warmcookie | 0e6df159e58f9c47bddae3fd9d307ba039289981f55d9f1a2d66539a27ae4e2b

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

Train.Simu...ls.dll

windows10-2004-x64

Train.Simu...rs.dll

windows10-2004-x64

Train.Simu...SL.exe

windows10-2004-x64

Train.Simu...u/.ps1

windows10-2004-x64

Train.Simu...r2.exe

windows10-2004-x64

Scenarios/...e.html

windows10-2004-x64

Scenarios/...1.html

windows10-2004-x64

Train.Simu...TG.bat

windows10-2004-x64

Train.Simu...av.exe

windows10-2004-x64

Train.Simu...EO.exe

windows10-2004-x64

Train.Simu...TG.exe

windows10-2004-x64

Train.Simu...ib.dll

windows10-2004-x64

Train.Simu...n.html

windows10-2004-x64

Train.Simu...n.html

windows10-2004-x64

Train.Simu...n.html

windows10-2004-x64

Train.Simu...n.html

windows10-2004-x64

Train.Simu...n.html

windows10-2004-x64

Train.Simu...n.html

windows10-2004-x64

Train.Simu...n.html

windows10-2004-x64

Train.Simu...n.html

windows10-2004-x64

Train.Simu...n.html

windows10-2004-x64

Train.Simu...n.html

windows10-2004-x64

Train.Simu...er.exe

windows10-2004-x64

Train.Simu...er.exe

windows10-2004-x64

Train.Simu...ib.dll

windows10-2004-x64

Train.Simu...UP.dll

windows10-2004-x64

Train.Simu...UP.exe

windows10-2004-x64

Train.Simu...32.dll

windows10-2004-x64

Train.Simu...32.dll

windows10-2004-x64

Train.Simu...32.dll

windows10-2004-x64

Train.Simu...ys.exe

windows10-2004-x64

Train.Simu...64.exe

windows10-2004-x64

Analysis

max time kernel
132s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 19:17

Sharing

Copy URL

Twitter E-mail

Static task

static1

backdoor warmcookie

2 signatures

Behavioral task

behavioral1

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/AddIns/BPEPowerTools.dll

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/AddIns/DefaultEditors.dll

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/ApplyXSL.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Assets/Kuju/.ps1

Resource

win10v2004-20241007-en

execution

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/BlueprintEditor2.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

Scenarios/66c8dfe8-f59c-4f70-b676-f2658dccb7fe/de/Complete.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral7

Sample

Scenarios/66c8dfe8-f59c-4f70-b676-f2658dccb7fe/de/Message1.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral8

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/ConvertDDSToTG.bat

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/ConvertToDav.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/ConvertToGEO.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral11

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/ConvertToTG.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral12

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/ConvertToTGLib.dll

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral13

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Dialogs/Credits/de/main.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral14

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Dialogs/Credits/en/main.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral15

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Dialogs/Credits/es/main.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral16

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Dialogs/Credits/fr/main.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral17

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Dialogs/Credits/it/main.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral18

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Dialogs/Credits/pl/main.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral19

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Dialogs/Credits/ru/main.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral20

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Dialogs/Credits/zh/main.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral21

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Dialogs/Legal/en/main.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral22

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Dialogs/News/en/main.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral23

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/ErrorReporter.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/IAOptimiser.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/ICSharpCode.SharpZipLib.dll

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Install/DirectX9/DSETUP.dll

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral27

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Install/DirectX9/DXSETUP.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Install/DirectX9/dsetup32.dll

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral29

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Install/OpenAL/32bit/OpenAL32.dll

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral30

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Install/OpenAL/64bit/OpenAL32.dll

Resource

win10v2004-20241007-en

warmcookie backdoor

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral31

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Install/Phys.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral32

Sample

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Install/dotNetFx40_Full_x86_x64.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Report Analysis Logs

General

Target

Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Train.Simulator.Classic.v73.9a.Incl.ALL.DLC/Install/OpenAL/64bit/OpenAL32.dll
Size

408KB
MD5

9945ba621ec33338f4acdeff5f410291
SHA1

3841fc34b7511bf3dd695519f352651305049460
SHA256

6f34249f3001a13f110f87835b9df5a3499268afc7dc5d90c71565f718d0e0b9
SHA512

53759a834cc312bc3cbb21c686131233dd1962b64e92dafcc12c999e4015d0dfdabc701375f9fb76481e81825c2c5579c1091ebd376c67c879dc9b64cbe786d4
SSDEEP

6144:Gp2s6S4bSSZ5Sv/ewYNCzvPI6YXaZB0wYfTK0IiBXWSD1y/XIuI+D:ERSLk/ewzzvPjKaZB0wYIXIuI+D

Score

10^/10

warmcookie backdoor

Malware Config

Extracted

Family

warmcookie

Signatures

Warmcookie family
warmcookie
Warmcookie, Badspace
Warmcookie aka Badspace is a backdoor written in C++.
backdoor warmcookie

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Train.Simulator.Classic.v73.9a.Incl.ALL.DLC\Train.Simulator.Classic.v73.9a.Incl.ALL.DLC\Install\OpenAL\64bit\OpenAL32.dll,#1
1⤵
PID:2892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2892-0-0x000000006B600000-0x000000006B65D000-memory.dmp

Filesize
372KB

Download