Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/01/2025, 02:17
General
-
Target
2025-01-21_8ab0ea17c2a693c052c358e98e829d53_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8ab0ea17c2a693c052c358e98e829d53
-
SHA1
e0ffb42c0d60877a21ca6b682f1ac6260009f464
-
SHA256
aad378742163eb42baca92c7bc0544062c369227cb04caf93b2d272864ca083b
-
SHA512
88308e66d02a488b698ba241b8bcff22391297c011205f5855504629b0907e49d3cef16f244234b3c8ff8f4a810f1220a7ad31a3dddf4bfe6787231e5c212364
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibf56utgpPFotBER/mQ32lUY
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_8ab0ea17c2a693c052c358e98e829d53_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_8ab0ea17c2a693c052c358e98e829d53_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hfuOFCV.exeC:\Windows\System\hfuOFCV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tQxImmG.exeC:\Windows\System\tQxImmG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nWvDaaS.exeC:\Windows\System\nWvDaaS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kNcAvrN.exeC:\Windows\System\kNcAvrN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zGZTBOF.exeC:\Windows\System\zGZTBOF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RBTRRxv.exeC:\Windows\System\RBTRRxv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZRMaluU.exeC:\Windows\System\ZRMaluU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aLkweNK.exeC:\Windows\System\aLkweNK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jVXmKri.exeC:\Windows\System\jVXmKri.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KXMrhoS.exeC:\Windows\System\KXMrhoS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AhjiwVr.exeC:\Windows\System\AhjiwVr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yIbhmNo.exeC:\Windows\System\yIbhmNo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YUwavFP.exeC:\Windows\System\YUwavFP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SNyuUxR.exeC:\Windows\System\SNyuUxR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nmIhkOf.exeC:\Windows\System\nmIhkOf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UUPFgmK.exeC:\Windows\System\UUPFgmK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZXlWmSe.exeC:\Windows\System\ZXlWmSe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FBCEIiB.exeC:\Windows\System\FBCEIiB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DIeBkhl.exeC:\Windows\System\DIeBkhl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tAGiGbh.exeC:\Windows\System\tAGiGbh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rXwUXep.exeC:\Windows\System\rXwUXep.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55caa1a6853829e632ee936fb2095f419
SHA18e0ea0985d5633458cddfa221850826fb8aac039
SHA256515f76187b65c8ff591e47dec6c9092c379284a7dc18be1079622077e3c6a93c
SHA5120bea32ec57f18bd3fdcd70a9f7b1df3231d54c2dd5c0152e8885122648e1611eacb58fa76cc4972f7b12f59ad290e1ec8e434c366150d99429442797a038f85f
-
Filesize
5.2MB
MD5c455d5d3209c458cb3a873c008e4428b
SHA118cf163fedefc27ba97d24d9bfacb1650da6af2f
SHA256dd3023425b280337112e7f943b3540e3701b47873c86339453fa7c593acc7160
SHA5124f26ff0923d3b9b9c8888cc7bb6e94b480eff8697b202dc06a434bf7001b83ab7610586f894e170de02c01c02c60e948be5a070d4d21788cdf6346164d87e866
-
Filesize
5.2MB
MD5cc23c2b8d77eaae31a4cde4e027c8992
SHA1de4c00ea24c35b4ee5fd5f5fb5e911e8b21b6d04
SHA256997c0bf5d56fe65d9ce116e05a9400ca912514682ee53598725d02363d1c0211
SHA5127eb6018e1502dd880ea356ecbeb7b7218c6a79ef70d7727155a61d6834391ff471d4430288a47605c2d7a77a168e51dbd94de9845c7153a5ac058ce381e16377
-
Filesize
5.2MB
MD5d4ba6877632eec7f052f6549676d4965
SHA1880984388ba7326fc9bcf64c2a7740842be37e23
SHA25606a60f18de9822e4fad980d3a1096191c6035ba7b4bc9795c4cf52f2e1c05f18
SHA512e59a6bcf5bea96dc4897e30808b80f762915001be3599543ec119e8f019094c4a9c8aa576d7365a057dd0f4f7ed3c9c031609d2ee6132106250836be3b5dde19
-
Filesize
5.2MB
MD59e0426d2f6a056f59dde78a26eec2c86
SHA128ebd73f2da988df745c8c63e916e22f79ca9670
SHA256835cad4baeb83d5b9e544e865e90b938b30f7171884b2715e50cf877976b8ed9
SHA512c47b2e51c4833f6fda3767175eb4c9977271a625b3254db3beaaab726b7cc076e8bac89438e8770a2d03d71e8a9576d28b26e6d5c8be5ce1fbae9a108c1dd282
-
Filesize
5.2MB
MD52fc2b56a508af368effdc913ef4a2862
SHA117321cf9d855cbdab77e2b38c78677eaf4d00ef4
SHA256e9dc83b8935067e2a89b2c9012a8dd53c94a4309b3b8b243e820d63e89a56020
SHA512ca39572ab42aabac756d01151f959201d943925a375fb039db4fb15f76698fa3108a9dad482ec814107adddce7f4a3b25ba5e0df8316294bb25b557758d40d16
-
Filesize
5.2MB
MD5f9d1acf67c63ed43f6c8df214522266b
SHA1ed28abfe7d41fe469e01d75db7428979434f3694
SHA256e6069d16e2b7c07b00db04e9c554f2f2a28a112a6159c83f0b0e76740a54a6a3
SHA5126388cf636ce2aa443623cc3301806db7b141a7962353b7a56213511a805e447bbd308e9dfb6e205c4024b36a38637878d0cd131aef0228e70655ab404609910d
-
Filesize
5.2MB
MD531228e82dc474dd5dabb8d57d4ed0ce7
SHA1ef156c05bd575561e311627d5aec9271fd98e43a
SHA2561a44b981c35e8a215764753ae62d3513b816263e34a6ad51da1e004353550530
SHA5128198e76523a93aa21f0bff7ccb3ed4954c585e57249fc5fb9495d59eaab1a590e69c9fd4e799c0c46dc3f132b8052edab4c6b989543a177a402e2792a3988e2e
-
Filesize
5.2MB
MD5ca3ef034004ee84f80feeb801ec6b9d3
SHA1b47ae1facb649e2dcd09e3e8afddafdab9d05708
SHA256757bd9a0406d2f8b80de2194288c1783b6f3382ed3bfe88a410fe5cf20956641
SHA512a94e587d0f89b58ecfd7ea01fc4cfb492f8d5ae9af844f1578d76a707d4d5e28276f565bfcc9404ec73d3a2380e551ca5a1d5512607539aaf12e423146759d49
-
Filesize
5.2MB
MD5456be8bf90fc1eacfb043f45bc83ccf0
SHA1f91f11f157129ce9a1997309cea10cf18a13bbfe
SHA25639c37569548c2db98d9876d7030820b8f3fb08b5baadb379d6aad70a19773be3
SHA5129827745341c44929b98ee67ca9f4ec04a6989d4ddb241f48c9035dac859f165a39543e51aadb634505cc7f091854b1c8548a1b154617b504e4f9558c42bcf845
-
Filesize
5.2MB
MD5cb428b080fe1611a7f95d707de328631
SHA1a34ae464684193275f7d442b6947cdf7c09c8f75
SHA256811c1043f5f646d394ccfb354f5b96e62c66dee40113130dfaf1ce866beee19e
SHA5129b72eef8a5e659505748d4f74c746f6ccea0743cf020096057f4a0e47f17ebec0b05bb48ce85f24aff0a3ce8ff75e21d0e7bc3e153bac1a386b9be2fa37d6350
-
Filesize
5.2MB
MD59b39b390a7571ca1909f7a39d9885e43
SHA13c9a3b6944806a85ef25afed95af0a52e6882a59
SHA2565170d44cae6367479c3834a5380b6f04997af132b21ebc076380449e829c171d
SHA512142755047a88de3d1fcbff1c1ad3444b7df9bb7af44c0a5109d87dd8df6091c61bf206342198796f43b30ea02ef518d3708e2e16bbb60c7d598363e6f50778b0
-
Filesize
5.2MB
MD52487b7a90b3a724bbfbbd4c74c5d6682
SHA104b97d1894b5e6c79e723b61ad001d351c30ebec
SHA2560784e77386ab8d2f5706af75876b1314650a91d1adf22ad4c7c319daa5193ab4
SHA5122cd8a84c0cccc27935d6e3ccdffe183d87a5220a842aabb6b54ae988f85da2b49e9dec45960ec8629d4ed0284a7621f50872a26c6cf01081e307c2d8e02680c0
-
Filesize
5.2MB
MD57adab372b3c65c94f1427309b5e39cba
SHA15e56a91ff7bc01e17f7437daebd64c8b3ab60917
SHA2563191d54b368eab03af746fe186d4c785009c57868d8f82d4738b45d02ba10237
SHA512574d8b70431221b76836487cf56cf531b3f53af2eb411dee386da0dd80a365e7bc6371ae9bcf7cf1050ae8ececfbed902f020b3a821827c17a72c81af441729a
-
Filesize
5.2MB
MD5ece375eec3a3b3b297434a524b76c899
SHA1e8d399a64d4f500477a8ca810e8e1cbbed91b0b5
SHA2568f73f36873f82284c06869babf1caeab35ed55abd9d41f3e749d12aad196852f
SHA512c9dcf69f35617728a5998e797b948f02e27853129cb2652461dfd27d703a79812e8a00b776e2eb416fa3f9940997da7b190eeeb4f67964d8433ed4c09cbc4628
-
Filesize
5.2MB
MD528b25fd04a31488293c0619f98b96a83
SHA1bdd142cceba7bc673a65699b304b9af81e48f089
SHA2563b19c6b62c0a3123204b12b9ec0b26f56f6b4a81fe8cfd6a644498b2976deb3c
SHA5120e55c9e6da596a6d3ec8d697b994c8fb13f72510a51be9f5f21d096e281f7383c61c8356638ae842073fd7a910223a8ef6ecaa653f66830473ede8ed8d267a88
-
Filesize
5.2MB
MD554b49dcffa62290ca433a71dbb605b6f
SHA12173021867dba8b03b1e330e2cfe6ed611761904
SHA2566845b087adf91e8d0f34af6c3baf14031fa0f5f94f063ad59df56fd340111bf6
SHA512061e564426c95f6f0b0af9a46c802c7f93cc5e982e2687eb7a409eb382bb2d8f6eb1e55bc923dce0af9504a8fb42d0928e067ac6c57ef82f9694ec49515f089a
-
Filesize
5.2MB
MD5cce260711eee06a6ebc427c932a7a257
SHA172518233df12c0f6790e7b98dd8a65bb9df03603
SHA256aa4bc051f2fc6ae3732233b22bd102ed6fe16cce0505d2804b80169d04f064c6
SHA512a55100d3fc318843579cc68b196a48086a65e1ed3d8ad49f5aca157d87433862afea9c4424fd77a60a2ff3f757899ba1c0b719852d646d390c2234ab8c2ab8c5
-
Filesize
5.2MB
MD5b9ccf7c15ffe6f6534dda5a0971ba4cb
SHA172b06514a38e66b80c10bdcf955715e5fcdb5c60
SHA256aef0ba0d14a95cb1cd12dd5d68051565dc5b1d10e4fde5046d5371b1ecd650d9
SHA5128e63e707d907e6e45fe58dee2426039a2327c764b493ac4d161ba134b71b12612feb2f57a709bc3e72fc663a3c82d3710351c97a08aaab227b98e06df69602aa
-
Filesize
5.2MB
MD59453eba07217376b987e9797412568c7
SHA13ba5188dc8da05a2be8c47cc79f3300da40c311a
SHA2565b9932b7705cfa0b04dbe40bddc342f25aada16636b9694a6b6cd48b0bc74153
SHA51218421fde88f5dcc3fe02dd20029551ccfb2e47048ad2a9ef92f0dadb942d08b6ecc300e76f452d19a92bdd4d187ad2415861bab74a49c1c38a077d6071b3b0c6
-
Filesize
5.2MB
MD53eb575ddbe12ec67d7a2951824a44ee3
SHA13828e7b7432a1c99d462be97c7efe8adb9cae0d2
SHA256cc1ae0fe5af0d5ca455662ad78cd0b1153f82d0573e197ab6b3afcbb31348adc
SHA512aea655b27c954cfbb0cddf6024e6157ee182eea557e0bdfc2a2b9663e7c57cf0695a28e8e1e7b64d885ee640e4be83140e4f4ee5358826a80bc128d401ca108f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB