Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/01/2025, 02:13
General
-
Target
2025-01-21_574b0618b2a739acaebddc226778e7b5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
574b0618b2a739acaebddc226778e7b5
-
SHA1
12322fa6b9d9966c7e1a406764e6e75f0c992720
-
SHA256
6f14d3c5e6ea26fe6945846a91afe1624552aafe9c146350b437ec3a0cc40e85
-
SHA512
0cb952eea7875523a6df86d1a9fcfae528e42c1c4f7cde20fed8ee65232e8d27bd2758e4514cb2d9a988b037af7c7d31b30caaba6a1dafe4cb141df02dc21735
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibf56utgpPFotBER/mQ32lU2
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_574b0618b2a739acaebddc226778e7b5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_574b0618b2a739acaebddc226778e7b5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wKTdxIM.exeC:\Windows\System\wKTdxIM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gmnJJCp.exeC:\Windows\System\gmnJJCp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YpjxXyL.exeC:\Windows\System\YpjxXyL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xhabdnz.exeC:\Windows\System\xhabdnz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UbhKYHp.exeC:\Windows\System\UbhKYHp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gquAAce.exeC:\Windows\System\gquAAce.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IEMdVBe.exeC:\Windows\System\IEMdVBe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DmDRxop.exeC:\Windows\System\DmDRxop.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mZGUltX.exeC:\Windows\System\mZGUltX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yfFovlz.exeC:\Windows\System\yfFovlz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nxhwwaC.exeC:\Windows\System\nxhwwaC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tBCFQkF.exeC:\Windows\System\tBCFQkF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cfklSWG.exeC:\Windows\System\cfklSWG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IzGlAjG.exeC:\Windows\System\IzGlAjG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NnqgSsk.exeC:\Windows\System\NnqgSsk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OVdgAoS.exeC:\Windows\System\OVdgAoS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HZBWOTh.exeC:\Windows\System\HZBWOTh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TLMTJFz.exeC:\Windows\System\TLMTJFz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GoMmUev.exeC:\Windows\System\GoMmUev.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CscXuHM.exeC:\Windows\System\CscXuHM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XVobtjz.exeC:\Windows\System\XVobtjz.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5df5ab90e1d674fa5f9f9b91a7708a31b
SHA1983e90b48b221dcf3780fb65e7c31bfb205906bb
SHA25690456626cbc483aa1d639383ee874af00e71fac0fb846eec5a72ff512f7da02b
SHA5129ce50fc1b0ac4fc4e828c2288c2240e1c652c262a6bd6d2322032da79642cdc3646d71f3b461b030ff54de20e27a75fa3429f4798a33b9c3e32b94873d3323a5
-
Filesize
5.2MB
MD528c8a4424519ae8d27490665f4243af4
SHA1a9825a43f737cbf34a97b31203be986c81c82c83
