Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/08/2024, 10:43
Behavioral task
behavioral1
Sample
2024-08-15_4ee64f299b5e235e0425f85b1576001e_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20240704-en
4 signatures
150 seconds
General
-
Target
2024-08-15_4ee64f299b5e235e0425f85b1576001e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4ee64f299b5e235e0425f85b1576001e
-
SHA1
bbc83e31a2b32cd10617796a795581b04121adb2
-
SHA256
18bacc39d1b9bf9b28b1524dfaca53162bc3e1964a1dfd1b3bbc4e9624450349
-
SHA512
4d1305cd1a53fb5a5f73b3009c5c0b1a7664c0258a1f1dc8dd1b4071375425356f0d6c06a7aa592a06214b23a171a2bc44681398baada5fee6f69cf682ba6f7c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibf56utgpPFotBER/mQ32lUK
Malware Config
Signatures
-
XMRig Miner payload 15 IoCs
resource yara_rule behavioral1/memory/1852-2-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-3-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-4-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-5-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-6-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-7-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-8-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-9-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-10-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-11-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-12-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-13-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-14-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-15-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig behavioral1/memory/1852-16-0x000000013F6C0000-0x000000013FA11000-memory.dmp xmrig -
resource yara_rule behavioral1/memory/1852-0-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-2-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-3-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-4-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-5-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-6-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-7-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-8-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-9-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-10-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-11-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-12-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-13-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-14-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-15-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx behavioral1/memory/1852-16-0x000000013F6C0000-0x000000013FA11000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1852 2024-08-15_4ee64f299b5e235e0425f85b1576001e_cobalt-strike_cobaltstrike_poet-rat.exe Token: SeLockMemoryPrivilege 1852 2024-08-15_4ee64f299b5e235e0425f85b1576001e_cobalt-strike_cobaltstrike_poet-rat.exe