Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
06/05/2024, 17:51
Behavioral task
behavioral1
Sample
64476e5b643bef08a76188f5228ea38e_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
64476e5b643bef08a76188f5228ea38e_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
64476e5b643bef08a76188f5228ea38e_NEAS.exe
-
Size
2.0MB
-
MD5
64476e5b643bef08a76188f5228ea38e
-
SHA1
5da81fdb180552d7d90674e1f0fdbfcb274cf2c1
-
SHA256
c8cf440bcfcc5dfc3751729db1d3533da9255071a838bec40bab1d95c6d773d9
-
SHA512
a8f54ad302ae5025306e7580dd6f72af4281b5b87eae4b0aadd7918bd3bd89ab416a3ecc956add2d99de91bff3fbbcb71218386ed18210c38ec553cd62dc00bb
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYz:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YB
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
flow ioc pid Process 9 ip-api.com Process not Found 2404 schtasks.exe 56 ip-api.com Process not Found -
Quasar payload 3 IoCs
resource yara_rule behavioral2/files/0x000a000000023bcc-11.dat family_quasar behavioral2/memory/2684-30-0x0000000000170000-0x00000000001CE000-memory.dmp family_quasar behavioral2/files/0x000a000000023bce-51.dat family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation 64476e5b643bef08a76188f5228ea38e_NEAS.exe -
Executes dropped EXE 3 IoCs
pid Process 3136 vnc.exe 2684 windef.exe 3116 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\k: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\n: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\l: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\m: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\u: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\x: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\h: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\i: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\o: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\p: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\t: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\w: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\y: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\e: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\g: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\j: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\q: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\s: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\v: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\z: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\a: 64476e5b643bef08a76188f5228ea38e_NEAS.exe File opened (read-only) \??\b: 64476e5b643bef08a76188f5228ea38e_NEAS.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 ip-api.com 56 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000a000000023bce-51.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3160 set thread context of 2832 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 1268 3136 WerFault.exe 84 3128 3116 WerFault.exe 97 1028 1344 WerFault.exe 117 3300 1668 WerFault.exe 121 -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2404 schtasks.exe 2668 schtasks.exe 424 schtasks.exe 4332 schtasks.exe 4728 schtasks.exe 1812 schtasks.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 3128 PING.EXE 968 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2684 windef.exe Token: SeDebugPrivilege 3116 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3116 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3160 wrote to memory of 3136 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 84 PID 3160 wrote to memory of 3136 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 84 PID 3160 wrote to memory of 3136 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 84 PID 3136 wrote to memory of 4284 3136 vnc.exe 86 PID 3136 wrote to memory of 4284 3136 vnc.exe 86 PID 3160 wrote to memory of 2684 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 87 PID 3160 wrote to memory of 2684 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 87 PID 3160 wrote to memory of 2684 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 87 PID 3136 wrote to memory of 4284 3136 vnc.exe 86 PID 3160 wrote to memory of 2832 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 89 PID 3160 wrote to memory of 2832 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 89 PID 3160 wrote to memory of 2832 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 89 PID 3160 wrote to memory of 2832 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 89 PID 3160 wrote to memory of 2832 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 89 PID 3160 wrote to memory of 2404 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 91 PID 3160 wrote to memory of 2404 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 91 PID 3160 wrote to memory of 2404 3160 64476e5b643bef08a76188f5228ea38e_NEAS.exe 91 PID 2684 wrote to memory of 2668 2684 windef.exe 95 PID 2684 wrote to memory of 2668 2684 windef.exe 95 PID 2684 wrote to memory of 2668 2684 windef.exe 95 PID 2684 wrote to memory of 3116 2684 windef.exe 97 PID 2684 wrote to memory of 3116 2684 windef.exe 97 PID 2684 wrote to memory of 3116 2684 windef.exe 97 PID 3116 wrote to memory of 424 3116 winsock.exe 98 PID 3116 wrote to memory of 424 3116 winsock.exe 98 PID 3116 wrote to memory of 424 3116 winsock.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\64476e5b643bef08a76188f5228ea38e_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\64476e5b643bef08a76188f5228ea38e_NEAS.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:4284
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 5483⤵
- Program crash
PID:1268
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:2668
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
PID:424
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jRckzECsMjoe.bat" "4⤵PID:4436
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:4428
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
PID:968
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:1668
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
PID:4332
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\go0HFZ4UBsJs.bat" "6⤵PID:4696
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:3936
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- Runs ping.exe
PID:3128
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"7⤵PID:3692
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f8⤵
- Creates scheduled task(s)
PID:1812
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 22366⤵
- Program crash
PID:3300
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 22164⤵
- Program crash
PID:3128
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\64476e5b643bef08a76188f5228ea38e_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\64476e5b643bef08a76188f5228ea38e_NEAS.exe"2⤵PID:2832
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Quasar RAT
- Creates scheduled task(s)
PID:2404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3136 -ip 31361⤵PID:4088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3116 -ip 31161⤵PID:2220
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:1344
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:1228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 5203⤵
- Program crash
PID:1028
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:1552
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:4876
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1344 -ip 13441⤵PID:648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1668 -ip 16681⤵PID:4452
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD5c434d49a8f1391c8ea4a178b0818b5de
SHA1fc0c68f1a7be73a4b6a1d06646dce196a59a2b1e
SHA256bd8bc2f6bffddf745a01dbd1a8b847daf86d98527c8e4daf0cb5a5bd588a789f
SHA512e56d77281d75558de6bd9f35b04a65991343eebe37a3c23e6d878852812d5ac853c04144906590f246aca9177e0b3bb4e1732099a243520ba8e6293aa3f8dc3b
-
Filesize
208B
MD55fa859b6bada96471c759951c588f566
SHA1b6e33174ae4fc51efed743827d73d27dfa79169a
SHA2561378b6edc51b64c61f8824486718abd53e59363af2969c446eb694bd35dd03e1
SHA51252cf5f82d7af4bf86b6f937f2b185839ca140a8f5c0a749330211bdd9ed096e5fc29d5c62c11b7862d64c023380b1865402e765f1c1ec5471cb7f31d699c46a4
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD56eb9877d75d83f54ae224c5180ef6bfb
SHA1f1359773ead7c2edcb15663b893963cb1255a6ea
SHA256db86d0d2f3a68d311ba8cf3e99fd18e320317d82f87f58d13bfda66a41288a80
SHA51201d06ac799659417b5e2c0844e16524878b6bb17a4261a49dad7c284e95f12315c93f9ea37e7880e7975fdc5c98dc1157172d3bb99b3c012a884c9bde16ef88f
-
Filesize
224B
MD5a81685e1e17a6262da988e532df58fb1
SHA133b1476bcc0efaf43ab87d6e15604b2e0b6d5f77
SHA2565e638aab758532fdb40f8c2a7c6a4448f8b528649b4ebb5ec5ea9a3b01139aac
SHA51238a562e3562a620bfa783dfc1020223cecfa8fb129cef46e391edbf65ac6ddba4a8dfb4018d820322b85658f179debd7fb0b24791897c7dd6140291756aaa5d3
-
Filesize
2.0MB
MD57d8ca95db2182c84dca10f66cf568f19
SHA18f016e912a0e558f56e84dda989c423d60fa9235
SHA256a51e1dac0b388b8a6f5f2ad80118afbdf101e3286c60c7f57c14637cd9c7c37c
SHA512ebcb4ee8d403467299f2b9a2a927b775c348f9f636dd3b6bf05ac719d043b511a08f60fdf40196b301225663d4e24bbbcfb2bd9e9d0b453e7fe56164c5d9ff66