Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21/01/2025, 02:11
General
-
Target
2025-01-21_336d868ed5acc6b0421157ee0fd5d372_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
336d868ed5acc6b0421157ee0fd5d372
-
SHA1
21b5818537af00d948c7abb03109959fd732c24d
-
SHA256
e7c9461dbf00522e262dbf5e5ad7e9bd8b1cffc20123436c76be2226bb46a57d
-
SHA512
41c56474008ba358d0c7e86000d52aa600133ca61751aea1586993a9d845d2a5e0642eca03429b18272d0a358d5a16d20ee177b1d956da90c8e6c56b65ffac69
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUL
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_336d868ed5acc6b0421157ee0fd5d372_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_336d868ed5acc6b0421157ee0fd5d372_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RvVCbJB.exeC:\Windows\System\RvVCbJB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tToIZrD.exeC:\Windows\System\tToIZrD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RIavlOq.exeC:\Windows\System\RIavlOq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vGZRdqg.exeC:\Windows\System\vGZRdqg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MwYTmiI.exeC:\Windows\System\MwYTmiI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\spQPdxr.exeC:\Windows\System\spQPdxr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eGnnyqh.exeC:\Windows\System\eGnnyqh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vVgrvdD.exeC:\Windows\System\vVgrvdD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zSMvrxQ.exeC:\Windows\System\zSMvrxQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PJwQjpN.exeC:\Windows\System\PJwQjpN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qMJTljd.exeC:\Windows\System\qMJTljd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oYAiCGA.exeC:\Windows\System\oYAiCGA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wUgePOk.exeC:\Windows\System\wUgePOk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VhGtBdb.exeC:\Windows\System\VhGtBdb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QFJSTuh.exeC:\Windows\System\QFJSTuh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IZzaLFZ.exeC:\Windows\System\IZzaLFZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mvcKYfm.exeC:\Windows\System\mvcKYfm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gqNOOFm.exeC:\Windows\System\gqNOOFm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HkAmvkb.exeC:\Windows\System\HkAmvkb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zvorEPP.exeC:\Windows\System\zvorEPP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wgqOduu.exeC:\Windows\System\wgqOduu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ed2f4ff5b35b357dfc6cf57e99e3c27d
SHA19b28b8037f3902e44d7ce22c99a2c41a4c9ee3a3
SHA2565557c917b2ae4be4a13fd1f8007efad27cf300de0869108a56016e3ad51b4047
SHA512d8e118c2ca20d780a317c134f2ebb6664b471babca6c6d99c3eff2ab9f54e05c1b95cea8e2619d9a27dfb5944177090641b5d0e2f99003219b4654c25a68e28d
-
Filesize
5.2MB
MD57484167815113190ffd5d2051f81e4cc
SHA1ab1af685059b1dc7600ade86f487d971bbc4eab1
