search

spender-sandbox / cuckoo-modified

Modified edition of cuckoo
395 stars 178 forks source link

Having issues with processing modules #401

Closed benrau87 closed 7 years ago

benrau87 commented 7 years ago

Hello, Running a new setup of cuckoo and processing was never completing. Try running under debug and turned off the modules one by one as they hung. Now processing just fails altogether, but decompression, behavior, network, and static modules still run. Any ideas where this could be stemming from? Thanks!

spender-sandbox commented 7 years ago

Need more info, not much to go on from what you've written so far.

-Brad

benrau87 commented 7 years ago

Hey Brad,

What would be appropriate? The debug output from the processing module?

spender-sandbox commented 7 years ago

Sure, that'd help, also what kind of file you were trying to analyze.

-Brad

benrau87 commented 7 years ago

Just doing a test run to make sure everything was working with a legit exe of 7zip. Always worked in the past, the only change is that I moved to mysql database for this deployment. I'll get the output once I fire that sample off again. Update: The file is submitted and runs just fine on the Windows VM, just never gets past the "Dropped" module when submitted

benrau87 commented 7 years ago

After sometime looking at the initial configuration, I figured out the issue. I used vmcloak to create my machines and forgot to kill the included agent. The issues all stemmed from having two agents running on the machines. Thank you for your quick replies Brad!