Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/01/2025, 02:14
General
-
Target
2025-01-21_5af3a36508fad3ef0d0c4abd884f0899_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5af3a36508fad3ef0d0c4abd884f0899
-
SHA1
07ddcf3a0ec3e503ad6a414e959c70538db43907
-
SHA256
91b432ce33ddad84e3a8f96f81862f9e4d2fe875c5d8eabb18cc9132b5365cf3
-
SHA512
839c0a8b82dbd4ed36accb51b027770e09b834344b9ec4f0be9e417dceb953b2f1d39b64b2549e8094f15741b96b0f4ff98036ed636a2978a8c78694ea35395b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_5af3a36508fad3ef0d0c4abd884f0899_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_5af3a36508fad3ef0d0c4abd884f0899_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hHGIIZU.exeC:\Windows\System\hHGIIZU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OmWPHJA.exeC:\Windows\System\OmWPHJA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KSNmlmn.exeC:\Windows\System\KSNmlmn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HTSMNeJ.exeC:\Windows\System\HTSMNeJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\poxdixc.exeC:\Windows\System\poxdixc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wrAEOVH.exeC:\Windows\System\wrAEOVH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mVHqMCv.exeC:\Windows\System\mVHqMCv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NHFjKGG.exeC:\Windows\System\NHFjKGG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JUKhXST.exeC:\Windows\System\JUKhXST.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sYscjRd.exeC:\Windows\System\sYscjRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WEXquXl.exeC:\Windows\System\WEXquXl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fVSCLCc.exeC:\Windows\System\fVSCLCc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nnuvywx.exeC:\Windows\System\nnuvywx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gtPGpSF.exeC:\Windows\System\gtPGpSF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\izsxXCO.exeC:\Windows\System\izsxXCO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bwAFgXQ.exeC:\Windows\System\bwAFgXQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YgFIUCd.exeC:\Windows\System\YgFIUCd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XAsDrxk.exeC:\Windows\System\XAsDrxk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bhHvRxE.exeC:\Windows\System\bhHvRxE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gLjyQhC.exeC:\Windows\System\gLjyQhC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OcYDFSv.exeC:\Windows\System\OcYDFSv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5243ec5a128e897e4f9dff45db81e86c8
SHA184f17a8c0bbf3c3b0af30ba5db5c46d71efb829a
SHA256e0b7c17d6f964847681479f2c2f057027f3ae8d6fe2254e3e9e628eef99c6d78
SHA51220e38cd626b1be66ee3cca54c7ad942760977f3ccc7c8936d70ce811c705a20416bb213dea5324a5d63a7a4dfc1074ee09bdcfd42fa2c897f75b12a2fca9865b
-
Filesize
5.2MB
MD538e2c670e9ac4d78952bf2210b57ba40
SHA197de229e19359d3db3cafeec16f10dea957cae5b
SHA256c206b834437935a7d1a6cd18f845d176ed7d3f580a2bc70e72c0f2dc9d908071
SHA51293d2430612c7d65e4490a22bf36986ac1827cc959373468c837eb222126e3639b9c63791bafb75e0a218f362bd0354019288d2ff3af63cc0308adde1f21038a4
-
Filesize
5.2MB
MD55ade1db6b7ef58060ed7675312c048ba
SHA140c8348bb974a12ab8748277253fb22eadbaeff8
SHA256c6158b2b5d94e6b69cccda6deeb30710344c7e6bf6a6edac7ed05666b865ceea
SHA5122dbe714bddc846927fd248f8f8b0076666d418cea2c3b0ba05d4dbab389c44c38c0b24f2f1a7dacf6eca863a24f2051f32f021da42e1cdab34754648da886f13
-
Filesize
5.2MB
MD54b413fe480dbfa45930aa0ad8c8046cf
SHA174c9a0fa8cfdc4b159bfc04110928e83ddf4cc36
SHA256810d454c889bce30ef4ab84e85bcf1dc04bbab032084afd7ebbcb17ab24d4c15
SHA512717c123146293454b4d564c3bd876ec49436ab8f989dcf4fd7fec9daff6eb8ec19613b257f26f1fa65b9a26304ce87e955a574d7abbb2936f1f2f08ce99c8169
-
Filesize
5.2MB
MD5db6808cde8d9600006f9d77fc1891743
SHA11dabc6796ccd0e4e8da746d021f7e70b35c17157
SHA256d4d1579d474f9346a5640b1d98a0a2f9e628630cad36e71807bd0c0dc02919e3
SHA51243c70661181d1b646d2f15b9123f514b53d39f5dcf732f4031423b41cf4b6492d0a2e112e8782f177396a57d25294da8cd1a2c8baf096e1b65c1f9db7b3c7f77
-
Filesize
5.2MB
MD5e147c81dbeba6aa55eeba64295ea8c11
SHA11d2db96f3a814b63452371efa9cd54d08d14f7a1
SHA2562951819ddc689a67b11694643969918882fff2e1dc7967b3f8bfe193e19472d6
SHA5121de2421d585ddacf5dafc29af98b30ebe6164607694c2274016d5972306fd79d5a97984ada2fbe28af73b01a7da7293c4f89117a5dba9e8b0d4d3e707f494206
-
Filesize
5.2MB
MD51a90ffc84591d6dde703c40c11711f46
SHA1077de206c59bbd56d8c1a281b61aff88c74d0872
SHA256afe56c8e9826d1f033c51942b7e51c5caa225dd8edee3a734f5abe932cec1b96
SHA51278b02d8c4a78f5dedbd7b4760da58b54567a888093e3cf44332f72974c9008490d14afee883927d65ead7d9d0af67d39b108046f9e1261e72db09c351eb81fe8
-
Filesize
5.2MB
MD5f3cf388302e3fdd3fefe296d0072fc43
SHA1e4c07f965790912b4fa397b11ea5632aa1362ea6
SHA256e7e03082610326505ff7d2166f4e87550c6732631e34753c3b0b23d2beeb8d0f
SHA512e469638da6f88819a033996859213955f4f4028a8341f52cff43c4e22872da8e402bd5df298b778818374907399eb732bb7895038a46079ea8e8c190d8d8ded3
-
Filesize
5.2MB
MD5eff115a843fd1c6dd565139cb3165d15
SHA18ebbcbf2a56bff8c9e91d86ba9d3602912730cf1
SHA2560dcc4620824765531c5784ce126da3c0fa2611ef0fa3d53bd9b87470aee54a99
SHA512b93e9fa3a2c33587cdbdcdb1836e8c348e5aa39d71b1bc5d8b720df36e2b12ed3db09d60bb9ce237ba0036b8b23d581ed24603a378ec36adfb32c1b9c8e0e1c6
-
Filesize
5.2MB
MD5f83d0fc3e2de168c3c42c2b134e6aea4
SHA147426796eed15303ad2b5398211aa7f8f15d5a93
SHA2562aa48de57135c8bf3e8f8dc6e3ed0f01add7ead119a5837bc78cf76c22720a91
SHA5122cc8df54aa1b1f34b538015913f664036cb0e8e562e38440b78b06abbb121c5e52df03674c9a1d2134796e2948740d63acf047626c726d6c0f91f99fb26dfd8e
-
Filesize
5.2MB
MD53f37e28bea6209839174307a25a61819
SHA12bf3ebfae18c55269187a3e35977e342c100e50f
SHA2563fc4abaf7208e74a3b90fd1149c92708c7d54df119278418f352887289819d23
SHA5125479d7f3f0f1fe586d6fbec71c2524e68bbe85f466c81ad8122a959f79d066d4eb7363d1053da462a286d611d8639dfada10054a04dc998bdfb15b88e85d353a
-
Filesize
5.2MB
MD5b65f0830c75286fcee825c61a1ba9acc
SHA1019249e0403af66f46c3c2042528e40df0a6f390
