Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/01/2025, 02:17
General
-
Target
2025-01-21_8ab0ea17c2a693c052c358e98e829d53_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8ab0ea17c2a693c052c358e98e829d53
-
SHA1
e0ffb42c0d60877a21ca6b682f1ac6260009f464
-
SHA256
aad378742163eb42baca92c7bc0544062c369227cb04caf93b2d272864ca083b
-
SHA512
88308e66d02a488b698ba241b8bcff22391297c011205f5855504629b0907e49d3cef16f244234b3c8ff8f4a810f1220a7ad31a3dddf4bfe6787231e5c212364
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibf56utgpPFotBER/mQ32lUY
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_8ab0ea17c2a693c052c358e98e829d53_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_8ab0ea17c2a693c052c358e98e829d53_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ktzgahm.exeC:\Windows\System\ktzgahm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lvqVxSG.exeC:\Windows\System\lvqVxSG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XyyySAH.exeC:\Windows\System\XyyySAH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MjZKBci.exeC:\Windows\System\MjZKBci.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tVqzJbt.exeC:\Windows\System\tVqzJbt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KMdkjdM.exeC:\Windows\System\KMdkjdM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pmSjIpa.exeC:\Windows\System\pmSjIpa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zUahqUE.exeC:\Windows\System\zUahqUE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dkMmell.exeC:\Windows\System\dkMmell.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kAtmQVI.exeC:\Windows\System\kAtmQVI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GWOWCoX.exeC:\Windows\System\GWOWCoX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OEoAmHJ.exeC:\Windows\System\OEoAmHJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EPixZKe.exeC:\Windows\System\EPixZKe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\axDBRWF.exeC:\Windows\System\axDBRWF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ckIxAjR.exeC:\Windows\System\ckIxAjR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YZNXnAJ.exeC:\Windows\System\YZNXnAJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zoHVquF.exeC:\Windows\System\zoHVquF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XvpaSGg.exeC:\Windows\System\XvpaSGg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uUAbaxI.exeC:\Windows\System\uUAbaxI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ynSLmVk.exeC:\Windows\System\ynSLmVk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rIzjzuI.exeC:\Windows\System\rIzjzuI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e73079b57e4128d7da58688126d0f894
SHA1095eff8ef05e93a2f199dcfe276c0f282f99c02a
SHA25619eba2c9b5d16a9575c3c70fe0548e2ff54d384d67a716f6f080c575c790e57a
SHA512f1491359708d183e6ebe982d312880fbd8093b83a35dc1a2b9ceb76d0311e192d40faee19a644ca15fa91325ec412d1ad670ec7be0e3f01b35dd9f6781b7cd0a
-
Filesize
5.2MB
MD5ca33672033ac7284e70b0af941f00f60
SHA19f088e53a9e2e8512137579c9b2f69da98bfdbfd
SHA256b656573ec9a3a62e9bd576d91aa297820de2b0e5c843b7de3d664a92c26baa9f
SHA51201d0e8a4239b6edede1de45911eabf9c6f28b96db6a0a45d17904caf6a0fce6b6034340494f6a40a0ddec399b6a74f21e82b654717970e1b308304403f4e1a43
-
Filesize
5.2MB
MD5b588685ed94f682522607d4791d25ee8
SHA1d57db407c51f5e0952836f27d28a5447b254cdc1
SHA256e15246c866e0518f12f3f9f6f2740d23ab227a075dab07a7e4dea0b4df6963ac
SHA512e378cf8007a29d9f86bbe0018a410feab554b649b46a2a2151ed3e86e2b177a84e0627de487d695c3a2af28b529086796d0b3a4a5cb9d7df9857c036770026cf
-
Filesize
5.2MB
MD572e7634a13b434c3d6346cf3adb89091
SHA120090d48832a5e9f12f19e81a567f374a1dbeee1
SHA256444db7f4907202224b5e56be70fc010e77ba0dbc792f98b4818377796ba68d6b
SHA512a63f3596588521df05e438a266aeb462837b2b864b3f33aced54cc81b273bcd51eb1f58087b64b36355a7d6bc0e0cef172888f1757138a7bf2d6b9f0d1b2e2ba
-
Filesize
5.2MB
MD543e05cd04a59f18fd8b5e2164faaba14
SHA1dd038c9e708c8a2110fdea2241aaccd16f041776
SHA2562b382cb5ee424ab0d7b429c041d242f81bf759c41d4cba2ba60b1e11c2ad3132
SHA51206bdd875892614c362332add7883afed85ba0b2751de3388baf76cd0ce0c8682f278c27037cac149f1cee09f2e17d2b1482ab4e4706777fcb4fdd848fffb54f0
-
Filesize
5.2MB
MD5d1212a59e15d1e477ec7b6ae17fcd58c
SHA189a07e146d3f4d01153c9e9b1a48bb8a05c5a314
SHA2569f4532f923569dbe929909f20c638664a3b9d25060dc58dd7b7c46594e596fab
SHA512a11ee703539ba44b5f6fe62c6966b7fb0d6b905140afd45d32098c69e48ce073210809f74930aabfe030464022058c65dc444360fd41ba99b2cc3b0bb087b179
-
Filesize
5.2MB
MD5e3f38f056a9e8a2876943bd552d8fd89
SHA19a4829e4fc7a99c1d851920565bacd905fa4df7f
SHA256119a65529911120f2e5392d07a16aa82d28bffacab716ccb5a2f41d5e2172f76
SHA5127e90a5756dc70ab45601d14c1f044a4ceb1aaae64de90a028eafb660c106e5d6ebe6a624373b66aba3499de76e70378546e9ae2fe0d8414a7576f4700a985cc4
-
Filesize
5.2MB
MD532f55dacf5f911d7ee312989b5cfbaab
SHA118a489bc38708789cfeb3c3b9bef5fa2c2563f78
SHA256fd3884225c6e3954733c699a9d8df284236bd1fde44c8e166be529012cf3647d
SHA51295bcddf44bcb10be37a0474eaf27a74022c233bc281cd495d12d6cd573dff2d8942f04a6b14f73b779b26c3359359a839f3deff872e1f955fa8f05639ec160e1
-
Filesize
5.2MB
MD50a29205d717f84cd3a84c1397c252c0c
SHA1026d53368401c59b511a6c1d6f51fee181215465
SHA256b13f7fd5ef890bb73e4caeb07c9a23146d11b72ce6832f06250074b5253aec2e
SHA512860c23a364fabb253645a80ae73e445dbb80ead16117f69afd86834356fd049f50dd14cd039339391ab26fcae9771bfb14c12c4051a964beb40844194827603f
-
Filesize
5.2MB
MD5a87e2841c41d8672070d036b940c3778
SHA17a5258d5747e69f0a0dafa8e02a8381b0c970dbd
SHA2561155c2f1005585d6287bb3ce8b053dfa86e72fb54aefd40b3d9d1ed41fe2a174
SHA512bb88ac5eaac4503dbf9786386303b0b5a72cb3c287d4cf472366e3e71a298b4ae63ded3c0824db51732d2abfcaf9e47f5330505b52433cf188c5cc61a4e558d7
-
Filesize
5.2MB
MD5ceb148e5fd90832aee9c3ad8a90fd0b1
SHA1d940cc6763ae460c3f9ffd1a23c19034f0379b69
SHA256bf4fd34edd3a1c65495ba14fd3cfb8a66b818db2a3ea94e1159fe1a9a308f2ed
SHA512efe0991c357cafa66e1d1110a001fb6c4511eaa218bb9dbfac8a9a7fce89086f1c4ec1b7114eeee2b09b3beb1ae4ec91ea94d3c95c8d9dd5e47e49694b517dc0
-
Filesize
5.2MB
MD5965f3d9ea437c5d39d4b472ed8570ba6
