Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
218s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 22:10
Static task
static1
Behavioral task
behavioral1
Sample
beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe
Resource
win10v2004-20221111-en
General
-
Target
beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe
-
Size
150KB
-
MD5
3c572a8ae14c61812ba2441616d35ee0
-
SHA1
40a9bc3539a59c8bdf93c67fecdbbd72ffc88a11
-
SHA256
beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674
-
SHA512
bac3b8efc9fff502e6181575a8a3d27cb0c2b223df82a07754b2879f67ee3590dfef833694be80e215918e4bff38ecf834ce60fe0ba1d7312756d3f5355b252b
-
SSDEEP
3072:6ldlXTPtEgUJmh+aDY+puszTjGkZHKZApg0P77mag417WHFRlyAtd6A+:6RTPtEgTh+aDyszTKkZH1pg0P7rb7Wlq
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/864-63-0x0000000000400000-0x0000000000430000-memory.dmp family_gh0strat -
Executes dropped EXE 1 IoCs
pid Process 864 D950.tmp -
Loads dropped DLL 1 IoCs
pid Process 1388 beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\loader.dll D950.tmp File created C:\Program Files\Common Files\lanmao.dll D950.tmp -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\vbcfg.ini D950.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1388 wrote to memory of 864 1388 beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe 28 PID 1388 wrote to memory of 864 1388 beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe 28 PID 1388 wrote to memory of 864 1388 beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe 28 PID 1388 wrote to memory of 864 1388 beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe 28 PID 1388 wrote to memory of 864 1388 beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe 28 PID 1388 wrote to memory of 864 1388 beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe 28 PID 1388 wrote to memory of 864 1388 beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe"C:\Users\Admin\AppData\Local\Temp\beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Roaming\D950.tmpC:\Users\Admin\AppData\Roaming\D950.tmp2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
PID:864
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
327.1MB
MD5bd50f0492f1e6965967a19183ad59e0b
SHA1f01826bb5c031216601c2e22638e083df78f6ae1
SHA256b09928394ddad0ec7997ff02b9438a41c2ad284d4c6fa1321a6ceed2bf4035d7
SHA51209e46311f75d9ba4f050b8190de1c19981cab4bb7f709eaa1bbc1a856e67e8628f41ea6cb344a9bf3b64915e9f20ce01c3c6e8b5c000851e0879591f5bac693a
-
Filesize
327.1MB
MD5bd50f0492f1e6965967a19183ad59e0b
SHA1f01826bb5c031216601c2e22638e083df78f6ae1
SHA256b09928394ddad0ec7997ff02b9438a41c2ad284d4c6fa1321a6ceed2bf4035d7
SHA51209e46311f75d9ba4f050b8190de1c19981cab4bb7f709eaa1bbc1a856e67e8628f41ea6cb344a9bf3b64915e9f20ce01c3c6e8b5c000851e0879591f5bac693a
-
Filesize
327.1MB
MD5bd50f0492f1e6965967a19183ad59e0b
SHA1f01826bb5c031216601c2e22638e083df78f6ae1
SHA256b09928394ddad0ec7997ff02b9438a41c2ad284d4c6fa1321a6ceed2bf4035d7
SHA51209e46311f75d9ba4f050b8190de1c19981cab4bb7f709eaa1bbc1a856e67e8628f41ea6cb344a9bf3b64915e9f20ce01c3c6e8b5c000851e0879591f5bac693a