b4b0156a60901b87cdacb313ef53c99ce0
-
SHA512
256587df457b3215af3f0b5792366c11be4123e1519de7ba455ad85930c4df1a79da8f519a85bfbf89da0e2a43e1cb913c7eb195ace6dc17cf3d483011a2c52b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lU8
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-03_0a5d75f7aa211abbba09ea75b4296af6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-03_0a5d75f7aa211abbba09ea75b4296af6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BKXpnbx.exeC:\Windows\System\BKXpnbx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HFPeRkU.exeC:\Windows\System\HFPeRkU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XIuwYPf.exeC:\Windows\System\XIuwYPf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XPyCgZm.exeC:\Windows\System\XPyCgZm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WWMsrrh.exeC:\Windows\System\WWMsrrh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mTWQhUQ.exeC:\Windows\System\mTWQhUQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iffPBDL.exeC:\Windows\System\iffPBDL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gOnplVe.exeC:\Windows\System\gOnplVe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JdBJqts.exeC:\Windows\System\JdBJqts.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OslAbOC.exeC:\Windows\System\OslAbOC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WYfXIwq.exeC:\Windows\System\WYfXIwq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OTLGroO.exeC:\Windows\System\OTLGroO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qlnByma.exeC:\Windows\System\qlnByma.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vkqDmZN.exeC:\Windows\System\vkqDmZN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SyuvahO.exeC:\Windows\System\SyuvahO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dDuyBnf.exeC:\Windows\System\dDuyBnf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pKhsefL.exeC:\Windows\System\pKhsefL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WEzTvmF.exeC:\Windows\System\WEzTvmF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bPYheTC.exeC:\Windows\System\bPYheTC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EpjMYIj.exeC:\Windows\System\EpjMYIj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jcIZKMv.exeC:\Windows\System\jcIZKMv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD572b33fcac7e10e504c3481f45b46c0d1
SHA12d9d4a629d5115d6f483566ee6872f47b24f2d17
SHA2569a79f0e7a4b8503eeed5ba2b00cbb0b941571fe6981c24691a60350e040155ae
SHA51206437e5bbdd96a69ae54938a42d735d7fe228f0bfcecf12f219fe136a0afc27f2ba97753b9dd0297342284528d10fac284a5b4454e4c568b0d4577b6e438889a
-
Filesize
5.2MB
MD5620b243a00fca7bc2575e79748eeb137
SHA1bd824824a3b62cd6d424a0c82c906ae50082a328
SHA2563f627c8d87ac726bf2b5c80e35816bf96736af36450765bd1018a1b16a66aa87
SHA51236e2e8e4911ac3023de97d92fdb4ead4ffe6ff841ec600b1aaee7c5d496d040efc3bda7891de7766412aa03bd80e50cb57c7ffed0c133123e38cd2c7a7fa5918