SHA1081bb810ad7c287dbceff86df298e39c5e49a781
SHA2563e6589621bf870106c6e9e1911cac97e8513d0c9ef91c883bb7ab6d5e97a69d8
SHA512b86393172d54f3495bf4be0ff295e263fea2ce8483011442fa9ca9a6f6491bab6be02fd1b4f2ca2b70a8190264590e931db06460e645d701893fbe0e7a83aeff
-
Filesize
5.2MB
MD5aad7be7a1a58e123a7689ba6dd9b8c91
SHA169607c4dc00719b8103b0ee488689b4b11231ef7
SHA25659e4da603524a8cdf9eb40d28715646048e4832f1677e0c6b05c43ce58747934
SHA512b83706615508f9c524f26f335a0f31ea1bd10a9a13b876f94f89eb2981589746382287ca840f254a127174c5099c2bf1ecda31536e48e62ce33a7c751b1e9ff2
-
Filesize
5.2MB
MD5178dcfbad6816a11caa0fc5e8bf29eb3
SHA198f7c48afad6e1f118cb306f99eda17689d1134a
SHA25671c96ba528a14a63f5a4f07259d9a270265a7f228dc50d3ff2ecbf74062401da
SHA512a1997063f7a33272c5b9e0406c77a79fa25b8c78aa25f2cd1fc5d547045583e7ba1fa50a5174f000ae36f96a03cf84e59beda406329211a828f4c7e539ea93ae
-
Filesize
5.2MB
MD5b1c84f7cd97d139779711f448590d9b4
SHA10746d00e9ee99100fa2a53cca52289e256d44d8b
SHA25650ac7289b6c2d0ccd86dbaa7093ac98c4910aae66012a9d2ed8e4080c6700daf
SHA512fd09747e5672cf60b8db6000a851492e084637d21b5571d188ed5449c909b08a70b5c6ffeb60f7655db96e508defdf74364565fc0ea9ed889cefdb3fd3007765
-
Filesize
5.2MB
MD5d98813a9438063fe269c075ea8797fac
SHA1edc2e8fdcc7b7f9b14a30bbc7fc744c93622ac5c
SHA256c27f3d44b4d6c8b6f18f0835a112a9213a9c8ca6c06b8035bcb271ae7427745c
SHA51245cdd39ce1ff12c294d1095b40a9873bc45bfb845b693d94cec51029faf404a75e9da3116c81c37c3b1c93485db4ffc11a7868e6127b857e7c576b270746d31b
-
Filesize
5.2MB
MD5873d2b8494375ae1c71cd7db1c458364
SHA1fbfe121b2ac7129752779863b16323bf0a5f5214
SHA256163f874104ca8615dcc9484a420a99ec59b25ee0172fccec868b20dab20856bf
SHA512944eca5a8d5bd6c064430432e3e661418b9ed407bee2f2adf35f51d0d7cc6be4cf1a12ba3d5570703cb894dc1b9345c8b2f8332649fe53f58ea8393e4e9746e6
-
Filesize
5.2MB
MD5a20e3c6a97aaac198b5504dc93863764
SHA1aab57f3b0889011aabf7b63d28cfd6780865840b
SHA2560fa60530031912fa1c6abddd3ed86f2f8e54ba7330bb5708c583482087c3ed1d
SHA51294ddb2f5996d32e6af8d7d507186464652674e2b5be692894c38aa880b9df0f4652bb60a198ec8c53694b062008afbead263d68b3e6d8b7342b382a9b3aae0d1
-
Filesize
5.2MB
MD5d5435d5938913ff0c1fb1b59fabe676b
SHA1fdc4b3256c964e4fd1639cbd870e6d222adef18a
SHA256db5b5866a95d9e5bf70a621f2d97394834c0ae146978a6cf9662d0c93a90626e
SHA512cf2c6ca25d29275a13aaefa8ee3ccf4741baa3f69b45d94921978ae78cb8f0345bb63bb55fb6422082188f748965d3c49d6bf3a6bdcc0c025432b3ae95b11447
-
Filesize
5.2MB
MD531f1012be96fa6751f6c9ac5f221fae1
SHA1e8774b53a1e824e0b20111e58d3f90690d2211cd
SHA256ed7e805f68f5bd93c8764766216d11f819b905b18cddec45cbe9232cd2f91c6a
SHA5126bfb0e954e42dde981a5aedc1f20af23c745ad090175e1668e78c7ab99de1088bdd1bf9f20ba7fca2074fc3ef2bc35bd287d5cc8f177dba760cbd8f11f306006
-
Filesize
5.2MB
MD53a471e151d9edcac6f718164b521b62e
SHA122de99b2167834e9254c1e55242cc0f09d038b4d
SHA25681b1a7789fb1d7655b3c456607d40302966eeee63052a8b147514d46ad999780
SHA51244f99b88e1eaceba11ea9a2be9f5da98781d70773d68b5d677408e91c51c8e6fc62d135e6bc30534fd9a5275fedf2ec81f5fc1757bfb43772611ff43c961ad55
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB