Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2024, 10:43
Behavioral task
behavioral1
Sample
2024-08-15_4ee64f299b5e235e0425f85b1576001e_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20240704-en
4 signatures
150 seconds
General
-
Target
2024-08-15_4ee64f299b5e235e0425f85b1576001e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4ee64f299b5e235e0425f85b1576001e
-
SHA1
bbc83e31a2b32cd10617796a795581b04121adb2
-
SHA256
18bacc39d1b9bf9b28b1524dfaca53162bc3e1964a1dfd1b3bbc4e9624450349
-
SHA512
4d1305cd1a53fb5a5f73b3009c5c0b1a7664c0258a1f1dc8dd1b4071375425356f0d6c06a7aa592a06214b23a171a2bc44681398baada5fee6f69cf682ba6f7c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibf56utgpPFotBER/mQ32lUK
Malware Config
Signatures
-
XMRig Miner payload 15 IoCs
resource yara_rule behavioral2/memory/2416-2-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-3-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-4-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-5-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-6-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-7-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-8-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-9-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-10-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-11-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-12-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-13-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-14-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-15-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig behavioral2/memory/2416-16-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp xmrig -
resource yara_rule behavioral2/memory/2416-0-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-2-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-3-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-4-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-5-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-6-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-7-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-8-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-9-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-10-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-11-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-12-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-13-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-14-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-15-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx behavioral2/memory/2416-16-0x00007FF61FCE0000-0x00007FF620031000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2416 2024-08-15_4ee64f299b5e235e0425f85b1576001e_cobalt-strike_cobaltstrike_poet-rat.exe Token: SeLockMemoryPrivilege 2416 2024-08-15_4ee64f299b5e235e0425f85b1576001e_cobalt-strike_cobaltstrike_poet-rat.exe