-
Filesize
5.2MB
MD5082cdb7315540faebfb457604a722642
SHA1912049df0a1fdf8e077f53ae7d17bcff4bc94568
SHA256bf0248e43135aa8fdb38ee38322188d44ae73457b40829ee254e859a0fbcb22a
SHA512799d7cf89a4742225fe0f58e22fe83c577abe70fe8944b75bd79dd9bf74a4217e3b7c7efc86b711be9a328b70210a7d1d0f77f0b198f7ef11e3bca0dd40be4e4
-
Filesize
5.2MB
MD5e6015e99ee9912daa3e1abd5b97715cc
SHA16dcef591790e5531e9e5e35034b0c3b4c1704f41
SHA25648d21b83f4368a9fcd3cd088b633571ae9a11fe383baa2247c23fb289412bcc0
SHA5123a5a8cb882e36467382d380b88b20ab5009c596bb5079e99f3e905f0114a66a6fdabc8e1b88c7e8cfd928fe8651085ea41ba3ad46a99e3247934c912500e6878
-
Filesize
5.2MB
MD52849bead2ebedfcd350bf7e4e4b26c9d
SHA1e469ac3b9285b75585b2c1563e01f24867cd0056
SHA256bf6da154c1176976db93cd2d34b198f1c2d01099c4fee9cd18d1c69280e0a609
SHA51201344592757d6e1fef992c4bb7e3c9d155ee9a58b1df8cf70cff01e9bcbe0fdc1efc19e52d87b7558b881644fa81ee35b09c46d7623eb54307f319b11133729f
-
Filesize
5.2MB
MD5496caa8b114e75f060b41294a758780e
SHA16b6dd8126dce6bba4c7b1f55037867ec38cb9fd6
SHA2564ebc11ceb0a1a5cb02fb753b9a99e1c8f934d0a7c57f765054d31aeb686488c7
SHA512d4a55b3a895052eed3c86a02539d9ef2796d85cbb4a812bada0d5a5b42bf9c9aa674104be9ddc0be396a8865a4f521212b22ccb9660e8315c8aeb6e0689c1e8a
-
Filesize
5.2MB
MD5a60305e12649878f6b1cd0279d05fcfb
SHA1de22c98ad37f06f2f103459ff1b20de12e419967
SHA256d4cea103fd9e8b734c546e7de97e47d03d75ae8dbda6ea11e01fc8ecae78a162
SHA51273d1aa5256adb21a079e07c116df8fbd05f4802796ef251953017cabda4c5a79eb0affe5a2bb4d21e759f7f807f41d71472eb54cf486b89aa29f96ef888a38db
-
Filesize
5.2MB
MD5a5ef6dd178900c3e45aca0a714d86578
SHA176070d3276235513834de48b144e1916cce6c4cd
SHA25613b473237e01cf5f5b42c6763a01ac0db6059a29d5c22d3a4caf30440b2a6075
SHA51205571b8ceaf9a846ae4f58ed91445facc4740cd66422a751d83fcfd0a747588012a66971836b907ee91f18820e35f920d023d812fb7415f2053a601989f20af8
-
Filesize
5.2MB
MD5aa6a4f366855aa27d2e3e2d3f1b58b20
SHA1201d153f4e4149a0db48fc42e2e354cbdc5c105b
SHA256f5d9c48fcbb3e0ab2b9ca0586798c47168df27890517b83c4cfffbd266ca793a
SHA512d734972e9ff7e898e50e48aa943804aedc92593852567900e5d01ba31666f33eb69d02e341c2dfc50c21e21b4a842e3afcfd4f4bacef8e8b8336410058391b1b
-
Filesize
5.2MB
MD5d5956847d06236fa8304df2f71cd48c5
SHA18160213bec7561a55330abb587624f6f9b5b3a21
SHA2560bc7443872363bb51a1849d8ce6281adce3458e5803efbb0d91a7ce29446db31
SHA512c83ef41a5d237e2c0522ec36c8aad2e87ee5045271128cb888dcea4f5c73d115fedd80053b40fcce0d4c9b421cc6c8d4e556837d53eb92cc4d7efbc9d2b5a171
-
Filesize
5.2MB
MD5f8dda67a4ca2a063673656a4e91786a4
SHA1bcf03227a3dfeb68b715968a5460a8f730fec596
SHA256d1a0ddb73586a6dfd182099650011fcc4577c8558b9e24f0107f12d02ac1f141
SHA512b5dce8a2494d66b127a96e7c6ff7ff87cc65dd5caab0695f3c168b5d8a5a47f74bce80b808f159ea168e2c1d38d9d8075734af982f772392b220ca8badb6be95
-
Filesize
5.2MB
MD53521c15d8572669cf2f60ed53ea68b46
SHA10ada881a1ec16249d705737ad325274732704f4b
SHA256613abb879480c5c04fdd548b5fa377a68a4ba3a3d48991401cf1e517ed64cea8
