Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
161s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2023, 04:02
Behavioral task
behavioral1
Sample
NEAS.0eabc5970b134f3e380c6bd13dc138f0_JC.exe
Resource
win7-20231023-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.0eabc5970b134f3e380c6bd13dc138f0_JC.exe
Resource
win10v2004-20231023-en
5 signatures
150 seconds
General
-
Target
NEAS.0eabc5970b134f3e380c6bd13dc138f0_JC.exe
-
Size
286KB
-
MD5
0eabc5970b134f3e380c6bd13dc138f0
-
SHA1
0d14bcd1d0c264820089465cc40af13c9fef8809
-
SHA256
0498548ac7c80f259147b213b9859b347e7ced21c52dd66b8316740d7418bac7
-
SHA512
c1e577e57f2ef5b26f546350da1ba3f751410e6d64f4ca4a60bd17217847355d59d02e995127923086120416a43235f27ee43abf30bb70b0ae20621cc8b4fc28
-
SSDEEP
6144:LGzRxSVtp0l6whGfsKR+zkBpTaa5tJH3h:6t0VPFfsKAkrbPlR
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2200-6-0x0000000000400000-0x00000000004F0000-memory.dmp family_gh0strat -
resource yara_rule behavioral2/memory/2200-0-0x0000000000400000-0x00000000004F0000-memory.dmp upx behavioral2/memory/2200-1-0x0000000000400000-0x00000000004F0000-memory.dmp upx behavioral2/memory/2200-2-0x0000000000400000-0x00000000004F0000-memory.dmp upx behavioral2/memory/2200-6-0x0000000000400000-0x00000000004F0000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Kris = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.0eabc5970b134f3e380c6bd13dc138f0_JC.exe" NEAS.0eabc5970b134f3e380c6bd13dc138f0_JC.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created \??\c:\Windows\BJ.exe NEAS.0eabc5970b134f3e380c6bd13dc138f0_JC.exe File opened for modification \??\c:\Windows\BJ.exe NEAS.0eabc5970b134f3e380c6bd13dc138f0_JC.exe File created \??\c:\Windows\ì4249552.exe NEAS.0eabc5970b134f3e380c6bd13dc138f0_JC.exe