Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/01/2025, 04:45
General
-
Target
2025-01-22_a376594f497916331d7d92f146d654a1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a376594f497916331d7d92f146d654a1
-
SHA1
eac367230ba2f4463efdb440b3399fead983e730
-
SHA256
6dd913a33202ff1472777c3570572e9ceb6a41212774cf48b5fd445c5efb3d0d
-
SHA512
bdbe6e426136b25b20f3a95031a495c3b26f61575cad6563ed0bf75cd9ae27313cb26a4988edd5c7c9658bc79cd17cca036f92d9cf5fd4a2dd56bac11d9aa258
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lUb
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-22_a376594f497916331d7d92f146d654a1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-22_a376594f497916331d7d92f146d654a1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RNRnXOO.exeC:\Windows\System\RNRnXOO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VGMQgDb.exeC:\Windows\System\VGMQgDb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VekKkYz.exeC:\Windows\System\VekKkYz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UrhLoFG.exeC:\Windows\System\UrhLoFG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cANXguK.exeC:\Windows\System\cANXguK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KdnQauc.exeC:\Windows\System\KdnQauc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KmRnwwE.exeC:\Windows\System\KmRnwwE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xNBEUKY.exeC:\Windows\System\xNBEUKY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jgDTeFx.exeC:\Windows\System\jgDTeFx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zCbVPFp.exeC:\Windows\System\zCbVPFp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CNUQwAq.exeC:\Windows\System\CNUQwAq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CmKxgsc.exeC:\Windows\System\CmKxgsc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AqfLDTq.exeC:\Windows\System\AqfLDTq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IdtVEbQ.exeC:\Windows\System\IdtVEbQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RFfptLL.exeC:\Windows\System\RFfptLL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JfTDZoW.exeC:\Windows\System\JfTDZoW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LSMknuX.exeC:\Windows\System\LSMknuX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XbDOEZA.exeC:\Windows\System\XbDOEZA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWZkJWg.exeC:\Windows\System\SWZkJWg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\imUoUTd.exeC:\Windows\System\imUoUTd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pNZzjkA.exeC:\Windows\System\pNZzjkA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD570b843445f945145bf2f1974efd79c9a
SHA12848ed32699d1392777580a5ec55de00a56d852e
SHA2563da73d0ea6ef782f8af51a2c4f3fb125e5d7fd157cc622aa12d6e4cce1b40592
SHA512beb590c8abb47912f1440e4c645002250fc9ddc16d8b82a35a0119eb35b8ad1733698a794de7a4463efb90caaa9b79ad84a7907b7d7c0ff6a67fb24de0d04b83
-
Filesize
5.2MB
MD549a63e2c0fc68907808301f348db39a3
SHA1d70759c6a3a48346246dccdc42820db8429de0a9
SHA256e553b466f8802be2807140f1ac7a676411f8301e6ae35c870b22d92ccec399a1
SHA51220981e6aab8888c021850b7a7415492c516faa557a0d39caae045188ae7cf56cb2e31cfc1e294accf678b97ff1db551cdddd4419a82ab1d6c7d30097773cf799
-
Filesize
5.2MB
MD5d3dedce3d35426bdd9dd10f8de9a571d
SHA1811b570e6783deb1fcb243d74a938059ff51ad03
SHA25658d316fd182b7c3e72066b014d1f915547a73ac37570da01dffe31d659a1a882
SHA512cb5d77d7c723570d5228bef49073ed3bfd447eb3302f5d68b874ce06e0184ccac783dbb727d4d42e149e0faef1758dc574fd0805f9c4bf7d8c9faad2eeaee33f
-
Filesize
5.2MB
MD5d2eb61149a3a8e473a4ba3041bf917ce
SHA147817f5d879b570e6d256b8c097ea8c328feb482
SHA256d264babdffd30d804517f1bfba33fa5158c18a10c0a43121ee4bf9229ee332cc
SHA512b4cd6beb95d2666cf0f0f8e6c9e13c03fee1e0ae6584887861619342d3cb4699d7e47788fb0d5dd8045203c144e66891acdbcce26e1c681a167dad24a13a3a33
-
Filesize
5.2MB
MD50c3812d6beaeec3995dcaae482df82d1
SHA12257df61d9c4e382bebb8fa0e088a4a490586ddc
SHA2568077ed97172ed1b07f8f9766170303bb1606495a8877169c6e5e06e51da972dc
SHA51233a4a6d97a09580f922f3317a41bed407eaea158338370a930bb73b3de5daa1509f745a48f55bf911139e587234b2a2a07f241ecdb9694f74e980b4cacb0e3a2
-
Filesize
5.2MB
MD54b74cc11aed17f83b55053d0aee6b49a
SHA147d26fe54b0a9d879b9c0956a31b0d7e89dbd482
SHA256e88e8e3a1b74555944b9798da087695db802274af45c3a2041d09dd3c610128f
SHA51221a362a60418c98a807fb11ce4f0e2555a24d5ce220f246f189145868a9f79f2322d0e0b28abdb14f85da07262a316453023305efe3c630ecadc6a01d9e72aa2
-
Filesize
5.2MB
MD59f4fb9a23e293298d386bb02dfb8cd1f
SHA1616793c110c044d5af2b4cdf49fb50e5614a1ba3
SHA256704d0768ad5d67faae4bed14a51ea41dd48444ef9b000c69467add92c8990e0c
SHA512e30eecf2b3d87c1c24971359598272ed7b0ce0e7a6b6fd42c26e6e1861ef1fb4290d73a2c7c0d622921435b534735a4f2bf42f7a10c68787f7b65c4550729d54
-
Filesize
5.2MB
MD5d8b132be5e7dbce3cfbfa0fe6f203788
SHA1d2e9b09be9aa78f3ecb83a611829a1a49c62a586
SHA256f1a073abba67d4561ce80bf3bbcb3091fbaa0a4eceb074bc53d574bcae7a802e
SHA5122a41cbade95e13097dacb8ee8eac0e79a2a02ebbbc1c54ae7d83c615bdb467398e6d8e1d2ee4608986ccc3b5001c270ea661d992a4a44942d7e9dcecb0fdb72a
-
Filesize
5.2MB
MD57926027529edad7a07e935bb6c800254
SHA1f1297c5bfbba770d505fe154fcc2af8bca4eedce
SHA2569713f7325458275b493adb53841c2075190442ca351615638dbdea29bd14e475
SHA512b0117f3c0819cfedcf9f6fa68eb6cfc826bb5032697ce1e1f784d6394593ae6468a333c7965afbfed44663f7f34b557f31ee23865bca2e1b0b0aed4ba0e121ab
-
Filesize
5.2MB
MD51fec96a7ee9b42391c33ada7c792732c
SHA1b9647f71d1836170b7c646cf0b04de75bfda21fb
SHA256fcab7d3d7284972d3fbaf93ec577f0fa522f9634e1916423c8d3ec728931e6e0
SHA512ab8ef81a2d088359a8e10d6ecf8d34126ba09a63b825b73a4c015efb0c798ff03fe560770b74c9784c4ff9602714e193198fc4273542084277f10fea4b678dfa
-
Filesize
5.2MB
MD53ed886c6855433feecf449ce227a85f5
SHA1b1a87758cda56e85ca1c5684d03aa47b4fddc0bd
SHA256b45b21c84b612d6f1c451940d0a252951e9ada0413ba20adce3c838c88893439
SHA512edd886d42694a0b83ed598ecdae71de158d89eb9c0df54349e9db5270bccd2ce1a2933404c400d39bece076e3ae6f14c7f51b3eb29351582ef7318f35980d659
-
Filesize
5.2MB
MD5a8c6010d7bdca0014a32d1ef1a8a64c5
SHA1ac4435ef84d6345da9a60050801552f600bec4d4
SHA25668cfaafb176c49c7be75a9a5040e68775fd51043c2794194c1344de2e890fb72
SHA51208eb4de8f761b7848454f7f1fd0e570095e75c953878fc65bd088122a32ab868a5d5091754065ee093fb93fb563ab64f24ed547ef4144840e42cd68ecc3190d5
-
Filesize
5.2MB
MD51a221ab3234a1d92ce8801ed94f08a46
SHA11f62ad9c2097732e7c326d8e48fd5fd079b54375
SHA256c98f28fb1b87c3d8903f4f3c7c5a5ec76a10408ff78e4dbfdbb977d6d9a56789
SHA512316179fa9b39a18fa922c18da3360c6657c950cd61b04970c383ed60fdfae29e627d26103be392a8f95831e2933bd3cecbc6cee38528d54fd3e0d3ed29e305e8
-
Filesize
5.2MB
MD520a71ced08e6b67b363f3de87b0b611a
SHA1126102a533c94f131fecc6b3e5f5e5f97d3ed86b
SHA256da535a40b9c1209492d90d35517dc664406c03456c76b776e4a8c90dd7fe80fd
SHA51266cacc9bed7c94874898bd9757bfdf3573a7ee9b11a44594dfc285d09b7710e25ea963c2e7d0ba5faacb6c851c225cf2ac6ab28a19a44101fba07193c654f0fe
-
Filesize
5.2MB
MD5cbdb10e9adf377c7a75e4c707ea2befa
SHA14bc6993d1160ae2a06fc2763e818d7379ced055b
SHA2565b8baaa43726ca6b6328be21b20f9d69722cfd2447cffa7915bea7cccc008c8d
SHA51290fee6bd6ec2fe401c4916c4e5b585bf826890241b6fce84f73df2aef15e18d2fa1ccd2e458ecac9ed4e91911061a2ce491f9a5437fde425d887708291334b52
-
Filesize
5.2MB
MD551d436870463a2ae814f5a22512e9363
SHA1bbd700ed26b3890dd464d8bbed9ac371c8c0f265
SHA2562c4fe5c46b77cbdb368ddfe456dfb67befb698ec70e31f0f7c43e361850d925f
SHA512fdeb1b930237e8b3e9e1e3f90d359cd0bcfe47474a786526c291668e86e8badaab409fcdca485f6708aec6805350c1c8125babde1be655983ca25a902b79730c
-
Filesize
5.2MB
MD5f433f17e5f1830c8a9a538b252fdcd83
SHA1aa00b05a861e7efb13377db70259874db70bb0b2
SHA25678c22a8ecb64f841a4f429facffee0fdb16a3db7383b376193159fa9573f9f37
SHA512f4172fcd36837f4523062d5cc19303cc103ead103d518a2f0b861654ee3c3f50b9a9399846e816573da27bf817a1948d8a74625f30ca9714813a15362d476ac3
-
Filesize
5.2MB
MD52f2f9e864ec32d1c26222f15e3c94567
SHA175059cf265ae19acc0a008bc97bf1cf8537a1255
SHA2562313a09deec393a26454216e2d8a5c4d1b3da87102adfe0069df5175b44594cf
SHA5123dacb41a58bd0b4fbd7d23955526d43fb63ac0eb86fda27304a6b59da50feaf08b25bc53390295e58cb02464ded1827b16a0ff099876ba9c8349da4f005eadae
-
Filesize
5.2MB
MD5f48824197761c78f7bfcdddb78a0ddfe
SHA1d7bf6fc1da612c5377d03551d05ed9ec221e94ba
SHA256cdd6319b6ccb64ad3114691b7141b473803dff9ac69a856e3d6290d3d9a11bc9
SHA512e38c14ab8537f3e2fbcf142b2a281c47c587ae43b84277e78973654184cbd4dc10c1019da4f29073e8780e5a74fc88652fc9acf8b12b1c40859a480ade8a2c6d
-
Filesize
5.2MB
MD58704d086165453f2d195c87ac66830b9
SHA1f2f8b47e67e43a2d14453b4a14d654da487a29a4
SHA2563664758e6a2902418378d3cd7330dec52f1c1041a57f460cf01dbbc7245023ad
SHA51244892949d882806dc9039098497bf237e11a4ac24141e7939962f90885f8ca065dc825b5e52a5f544a14bbb645022d0f32b3acee40c6d69879b514f56340ee8a
-
Filesize
5.2MB
MD51b1938e098af214e484b77c531a8bec2
SHA1dc15cdb912a6db3363a280d6106b4b4f49c6dd85
SHA256e6623b9eb84a359f27a0007e30d014b94aa2349eafdd643eb24c3e8ee8625599
SHA512cd5f1f2d7e7c5775081b65c0e7db01578cdc3c7748b222343bb88c008468ed1557655ba00750c0b2bd7a725f4154b767244ddcfbd7d6198bd144ee8920183d4f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB