Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/01/2025, 02:11
General
-
Target
2025-01-21_336d868ed5acc6b0421157ee0fd5d372_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
336d868ed5acc6b0421157ee0fd5d372
-
SHA1
21b5818537af00d948c7abb03109959fd732c24d
-
SHA256
e7c9461dbf00522e262dbf5e5ad7e9bd8b1cffc20123436c76be2226bb46a57d
-
SHA512
41c56474008ba358d0c7e86000d52aa600133ca61751aea1586993a9d845d2a5e0642eca03429b18272d0a358d5a16d20ee177b1d956da90c8e6c56b65ffac69
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUL
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_336d868ed5acc6b0421157ee0fd5d372_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_336d868ed5acc6b0421157ee0fd5d372_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HywEfhf.exeC:\Windows\System\HywEfhf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sSHAKyk.exeC:\Windows\System\sSHAKyk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YhoGmbh.exeC:\Windows\System\YhoGmbh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NygdaDQ.exeC:\Windows\System\NygdaDQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QLhiauQ.exeC:\Windows\System\QLhiauQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lxczfBz.exeC:\Windows\System\lxczfBz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\APwqelW.exeC:\Windows\System\APwqelW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rsQvwHi.exeC:\Windows\System\rsQvwHi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BVdtrnL.exeC:\Windows\System\BVdtrnL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XZEiQdm.exeC:\Windows\System\XZEiQdm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TVRNQOs.exeC:\Windows\System\TVRNQOs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wGNTDPs.exeC:\Windows\System\wGNTDPs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lDcmzpS.exeC:\Windows\System\lDcmzpS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wJiFjnU.exeC:\Windows\System\wJiFjnU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bVChRKu.exeC:\Windows\System\bVChRKu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZypOiLZ.exeC:\Windows\System\ZypOiLZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\otvBDLo.exeC:\Windows\System\otvBDLo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\othHpqM.exeC:\Windows\System\othHpqM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AvIIPgT.exeC:\Windows\System\AvIIPgT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NiqFWZA.exeC:\Windows\System\NiqFWZA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OATFONw.exeC:\Windows\System\OATFONw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5bfc8bd195288ec4aeb02985afe4b12ca
SHA1d694e87c5dddc3d09dd78ecda63e6a2c2e5eb818
SHA256b2c824f91ba616b3ed48fb00bbe476755ec360a7339ab42b5bea2325d073170f
SHA512cbea555b37319ca4bdec5434e0ce33c038b4122c6ed8a60c8185675630c108fd2aeca5bd2835d7006cfd19cb20c768fb7da8b61b0586c94bfbbc435efb45540a
-
Filesize
5.2MB
MD50a8823a08013534814bdc5f1021db587
SHA13b49dff82f91d59e1359890deeb6accde2edefd0
SHA256b24283c5b284d4aefdeffea7f9b511d032c7b65099422cf84fadd5d7008fe782
SHA5121f12cae24c3a084a7548355df116dbfd5e5832d8f96b906eaa000d4fe178cbbf0d9573c9095934584a8240066836b9904c0fdf71e6441b739770eb8fd9680dea
-
Filesize
5.2MB
MD5dc3cb6e72e562bc02596cd5110403c48
SHA1b8f866b89a194d97fd895d47e85aaf9e26eb719f
SHA2563f03eb48f27ae36a4ea0e27bb75b18d038ffe2d4c5eb2fe76b983d0442d14277
SHA51227860ffa4adecc09112c8c1b852a0bd083ddfd961b32b15ae9943041eca6f26383b40b2978d47c68e63f35bf8d2c8f493b402e643eb7b45bb3d63dc576ca5190
-
Filesize
5.2MB
MD5a04980bc140fa477da43abf0820e4cce
SHA104f28e1573f007fa131e985b269c0af98149e1de
SHA2564c7a29c18da533cb67071726bf8c0026a9287837103771929779f84f38f1a7ca
SHA512604178840fb836315b566812fa2a74b896b880049b7487ff9966567f2fa1331cb3a76fe0f5c6ef576a695a2a81d47d00d4174452d1a914e9fb3423486a4f141c
-
Filesize
5.2MB
MD54aeca4c5e6f99c82f046ec3c9b469341
SHA1142cbd5f3f4ffc98ddcf8315250fa8d3b6a44525
SHA25667da4ad2042cc2e7fe4214bcdae952e75629d2eda2166333152254d6a5da7a1b
SHA512ff9ad82b662743f176f24d83e0393d9c81a1fa9352257779688e0f3e6f2c35d9ffd9ebc7e0d3b46224f74e56635951874872c00c23bb8fcd1ae7d6d0f3e11012
-
Filesize
5.2MB
MD5af3182631b6087c0a406043ee530e748
SHA11e8a3188609b47c608abf122bbed7cec949ec664
SHA256839f80a2c6507fe1ede4fd672f5a0305129223f96a43fd76c8f848f86f7e8d4d
SHA512a4bbcbb31c5caf13c1d133d54dcea4b735f10a7004c1e1ca2185fe159d1541291fbcd32cca3dbdff20d8083dbea0e2bc51fb9bda2366d8a7456f8af50dc0b99e
-
Filesize
5.2MB
MD5f84b23f285daee06bc41cb6e0f7fa029
SHA1bb0d3b986e4aef79b47fc03826400c77ee7cf368
SHA2567a6d3c157c3f3fba025532941c66952c614c0f2e52347f2ae5ad67dabb80eb9c
SHA512ef2e973b6fc8b1d697dd33f1d6ed910630eab270e22174025064af5e8679c4d2a33955970acc123216aef5817f636201a39366750d8a2b4bbc40f02074581620
-
Filesize
5.2MB
MD5b35073b81dd773f3fec7b09cb00d55cc
SHA14f428e441bbd47cbe981f3a13530fa313f64e6bf
SHA256e4cbf9dfaf3ef69ee4669ee16307ba813458b4c6e91039ea390d87955eb46d3d
SHA512ecc376300620f7f1c1ccc58d1712961e053e0254184292e6413c7ba24e65b7bf575963ad2ecefe54fa4abb4794c07350e71414af3cc5f2a37fb70ac70caaeb01
-
Filesize
5.2MB
MD5ef986c790ad14f22f2eb1e27ff597550
SHA19da1adf612d880f4646224078cb8cacf00530bef
SHA2563b023fa137c5d25dc621f82b02043b09b50cf6d29c391b8ff8a7c2b9540f4db3
SHA512c1e06b945b73c50ef32ff8546dca51e6f95622c4d63e3036f15525f7ff21dbebbe57c1649eaf799ee9b5bef9dfe9be512e13454c07baae2d5b257f20f884727e
-
Filesize
5.2MB
MD5bc5f638af681fa9c06de75004221943f
SHA16138d8ead862e949ea782af4624b4dda8faaa91c
SHA256188873a2a1f87e2e3f25b5ad8fd46602dbec94544a2bd5e8abf63e22a9a8bd60
SHA512504481b669d46408f6f090d96a0252449f105ad291b1a5c3baef0a30457fcd83f98590326791afc2054d77500a79fae5642939c378f5f3e36f1e11ddba62e605
-
Filesize
5.2MB
MD584a657b1f5412eb663388440d084c5ab
SHA10a812dd5870437138c910d192c498bf722329f6f
SHA25631b922cdedcbf826c8a67a7e856c278939c82e4eb6acde2902e798f38d01485b
SHA512978f90cdcc99c6dca0aa1b5c5e4c21f930262ae2c418db057489876ea672cc86cee315ef6875a8fb26c130700a5ea9d1862418b7a6c0c88a29d59440fb88b079
-
Filesize
5.2MB
MD53b2e3e6771f38c4dcc208cd0ecf404da
SHA130216766d62299632273632def4137e53e016b18
SHA25628b7b7f7989f33d90c4405a40a3d67adf1abe2be12935a1a9f2fb0026eaea74b
SHA512b43101212d8cee67d88b1e44dc9dc194393340d003e61e708c196a9234769f2c68071c2f7c1d7cce89c075eec928a6aa8300fbc54d57eaaccbbfc14a6b6e9e46
-
Filesize
5.2MB
MD5ed199bb59ed8da7476827287e05acff9
SHA1b109e9e5497beaf2f026b7147400af23e344f44a
SHA256b73b132b9ec4ea82d0ef99c30280200b76d35d59728ad59fd05589bb485d5c3d
SHA51245ea0e888622b28a3056d0298f13bc8b09948dee1cbdf46d297df41e504f5a425fb2df28cecf9cd88bbbbacf68060734f358e3879801703d9464fe20e8d22427
-
Filesize
5.2MB
MD52b111ae1dce9d58d3a0801392b81d1ed
SHA19609e80b1c324ecd4afb1e10038f3cb9adec1240
SHA25616d25208c95f59b8b6856a4b12e740e0a6e79de8b4c05f307e607a00c863baa1
SHA51225cd95ddde5e3ea05e4675f2c9a40d75094cf2a325ad4f199e2b0cd1fe0e3572e3a41579c3adc434c46addd98c79307c6f4b14d1b28578ed25162e8a349ac132
-
Filesize
5.2MB
MD5bf8add78e5a7d8ab021c3d5456932a0b
SHA197542a0d7398764b05c08ffb077b4aef87528cc0
SHA25677ca5434aced58fefa24643431c4873c9f77e5fe7a97acc1335583cb21772479
SHA5120aead04750bcd3d672ef54eba1b3a01f5c4148f57635c5ff3c7f73b29f94e7bf7a76b65b6a43625d16a032e2aff38b33f795d6757582bdc0f7b736f3eb7e6556
-
Filesize
5.2MB
MD5016993d49bebb12124ed8cfbc694dc01
SHA14350f72567aa430805b543a4cfe89908b629a864
SHA256c0bb71bcd81ab536667bec4f3ed98128ccde52951732bab7f9a7693736c353d5
SHA512cc6609a7de0bd58dcf5e9a39c890870883a2939b4238258bdb5aa262bc95f88802f07d00a65c3af48ab193da71b41913ebc7e025ad34a1c698ed479803e53d60
-
Filesize
5.2MB
MD52c7a5baa7ba94e0172f75892bff1541f
SHA11d1cc83a375d95ce8eaabd8fdd401f5827c48206
SHA2562da81ba510ee6fdf50e2beded8514a05cf798368539ea410a1f06eded3e50c41
SHA51270606f793bd84032b9ae6edee33fe96f3361d4d10e2543dd37b685a369a9892d041e4bd238311f6d558d54dc67707d6265b00c2123091c22aa3a6fe964beff23
-
Filesize
5.2MB
MD5ef36742f7b7842b3ea37ff1b378f985a
SHA1884a816a93152bc8f080060d42b8ba37d3fde2d6
SHA25633dfe985b4da0965e4ae6857e04c87f602f3ea99f6fe06d1451dec0f82802d87
SHA512dc1fc2b8e6f108c9d2ff38755fae7dd1acb527f5daf5bbdff1dab0dced18f3fe9d00e25be3432e0ef61d03bf35a264f3d4c6bde10ca09f5cb54b76a9173f15ef
-
Filesize
5.2MB
MD5a0f1e24d77d44ae0f92e984d3312b988
SHA19db38456618500a528c7d28549109ad92a1fd3c6
SHA2567fafbe5f321b9e615897f89b6ca68a684eb0764a5995a12a73f4a2a73ad9c039
SHA512a71c816f975904a619b6d7246f3b99e2adf598b9718457ded0905d1aa03fa637ebb77001cf742139a8c2d5907ecefec5e62dfd9d780fc88f2c201945dda40731
-
Filesize
5.2MB
MD5c5f384ccd0724200f4289048e96659fd
SHA1e130737f915af1943131ae449ba59bbf7d9645e3
SHA256cdd175a0cd06033e687d9448e7b99e7935a2ffec0950602d266ff694dd59560f
SHA5125cd7873dbca00d006fe6faf8a7b2b43e7227092b411c74493f557093c6114e1ddd4d924a16588bbdd26714477c2e26ccb31988b80aa9d69a3b3f21718eeab94a
-
Filesize
5.2MB
MD5e0111d5817253bda938ea0ec53df8b99
SHA16c11125c6d334a370a628afa64d59ebacffc67ba
SHA2562168337183b702f8a553bf4beca84040a3f4803a147b134308b42ba2b7c9a1fa
SHA51277682eb4634221fe13e19751254dadd88f53dd7e66f8a2d5aa9de8fccd05c968c0a0bc6143cf6b03b6d10eb578bdb445a11c7975fb1e94162629b86c5a34fbf6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB