Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/01/2025, 04:45
General
-
Target
2025-01-22_a376594f497916331d7d92f146d654a1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a376594f497916331d7d92f146d654a1
-
SHA1
eac367230ba2f4463efdb440b3399fead983e730
-
SHA256
6dd913a33202ff1472777c3570572e9ceb6a41212774cf48b5fd445c5efb3d0d
-
SHA512
bdbe6e426136b25b20f3a95031a495c3b26f61575cad6563ed0bf75cd9ae27313cb26a4988edd5c7c9658bc79cd17cca036f92d9cf5fd4a2dd56bac11d9aa258
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lUb
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-22_a376594f497916331d7d92f146d654a1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-22_a376594f497916331d7d92f146d654a1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\emJQmRb.exeC:\Windows\System\emJQmRb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jxmYpgr.exeC:\Windows\System\jxmYpgr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pxFesOU.exeC:\Windows\System\pxFesOU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\czEJMUI.exeC:\Windows\System\czEJMUI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wUtDNIF.exeC:\Windows\System\wUtDNIF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\beGUmYh.exeC:\Windows\System\beGUmYh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yOyUIzh.exeC:\Windows\System\yOyUIzh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TGCwQqO.exeC:\Windows\System\TGCwQqO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jOmkLpx.exeC:\Windows\System\jOmkLpx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LNkLrVs.exeC:\Windows\System\LNkLrVs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wZsDEQW.exeC:\Windows\System\wZsDEQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\umtvMRT.exeC:\Windows\System\umtvMRT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZPzOoxB.exeC:\Windows\System\ZPzOoxB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JGXocom.exeC:\Windows\System\JGXocom.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FOOYpJq.exeC:\Windows\System\FOOYpJq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tlRbSRR.exeC:\Windows\System\tlRbSRR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Zdskfjs.exeC:\Windows\System\Zdskfjs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UMOdlMf.exeC:\Windows\System\UMOdlMf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TkSintN.exeC:\Windows\System\TkSintN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\irADyFw.exeC:\Windows\System\irADyFw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\boEXyUY.exeC:\Windows\System\boEXyUY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52b095ce22a85beb005bb2dac4394b371
SHA119f0d2997988bfcc27a865d6467621097953aedd
SHA2568f699e5bedd36e693fbc53d3ef6b0ab9be7def48b44334ed16cc6e5e2a1a92b4
SHA5121ab5920049b6039e4e539c3054651cb7e17bcc92e426480016bd06db7c370a6ded567665bf51a7e80cb9da2c40408d1850075aa50a66592e25cf8aa590a4c952
-
Filesize
5.2MB
MD590275ef147e91548bce19580e25727e7
SHA1d989a9d711a31853f09dbc9e1d4ca81bb02d0056
SHA256b66476d3a8b21a0ad43b0cf1226a5e87187021b2bc8798ef61ab98858adfe3e2
SHA5126627835f007d208b5120710d00421d90ba5755a120186be8594d7cda0b64b153c19274ee6eb2f800d81b570bf7f6ea3e5666afb559260b47e66af0ba87ade769
-
Filesize
5.2MB
MD5c0d2b47821071ca5be05099009fd92dd
SHA14de8848b23270252442e0646d6bfcade7343ed16
SHA2563360bff78dd56286d0f082e9a443fb3f611072e6f255c179acf3ffc287d34301
SHA512f1d77081af036f3ef8677bcf2332c8748548a237acaa7ef3db840210fda74aa441498fab3783c4161bbdce968132346e2fb8ca590b8a9761d0f83215ac63fab4
-
Filesize
5.2MB
MD5b1e4d9ed55bbef23f084eb5a6da4cfa9
SHA12dfd717449cd1256abf875b9677f2d9d99511495
SHA256cde2a78625e3aed84cb194d33f1141270e475601b705577b9f537a9e6f7bb227
SHA5127f9e4cbe9ef4c84dd1f5d24cd52681325c35d7fec3e2c3a67e2692cb45376799e66ab116bd070ee0037395e19b71a6939d79f853fede4255da3b0ae2c67704e2
-
Filesize
5.2MB
MD5fb546c450e8f4efc473f2f128365bebf
SHA1886ca630504b77d68cc48df29374fcb308f0f22c
SHA256fc31e6150fda98f6be485cd2cbbdd3e08274d8640a92107ea2ef126af9f5134e
SHA512c35cea0247d09610d7a55ec9d3abe755a509a7a5abb60e04b6fa9d7947bc47931385f8d36839e6ae5ee419eee5bf20c791230fc06dd9793416006d5edbd892bf
-
Filesize
5.2MB
MD596ce6cfbbca96f7ec3b5237baac49049
SHA167aa6f12038ff5e1b5e94be153b181825e8b8855
SHA256228b7a837429515faf377c8f05908aa21564aa13ecc985185a7f91de8c0d4254
SHA51222d7b0f1127769ac52a10074695ae0617b249a37aed75c6c6ca05ff29e67f6fccfeb44ed6e8f5f9f30111052a2cf7621498a53f048ff453d2526adcb5d4f75ec
-
Filesize
5.2MB
MD548b6cfccde06b2c8745fc5d50388e1c5
SHA1fb7413f42b9df5485251a376c5c7cc68b4efcfbf
SHA2565a02d28fcde7b37eb9adcdceb89fc89ba2b853342ae8125e896f45fb55e23272
SHA5120728b75bac84376db8563c653466c076e2b9b21119f015c6ec4efda5425b9f22e6533f9f0211fa0a13a424fc4548807e3111e92bab5dfefb774fe5ed653cf49d
-
Filesize
5.2MB
MD5a33caa77557f0f5ad2344d2d0e33ea9c
SHA1eb1b5421358e2d275fbcf941328a511e0e2bb8d2
SHA256564cd810a5ea3376b8497164183dd8b46eb775f3e7de6fc9144ba4a1dbfde88f
SHA512af096bbe6cf58b40268a87d41e11c1dc3fd0004d3fa966d0a48e6054b9916684987ceb0067f1f8d19c09d4105b4322eb37e494718a58c1f633bf72411e38b936
-
Filesize
5.2MB
MD5c025de67c5d95a2a51d3b58118d2c29d
SHA1099a02c3e7eaf2b2f6728bd0f9dea711dd487c01
SHA2567f13f3d6e278b08e7e5a502230c8aee27382b59a3376e537b181e4e304813ff2
SHA51289f3851882e9e4bf6ff24e20d744b598f167c09b3c92e997ec001e203816a6d8016f4898ec4056e8dca10ca9a64c9c77290ddb7dae787aeb4f60a67a8fbd77d0
-
Filesize
5.2MB
MD52dfdb1bb3dfd70ac7d5fe2f93a91ab1f
SHA1b8a97fab9b8b37dcf093588659b1f26836551a25
SHA2567007a8e529f5579222ceb89aa3188e867692a6db908a5b14825166eaf8f54833
SHA5121a41de89d52fe70a5bcc17fa4e4ecd3bacd9b52112c01df27bd7ac4c5b67ffd7ae4079df1f1b14e3f9388ed4e92d787fe29805d62540a2867b080b42e6d9c281
-
Filesize
5.2MB
MD5037fb555d903d373f2f34befd7917f06
SHA1e85b58289ba6dc1f17810cb1a24fb778c9665bdc
SHA256bb90bb1d6701347d4d0a9be2ccc418ca587300a85f8ae957f4f2e0b2997728b1
SHA512e685fe7fceb8617e665e07179c6d612f6b50e978a5ce68fab677735f231991a5a25f350871ebc04ed2cbc6557e753ad841b070c36461d1c6a7f1f1ec7927441f
-
Filesize
5.2MB
MD567a493196ce1a82d17ec6fb7a5411d31
SHA16a7937da5f4461a25241b021af9f4ebb0b9793f4
SHA25697f7a89d63627d1d35f615f4a475e1525ed908be9e6dabff34a40f92d374d059
SHA5128b69f268fdb31a20e9d6f37b41cac5b621c6b89542f0c11a89a53135e9266bec49c694a0fa5ac2a32811ab9e84b575641f426a18e6161152aca5e2e71a7d6770
-
Filesize
5.2MB
MD51c39cd3e1c71a23c12aadf8e6f2a660d
SHA181a43e9122df4cdfd79a489502d5329b4310c9de
SHA2569cff74a7da499da85871e4fba42a19b1b52572b21fe3c16af7ed384ef08e59a9
SHA51236e3119ee7a9c9c4c1d65f82e44d77a621abe1bff333e3580359c784e837a0c938d3b4acbdd80d48ae398812e7c146433542f023bff876d576384052864f847f
-
Filesize
5.2MB
MD55883d4d58adc30a9d64a1d55e4c94106
SHA169752a4b8752f60a9be94d28807360e8df983e00
SHA256fffa4dbc6063f5a23079f820b16b8c252e9a5dbeeaf8957c408116b0b8aa0f39
SHA512b38ff4892d44e6e203b71a8ca45b0a71dbfa8804a2e567bae9dfc53bdcefb47925af07f15aebc30d3bb3764e51927fc3618f047b70fe1c5c15fc654bb520bf4d
-
Filesize
5.2MB
MD5fa891d24dc883909ae215182c34c09f5
SHA1da9f90a4e6618806392b1f41656fd982df59d29a
SHA256a3a6f762433a9039d7c7862f1eddd1dacbd4d13125fbef157be401d39f93fa73
SHA512fe06db3c74e1bd79f0e4ac10e04bc9f0f04cf332565a4b54a5ff67b7188beb4b900f11a62ef4f13cec97d5bd93a6cdc56890e07f1255ea303b0025ef2ea1a8e6
-
Filesize
5.2MB
MD5acf96117ab21046908d602be7b7e5a4d
SHA192a1d8bd98d1d98c42b6e91d9bffe4b65db55a4e
SHA256fb0eb77accc534747db72e4963b734540a208e04920b58c9830775c64a53f797
SHA512664122ec02ea1961b5b8159983c86a44e3144da7dfeeb259bde7d0a1659e3df27676f2c9b3c5d19ff1698a789a5cccbb99ad2fc7dc5d7f9b3986a9620ca8797e
-
Filesize
5.2MB
MD58e858ba4130d1d79089eb05eea634f4a
SHA1687f4c01d2f8683fe76b357ca4fb1a752318d68f
SHA2567e7c2a33ff37f868b909e3e2fb10c99f697de75686f05fc9196dcb243a6993c4
SHA512a96f1e45ee1a72f0f7393d80a68b2af5caf6c7fdb60f9e814fb9363db7c50bf8ab78c40c39ff8ac6e4bacbd631fe96903e4934695095529bdb5d1aa60486585f
-
Filesize
5.2MB
MD56f632543f545564cfb205bb803e9a5af
SHA1417f7e5bfd684d121ae2b9eddd47eac1d1a3ff16
SHA2561ed422882afa7c9f3b7a048fda500d287f888999fb916a53472043c1e9d02487
SHA512bd7e1fb881748a116a90dee5d5acb86a85cb08d75f1b013b86e08c88127e87ba1a683b0e5401b90b9f03bb8bb19bd1e04d28066a5418ff661352071590cf3bdc
-
Filesize
5.2MB
MD546860dc506537caf4398092a6ce91455
SHA184a19a53a87731ffb65decf1b883584369487935
SHA2568958a901c690e7456e63c9a75a6e4d95b0d82760bb49aedd9556d65590860992
SHA512e148b1430931e167c068d8e62bda66345dd68aa017ba1a3f03c2bfae41c5311b004613eb73334125b4fa61feba3a030ce724ee9b4ffd05c19478c74db167182a
-
Filesize
5.2MB
MD5f0278cf53129c33e9258ae2bb6dadf12
SHA1c90c29eb3e0257ed3e27a08b6421202a1a88c035
SHA256aec6f37243c96b6ab1d81b1c5183a840f874f6292782eb9288aca82e143d6ecc
SHA512015142819667ca10882c61dd969badca58a09fe4edb775763a2a30555c3d73f02a579ff7dc77d10bac29cced49b1b540e212d090d5086fc1feaf2ea00a887468
-
Filesize
5.2MB
MD511a1c8240fbc8c74e615a822c9d2db38
SHA11825ac57203027c423e5cfe0fc513d67dbaf5838
SHA256cbd4bb819b3d87bc9c8bba0ce0d9d26c0f07047df0c43f413bc2e02754144b52
SHA512caa4d373176fa081856d90f499dbb62372ed7c44932974f6c9b5b5ba3e769820233cfd39f0ff638e2528d035562517a210804e9293a1b5c6f42a7a6d724bd1f2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB