Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03/01/2025, 00:54
General
-
Target
2025-01-03_302c40ffdbe583bf31b005dccb5dff18_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
302c40ffdbe583bf31b005dccb5dff18
-
SHA1
86106837c5b0c33435c581155ce21a9c8efa6705
-
SHA256
47830bf38183c44e52be1f55e18175c731d1ca07c3739781f5055318e1f47190
-
SHA512
4977090fc06dd537fd4d8fe463bdceae9605117b47a5a28be09aca2dc93c99acc526111257d719bed2d76f3840d3b3b824c901089b5e19f83d0714e02f51d24a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lUQ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-03_302c40ffdbe583bf31b005dccb5dff18_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-03_302c40ffdbe583bf31b005dccb5dff18_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cEwowxw.exeC:\Windows\System\cEwowxw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nkkBOmF.exeC:\Windows\System\nkkBOmF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kVroRor.exeC:\Windows\System\kVroRor.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SanoJqI.exeC:\Windows\System\SanoJqI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SkJneWM.exeC:\Windows\System\SkJneWM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RBVgxvs.exeC:\Windows\System\RBVgxvs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QRmjBmd.exeC:\Windows\System\QRmjBmd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tJIkEbG.exeC:\Windows\System\tJIkEbG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RxtoqNF.exeC:\Windows\System\RxtoqNF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VzsqLTh.exeC:\Windows\System\VzsqLTh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dmiWbiS.exeC:\Windows\System\dmiWbiS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tfghsWC.exeC:\Windows\System\tfghsWC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KXhDIEo.exeC:\Windows\System\KXhDIEo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AvKvqMA.exeC:\Windows\System\AvKvqMA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GDyAlNE.exeC:\Windows\System\GDyAlNE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MmyhLwT.exeC:\Windows\System\MmyhLwT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HxdUHKX.exeC:\Windows\System\HxdUHKX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nPJiMuB.exeC:\Windows\System\nPJiMuB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TIUFOWn.exeC:\Windows\System\TIUFOWn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cqtmSiA.exeC:\Windows\System\cqtmSiA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nIGRDXk.exeC:\Windows\System\nIGRDXk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD592e49d12aceb79989aa198aa637ecb5e
SHA1457e04f459a656894efff44f54c66e1fccb040ff
SHA2569ba28ca7b8d51893aa19b81e157af41573732f4bafa43747174c937c27d161fd
SHA51215738f245e803885aaf8c2f1f54637544f71991b308e9ca81d67caebb23d1e98fc4981c3cb335eb775c2a2718327dd7ed92a061a42ea7825529d0709c769c4d6
-
Filesize
5.2MB
MD58765d9a68fe8d4231ba131f364aaac77
SHA16b5cab8e428d59b251def386a38360906fc3cff0
SHA256d952b9973d75ef08d321954f58e497863d038a19739966afeccaa5305cdad8b3
SHA5128d8f137b77bf6ed9e46f5e44c305ef90c83faccca7f7ba776b735d5f29ceea63216eb04756438f70f6434ceec5933482db2afa9f427da7f658f2442826286bd0
-
Filesize
5.2MB
MD5f50d55b67ed248cdcd56d4eddcbd920c
SHA1b29d5e6751be98700f8362e12d8831936a04f01b
SHA256c3296980dce4249516a607d0197a4ff1dc6dce98c7ab690e0624a72473ed57a2
SHA51287166a2a255018b5e5bb4fe46691f0e08d9bc262aac8221bed0e853fbcc1a48ea15341b00336d78b9dfac5578d7692e37ccf66e0b59b51f817d4b4671870cc0c
-
Filesize
5.2MB
MD52ebd251ecb36478d64f4167dff3b5956
SHA1c1953494b518d61ec04012bb02580784bcbe6086
SHA2568e865f75287c73a2faa5f4a5172cca9ef891fb3e00cc64d593d2293db83d6083
SHA5128040f5f105586048d78de58f6587ab86bc57050e37effccf4e5c0ab0afda22c24ffa6b3c5c72e74db831d2600eb59905e5a9ec804fe4466d974259986c3a46b2
-
Filesize
5.2MB
MD5d24db8fd46ed394fd02ee6f804de6764
SHA1bf53e736369c0221d372f658e95bfb64d7050e32
SHA256218f518cbe6ade1676aea4755e98d2622c891b66a3ab41dbde30234309e0eac4
SHA51267e8b82560316c2df2e1c72866b8719d32f4b4b3a226853d59e3cf4525b3aa7ffe3d2784bd601424474241bf0eac76b5392b1cf69dd14889ba53ad74c72b90fb
-
Filesize
5.2MB
MD50207cf797b7409ba21f97183098e9fb4
SHA109110a02194be73c5850413d2de9deff773003d1
SHA25687e7504bc594ca3539ae19eb3b13c3beadb5e263d6b8436d08a9b5dac3d9a44b
SHA512d2e51c89f0034ff1ce2bffe7a666c30f84f670ccf9449efd1429d5a2d66841e35b25567fd5a1aa7dcee0e3dd56649374f5d08d9e2d4ec15600c03c2b3e6b3bab
-
Filesize
5.2MB
MD5b4b04c1a48f19d641908a0c8a9fc0cfc
SHA1d766452797e0a3bfb256a6484692757cf70c195e
SHA256295b6fa63e8c4088d847c604181115e316467732c193cb88aa3a962b54cf7a30
SHA51225963717595f8cbfd6009f31b85ffe89b916a00bc49108020d2e755e1df7a483fac7651b98d92b20b162ef57364c4c7b1369ac5f170c4c7b9f34fd92d3e17e9f
-
Filesize
5.2MB
MD59bb1ab84b1f532edc4ce5ad4a0c0351c
SHA1721c20f8a97750ad6e1e7479faaaa8555bb0a9ae
SHA256476b91fec761d8149b522d4f262f933c4d3d11a4976d6d8a6d6f196c3e1d9a71
SHA512046ad122876d1a7eb6d56a81c9933bbbcf1595e396cde889c69e12a8a65c3b539b7b2a7540b68abf4837df1ef1357fb6719909b68e33ced9bf0ac6e9d39dd6de
-
Filesize
5.2MB
MD54fcd656112018a0955321691692cc436
SHA1d76db15d46741b1af80d78d90ce5a63a3eed7581
SHA256c9e47d81b417aa7986d440b049ab08ff6f9daa670c39c03f63f8867c8d386f98
SHA512cc47a5a33cbc418eb5c9c5135ba97331e02bdb22f4dc89cc1af1eb9034569655cc9abcb1812702c5f7258cc6d8a8d9c621e5c33e5c4729cf4e4de438e99efa6f
-
Filesize
5.2MB
MD51c9776ba3d4e7c82ac5434e64fe5cb95
SHA19a1af2e92806eec2243e11fdaa95d3afa6253948
SHA25645851e2d99ea62d1449e1d92e2c5ae154c8436aa33108fb73832dcd5057fa457
SHA51227c726393a6e66d4c0adc8447958c4d3d945a8ed17530e4deab34d2959e43fb6ce7e08a57ba7f8bb85b4059540fc9ff8a8351c8ed2a986c1c1e5ba6b67fb8f43
-
Filesize
5.2MB
MD546b85ac71ca724ac95ceb1a0d076d531
SHA1dd6eb074d02dfa71106ac623b503d33eb3d79f16
SHA256b7b7a86613950c85a8da1d3ca9bc51dee2b9fe50ad6a4fa7e535c6972a83ce38
SHA512b7324273dfdf3fe0d27ce4deeb8e62786ecc799b16803a5e6daa14c05deabde49ceb7e1abfd4f345d62b3150d71d2bca7f81f586961a7c944672090d108f6df0
-
Filesize
5.2MB
MD56cc4ca2bccdb7a3fd1886535aea29622