SHA512cd69bb60918955fcafe54e17f21cfbee7a18b5a85c1b0635f48d51664cc8bc08da104e83fe555dddebd7d75c3e53bc7f15e1dbcacff4f7becfe89dbe58156f1e
-
Filesize
5.2MB
MD591aced1a10fe0f654ce591c1ab35bd20
SHA12f2e85461b98e223c04c7e291d217145972d3089
SHA2561f382bbcf38abcef96c910bae95f475f174f293550d3238c4d234b84dd52af7c
SHA51203e3edbf98a94ec68c4dba6b9e5ed81900b4314237a181f9c21168bd0deb7c88b88052169c554ba4359c7c37f321a5203b9dbca08f47d3625441a5772c18d27c
-
Filesize
5.2MB
MD55f181283aa51daae20b1b93bdfcc3fe8
SHA14c875209af9cc4041a6b1732c60483fde40d8f7b
SHA256af7d18d877c739d84b869a9b51e4708933a29e9b9bd7e07596885b3246233a6d
SHA5124077a9f4601781022d7171895d2c4e441afdef6ea1a6b233629e698ec523977df040b872a988ba8e22e5c44c1eff2fa047125bb504f94113cbe2aee5aea22187
-
Filesize
5.2MB
MD50a571887513a8c5c49d07b6861014ac7
SHA147ff60b5923c3c2eed3c036346453ce85b58c034
SHA256246204b7adab3392e6ed85bcc99b3feabecd8d22e78b7e1d8a4fea3bf7956b45
SHA51217663801e3680dce7d585aaff98916beb92d14766e3b5d76fdd344e6afd8d59ba68c25c142ee7fbc1269df8d27d0f277102922d20caf085c3725078fbd83a84c
-
Filesize
5.2MB
MD53fc66cbcb393531d09ec4170f2fd7cb3
SHA1398affbd4fc2a59c2cf522b7bb127e57c5e74907
SHA2566b8b20f023b6ad31bed28ee342c7aef39d8ba610f254414384005a0fb7d7c2fb
SHA5120bade0ffb0fb6214554db37b10668d90f6392d4109545094401645a14b16398fb5c3489caf89e42555da3392685a42b60550d640cdbd601b81d46dab3675d6c9
-
Filesize
5.2MB
MD569bdb3c853f154736abdce651874323d
SHA19c3d9df27c6f191829fb865f6f14a3c7e6543f78
SHA2565c3fe38858d1f896659afa28e8671b0b093811700639d008540249f462cabbb4
SHA5128f8f9e50f80efbae7eb7d04b033ec1e91f1cff603fc792bc85910173c620d1288ee60b4c8b46d7d72f174c5b96519489a8b562720cb50c08f1548abfcb11ee5a
-
Filesize
5.2MB
MD58e314dc056f38b8c09c6a70a9a994650
SHA124072196283e9dd3d3f0784e3b931f32fd79c164
SHA256cc476fd9a25b63f1bbd5dd7901704aad18366312adb06f4ba7dd9c4201493103
SHA512e3a79ec19b4a99739d98536d5f9961c7cbb99fa237d454a0aec3a7a8642d445d845b79d2022e391a646ac24c8a85d8881b6a1a028618cc82f558d86ea35d95b6
-
Filesize
5.2MB
MD593358609de183f49f5682f54a977c763
SHA1d55bc97f8fe11bb7a910ad8100a2f4c6a51fc036
SHA256ed5ca3c0840b245f24a834d82aafb1311b4fd3bb09450c7f210bab05ea6d11c4
SHA5125fefb6a91ab3da6a70eb4fc6649e3a65c4190968ae9b2e6b6a7967abcc25bde3cc8e5cded748897a2fef44108ec1941fd198c8fc5c334084925caf6a3d042133
-
Filesize
5.2MB
MD555bbf4405c4fcb9c291fdd0b049e5110
SHA1fa3ec56704a2a7096cac77ad9fd0c8b502a8726a
SHA256ffbd91a1c898888c72e0228246afa98d87409dbabcce23ff7fc79e1357260d6a
SHA5127d5f166d6038e25ea37d7a8d0090af25ca0a452dfbdd53c8aa7132309bc5f0c4694bf091568e877eeabe9abf1892a3238dcdb211d5208b46fd36d6a787dfd6c4
-
Filesize
5.2MB
MD5dd5bca3ec525d5c8f81505992586d6df
SHA1a73661097bcfe3a105667852ff5851c93c32a4c4
SHA256f7a0a14cb2e33b2b658b79e7fa44f5d3db552c57784e78908311a1f24960dd49
SHA512a7cfa53136af8bf0ba7e0a9de64e2bcc104d21dc49e745af4764fcee0a6c3b575472611a1b7d71dc6cff79c4daed4ba56efd709374df5368b442a3386fb854c4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB