Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2023, 21:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30.dll
Resource
win7-20230220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
30.dll
Resource
win10v2004-20230221-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
30.dll
-
Size
1.3MB
-
MD5
708831126114de4b5e8084c339a2baaf
-
SHA1
8ca717a8ee422ff0690f7cb0c3ea9d9ac7dcb288
-
SHA256
fcdf4497184a11dda48b59d3e558b6a429b204cc80669f00920291f2b467a12d
-
SHA512
aeaa64ffc7c21a4d0d2dce18efa3942084cc67d6dcfb7496d680e8cbc98a9274763cd7f1c52a0691de8d7ac5add573e418063aa94402c26add98e50918a78a20
-
SSDEEP
24576:UyyKuj5NbJ51OG65IGC6V8u9gA3lob9Ov/U6mTRcaT2Cm:Uyy/NlOGYCT39O0vBSC
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
Botnet
0
Attributes
-
watermark
0
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Blocklisted process makes network request 51 IoCs
flow pid Process 20 3524 rundll32.exe 21 3524 rundll32.exe 27 3524 rundll32.exe 30 3524 rundll32.exe 31 3524 rundll32.exe 32 3524 rundll32.exe 33 3524 rundll32.exe 34 3524 rundll32.exe 35 3524 rundll32.exe 37 3524 rundll32.exe 38 3524 rundll32.exe 40 3524 rundll32.exe 41 3524 rundll32.exe 42 3524 rundll32.exe 43 3524 rundll32.exe 44 3524 rundll32.exe 47 3524 rundll32.exe 50 3524 rundll32.exe 51 3524 rundll32.exe 52 3524 rundll32.exe 53 3524 rundll32.exe 55 3524 rundll32.exe 56 3524 rundll32.exe 57 3524 rundll32.exe 59 3524 rundll32.exe 61 3524 rundll32.exe 62 3524 rundll32.exe 63 3524 rundll32.exe 64 3524 rundll32.exe 65 3524 rundll32.exe 66 3524 rundll32.exe 67 3524 rundll32.exe 69 3524 rundll32.exe 73 3524 rundll32.exe 74 3524 rundll32.exe 75 3524 rundll32.exe 76 3524 rundll32.exe 77 3524 rundll32.exe 78 3524 rundll32.exe 80 3524 rundll32.exe 81 3524 rundll32.exe 82 3524 rundll32.exe 83 3524 rundll32.exe 84 3524 rundll32.exe 85 3524 rundll32.exe 86 3524 rundll32.exe 88 3524 rundll32.exe 89 3524 rundll32.exe 90 3524 rundll32.exe 91 3524 rundll32.exe 92 3524 rundll32.exe