Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
22/01/2025, 04:42
General
-
Target
2025-01-22_15dac6d9deecd512e917c7577fc103e5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
15dac6d9deecd512e917c7577fc103e5
-
SHA1
71e8c3de5adde2fc50668ac047e8ad034d6116b8
-
SHA256
124efacb7cfda799eba0cbe5bafda34a46142187d31fc2c0b8aca9456414a236
-
SHA512
949a9f306e0e723553211b3d23a1296fd935d0646666cd45bc4e11fe25b69f5b83ec178dc4b06465d0eb2b43d1a5c5abd5633b6db70fb47a62720a7d1921fd83
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibf56utgpPFotBER/mQ32lUI
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-22_15dac6d9deecd512e917c7577fc103e5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-22_15dac6d9deecd512e917c7577fc103e5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yILyglh.exeC:\Windows\System\yILyglh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HdZvfqY.exeC:\Windows\System\HdZvfqY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FwurmtH.exeC:\Windows\System\FwurmtH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YMZEzQe.exeC:\Windows\System\YMZEzQe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mZriKUM.exeC:\Windows\System\mZriKUM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cxWtXiO.exeC:\Windows\System\cxWtXiO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RIUdoZv.exeC:\Windows\System\RIUdoZv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NIvSmVH.exeC:\Windows\System\NIvSmVH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FyraSse.exeC:\Windows\System\FyraSse.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\khIMoYd.exeC:\Windows\System\khIMoYd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DfYnsRd.exeC:\Windows\System\DfYnsRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bkKDloO.exeC:\Windows\System\bkKDloO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TYGBYVT.exeC:\Windows\System\TYGBYVT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\didcqgg.exeC:\Windows\System\didcqgg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lfwRYRQ.exeC:\Windows\System\lfwRYRQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LfURZyY.exeC:\Windows\System\LfURZyY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MyRpvzn.exeC:\Windows\System\MyRpvzn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dpQjgML.exeC:\Windows\System\dpQjgML.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OvnBgZn.exeC:\Windows\System\OvnBgZn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AcXqXwf.exeC:\Windows\System\AcXqXwf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PFTYKOr.exeC:\Windows\System\PFTYKOr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b85650682aea2105541f453a12cc3a7a
SHA1a87eefb5d3753f3127ccdffe34629797ea42d511
SHA256842d93e89a7c88ef71ab8688f1dcdb0a3c7acd1ba358e4c40e8054ccc0f434b9
SHA5121382b8e69f16f33490d4bdbe39cecb44aaaa06c3e8d7febc028cda3610d5266ababc1bc5f47912573ef59cc75cc580e0a459be02c95ed81bb13d62ddca8c4726
-
Filesize
5.2MB
MD5242639aa51fad25c05c4ebab0f90aaa5
SHA1b2f8de1749c08e0c9e059ea476f154a92a368fb1
SHA256d92f9ea7e4cec9167d2195152b35179964e391c41a69a7da07ebe001b0ab93d4
SHA512a95e4927ddef4cfa77c37d9c32eaec148ce7662d69a98ced51d92362806cea5cc97b062822b68cc19741e01c9930c3e3a1dbe3e6c552d4dd41c84bb9dafe896d
-
Filesize
5.2MB
MD59cd0fa676a0f1eef8abd1de8eb9a7499
SHA13995af6da149aa69b334dc37c334b26dcfb30d91
SHA25623864c1eafdd7da8b1d4ca37d1605a6311f119471596be4825a45f385416a165
SHA5120366136af621cc95c5cd8f652e3b7e53228397e0fb8b1e1cdf5adc1dda20583699532d0b47a7f0afe84466d2824ef9ec2fc02e6b69761c3dbf485693ac881c99
-
Filesize
5.2MB
MD5247cb3514123ee97f694953c3073193e
SHA187888f96fe9d72277f2a981ba49cfc773d86c8a6
SHA25633461178b13d14cffda9bf19d1cbf81ceade360cd7d02e6c4aa8d84d153f3202
SHA512d8695396a5429b9dac9983e4a38354de95eebfa45bebc70da768a404ebb4376e4dfa4292d1e5f9b8694f6bddf56f60d26c8edb1d26020fc2fc80f208f6b245ff
-
Filesize
5.2MB
MD5b2911f456a5ac2ee595c512eba595a4f
SHA14afdaa27f3d1374111e55a1c8832066d1dd10b2f
SHA256902e1f7c9e22683776611b8e0e7f97a5c4a7b68c53359a4855637981d641dc33
SHA5128fba3c3143d7dbc756c38ee62947a7b6835915a63da51196ce83ee173321d86c4e5ebd101a2d05bbb29ee139def3dabbd4a8baeb95aabc92466e83e1318fdf18
-
Filesize
5.2MB
MD54e791c16be13c5921bf7a106aea9e586
SHA18cfc86a4407b03f99c2bfd312cf31ef857aee9c1
SHA25691806978748c639bd0401cdbef08d6566b22e8c9d3e32d38dfded85a1cdb1c1c
SHA512d959ccec38ad902f457c14f1176cc4852ceff4ae53a211e404d2764f321d78b404cdacce0aa600d15f1ded70de2ee07e21cb1dcbc95e51fc6393b093f7601cdf
-
Filesize
5.2MB
MD533af3f0494956ad763ffb01e98fc3d23
SHA1f799a882cc382aac9ed9ef6a6b144307ba30cdce
SHA256e4fc13accae476da45b9ccd7bc32c680eb15ebd55cc25b1cf3e0ac928b08581c
SHA51283e19996d7333f0d7d42fa9d0d4b0017a6ad2118370690121e555ea0d147ea4f0f687748e3792367569cbc42b153be0951415a7cdcb8282d27e00a642d78f280
-
Filesize
5.2MB
MD5c8bdaf44fc02bde066f8de398921e4fd
SHA1f43aa8b08e3f2034334f5982560fd2ff63a9e5a7
SHA25692e1777b103399fcd47cf4ffb62f1bb386c46d08069f01ec07c90d6027a6be92
SHA51256b45852b895f8e2b1dc0ebcff6826cbd1f99ba250926bb3b0c0e2d1a29c402963ed33302746e12fe8aba65f5ffa3b0a6cfa0ea8e5669f07ccddbae8c11b4569
-
Filesize
5.2MB
MD5a1fa5ed9e5949eb53723080e576a045d
SHA11847d0129ea782c6263eb02af86e4edeb846b784
SHA256aca110a3e2388d90e5b04ddd4d2d869f1b526985b0ce63823f6acaa95de40225
SHA5127c16a93369d01b5f2be695bd08945e621e4091a3b8e3b63374958e61caf526f393f725cb0caa1fb37bef87cd30c857f4617f215c88c9aaefbb616643c5009d16
-
Filesize
5.2MB
MD597d3daf638a2cadc85687d9ecba8677b
SHA177da17d8138b66ba0925324de1217b451c094d41
SHA256f5a18937ddf52471fb505f9448c71bcf6c87a4c93f4d8cc7ab89303434dc9964
SHA5126f34b573dcd28cead61da3483453fbccad5d85363bd05914dba551789b9171bac006fbfd6589ba0cfc9f75ed0c4a31bdf2be27bf9d7e6a761688ed7f9e088cf8
-
Filesize
5.2MB
MD52481d6a89a6cc5b767409c94a8fd8905
SHA1d9065c2fe5406d948cca0c7fe4ec4bbbaf3e1a01
SHA256752bf95c1757162170b8edd6acecdf32b79cebf71e65c0cd299fc85db7bf8f2a
SHA5122e995ba541ee2e0d0ac2b38ce8153a29ea5a4a4a62c9d1a24cee806bc9cc791ce56bfd3c088ac7bd78ea1ec21fd73d24ec5e79cec6c8b2f679e7e5bf28c46823
-
Filesize
5.2MB
MD5214a5f4262bce80072237bce96dbe9db
SHA1b2adce587368967213f1632819bad256601fca7c
SHA256a82f1a5422f3fb68a531045ff3903294ae45e1edb584bcdcc921455e5c72286e
SHA5123b5d13dbce36eec461525f4763058b544778efebe7c95f5da99f31ea880434835b4942723c2f22d1b65c53aae0a13ff0c69abe0752b01f79af40bffa5ab03ece
-
Filesize
5.2MB
MD54f7afbba422942cbc9cc89be8dc856b2
SHA1e697d9691b1bb4ceb3ef54dccbc65c5576670443
SHA256bb49c626bf89ac49bf260ddbc077f2a719dce6a760977451f7fd14931a45e283
SHA512af020b052d9d02c0b6b10b5e917627dc8e365434d80e5616b0d743815bc2861db427b980aff4defbea98385346c9195e8f24d1e0a9527a6e72bb529d52aafd0e
-
Filesize
5.2MB
MD560afaab75c46afd2d35de939642ea810
SHA18713250da2861f62f02f4dde37fe69b0f45e5640
SHA2560a871cfe957b9c188233489cc919484db13ec6f9e7a818cf4756d6fef5e9cf48
SHA512464b507608c58cfc6b793122034d6c127512afcffe14cbe0b2bbf17b6a372ff38005a897da00661ceeb98cb5ba0fef6c82a5be51bc67e450aa356d7c17f680d3
-
Filesize
5.2MB
MD5550c30c8c52da48ce2c8067af93267f2
SHA18a9760ff89425624fe4aea1196ee5355c07e0e9d
SHA25615dbd2199e35e3b8f82980f948d8ed3e134d1153d39d77964af979f59981969d
SHA5121d1a82ab77a3bbf66b119fdcbec20f8ea48a8a4bd1226124ac7e5cc83df6d28a48fa51a20d56324accec9e3abeca53a341cf45c12468b7e24b40b4ac6dcd777e
-
Filesize
5.2MB
MD5e4e90fc1e700e9cf0f5609664123914f
SHA1e375110050b7a8e0aad0bc1ab14902b8e9a0ca11
SHA256693bde226b7b585594e2db819b9e2eb965cbc864e65baaff33bdf630110dc623
SHA512c95102eddc5d7534c30c21c6a119151301e6ac017b54f79ec2c25f8470f735053fe7654a49e3d72604207cd43cd851e163dd36d10477b6e2c29f45d26ee98634
-
Filesize
5.2MB
MD55c33b9932331cb6f9153bb35d4ea423d
SHA1f0ba864411bd5edd8b6658ed86ecf6c84922d2b4
SHA2568690de0273cc7c5e2b960a705eb0730978bf179f84dbfdd2b81148203b299941
SHA512f162d542f1d2c73cd2e98c26e60ac666c3f3751286bede14cfee97811b9a20e56f1a5483e72c2f5105d6206f9f0c6d3a3bd00e911e53a499ca4e1480397b162b
-
Filesize
5.2MB
MD55afcb5ed29cf2f417fe3ec295dc38bed
SHA182929a92def4f839006392b206277231d5f7d8c2
SHA25615fbb97283dac8e0546382782fb80787eda32207be43826e3e63bedacbad2960
SHA51251a8dfbfe9720833539278dece6244ded0340ae0e2e354ac2c1de18b0ea898ea2fe642ccef99accfd148d1848e5e7c8680afd79fb607a81afcd238249f4137e0
-
Filesize
5.2MB
MD5683654b28d79da76e48ffe824c49e131
SHA195dd3bf92979c814f5a8cf840aefed87e516fd78
SHA2567dfd90734736b32227ea78c3109f0a7dc9ed717556ada9f6979d205c30f32108
SHA512e5fa9f686d47a9d515b9d0d755c03ae0c9c19e3b400d853d7c4af57c80349ea7a47914b3e04a48d8940ab23f6b70c40fb638ebd023b757ef5a8fb23900d3982b
-
Filesize
5.2MB
MD53116dcf7ef9f64e418f488fcfd4d3320
SHA133d7299a020ac648988d277ff0c07f113d5c028b
SHA2563aef1540a73457a762f48a15037d38bc2890756e2b8d98dff58e7a0512bbb313
SHA51230a9f5d368a64de5201686b43bc46e50b8163274d603eb0259a9004fbf8fcb6971ed37319022c3a91fa75ecb4da950c1588fc5e187ac43f6d942537278b866dd
-
Filesize
5.2MB
MD548a43c288c4735d043c07a73e363c853
SHA1fd5bb3484e70751a08e624036ab6c507a151c346
SHA256c6dbd351e3609790ce8d32ee174866a8cf001642d1417951e59e13bb079d8d98
SHA512ae2e93e50c6792c17a5b523b56c952628a9053409b0dbae8fad399562d8e02537944f3435b1ac043370f965797d477676b56e961a28752b690868a761b94ec76
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB