Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/03/2024, 12:07

General

  • Target

    ysme.exe

  • Size

    68KB

  • MD5

    63e89bf274c20c083a0fe769e948e2b4

  • SHA1

    ffe988132fc4e69e782f3fc9da8e13c281d1b302

  • SHA256

    d536aae3b7468b7598e0e5e39e004bc26a087b81e68c3fdf9205762f2bb6782a

  • SHA512

    108e8eccba50e0bc91ececd68fdfb3019e42f2d6be04885a29c5b81f288803eebc619a3ec00cf6458b87038d62bfe63ce9c642627742fded111890b3b5fc9c6b

  • SSDEEP

    768:BCB8S+OR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMIIV:BHJaAoHoc2x7bZoYBAcQlwJdMY

Malware Config

Signatures

  • RunningRat

    RunningRat is a remote access trojan first seen in 2018.

  • RunningRat payload 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ysme.exe
    "C:\Users\Admin\AppData\Local\Temp\ysme.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:3872
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "NETRUDDL"
    1⤵
      PID:4456
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "NETRUDDL"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:3176
      • C:\Windows\SysWOW64\NETRUDDL.exe
        C:\Windows\system32\NETRUDDL.exe "c:\windows\system32\240652968.dll",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        PID:3616
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3144 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:1860

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\240652968.dll

        Filesize

        37KB

        MD5

        09eb4fd3bf9dc0c551ef0018de949a4b

        SHA1

        c610bc0276fadcb79a0895baa5b908f43ee996cb

        SHA256

        50f45124d1d5e8d433ff30baba0d242071d7f19231bdd54e2a498ef66721732e

        SHA512

        bc8a0d77b54542cb914692fe1a1eb0d92e5c75f7ecb1a595ff37b0c4c05d29d8a69e5d5d6f4bd65ccbec78e832d9c4cc546f43f0c9e29c059b5cd8cf46904d8c

      • C:\Windows\SysWOW64\NETRUDDL.exe

        Filesize

        60KB

        MD5

        889b99c52a60dd49227c5e485a016679

        SHA1

        8fa889e456aa646a4d0a4349977430ce5fa5e2d7

        SHA256

        6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

        SHA512

        08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

      • C:\Windows\SysWOW64\ini.ini

        Filesize

        44B

        MD5

        741a4fc3c8cce4d60d602f58cf3ebc3a

        SHA1

        d936fa073b66330a2da4e1dd04a04bd212f8e4a0

        SHA256

        27af54cc90e01244ff8a4ed2b7cc112dd7385a1c6fee4236eb85187c001ba72e

        SHA512

        dc55c5c65a41cd5552213803b2f0701ecaf6c352ac2736d408b11a456d3fb46a6b5a66330a23f592685130dfe7213842f6112dfd50fe9dcbdfe19affeee23b10

      • memory/3872-0-0x0000000010000000-0x000000001000F000-memory.dmp

        Filesize

        60KB

      • memory/3872-8-0x00000000005B0000-0x00000000005BD000-memory.dmp

        Filesize

        52KB