SHA1e2a94466a37915b8a74bf79b60dff39c86abf366
SHA256b9c7983a2b57ada093273debf844b706c9e7fa50b03ebee3490387eb63663999
SHA51274ec35081a10f5c69130b4dc551caa57ae8f8ce58cbff1e8cf5df0a52cf75e8893f878398b277cb66697339c9008d047e3b58f52b7203b80205ec9229b6cf58a
-
Filesize
5.2MB
MD5bd83f429921f431068fa7e773b43199e
SHA1165f73c7b3fc9d9732bdba97ec3c44b0669d70c8
SHA2566ac5448a8362e54e732f66d866f918389ce23747341f166c32a6db0cfa552f53
SHA5123c8736418944e1188f63d52ec0dd446281cd511907fec6b4c9a4e01dea1f6e9c02defc17297debdf0a405b1feeb53115b11ed77453f53e2c72430924dc137cfe
-
Filesize
5.2MB
MD548a8d4901fda2df8ff3c87954a83baa6
SHA10d881ee0d00fd03af0c5612347ae8aebb94fe5f5
SHA256f5763f77487a2e77e9d1fdf3eff50c75d6bda385f58e88c7a5d32cbb8104ebb8
SHA512c3a86191e3729a65e5ea5cc59992ba7dab524a1563273ba7957ef377a556b994b4bdc2c5e7fe600a148be7fb220e331502993c7c39af5de2d8968c6a1e26c60e
-
Filesize
5.2MB
MD5ae75378b15b0a3afedee21c10850081f
SHA1adb3c2da27ebddda532c20936fdacf7cd2138d56
SHA2568473c96b1b1f350bdde350e70c16f3cde223ae4aefeef49ba1cb88c5522762df
SHA5125f86086290bee361d882c0fac72b9cdf31d854c731dfa407cf0fbc156a85d655b63bb2a1a977bca050ab3801574d913f126fa75bf6e860d61bb66bed395d8cb8
-
Filesize
5.2MB
MD505854a2ff5cd3cddca62791cd351b25c
SHA1f03acf85e5a93876074cbc4b47213c68c040d742
SHA2565f2de3a25e3cd02f98aa14efb2de5b6ec6bd97b156cc3839fe1b353d6d27725f
SHA512493e822b8bae56f0e12ff109c7e1f3f6d753746dc0f6fe130e99ca660b4d72116f38069347927fa085a5aa5f978edc832bc286ba885a94f248c0ddb64f99bbe7
-
Filesize
5.2MB
MD50bf1e15a465b73211b986b0ff5837b53
SHA14c8a933d3c2d67763d5ba77b981144af7440746b
SHA25655b37a9fbbfb946fb21f2e6ee26213fe839072aabffcbd36b9a4af806b10a3eb
SHA512089e1f5ca30cdfb8e824390e15ed9d9d2b81e78d1275e31671ed3102f77bceaffcd7b9ae612f60a16c976a0c8d1b2d2443f54d3f40fa8c0287ac13d5fd8ce33a
-
Filesize
5.2MB
MD57dc0e8acce78ad0ac6c0fb7dd1322b3f
SHA1433656d21612912384b20211714bc532d872e0c0
SHA2560625dbfae264cd97e845b9a97e216b5f8c40642443520f4ac84ab92d399768c4
SHA512d8b418f2e25af93190e1d97dabccdd19d2d8c0f0c0a433d20085cc64a7e0384efc281c3757ca14793aec1121507bc04cb5e8d1bfab0b8283d7423f1780ffe085
-
Filesize
5.2MB
MD5f563eaf388de9f81c505c5a9f8af3a01
SHA175b1ffc4801e98959cbab94868ae116e54590aef
SHA256fa2fccdae735256a24cc550b28e2603cd2dc7e8a80befb150de5ea8b5ee6296a
SHA51224b59661f426363e74671ef4a513cea34e3505fe788bed6a9b53aa08d3e4a927ee71e8f6d0960e41b8fb12bb525f8476b2f87ccc4172d07e8b6e6e55cf5fea54
-
Filesize
5.2MB
MD56e4b76ad50fb7173e69b4fa4075256d7
SHA1ff2629f792afaddad3aad9087e6ebec8e5942973
SHA2569ffa1523a9a01be1b34cdb60c35ce46c5d0240364e001ea864822859afb94149
SHA51210b7282758064274a3e3f063edb0b301c8b549ac5b3f16ff369c56dc8c4eb2cf9f7f0467650127811147491c8bea6f73059431d82b4da0efac839eb627adfd13
-
Filesize
5.2MB
MD5976157e482283d5623190adffc7e5ba5
SHA14dfe110cc43a81164c0935829f01aa9a0527ee5a
SHA2563c52b0cf89ed657dcfbb053900090665d19af3f55d7933f81b8cea5b22ecaabd
SHA51240156bdd2855fa11a03acaffb90a088c2dd02bfef43a170477f2499556680cfd3dcbea0a8ee62a0d9518106d446ed60dc09653782bed93ce7b9ae5e352fe6a0f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB