Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 13:53
Static task
static1
Behavioral task
behavioral1
Sample
rSkeledes.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
rSkeledes.exe
Resource
win10v2004-20230915-en
General
-
Target
rSkeledes.exe
-
Size
503KB
-
MD5
ea1d99e95c51be095f8271952b26acb8
-
SHA1
1172ff4e5d077d79f47f81f1e4ec3288ec608799
-
SHA256
d2a7db4b5d96370d8693b3e204af84f3b607ccd744b204e1a3321e007d9ab8c4
-
SHA512
42f57e99a0a2a534b7c1ca89515c43212ab2c7df394f03186b526a4d3ec78385af502692cfbe631ecd984175232d9a6e13bc4e893ad0abee65434e9abb9c1bdd
-
SSDEEP
12288:6wc+rgbIhKjQfDDPURqqwYb7csVLuKOEy41cdgev+AVRUj0DgUDsR:6WrgbIwQfDwRq9Yb7cQdb1cGlGR4y0
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe rSkeledes.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe rSkeledes.exe -
Loads dropped DLL 1 IoCs
pid Process 1856 rSkeledes.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1856 rSkeledes.exe 2772 rSkeledes.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1856 set thread context of 2772 1856 rSkeledes.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1856 rSkeledes.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2772 1856 rSkeledes.exe 28 PID 1856 wrote to memory of 2772 1856 rSkeledes.exe 28 PID 1856 wrote to memory of 2772 1856 rSkeledes.exe 28 PID 1856 wrote to memory of 2772 1856 rSkeledes.exe 28 PID 1856 wrote to memory of 2772 1856 rSkeledes.exe 28 PID 1856 wrote to memory of 2772 1856 rSkeledes.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\rSkeledes.exe"C:\Users\Admin\AppData\Local\Temp\rSkeledes.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\rSkeledes.exe"C:\Users\Admin\AppData\Local\Temp\rSkeledes.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5b0c77267f13b2f87c084fd86ef51ccfc
SHA1f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA256a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
SHA512f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e