Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 13:53

General

  • Target

    rSkeledes.exe

  • Size

    503KB

  • MD5

    ea1d99e95c51be095f8271952b26acb8

  • SHA1

    1172ff4e5d077d79f47f81f1e4ec3288ec608799

  • SHA256

    d2a7db4b5d96370d8693b3e204af84f3b607ccd744b204e1a3321e007d9ab8c4

  • SHA512

    42f57e99a0a2a534b7c1ca89515c43212ab2c7df394f03186b526a4d3ec78385af502692cfbe631ecd984175232d9a6e13bc4e893ad0abee65434e9abb9c1bdd

  • SSDEEP

    12288:6wc+rgbIhKjQfDDPURqqwYb7csVLuKOEy41cdgev+AVRUj0DgUDsR:6WrgbIwQfDwRq9Yb7cQdb1cGlGR4y0

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rSkeledes.exe
    "C:\Users\Admin\AppData\Local\Temp\rSkeledes.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3784
    • C:\Users\Admin\AppData\Local\Temp\rSkeledes.exe
      "C:\Users\Admin\AppData\Local\Temp\rSkeledes.exe"
      2⤵
      • Checks QEMU agent file
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nshB22A.tmp\System.dll

    Filesize

    11KB

    MD5

    b0c77267f13b2f87c084fd86ef51ccfc

    SHA1

    f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

    SHA256

    a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

    SHA512

    f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

  • memory/3596-18-0x00000000773D1000-0x00000000774F1000-memory.dmp

    Filesize

    1.1MB

  • memory/3596-15-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/3596-16-0x0000000001660000-0x00000000020A4000-memory.dmp

    Filesize

    10.3MB

  • memory/3596-17-0x0000000001660000-0x00000000020A4000-memory.dmp

    Filesize

    10.3MB

  • memory/3596-19-0x0000000077458000-0x0000000077459000-memory.dmp

    Filesize

    4KB

  • memory/3596-20-0x0000000077475000-0x0000000077476000-memory.dmp

    Filesize

    4KB

  • memory/3596-30-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/3596-31-0x00000000773D1000-0x00000000774F1000-memory.dmp

    Filesize

    1.1MB

  • memory/3784-11-0x0000000005210000-0x0000000005C54000-memory.dmp

    Filesize

    10.3MB

  • memory/3784-12-0x00000000773D1000-0x00000000774F1000-memory.dmp

    Filesize

    1.1MB

  • memory/3784-14-0x0000000074230000-0x0000000074236000-memory.dmp

    Filesize

    24KB

  • memory/3784-13-0x00000000773D1000-0x00000000774F1000-memory.dmp

    Filesize

    1.1MB

  • memory/3784-10-0x0000000005210000-0x0000000005C54000-memory.dmp

    Filesize

    10.3MB