Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

NEAS.0ecc2...00.exe

windows7-x64

10

NEAS.0ecc2...00.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    15/11/2023, 00:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.0ecc2b93755afc242feaa9b4e7fbc700.exe

  • Size

    320KB

  • MD5

    0ecc2b93755afc242feaa9b4e7fbc700

  • SHA1

    eebccf35c3165ae7c2f16e3ce14e3199c8a1b055

  • SHA256

    9f28e8fc7ccb22a6f3ff15c5343ee14a1712e9404216ae74519d2ad9e728bc8a

  • SHA512

    a61e996371f79755cee64b9864b93f8865d4e6d911479d2261df05eda173e640fd4cbcd4765dd3eaa2c6275fc1032260e4cfef1d6445087aab0cc651b283f08b

  • SSDEEP

    6144:8UORK1ttbV3kSobTYZGiNdnijoh+EiIt4f/qwuw:8ytbV3kSoXaLnyosHqMCHw

Score
10/10
dropperpersistencetrojan

Malware Config

Signatures

  • Malware Backdoor - Berbew 1 IoCs

    Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

    persistencedroppertrojan
  • Deletes itself 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.0ecc2b93755afc242feaa9b4e7fbc700.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.0ecc2b93755afc242feaa9b4e7fbc700.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Windows\system32\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\NEAS.0ecc2b93755afc242feaa9b4e7fbc700.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:368
      • C:\Windows\system32\PING.EXE
        ping 1.1.1.1 -n 1 -w 6000
        3⤵
        • Runs ping.exe
        PID:2192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1232-0-0x000000013FA70000-0x000000013FAC1000-memory.dmp

    Filesize

    324KB

    Download