Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

NEAS.958a2...00.exe

windows7-x64

10

NEAS.958a2...00.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.958a297912778bfedf7f5c8f4e270900.exe

  • Size

    1.4MB

  • Sample

    231106-czm9jsga6y

  • MD5

    958a297912778bfedf7f5c8f4e270900

  • SHA1

    22d2e9dca6983ba173b6c9e48e22324467454ec2

  • SHA256

    366f45d064951e8dd798c64542ef1ee608f501b95f2839e28bfd9fba69cde067

  • SHA512

    182980b100be670d9598f0ce2fc71fc868a16ed27663f5182297912b8e0deb1464dd00840f5fc663e3495f1f78076dfcf787e5f5f4b99cf9bd02b816486ffdf4

  • SSDEEP

    24576:qBBkOlRe8ZcXPuCyRdaN1yV/vELneAcCg8:uOOy8eEa1Jct8

Score
10/10
dcratevasioninfostealerrattrojan

Malware Config

Targets

    • Target

      NEAS.958a297912778bfedf7f5c8f4e270900.exe

    • Size

      1.4MB

    • MD5

      958a297912778bfedf7f5c8f4e270900

    • SHA1

      22d2e9dca6983ba173b6c9e48e22324467454ec2

    • SHA256

      366f45d064951e8dd798c64542ef1ee608f501b95f2839e28bfd9fba69cde067

    • SHA512

      182980b100be670d9598f0ce2fc71fc868a16ed27663f5182297912b8e0deb1464dd00840f5fc663e3495f1f78076dfcf787e5f5f4b99cf9bd02b816486ffdf4

    • SSDEEP

      24576:qBBkOlRe8ZcXPuCyRdaN1yV/vELneAcCg8:uOOy8eEa1Jct8

    Score
    10/10
    dcratevasioninfostealerrattrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      evasiontrojan

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks