Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21/01/2025, 02:14
General
-
Target
2025-01-21_5af3a36508fad3ef0d0c4abd884f0899_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5af3a36508fad3ef0d0c4abd884f0899
-
SHA1
07ddcf3a0ec3e503ad6a414e959c70538db43907
-
SHA256
91b432ce33ddad84e3a8f96f81862f9e4d2fe875c5d8eabb18cc9132b5365cf3
-
SHA512
839c0a8b82dbd4ed36accb51b027770e09b834344b9ec4f0be9e417dceb953b2f1d39b64b2549e8094f15741b96b0f4ff98036ed636a2978a8c78694ea35395b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_5af3a36508fad3ef0d0c4abd884f0899_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_5af3a36508fad3ef0d0c4abd884f0899_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kNMadEt.exeC:\Windows\System\kNMadEt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OSPcapB.exeC:\Windows\System\OSPcapB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCRpVMb.exeC:\Windows\System\uCRpVMb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kpQeTOe.exeC:\Windows\System\kpQeTOe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jvOJhKQ.exeC:\Windows\System\jvOJhKQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pCRegBY.exeC:\Windows\System\pCRegBY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BzFzrpA.exeC:\Windows\System\BzFzrpA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dHvMeNB.exeC:\Windows\System\dHvMeNB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DjAhkMW.exeC:\Windows\System\DjAhkMW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SBRYSyU.exeC:\Windows\System\SBRYSyU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\btKeAqJ.exeC:\Windows\System\btKeAqJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DRedDwx.exeC:\Windows\System\DRedDwx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TaYSVBE.exeC:\Windows\System\TaYSVBE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oVcNmjt.exeC:\Windows\System\oVcNmjt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ewkNnYA.exeC:\Windows\System\ewkNnYA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fIFfflP.exeC:\Windows\System\fIFfflP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qxiHXfE.exeC:\Windows\System\qxiHXfE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pmeZJUW.exeC:\Windows\System\pmeZJUW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KBUVHNb.exeC:\Windows\System\KBUVHNb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dynboaF.exeC:\Windows\System\dynboaF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PMbLhqW.exeC:\Windows\System\PMbLhqW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b508f5aeee64d9be989e128e59953c7c
SHA1fdd1217afaaaa24536a9e567c3ab2d8f40d1ce05
SHA256d61eed2ba3de810617e2051ba6ed1f902152d886a910ea3231314d42d3ac2b4e
SHA51244054ce2d46628e2ea135a3251dd9f6a39746f5d90734d742545e2b9ad04c8b898fb739574cc0624f3ed3f621e37d2066b8037c9859e463327836b08ab44c79e
-
Filesize
5.2MB
MD57b6d17eb495254c1731dbb48dd7fb19e
SHA1e6027016ef92845bcf0fd40ce42ea3ca11d76e0d
SHA256bdfc0e8b3e19ee146da95f051a2c3ea075cfe127870e44504593d48ae256a854
SHA512eac3c500659a4dc93cfb2862a9aecc3426956c73dd68966279ae6c884f62ad7262011ef2c4dd91b2caa9efc3e4f749caab826440479d615ad5574515d0dbb6ba
-
Filesize
5.2MB
MD549e79a92ceddd0e03454b4923b985d1e
SHA17aacebb165a567d84968b7ade7d3babc3905b01f
SHA2566d84b3687c7329cb34bcc222ce5764ef52c6cc2aac9e5da5541857fe4675a47a
SHA512e4d075b123d4d5ecbd9a7c89ed730091b8f428d5c14bb2b102f39965912910f10fbac0c7e11e44390a09fb66fffcdf2989f54642f6c11625d9f53c2520bed849
-
Filesize
5.2MB
MD53d28545989f2b38055222dfaf85d01ab
SHA16c7b8aea55a9313446abdcc4012808a41cf416fb
SHA2561cccff76276f4e984517fa48c0327d88b2e917ee57537fdad8f7dfe2fe0f66f6
SHA5123cee6038fc31dcadcfd6085d2b7911b98e396c91af85b7ea29956019804608647378ed121adaaf198d3205a35e5c535e6ca8b53ccda695ad33ae1a5fcc69979b
-
Filesize
5.2MB
MD5a4e9d7bea1e5b1973c26c8b0a4c3a7a7
SHA16b50994c54a5862d17c1c91c8dba7b5fe1ba4c76
SHA256cb49c56f97ae76e896458a4bd77075b8f7ae219ac5b87fd4cd114ade85590882
SHA51229702f955d4756c5ee24f6063d38f40292daba0fdd18c8955cb646e88178d525a0b1a43732506ca71a09bb71c457aaa0eec42a95b41aeffaf00f47a851391371
-
Filesize
5.2MB
MD555d1116e116277b50f6e8240f9ad346a
SHA1aa526837cec2e2545cfdb03c8485de798b9e9eb7
SHA2569697e4c941c22611b2aa953ab88608765e65fe5bcf46c1cd3219ba6eeac61ee4
SHA51209481bbff40f8fbfd0125b76282824973afc17fabd96f993450e9dcb78cf802d74f70faea587bf631e55cea4674c7d781219a84741cd89108ec7d8f9f52a9a56
-
Filesize
5.2MB
MD58e38c812d0fe1bb3f63f37e88f72a642
SHA19aefbcc7e5f00b745510cc0c812626de3f2c0869
SHA256cfea0cb35448a423d37f4c35b4e86e5d333fa50cda7dc0da5cca013682c9c944
SHA512e8021fa8548fdab2f539be3b140165d602117f2de088fde45fe96243131189184059b1c2b493c62a88a93b761f61794fc42c3680ec1e92f4b226176976e5ab50
-
Filesize
5.2MB
MD5da1f76733781d413d709f86538e04d79
SHA12e90d18e77c65b7dc60e19c1b678d3209ff9f58e
SHA256206c7e1701f704df11cabd43d638cffc1ac0464ecabad15ab8cf47979301fc63
SHA512b11acbf211e50cda8dc89b0c0947fed00dce469c70de995ff7a9cf0d3e15933af9a3454003065cd6bc8bb4eea46d5934b562afa5650ae33809190de058ad6d7f
-
Filesize
5.2MB
MD537250c7d636073197616c8849172c54c
SHA183cbf88fc741136baa3d996c83c79411c28c663f
SHA256a0139545211a6a739986dd796a2d35b7ed15104f402a35932a3b54577a8fa618
SHA512f375b67b13e44f8b9fe99e8924aa687fb4fa00de94e66dc4008302895575e8ec9ffbf1bf2efce2ff99538a6e0cd5f0a9fb1f5db794b9293c8453cc303e68ac85
-
Filesize
5.2MB
MD5d8d606936b56797c4e30a6f0b783c0e1
SHA174ffbe8a53ec4dacf2b09674834e0664d7c189e6
SHA256d135d54fe129bcc39df9996b778489c6aaf8816f9f628d97db0d250d63d9eb3c
SHA512af97374e0dbfde441ac17ba962643bbef03697da16851ab09eed368f2cf5c5fe3957de1ccd24710666294ff601be2e50253c8f1fe257fd0f3a79aaad650b8ce4
-
Filesize
5.2MB
MD55af86116b6d9893c30c165689b2c68c9
SHA15b2726fd86a16adfc8a4aee2908f22db7e0c29eb
SHA2568bccb3ce893be37e4123710c270e173825e59340f7b9ae48b190606bd149c347
SHA512ca7564567d92dc8ac457947d38183936cd0c71f11197fe1ed5e5640c426026f7fe114f48e4ed11d5ae28b09a92a9114fac4a1a61a99e25bbe3bfb39a60b97a42
-
Filesize
5.2MB
MD5bef8320f0abccc63b7a6c47153878c2b
SHA1e11319df208f3b41ee4dfd85b42e7e733d027e3b
SHA256e3b4d34386325c59cd4f429bf1a5f13ed9f4e9894adedf4b32c0ad313ad2b8f3
SHA512e0922bafdf1c6b1a24f64783c2082281e831d2db487834ef0755f00732f9c6751566078a98b259f40fecaca132ca7aba1c52540d45d1d7d5d6c639a86caf8248
-
Filesize
5.2MB
MD548764120061ca4c3b7bc0f02f3bae3a6
SHA1767660b71301d57333d06abd492b8eedf1494313
SHA256af876187d923d48fc9eddd9032201f9900cd4de071493de58ad7067348f8a0ee
SHA5124753a59ccc06d0deb9982e537ca73f1b9ce33790cf32dca9e714b24918f8a3cd42d87f243d2dd7083007de99a36f65a2386343209dd621952f13e3eb633f5be5
-
Filesize
5.2MB
MD542cef44479e2bf3271610c8ebd3360fe
SHA11f715afefe4dffe631ee66464a92ed5bac6b70ad
SHA25625d4b83db04adab6146d7372bdb23f45811a7a7a70f51af5c99b603a3bd18d6c
SHA512c4e9fe5674c9dcb80a2c93fe06f303927cc409c517d6c63c6a2b029436ab0c62543a385a0e80f81a9525822cf157ed9a32e42e808d1fb593b2fe9f95919e26cf
-
Filesize
5.2MB
MD5964d6e00c6f23708f88f4e07906bbae7
SHA1312e3cb1e559d4398a479c65d672fc3e6ed69a67
SHA256e193bdaaa0d2f049d340187e049af1eccc746c60d9ebeb184a0d843f3d76ff00
SHA512de598dc4de4c79a446b29c74e4987013740bfe3fadab61fd129fb86fc374da8c54188955b283b360fde859f7be4107e5d3c34d606a151865f517b4614aefc165
-
Filesize
5.2MB
MD52e2efe2be5a79dff32675ae11798f6c7
SHA1ec75bd00e5b6a0083e163190948e5bf64d3b6cfa
SHA256205f64617ccef3c27b4071a7917553b3049869d35e31db5f3d95a11c5ea06abd
SHA5124e5fb3e69faad555ba8206875046b4ca2ec83e29f36e3ee3ede6472a47aab513910f2bea04b4380fac8ea507d82f49369c8c3ef1653450dbf97bf16417584826
-
Filesize
5.2MB
MD5dafab5c4372e134837e75e1ba79b6ec4
SHA105b99528f7727c076dcb97148ec4d884185cba6e
SHA2567681b8396aa312cdea3e6bb5334b3cdaedbaa62bd1f0342f1ae03f1346e14f51
SHA512d938c98e5e7b437e515a83e7d6cfd50e8c463de549ff49266d681cfd781ac2ded2262beacb56e499b3c0543234d2552e13463d219b345f9d3066b71457d905a7
-
Filesize
5.2MB
MD52448444026513ec190304fc31aad9f75
SHA181199e921e91f4ae850c9ac7370d05518f4dcc90
SHA25605aa7cee58493acd6c32cd6022caf558f59f900faa3c27300405498995961f44
SHA5121a9b4e3c3d9c44a495ad7d5902a1b137993d007757ed32592ee23477ce1685e70fb65e9ee89a2996320542d003cb83732398f18481b55b4c531ec5ff7909765b
-
Filesize
5.2MB
MD58b2ffa9cea99863b2b9a48cb72fc19f1
SHA1c2ff40c4036e52d8215a8639ee6a98857dc8639e
SHA256bcf77d1831f9ab69e0511f68d90bace8a3c092d70f5357e4f81f139dc2f3b07d
SHA51201ae3cac5dbb44366fc23c7836abf10ea8d5c104be8e442969166adac5089444e5120bc98e155719c9d334dceb25171d03dafa6586799893775dea76d75d5ec4
-
Filesize
5.2MB
MD5ecec1971f02643287f111c495ee930ce
SHA1487e591292e7268abb15515963abf87eb6b2fc52
SHA25685a2ae64e1fff0791448ebeeb5b5d20779a59074b4bdf47911acfd77c213b8fe
SHA5123c0721216c03653642d1424eada19853c061cfdc3606b0f92702dbafcf9600f6700517dfd7dbdbacac86bcca7aa2c73293662524d940a811e397b4cc63deb750
-
Filesize
5.2MB
MD5752d72ebad15a35eb719a3a68f3ab9fa
SHA1352e4ffbd189f3050322bd44204ce2742f95ced7
SHA256056e311cd975e19ab5b0a9fc422cb6e4872dada7fe37e63fd5d3a4911babf9e7
SHA5127636087255a420066b3b26d830a73963f15970159bda0085f931562e7ed1e5894d9f02f59a567ea3cdb36226940da46ef85b2ec3650a74f97b7a375c7d2f1758
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB