Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/01/2025, 04:42
General
-
Target
2025-01-22_15dac6d9deecd512e917c7577fc103e5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
15dac6d9deecd512e917c7577fc103e5
-
SHA1
71e8c3de5adde2fc50668ac047e8ad034d6116b8
-
SHA256
124efacb7cfda799eba0cbe5bafda34a46142187d31fc2c0b8aca9456414a236
-
SHA512
949a9f306e0e723553211b3d23a1296fd935d0646666cd45bc4e11fe25b69f5b83ec178dc4b06465d0eb2b43d1a5c5abd5633b6db70fb47a62720a7d1921fd83
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibf56utgpPFotBER/mQ32lUI
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-22_15dac6d9deecd512e917c7577fc103e5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-22_15dac6d9deecd512e917c7577fc103e5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ugjTOKo.exeC:\Windows\System\ugjTOKo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vmgvdHj.exeC:\Windows\System\vmgvdHj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WETMVjE.exeC:\Windows\System\WETMVjE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yMvueps.exeC:\Windows\System\yMvueps.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OqunpmR.exeC:\Windows\System\OqunpmR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SfrFJBC.exeC:\Windows\System\SfrFJBC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IfXBvjm.exeC:\Windows\System\IfXBvjm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vtKWpTl.exeC:\Windows\System\vtKWpTl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LWrKeSk.exeC:\Windows\System\LWrKeSk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YzrvfUA.exeC:\Windows\System\YzrvfUA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gTsPFei.exeC:\Windows\System\gTsPFei.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bKOMxGf.exeC:\Windows\System\bKOMxGf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MQiqEQZ.exeC:\Windows\System\MQiqEQZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AVYxkBS.exeC:\Windows\System\AVYxkBS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uHLTdKh.exeC:\Windows\System\uHLTdKh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CAoFKPd.exeC:\Windows\System\CAoFKPd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vyMyZeA.exeC:\Windows\System\vyMyZeA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gttjYnG.exeC:\Windows\System\gttjYnG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dNnohHW.exeC:\Windows\System\dNnohHW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lsqMjAa.exeC:\Windows\System\lsqMjAa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EMLBCLa.exeC:\Windows\System\EMLBCLa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57d21ac26d8d8dd8d61baa00a8f268bcf
SHA1531d5d807d77b066075a3acad1541ea4ad15cdc3
SHA256e92e422ad67c614ad32a7b2ce7d078d24204b7f94f2f07ffd036e15e8b002986
SHA51247dbdfcd9fd5c4c22d4f504c475d279e1483cf403fcde0e136f5ca43fab9b2542f9bf3db9486c458b9bfeead4aefbb873e2d8332c51ee57d650a92c59f4633ef
-
Filesize
5.2MB
MD57feefc9af15ae273ec819c5f7fe342e4
SHA16769105f1a8aa5ae0aaf96949c5af4a86cad061d
SHA25614b254d403033386c411f48fbb939f8e1fb1bce71520ad2996446c66788d8e24
SHA512eac841e3c193ca4e82ad8f1347c0fdb70cfd6fa39684f392f570278a3adc43e2ed717da84fb3d40fec9be96177158a5335c44146a2a4f0db0be507801868f5ab
-
Filesize
5.2MB
MD57c77875e63f8e23065708c7d7a344771
SHA1c1f1b49157e47d6a1c94331a58553588887a8e0d
SHA25618c9998b81dac88f9c07ddb426dfc59b64f5dee80e9e377a3638693e3cc3aeee
SHA512296344646c42abb169b8c898ac6f2146a1385e5003b25fb420828f7a02a18c528e93b69588b06968386b7c2e9453b4b558500cf37ffc0aee9feb0001f6393623
-
Filesize
5.2MB
MD5c413e88128d3815af45db14286595432
SHA16ae8d6fcf1014e6bfbd666effc685fca9feeaee8
SHA256037185b00128130ac85ea1bda43ca6f70a07a21b25efddd09be5febdc7c83945
SHA5128b73bef6b78c6d5bebff7e55e6b789b285fde21e21b25182ae4762b111f2e807a2203cfec524be94c76fab84fbb3f69b9c826bfe9cb377775a1ab94b22d2d870
-
Filesize
5.2MB
MD5df9306313729f280242c1e6e8ce559f8
SHA12be770657887bea8d9cd5dd328cfc3d82ba1e4fd
SHA256180e7fc50feb23484a4eb0f2eaf26b99dcc9aadfd7d2b241ac2e6607efdf186d
SHA51227f112a2a230d55706f6587d6d0bcd06af80cab194ad46e0b53e332f06d85ba45c1e37bba5803cf08b8558a2004bd6adb33b27b762c84327185196817c76d9f7
-
Filesize
5.2MB
MD59127efa4bb7387c2fa4e355a716b4328
SHA17c4b5077810f89385d42a03eff7c485cf3fe9d07
SHA256919c8e10830092fa20863d29b882cd861cf0dcc984124e4840aae6f0f38b21bd
SHA512f6475f13a885d89a9eb2d06d333119deff58f935aca8441ea01a4b2ae6d33608423cc789bfde07d5af15c321bd8cbf0c7b51ce49628850c4a2cace2a16b79dea
-
Filesize
5.2MB
MD584e1c2b28aeb48a50c6f70c97a2b780c
SHA17dd4e9588af78c1ef913144cc62cf804109109e4
SHA256d6a38772907c43eeabf3ec8a7718ff7d60d05bc50aa33913d7ef4b4e67006b49
SHA512611bca5c1269c4175d36d5c8334e490b375921782a1a380ab6a0c066995c34c8562bbdf2b9ee9cbdb05cdf1cc52e94d5ac2a2e67a449f61cc20d5689d2490ec1
-
Filesize
5.2MB
MD5348fbddd94ae2d742d625491823972e8
SHA147b28cba36ab1e6f6b94d759b6fbf1ac03bbe415
SHA2563779e2b746acad61af4ce0f3154a45d46ee4d815b2f50316fcb1d2126b8e320e
SHA512bb5c82fd6ece6fd98e27d23247908fe27d67c94a9b6da247c065d34a01a307fca73301cf8979161cdd5232b0008b6eacb890d0a2ce51032babc459da2b0d6986
-
Filesize
5.2MB
MD51764a138f0e81a49e359f2747f5925f0
SHA1ad37c87df657aa0048ac0cbfe406518ac48a4690
SHA2569cd3d82eec3df1bdbae04601d22920deede5f8732a132e1b575abc3150ee57a3
SHA51243abb83e8ff7f02f455d552f91ce8bb7ddc682c2db93bbac8a848070733ed707003cd1833ac3ae3c26680917f0a4983135e37ffded515119140576bc157459f8
-
Filesize
5.2MB
MD57703aa8038986845d31bfe88b7393b8a
SHA12147ec9de8ff1ca0433eebf05891a41e28f2e033
SHA256543a1d7ef9cffba667c993e20e877630b3d34ecd93050383a91da4d0dbf3af6d
SHA512dc49de4b73783fd2b2299a5dcd5248f2a0dad933a1f4b593b6a9b4627717b97f389126b73fba5650aeea092598bb1e6cafbbe8f76c98517e061fffe517ffe392
-
Filesize
5.2MB
MD5d0df652851a0de7c0d305211725a322f
SHA1435fc42a4a561b778660619135cee86b6c857775
SHA256b20313728840a97981a73a2c886ea5f9b2fcce347d5452b41d466476e673914a
SHA512e9907ea48edfd9629849a8f587db5f4ddc07cec899cba2ab1a675bdd555b5dc7818226d011a9dc8b19973b7ae332ffb5bb2359e883c84d76ccbe99b4edc97348
-
Filesize
5.2MB
MD5f867b7c57b434ff411f2d8799281525c
SHA1ee6ce98702d45e046255c93fbb5186e920863294
SHA256a5caade1070f23c959d7d274337ebee533970525dcb7bd0de7a60cfc8b74e721
SHA512a9a4bd9ce3cc64f12b92abeacfb3bd2ea6f6b98efa6272669c167e44348776e6ae2f72751f792cef6d101cb94aa3f7348c09622cb2a7fee19cf206eb93822a5a
-
Filesize
5.2MB
MD57afcd7cad991327c5cd4308704a26406
SHA1dbd315dfaaed7ce4e2c0f7af91f2d3decd02cef1
SHA2568366dc491b0c1af87b0acc14599d6c23299930765f4a307f51ede8631d755852
SHA512f5741eb3aa739f7a5b5eb44905b6170bf57142668440163d1f458ce2cfc3b88af47c1b99297d3e3075bd11f870930e202a3f3695e1a62a7009339db814ef6b79
-
Filesize
5.2MB
MD5e0f4cda38c598b6bdd5c6b812ef3fb3c
SHA1e66afee7ed2e6573d2d53ddec7b0993ab8045dd9
SHA2567c40806df9852be771222c2bef3c9cbdbebf48e6ce84492295cb6fe0c43b0080
SHA512095c708ed224603cb390045f73bc10350dd2926d64071d54bb256b6bcf9b4594cedd0129f8600f542bdfb1ffa22b73b3f496e20b2ee2bc1be81d865daea54662
-
Filesize
5.2MB
MD5b59f13461827c141f4ed58881c308a10
SHA124f229aed3d0f2ee5138d048234cfda1a148886f
SHA2566c352c90fbd95d0a7e909ca8f22bc7f60d722be075138b3af4781b08a53e5dfb
SHA512cd25c174b8be3d9e0635b3ab75acb690c5abe4293523cc2361ba2971ae98d1452d6a5c3a11688f191f8dc2ccc2bade059fa9e762e642d3b0336710fb485570d7
-
Filesize
5.2MB
MD58857b6031fa4ab211c4dc8aff5176d5a
SHA162fdb1e470d96e8b8ac410293a328c30df2fea75
SHA256393815907e993a380da0b662744c7125908ee3a41aa97a052043cb0540177958
SHA512fd671aec0b1447e91468b6855a97fa68695960b70c768070b0ad6f29a4c53dde8292c236b6afd5913dd3faab3763f934e5b9ce9e449a23c9c6ad3c48d9ddc6a1
-
Filesize
5.2MB
MD53cd347e57efd68dbb0b4e865797072c2
SHA138a7bd49854b14a4767c89f530134f1347bc6bc4
SHA2566b41cfcda80c9666f11a44c7ca1c50fc56aaf1e0c9279c3c9349cb11d7890baf
SHA512dc7fa1c4199564c19962c3d700bf725018e77abcc00357ce9dd7fa577eef7655954617c4c7bbbbd4806d3b4d64f6017104a0e1042aef7e898807027b9611f23a
-
Filesize
5.2MB
MD5f380fe462a6c143c1856e4316d525646
SHA1f9fa39cfcdb098047f5745ba7176f7e9bee91fb0
SHA256d7a1ebcfc17b244936799dc5851615d7509fe9612d972c7e0abb357f4b34ad02
SHA5128aa5f90bb2cbb22ea2f243a96fced687fda4b1582584d11f9989b0a76fe067a2a88231cc655c7905e29a23c030f498975103e0add330ccbd1cbe3fe4445e46ea
-
Filesize
5.2MB
MD50767f6a0eeb97e0b78851f2c2511ff40
SHA10d5e7a9b569038389135f40b9648904a26db178e
SHA2566058b9ae03b92c29a817ae04ff759f246487da6181c000d6ecdf9ee7bf58a318
SHA512aa68fe40743ee60f009026c29b07ef192ada6198bc774248acdebb0e41b3882e4a7e20ec3aad8fb77eac833556541b3a913cce05bb8d4f79ec8c4b829d51f154
-
Filesize
5.2MB
MD59b4129a4f496a69ed777db4e5872ae06
SHA1e8e2332c5d8a4d5a95cd947ba687ffaf97836890
SHA256f36be310d208af889f0ad78cc08062d9e61e376600ebb111a2c5edd4f608a483
SHA5123a433c901c7e9c204851d0df619d87ce109355cf33c2c84af461281b807873ec768bafadbb8ec9df4535d379e4f4246be2b950f6ca13044e559ea2406bf46269
-
Filesize
5.2MB
MD526c98f6d7d5d308d78a29d95f5cf02ae
SHA1f1889954306554fbc7559f02974b087c9ab45a9b
SHA2566be088712a56c616543d75eaa65b2107597ce5d8ef11d99471bec629ddc7a866
SHA5126724703ea4463b4104ad1db126f5f2d972ee1b0cf7d58f777d81120a0523e4a395ea3df8b6e2cab8b01d33d931c604ff5818ad66ce5065d14b1225c8df2e98d1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB