Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
NEAS.97869c1104303d30be81f74ce6fba3b0.exe
-
Size
3.0MB
-
Sample
231016-w5bmgsab57
-
MD5
97869c1104303d30be81f74ce6fba3b0
-
SHA1
1a663d0fcaba36ba34007048f9b829ef1306662e
-
SHA256
f914dd0ae7bfd6e26b2b41ea5fd5e68a3f0bd4f3404811a29a46429b71f8205c
-
SHA512
058b48d071e67adae13ab783632f3dca73e52f22e9dafaa27a2e073dc55611c3ebb08057798b0586e61b2bcad4bf2b59262ffc7b07410e90bf4140ac89fa814c
-
SSDEEP
98304:PM0woQggbNhWxU68v4Xi3yAbFwHTE9J/i:N0gOWfackHbFJH
Behavioral task
behavioral1
Sample
NEAS.97869c1104303d30be81f74ce6fba3b0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.97869c1104303d30be81f74ce6fba3b0.exe
Resource
win10v2004-20230915-en
Malware Config
Targets
-
-
Target
NEAS.97869c1104303d30be81f74ce6fba3b0.exe
-
Size
3.0MB
-
MD5
97869c1104303d30be81f74ce6fba3b0
-
SHA1
1a663d0fcaba36ba34007048f9b829ef1306662e
-
SHA256
f914dd0ae7bfd6e26b2b41ea5fd5e68a3f0bd4f3404811a29a46429b71f8205c
-
SHA512
058b48d071e67adae13ab783632f3dca73e52f22e9dafaa27a2e073dc55611c3ebb08057798b0586e61b2bcad4bf2b59262ffc7b07410e90bf4140ac89fa814c
-
SSDEEP
98304:PM0woQggbNhWxU68v4Xi3yAbFwHTE9J/i:N0gOWfackHbFJH
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1