SHA2562a3932857a9866711e33a74b1e2eabf7c0d0444c9021c1f3e9b6d2ee8e2a7424
SHA512ec4e34fc64709980e895fa7baddcbbfae572258a1b7602ab0c37afd9b1130b1c64acea30e2dacc2270f7151dae06495a43ebb106229d2b7ee321f37003411ed4
-
Filesize
5.2MB
MD52c2370bafa40229c55026881667ed800
SHA1998f000db73a6cbe44429563e94208ce79cc9176
SHA2561bc65029a8c4967b9732bcc060ebc2ce4ed4d03fe4cef4ee610a16bceb0ba0fd
SHA512c559b80c1b430e8542548a96d7e2bdef5de051a39d7b9acff6246189f1e709fe956a37547ef9aac5db2669f9379b71a7bc2c8f0459783bb1637cf5cd9ede50cc
-
Filesize
5.2MB
MD56176e9f2b0fda8d0948ae5082dc29b82
SHA14d426f6f819daaaf70032f9c4dda803838624b70
SHA256fc62110e8582fe11bfcacd5fc6cc41f587f932cdb803675614a1e0175b891bb6
SHA512bb7169d5e7faccfada76622ce7d7c3f9255b3c059deb89a97cdeb5974a5a0e151b9d44fe69e970874bbf2b9d8b65f80a798331e4e4c329ef6fa05b8bdf854d62
-
Filesize
5.2MB
MD57487f23390f35cd3c62464b21a8bc110
SHA122f959d8831774eb17dccf91f13ed775e9228ba0
SHA256633e56cff159580068486121dc8af7204e3579c7a2ed92a90dcba12fed5f74ff
SHA512a165bb44ee1eb28334bb472d86c80116b658e2a51ae2bea1064ac68f4aea11851dbbafaa491f213e31f0fd877ae63274598ecbfdd3b25fcd79f69c2b4d2f7719
-
Filesize
5.2MB
MD56dfd153f62da3b1cc72447446596fa4e
SHA1ece0e6d2b4b70a9f9ba264ec5796eb984db754b1
SHA256aa4914a2da135464da235684f65a2d6d4febd91b3f5f0b844b3c3f5e33726e8c
SHA512f89f41133d03307878e3076220706571af55b61aaedeb20f37fd16da0bf1eac4ef5bc44ffd1fec22efff73072e4af0f7ee65508e94df4c2b20e1ca88ae3ad44f
-
Filesize
5.2MB
MD5b99142be0ae7f113dfb136712eb0c884
SHA152138f130cc6fc1b6c40d4b58fc5b004bb1e94dc
SHA25671082d82fa3230ec6846a29794ab0354b2e7d7ecbbd37210f4d55d3b0df0457e
SHA5120d271110bf62d8c7bccb4d7646705e4bac3dbb4cba8e4a15ff00628e682d4aa88d98f86f71b8baa9ec540b4b49a485653a1032312b8fc84ded60793a19d1ae90
-
Filesize
5.2MB
MD56a400dbdf5f271519173df26ac565e9b
SHA1f45fdb97f0ad603c7eb044de9e4e44038b23ea21
SHA2564d6cf9182ce7ba50870e6298762171ddf61a931e82397e3f3a16513553feb140
SHA512de911440e0ec1bfef0af5ff09b0dbcc3c9a93a1b7ce5ed11bef6a5d3e0bdfca7411787965289532f287617de78544cd9d950dd57ee3b70b97a150fba628cd405
-
Filesize
5.2MB
MD5b55290a7b1545e4cb56ea860398fc21c
SHA1b42d0b4d7f04dc609c06a33f4a5f5590ddc1fe9d
SHA256cecd36febb8f89c74c8ed969c5501a11ad5502616a5e7e15ecb09986f86400df
SHA5121ba0acfebf73b045abe33700386ae2c4739c9b6edd1e7e666d912f611431ba6634d66a9cc2b93663d350b2bb669b14af4f0014f4f63223d8e9b91cb47405a7ac
-
Filesize
5.2MB
MD501b3ee2834512ab88fe081f9b72aa0e1
SHA10e034703d335b2237f3a6d9233521189f044fe31
SHA256f359e7c5daa3b9abba26735ad56374225c6e90e42debab29dab38534ff94e149
SHA5120dc81ed40edb98c8305ee01580276fb82539c974ea9f2a9d607688bcfd2bce7356cd41970048188b3ab6ddec4c10249f1f5596d025eab7cb9a8b54ae103abbd5
-
Filesize
5.2MB
MD59fc36c48548e292ae6652daa60f08039
SHA12a340fff3fa43f87d65fbd94829261539b335969
SHA256c0c5d013f7fd08a29b6a4a53dcee5ec0f629d31991891c5439502423620dd4d2
SHA5128322c368d644877b09140ff8b2ebde3cc5031e43ac85ccae4e3971e506e19cd69704a8c9a6dcffb5255f086e9daf1c79b19685572cdaea6ffb0d19dcaedde715
-
Filesize
5.2MB
MD53474a090f1c38cd76af0904fd4b4fcbc
SHA13b77ff19e28714678f701a88d20142e2b45eb9c8
SHA256f70be1005026a26e35d8119c117f0a055d93e725cdb1eb3c63cb9f716d77a1ca
SHA51266ab633075f4ba7881849a310cab8fd9a0b8ffc0f8e98b4e471a1e54624184373e84cde9f0ed6022872d1a994b4962099a93d1a9bad59d43fd03123858ed1188
-
Filesize
5.2MB
MD59b2b7b5d0629bcedcf5e6957b7b73dcf
SHA1b6c276dbc019a5a0917c2dd93ff7a72832ef683c
SHA256f09cb501c47b889497fd8c9119026e4c1ea1e5c6c0683ceadcfb601c37efb56a
SHA512b1964e647c382200999a7da2fa3d1087d5c9f33e453f098af892c88dc5fa98daf046d90161fbd316f36811c60ae46dc93c5de29622105c57b8f187c161717c8e
-
Filesize
5.2MB
MD562266dbe64aae9c3f86098321d44e9bf
SHA17b2382f0d5aab0a14cbf364ff87704f4ecd298c0
SHA256adff356966ba19539fe304f49e6f15d95fcbd575ac1e9eb4d575ee242f727129
SHA512083890326fbce16039ae0fa8eb6733406bfa8866db58ff622688c9e2baa1ffcc22a17b6001a9aacfb53234b3998d7f83b37001c8277ed8bf8d6e6c1459de2648
-
Filesize
5.2MB
MD5e847ab3f8f0bfc7a0fb4126a6e43871f
SHA1e926ce93a3c7cabe09e70a41909c39c931cdf3db
SHA256ed256f25efb89b02583d6b41f8c629af4ab678f1c37eb9a6510b6062817158c3
SHA5125e36ae9dce866422bdf471a03c93db8d860ae1da8f77e968b1f37cc2e6fc032fd8d11e1a8833ded5bb8a19a5d9c5ab272067a0d1c4251070f85d0bd7e340e731
-
Filesize
5.2MB
MD5651835023656846219b75d6d35f7b1a3
SHA1a4a973d40e0c626af5dd11c13513eaf49e55bae4
SHA25672c848d2a157af164294ed9a870b116038cf1f62bf23359cedd6ee4a1b0bc81f
SHA512fbabd8bad6479737651c0ecb779141c124e6a1b32dbe9185ac21092db72ca6a2e39284934172babddecd5474c12bec4edf9c50389752c57d2ce3fb7f4187f49f
-
Filesize
5.2MB
MD50e196db7ddf5022a6ffaa4ac48f44f18
SHA13243f213d97b71b27d6761a6343996b355d0a982
SHA256e529e8701436d3c87e9bc65b94f47438f01b110a1fee085c71329299ab21b9b0
SHA512671a22ffafec506ecf9a9c25431a773f2ed6b49dddd6645c55212cbd1c3f0619034df473923e33e3403aeefd5e45939974a56622333a4a159673ed380c45c7c0
-
Filesize
5.2MB
MD580460694427f8f40f78b6806c4f73b5e
SHA1da932789e7300dcd5f98fa2d95a708d03c397f5f
SHA2566ecb50ce10d40b8f59b3464c709fbd2f0f8cb7ca28b27ccd885cdf7ca7c18cb5
SHA512a4c468a798f362bac077c529956b91395bc861fb0ff30e9bfac7ef9961129352494442ea4990d3252b8ad742ddbe008d066cf49fa94008c56cf43d3051cf079a
-
Filesize
5.2MB
MD524021ddb9d98ba44a6064871224d9f21
SHA1498daa98aa21ae13601233d93fd3e52ae9f2c64a
SHA256e4ebd861a81bcea01fd586ac14225681074699b9664d4efb21c413dd2022f0c7
SHA51235cb1d2649120c004cf998a461868df6db6dc04f9f41bedded176755c1a6343af9f0e77981c1341381f3b68949fcb90ff855e2ef7b284875bc831493e3e28899
-
Filesize
5.2MB
MD598c925eeeda3c220c93d051cb0b62c54
SHA1cef60c97bf58214f291d4f46e3b8ef8f180f0afb
SHA256cf99b6ea6ad9e99516f1e0feae818f8cbb5411119bcb33a940a879ab7044c922
SHA512b1db0688d9e0217e664067ea1b391393e12f9b1d11fa6218520d21f4a354b36c5a55e7c77ede4a9729fd0ac642f34d62735823709271545984406f4af2e185af
-
Filesize
5.2MB
MD55b04555257ced6f2b871edcf48b2ccd9
SHA1279aeaa14c31d4ee024aeabe00e494dbd8613ff3
SHA256a9a88f8f91923829b0c4b2cf8d9c0ec7d27ffe1a81c7d24d81a3b8ea0222bcf2
SHA5123def859bc051503f1de204a836d8ccda343fd39a10ee5c53400f49d2f9305d415bff49f11dcf53a56258c23295462269113fd6af2c6c0c53d998abbf892546eb
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB