Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/12/2024, 03:25 UTC
Behavioral task
behavioral1
Sample
2024-12-14_c282942be6c6d0ad18e6cdb440aeacd6_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-12-14_c282942be6c6d0ad18e6cdb440aeacd6_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-12-14_c282942be6c6d0ad18e6cdb440aeacd6_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
-
Size
5.0MB
-
MD5
c282942be6c6d0ad18e6cdb440aeacd6
-
SHA1
e402fc6362f0372d0510651d8d27913df665845d
-
SHA256
d17f5b80e0b5cc8d6e0ba6f92fbeb7f5ff9b95b1a631f7e6a4d17df4150abd6a
-
SHA512
da5216f46c42a2ec1d2a7b9a22c2b00574a9d24217f0ef79c9ffbba80b6bf87ac768335f9bebef746f9ed22ab261851356560aa613154a39dee820b81d600242
-
SSDEEP
49152:r56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeXvpnH:r56utgpPFotBER/mQ32lUV
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-14_c282942be6c6d0ad18e6cdb440aeacd6_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_c282942be6c6d0ad18e6cdb440aeacd6_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_c282942be6c6d0ad18e6cdb440aeacd6_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2036
Network
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request0.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
DNSs3.us-east-2.amazonaws.com2024-12-14_c282942be6c6d0ad18e6cdb440aeacd6_cobalt-strike_cobaltstrike_poet-rat_snatch.exeRemote address:8.8.8.8:53Requests3.us-east-2.amazonaws.comIN AResponses3.us-east-2.amazonaws.comIN A52.219.94.249s3.us-east-2.amazonaws.comIN A3.5.128.237s3.us-east-2.amazonaws.comIN A52.219.108.89s3.us-east-2.amazonaws.comIN A3.5.130.255s3.us-east-2.amazonaws.comIN A52.219.84.226s3.us-east-2.amazonaws.comIN A3.5.133.185s3.us-east-2.amazonaws.comIN A52.219.177.89s3.us-east-2.amazonaws.comIN A52.219.141.41
-
Remote address:8.8.8.8:53Request249.94.219.52.in-addr.arpaIN PTRResponse249.94.219.52.in-addr.arpaIN PTRs3 us-east-2 amazonawscom
-
Remote address:8.8.8.8:53Request8.39.65.18.in-addr.arpaIN PTRResponse8.39.65.18.in-addr.arpaIN PTRserver-18-65-39-8ams1r cloudfrontnet
-
Remote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request92.12.20.2.in-addr.arpaIN PTRResponse92.12.20.2.in-addr.arpaIN PTRa2-20-12-92deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
52.219.94.249:443s3.us-east-2.amazonaws.comtls2024-12-14_c282942be6c6d0ad18e6cdb440aeacd6_cobalt-strike_cobaltstrike_poet-rat_snatch.exe1.2kB 7.8kB 15 18
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
0.159.190.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
8.8.8.8:53s3.us-east-2.amazonaws.comdns2024-12-14_c282942be6c6d0ad18e6cdb440aeacd6_cobalt-strike_cobaltstrike_poet-rat_snatch.exe72 B 200 B 1 1
DNS Request
s3.us-east-2.amazonaws.com
DNS Response
52.219.94.2493.5.128.23752.219.108.893.5.130.25552.219.84.2263.5.133.18552.219.177.8952.219.141.41
-
72 B 112 B 1 1
DNS Request
249.94.219.52.in-addr.arpa
-
69 B 122 B 1 1
DNS Request
8.39.65.18.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
56.163.245.4.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
92.12.20.2.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa