warmcookie | 2922d5a4f2de932813d21422303133e01b9ea0ead5714b58f075f6afaf960b80 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

Assets/Aud...e2.ps1

windows7-x64

6

Assets/Aud...e2.ps1

windows10-2004-x64

6

Engine.dll

windows7-x64

1

Engine.dll

windows10-2004-x64

1

EntitySystem.dll

windows7-x64

1

EntitySystem.dll

windows10-2004-x64

1

LiteNetLib.dll

windows7-x64

1

LiteNetLib.dll

windows10-2004-x64

1

Newtonsoft.Json.dll

windows7-x64

1

Newtonsoft.Json.dll

windows10-2004-x64

1

OpenAL/x64...32.dll

windows7-x64

OpenAL/x64...32.dll

windows10-2004-x64

OpenAL/x86...32.dll

windows7-x64

3

OpenAL/x86...32.dll

windows10-2004-x64

3

OpenTK.dll

windows7-x64

1

OpenTK.dll

windows10-2004-x64

1

Survivalcraft.exe

windows7-x64

Survivalcraft.exe

windows10-2004-x64

install.sh

windows7-x64

3

install.sh

windows10-2004-x64

3

start.sh

windows7-x64

3

start.sh

windows10-2004-x64

3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2025, 18:04

Sharing

Static task

static1

backdoor warmcookie

2 signatures

Behavioral task

behavioral1

Sample

Assets/Audio/Creatures/Moose/Moose2.ps1

Resource

win7-20241010-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

Assets/Audio/Creatures/Moose/Moose2.ps1

Resource

win10v2004-20250129-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

Engine.dll

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

Engine.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

EntitySystem.dll

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

EntitySystem.dll

Resource

win10v2004-20250129-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

LiteNetLib.dll

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

LiteNetLib.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Newtonsoft.Json.dll

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

Newtonsoft.Json.dll

Resource

win10v2004-20250129-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

OpenAL/x64/openal32.dll

Resource

win7-20241010-en

warmcookie backdoor

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

OpenAL/x64/openal32.dll

Resource

win10v2004-20250129-en

warmcookie backdoor

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral13

Sample

OpenAL/x86/openal32.dll

Resource

win7-20241010-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

OpenAL/x86/openal32.dll

Resource

win10v2004-20250129-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

OpenTK.dll

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

OpenTK.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

Survivalcraft.exe

Resource

win7-20241023-en

warmcookie backdoor

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral18

Sample

Survivalcraft.exe

Resource

win10v2004-20250129-en

warmcookie backdoor

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral19

Sample

install.sh

Resource

win7-20240708-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral20

Sample

install.sh

Resource

win10v2004-20250129-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

start.sh

Resource

win7-20240903-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral22

Sample

start.sh

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Report Analysis Logs

General

Target

OpenAL/x64/openal32.dll
Size

407KB
MD5

2b5a427b85eea53675484405af5010e0
SHA1

19201c0fb48ed20effd74de7989c2fa45326e35e
SHA256

f42706c862bc3d66550eb0a929bd5cb195c7a1f6a181cc854d59fc124d771023
SHA512

f1793a8d9402da2d23e14046ca2618bdb5fc0dd8986880f07d54df8fd3b23359de9d9b515f53b072a1d843b492d000ac5f2716ceb01f3f9d694e1aa8c4cf10d3
SSDEEP

6144:ipdaQesGCdaTNOznuivPI6YXaZGQTH0PBXWSD1y/X4uI+D:wTesGgaTNO6ivPjKaZG4X4uI+D

Score

10^/10

warmcookie backdoor

Malware Config

Extracted

Family

warmcookie

Signatures

Warmcookie family
warmcookie
Warmcookie, Badspace
Warmcookie aka Badspace is a backdoor written in C++.
backdoor warmcookie

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OpenAL\x64\openal32.dll,#1
1⤵
PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-0-0x000000006B600000-0x000000006B65D000-memory.dmp

Filesize
372KB

Download

© 2018-2025

Terms | Privacy