Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 13:08
Behavioral task
behavioral1
Sample
2024-09-14_a188f0f679fc1e796593693aba97c320_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20240903-en
4 signatures
150 seconds
General
-
Target
2024-09-14_a188f0f679fc1e796593693aba97c320_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a188f0f679fc1e796593693aba97c320
-
SHA1
a9c0b1834018463350a25c784658bea11922c3e9
-
SHA256
4cfbc027c7507ad6807223b76f1492d22328f4c6516c64cf8c336a57a02312df
-
SHA512
91d5bb04752d069eabf83bcece31e4f6508f7c2f0914cb90746bdb65ba82703cf9746980c5fec1fd35f53a6f9f2f3c0ffeb7eeda6fbec33ffd185393e8e662e9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibf56utgpPFotBER/mQ32lUX
Malware Config
Signatures
-
XMRig Miner payload 15 IoCs
resource yara_rule behavioral2/memory/4512-2-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-3-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-4-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-5-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-6-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-7-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-8-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-9-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-10-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-11-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-12-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-13-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-14-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-15-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig behavioral2/memory/4512-16-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp xmrig -
resource yara_rule behavioral2/memory/4512-0-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-2-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-3-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-4-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-5-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-6-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-7-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-8-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-9-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-10-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-11-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-12-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-13-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-14-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-15-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx behavioral2/memory/4512-16-0x00007FF7CC420000-0x00007FF7CC771000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 4512 2024-09-14_a188f0f679fc1e796593693aba97c320_cobalt-strike_cobaltstrike_poet-rat.exe Token: SeLockMemoryPrivilege 4512 2024-09-14_a188f0f679fc1e796593693aba97c320_cobalt-strike_cobaltstrike_poet-rat.exe