Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 01:31
Behavioral task
behavioral1
Sample
a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe
Resource
win10v2004-20240419-en
General
-
Target
a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe
-
Size
145KB
-
MD5
5647d4670bf453ea46b04b70cee2eb41
-
SHA1
9cff36e41153665ca479950133b9521a850ceee5
-
SHA256
a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e
-
SHA512
d27f7d110ffd521c9a144c99c62a5fce6b1c3956a11edf2e3160f28dc4ac40c3a32953d2d2f66f6b855195426ea35282d94cd20ce0cf8c947e39119bf3ada26a
-
SSDEEP
1536:0MvKGF80crNopDaPsDHtcGquYVnPKp4ZAk3rf:tvvj00DaEDAuYFPJZAG
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral1/memory/1372-0-0x0000000000400000-0x0000000000424000-memory.dmp UPX behavioral1/memory/1372-1-0x0000000000400000-0x0000000000424000-memory.dmp UPX behavioral1/files/0x000b0000000141a2-7.dat UPX behavioral1/memory/2988-8-0x0000000000400000-0x0000000000424000-memory.dmp UPX behavioral1/memory/2988-10-0x0000000000400000-0x0000000000424000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
pid Process 2988 ekrakdeep.exe -
Loads dropped DLL 1 IoCs
pid Process 1372 a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe -
resource yara_rule behavioral1/memory/1372-0-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/1372-1-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/files/0x000b0000000141a2-7.dat upx behavioral1/memory/2988-8-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/2988-10-0x0000000000400000-0x0000000000424000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 checkip.dyndns.org -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1372 wrote to memory of 2988 1372 a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe 28 PID 1372 wrote to memory of 2988 1372 a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe 28 PID 1372 wrote to memory of 2988 1372 a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe 28 PID 1372 wrote to memory of 2988 1372 a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe"C:\Users\Admin\AppData\Local\Temp\a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\ekrakdeep.exeC:\Users\Admin\AppData\Local\Temp\ekrakdeep.exe2⤵
- Executes dropped EXE
PID:2988
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD58ad1aeba150342ee01c62217b451dda5
SHA119dd0cfdb52669f323b8dc7e661bbf9883873e0c
SHA2562eac49f28caa284a55ec47f5ca2abb6f65884e93b5a0cdb398642a439222a145
SHA512694a94e4c624dc8caeb8527e91a98d20498f6b087922d54090b3e8368711c720ff1222b25980bed88c08977b9ccb8c3fcfc7cb7ccac231698d82acaacc9f86f4