SHA25619a12b862e5cc257571b9ba20a6619f81899b28af53fd4ac13be81431e793085
SHA5121405f33a303af28053954b119de3dc81039e8d3e17d1fde204cab9ef2a59bd243318b157d2a1c570e7df9287f36f2a43212f24aedc2339184ab7c154164a2cba
-
Filesize
5.2MB
MD5ea12e60b1564e5e63342bf6fc5c4df87
SHA1a10b2ef1a614fadb159ac72999094517977704f6
SHA2564ee0db635902442afab715da42cefe74499726371c50d510f3dc471bc3388910
SHA5125ea42ca4ca48de076046be9018fffa4f71f6fc0ce908c82d8ac31a900064bf1fc66fb31ea6b77769bddbd6dad56f52fb4816ec815ea568874a70f4a349540b05
-
Filesize
5.2MB
MD5a10730416512e3eade69c9e2c1fa6b76
SHA1db9e211ca411b0e4073add36dc34905e43546029
SHA256fe3a06f5aec3c9e9c63f9401b020ae85ad4fbe8ac45612f606e7207a219a3bee
SHA51292d60cfb4c71010f3809c5f1c1f04abf7a8a11bebed8c2b965f746e0fd376210bf044c790ec7a7c639f321cfd44f08f3a26b04a3a92c09257acdbf7896aa856a
-
Filesize
5.2MB
MD5565e4cbb99a93884f8287b9669849589
SHA1611c81ac33946db35fbb59997c3a18abddff930c
SHA2569a67298cf29f99dc65adb6790c8f1f7f64c53300db552533427a2c822ec9742d
SHA5124d2d808a1d689f689719476b1f3d5d0db4fe8057860c750ebcc6db2f67ac55cb76f0ee74c883132051922e8a7f67f460e089efeb665f701a86966f2e8eb8871d
-
Filesize
5.2MB
MD515c577d238a1eeee19e831da9b11b0ad
SHA12b79dbba78ad80c29e1e9cd48e2d8e08688e7dcd
SHA256e1aa06c1df30f5ae0d12e096efb88f4339265fdf5c58764fcc3dcd2494a75d3c
SHA512b90029f600ee4df23a89afc34e5e62a6981a5e16c57080a479e716e574133cf1814ed5e859f2f69b9a05df2a4190618fdf2d04c66bb815fbb95c32718c08ef8c
-
Filesize
5.2MB
MD5092081a64cebdc55638056566e294a17
SHA1ec13594c4242da453c2e73f5e04b1e4120733d81
SHA2564650524d0320ed846218d9380f9b2fee99c85712cfed06adf15d16cbd3194dca
SHA51203471e40932406c7f4e92853b97f791692c1e7baeae54546fa4c70e9d6d9e1c584a4486a056558a31ecc317e27b27f27d15e6032e72f56e69248574e0a118e9d
-
Filesize
5.2MB
MD5efd96e03c36a3835dad23a028d0307e9
SHA131c3be8068fddf15a20b4ebe78688e45a69f9bc5
SHA25609a78f2f60d729a50050173aedf3116648061bed964d0fe198081aee98d7b8e0
SHA5120971dd468bb8a20ff177c658f1b3426680066bfb69a4613b3256ea091bfa4c4784fcde362aeeb6462f94cbb1e303e0d98194851e76e863c27b2b45ab54199d2a
-
Filesize
5.2MB
MD567662befbcf959736722c3c2eb0a5aa1
SHA1357342f9266b98fc2dd2ca51574b011845c7f028
SHA256fe9d7d1e00d6f765994cd68fd044333e6956638900e80f8502406787a0f80ea4
SHA512ec6b77882e97d8100f9d67d8f9471a907cdb8ebc9be06e7755fc8a07c530bf26d55b96f77cc2210e9458b69590f454bafe03c13b76d7bb9316a19043b21616d4
-
Filesize
5.2MB
MD52a5e3756613aed81c6ac78bb3d86e75d
SHA1d437dfac59d4d2dfe203cebd990eaf57fada7fbf
SHA256596c25d547538e796078806a927a60e2196c895542e5bf31ce3eee5812c654da
SHA5127a91a3133a76680957fcea39a69b7cb7273aa21dbcd45d521fd06c0ef82f977caeb01c08dd956a9e3f7bb5c6e1e083556f253657e6eacfb572741ee79578b7f3
-
Filesize
5.2MB
MD520bca607d13d3d8aa4dc6b5a10346d4f
SHA1b73f03d48621d518d9f38d18a14bbe5e7e3a3cfe
SHA256e92f90b349cbc1dd799ebeb11539253b7d9aeabfc02fb70ea4eb6d9ed4adf18c
SHA5121e5fbf53859038553fcda1c00103d6bde698cfaf9a629f468e6b0f39fdef5e82d2e7ce57827163f0852d20631b653a940eb0bf95e6ec1195b8b79d7c138389e0
-
Filesize
5.2MB
MD50200d4a4ed5537ea8f82adb4f2c25653
SHA123140f8703155ebac6abea0fd93dcd8198108152
SHA256e0314d3b1f97089859aedced803985c332153426ac37df41ae34c8864be7a523
SHA512100828421cd4ff703a7fb1a27964a24ddf816bc9130fe53349bb0961df478397255829e4041918c2651693e4efaab24f32395eb4be49f8aae4a6b5b33c3d7771
-
Filesize
5.2MB
MD5b18a396a9686404e233ca11e85270990
SHA1230d3763e0a2097833061d0b953fd9c2153f3bfc
SHA2567fbd02d2700d8d2ffa8a59cbe313cf58cb57f07ba4152ec4d659cdb202ac92b4
SHA51243c543407bb0de053357e229c51095c94dc3313aac9c3c359101f31cab6d182c6e30ec9e3a591a2f1ce3b279c30f5f533694d73a26bb2b6c30573a04b172fa87
-
Filesize
5.2MB
MD5a42ab4cc5071bb1d9df61d7e77394fc6
SHA162567d1d9fd360d252ba176521e7a6956c4b92b3
SHA256e19f195036fe6a19ddc924d2e21999fc48b6c871ba85e5f37a112bc9d598ee53
SHA512bfc7f1403e4c79abe36fc9169285f2f17f509703b4a0af378a01f13058717a1edd3214de8fe9480cd31b8cd5ddd9d94d975688957b333425105b4f9b6cd6dfbc
-
Filesize
5.2MB
MD5425c042cd1e3f761c2aa093bfb8c6e04
SHA16c3ef545e70e6267c66988db7fae917e211e9387
SHA256312bb0f47409029b42457dc0127341df237b2daabada23859b07a74b59fb4981
SHA5129ad9a49d6028611d7e26ba5a59f94af0b97bb3779da468f1eeeea2d85804f3357c43f7119ac57cb2e5db7c2d6fed96b91c7de4baef8946c68938261bb61ce67a
-
Filesize
5.2MB
MD5d13f9cbd757cbe8fe11ff730194706b1
SHA13e31458ae76e682edabae0bfbbdd3c11f7ed9fb8
SHA256bb25e1b66846c877b4e095574df7adb19c6c77ff3a3de0d4d2ecb1de1ac36210
SHA512636d71bd393f490c12015f929f42f3b43036ece6578451d09b0bd4d8ec4865584a45901a0f2a495d9a666d85623fbae2876edbb2ad5efb985a04825b4c6bbf43
-
Filesize
5.2MB
MD5d9ba2f7fe0c5171c9ed22bd1ee90af4a
SHA116e25aaca423c1adcc7d806530a6c1cb5f7de85f
SHA256498e8fd97a1f70dfb1e8b2e0e060f62ef8c3678919677789b451d43449ac0aad
SHA512c466ed7e3d343db86a6c0dec20a1e1d1e32f574fc1f40efbe0ae1e6425a4425c6adec3f4bdf7eadb8eb09ae85f73b3538bcc6e81b87f1c6573f9157dd270b510
-
Filesize
5.2MB
MD50cc6a549f29d7dca862bb3941287585c
SHA1c6b6c24ae7f3360d267695e604fdb02b2cc43eef
SHA256cc029638a70875d669e7b954fd4105b991ce9d5fe9f72ca569966e02451efa2c
SHA512158340f71d5fb8bc589c490f19f964c760c72583e4e972164158ea004829df9425a3f798c9b2728950df15a68e70cceed4573be2ee9b5ee6d17a6a6833ef94e9
-
Filesize
5.2MB
MD54bac1da81295621fbbdb97fb158a105f
SHA1d6b346717ac944464dc31c67f72023e998cc2767
SHA256ce4f6dae83824d217e4e6653e139c73cf71a183c09240ab4a3aaea52ea2f40a9
SHA512c08b214771e0fdf4988999245c427a78b054a71cfb40e3cd870769e0bc887719f7ec8f0abcea11710a969df4906463efce2e3ec3b09ad964d1621eb84715dc7f
-
Filesize
5.2MB
MD5bf167ef945614642fcf5a9bf4dbe05f9
SHA19bf7b835a107a2f7df462afd09d9379c324c3bbd
SHA256ea9effec2ac5c2e6e3e6a5685af70335c57f250f0f926357ddc3f1fc2f1b2f89
SHA512bf2b7bc097450b60b0973656cec6a731d2d4f5e4cc4cb9842bce48559676448f1213580e5461721b020b8bc5bde2e47ebc5d55805c193d13f586e1689d8a4a9e
-
Filesize
5.2MB
MD589e7a066dbf38ebff4bad2d3539f866b
SHA1625f32bd5be3e51983511869ecefef068080daea
SHA25661c7790ebb74a6eac70538f3da56281384200e7a825f6a9b40ed94d71d1c714f
SHA51262a61682a2aa015649437012a03240324cb0212d9614b16d883f9c51c3ef3856fff191a23b00818fb98b09f3dc72966e148ddb661798edb3598226626039690e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB