Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 14:19
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe
-
Size
1.2MB
-
MD5
c6b5e1e08854161eff9c75247bbb9de0
-
SHA1
32444db9eaba072b09446330e1d99014f8d97e97
-
SHA256
3c52b42cf7005f0a9091e2dd0b1b3cd41d35c8b469252d4519553e81a16a56bd
-
SHA512
14f8f92ff504b32b6bf753582dadea484579a74d0f4bcf3da970ba04ee2968f9d8578e0d5bed91683a262925d1ec4bc45972ceff77482ff66f677f361783ce9c
-
SSDEEP
24576:7zXKqa8SEijjC+37liXbLbklmfB6/tbQdSmKeJ0xViDJOVH7Ruz:7z6qaakjC+3srLAKB61bQd3Kea0JOZ7W
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3124 hxrzgfgdgzmm.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\lmacq\hxrzgfgdgzmm.exe NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3660 wrote to memory of 3124 3660 NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe 90 PID 3660 wrote to memory of 3124 3660 NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe 90 PID 3660 wrote to memory of 3124 3660 NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Program Files (x86)\lmacq\hxrzgfgdgzmm.exe"C:\Program Files (x86)\lmacq\hxrzgfgdgzmm.exe"2⤵
- Executes dropped EXE
PID:3124
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5cad1db5e20e9ab6841991c7f939f03ad
SHA1ee7e3b8b4fd9bfd95aacf707d45152f1611e6bc1
SHA25612c57002f482c60a1603bd4acf715fc17f617ebf40b11ad00b7e39e2e4323f80
SHA512553ad41282a7837f276043573a2e9d12099bea8d651ee0dd789a2e7e89da0832c0952af3ce4b3e5c005f0f9a236ad78cab1ada2d4026cc0e97aa529760f2db5f
-
Filesize
1.2MB
MD5cad1db5e20e9ab6841991c7f939f03ad
SHA1ee7e3b8b4fd9bfd95aacf707d45152f1611e6bc1
SHA25612c57002f482c60a1603bd4acf715fc17f617ebf40b11ad00b7e39e2e4323f80
SHA512553ad41282a7837f276043573a2e9d12099bea8d651ee0dd789a2e7e89da0832c0952af3ce4b3e5c005f0f9a236ad78cab1ada2d4026cc0e97aa529760f2db5f