SHA256abfb0780413edd15db5b168865153c99960649883a26707489b57dbb3cb30c39
SHA512d9e4c71e4a75b3b9882714c6f9c760d3283af9e0d9b8a7c9cafd949a5a0528e1e101c2959eaddb0d339e4725407f8e7bead595e5cf16ea9e1d9e1e274fb7f14f
-
Filesize
5.2MB
MD5dd739b4dec47ffa2e8dda4bc4a2058d3
SHA13a303cc1b8e0f555fa6ca8d7c9e502b1d58041ae
SHA256dc9539e848acf7bca011991bf32eaedc8676322f01638e5af451408aa17b207f
SHA512e4163ef882eca56eb02baed5f2eea06b5d42bf36f0194d75fcdd78c200c2c90da9cbdfdd33c2070d8829c0717d29f9b611c37e26b83dcb2fcfade70a0abdf390
-
Filesize
5.2MB
MD5dd6f8a0b549229edf42bb2ea751786d8
SHA1948c737c6c9bb60ddce2a3955ae1f95df1dd38cc
SHA256577952963e4349092329b10f2ed4bc0a719aad1cebffb6da82b987c9b5b4a7c8
SHA512d35337eb71fe8a81bcc0d39e4df8945830bc0b50f45cb3f44e972414210d713b9f21746c8465d2e4e018da61153e8c3eeac2e2c8be874f3d749d4996c651ab00
-
Filesize
5.2MB
MD5de31cab07604ee8cf17d026762906989
SHA1fe5d217ffec7c5148a656277cf779e7bdbfdbcae
SHA256bfeba8cd2c22e1281c6b05418cecb7d995cc8ecf67b5418beffefc8104a091be
SHA51270db95bc2f969279e5b1eb85aea64feb7f99421fef68578506ce104a23f45632449d89cb69266e38f23b495db89697286fb9a92d5b6fb55e77b69f7f6e511b2d
-
Filesize
5.2MB
MD52f1ee0156223dd365c665d7dda6e2314
SHA1499cc19ce9acc863ade20190ae88f3297fa0ed46
SHA2563bb96597eac411735c4e3b8882da6837b14e330c666aa838b555ff79fb5ecc46
SHA512a13b3ce95f931f9f562c19301a0a4ae311e28c918a26bd0b1e95f92292207c53281aba8cb61f33ba6ab41ba817d3ea29826fffe50130e8193b26255748b29f05
-
Filesize
5.2MB
MD5bc1cb5b0ef1b465e47183ac9c2a74fe4
SHA1bbfc43c50934dc53e506a30fb5bec39948c044ba
SHA25641f76888db41d4e5d2d0fdfb94fe5b345533e13fc8b4ad9261d025cb2c6fef6d
SHA512b70bc3bd991a886c1f169cdb133cbae989135c56438e0c7e7cf2cb1a362d7985218ac4b033da544f36f26024d9c7661c97b2875e87fde24b78dc620ae9d9117f
-
Filesize
5.2MB
MD5b0b21d2ef509a169d1dd8fe13f1095e8
SHA12093f036833e87e1dbe7cb4634bd6f623d06f1da
SHA256075cd782c92d4ff09ebd283a8048cdc21c13950700266a1e6dedf123aec14380
SHA512a7afd675cfeced6d8ccb2d4be765a462ebc7ec59bdb045c090727bf6bd31151b0f61b5c31a5d26b6e58ebe996f2de5585512d30f99fc9759e44e8a21d680effd
-
Filesize
5.2MB
MD5d27df1e7907c609f942b7f37b542abcf
SHA14f920eaccfecb0a71d59b5acdc6ea62f3a45dc34
SHA256b322c71fe2ce28b0408af60e227b5a0dc0384f0bb48879b4f19964e9ad87dacb
SHA512e59846e891c40b823dbe944e6b102d9109ed54a5e83f1fb661ce7f7b3adb28c6e4c16532ab64ccd68095df910ceaaf147edb96bda607f237e293e3d2b78ba0c6
-
Filesize
5.2MB
MD508629a12b0e5c406da00af75cabbd952
SHA10e680295ca83d78e94f13adc0d59d66ffa069c91
SHA256ab125e91df071c5e05781fb686c1b87eb3ffcfde5e9000824a40010cec2fce72
SHA5129beacf43634a1e4ac571d35c71355b163e39ced14b678726476de56f3587a89136c45eb53e056e80240c2df52f9ac3ef922edc02296e490469e0b0fe2ba1cf9f
-
Filesize
5.2MB
MD533294cf867ddcaf8bab738b2e2f1422f
SHA1ec0627bee2a59d402e3f494d9b68d7e740af11e9
SHA256aafa9cf2a73c46d505b0f05bcf1385158d7f450019b5678acecb41f0ddc02781
SHA5125d9c8e9ba4a8559003cb1f7d66910b2bdcb61ea0a5e918ae47dcd0ab194a85613c7e32a2a5929b283a23b07da9e0557524f0f0626b1bbe17ae25d0190853c89b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB