Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2023, 18:29
Behavioral task
behavioral1
Sample
NEAS.93977855e03dddef70cbf66b16c6be10.exe
Resource
win7-20230831-en
General
-
Target
NEAS.93977855e03dddef70cbf66b16c6be10.exe
-
Size
465KB
-
MD5
93977855e03dddef70cbf66b16c6be10
-
SHA1
6c30aaf76da7bd5be3120a41977300a6068e8a9d
-
SHA256
0b9a8a57f5f9b7a2bd41a12ddb854ee1b534c19f04ea83196682c2a85362ddaf
-
SHA512
0d185f45b996e6a641970235b4cfeaaa0f96d795db7f5a61785b75eb2d7ace80f14b942ef479f98b99b44eb093bc1b8c0187502735cc854af244c933a04a2b39
-
SSDEEP
6144:k9H4y9VOpL/DeRRoSGFPRuDYBzFrY5dRA2AkCMnZi6c/2AS9kFwJARejm7m:kZF9VOpnqoSG1EcBhs9xAkLZMomm
Malware Config
Extracted
urelas
121.88.5.183
218.54.30.235
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation NEAS.93977855e03dddef70cbf66b16c6be10.exe -
Executes dropped EXE 1 IoCs
pid Process 4356 sander.exe -
resource yara_rule behavioral2/memory/3388-0-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral2/files/0x000700000002314c-6.dat upx behavioral2/files/0x000700000002314c-8.dat upx behavioral2/files/0x000700000002314c-10.dat upx behavioral2/memory/4356-12-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral2/memory/3388-14-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral2/memory/4356-17-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral2/memory/4356-18-0x0000000000400000-0x00000000004A9000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3388 wrote to memory of 4356 3388 NEAS.93977855e03dddef70cbf66b16c6be10.exe 85 PID 3388 wrote to memory of 4356 3388 NEAS.93977855e03dddef70cbf66b16c6be10.exe 85 PID 3388 wrote to memory of 4356 3388 NEAS.93977855e03dddef70cbf66b16c6be10.exe 85 PID 3388 wrote to memory of 2032 3388 NEAS.93977855e03dddef70cbf66b16c6be10.exe 83 PID 3388 wrote to memory of 2032 3388 NEAS.93977855e03dddef70cbf66b16c6be10.exe 83 PID 3388 wrote to memory of 2032 3388 NEAS.93977855e03dddef70cbf66b16c6be10.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.93977855e03dddef70cbf66b16c6be10.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.93977855e03dddef70cbf66b16c6be10.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "2⤵PID:2032
-
-
C:\Users\Admin\AppData\Local\Temp\sander.exe"C:\Users\Admin\AppData\Local\Temp\sander.exe"2⤵
- Executes dropped EXE
PID:4356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
287B
MD5076ff79aa57dc4c8c239c4e921e18bee
SHA144cd3009b8093b5e5889c23c6e49878958e9b83e
SHA2565f439ddd5f569aa13566f07dc643833fcce94e795bfa60d450e1aef3d66b32b4
SHA512956fa5df9309fc6cff5553b5c27176cbb3697ff647759e4f78ae80695a2412581c3925dc980cbff4cb650148ad4cf36c93f0411341307685a1f66b9c6d6e405c
-
Filesize
512B
MD5178eba193b631d7b0653896453b678b2
SHA18878cae8fb5417248da5800e4d85b00149160404
SHA2568c7800dfaf639b17e6b682b6fa2365275e6f80d07e6aa6bb56b676669d0e9db5
SHA512936f9ec171c7ad5aa63c6691d9ea109a3f1ef31fe00bc26fe5afa8ae0ee21b5d3f65e873a242e7986f98bcb9abc82911dbf34bb907ed7a4973e959b7e90c69d5
-
Filesize
465KB
MD593fe63275b95aa77311747ba315736a9
SHA18cc3dee55de28b4487896cbb55920576d726345c
SHA2560964750b7e6a4142ee28d9fddeec71403448a615116bafca5b519efcfba36908
SHA512a6f7cbb9859b29e9a6e7bdd006d0ccf8ee39aaf21a5777c99181ff93afd6e2aaae38d05bc96d9668f98445bb3190b4c872f8df1328a27db57d48d0d71a319a0d
-
Filesize
465KB
MD593fe63275b95aa77311747ba315736a9
SHA18cc3dee55de28b4487896cbb55920576d726345c
SHA2560964750b7e6a4142ee28d9fddeec71403448a615116bafca5b519efcfba36908
SHA512a6f7cbb9859b29e9a6e7bdd006d0ccf8ee39aaf21a5777c99181ff93afd6e2aaae38d05bc96d9668f98445bb3190b4c872f8df1328a27db57d48d0d71a319a0d
-
Filesize
465KB
MD593fe63275b95aa77311747ba315736a9
SHA18cc3dee55de28b4487896cbb55920576d726345c
SHA2560964750b7e6a4142ee28d9fddeec71403448a615116bafca5b519efcfba36908
SHA512a6f7cbb9859b29e9a6e7bdd006d0ccf8ee39aaf21a5777c99181ff93afd6e2aaae38d05bc96d9668f98445bb3190b4c872f8df1328a27db57d48d0d71a319a0d