Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 00:05
Behavioral task
behavioral1
Sample
c-realV2.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c-realV2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
c-realV2.pyc
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
c-realV2.pyc
Resource
win10v2004-20240508-en
General
-
Target
c-realV2.exe
-
Size
9.8MB
-
MD5
cf88f81270f9a6abb71bdfacb7c5fc96
-
SHA1
6a99eb6f3b0b266136f86f81070afe8df4622615
-
SHA256
ac7bf1cf5d4b2ec6de9bc3e5f4402df6d9d7ebe089cdcbbcf7be8a8995a56f1a
-
SHA512
6657b2eab3d2af4985d46ca7fc78c92d1cc9a3913b2bbb0182dcd13702e9e58abac7273727afca031bb826f8e9e99c2e881ff7cfe1b0bdd2b9e7b68a04ee9785
-
SSDEEP
196608:O2RuMeNj9iBqRsj41YWuJ8IcUeOYXOxfOsYk6dnvz16:0TUaYBJ8IcVO/xqdY
Malware Config
Signatures
-
Loads dropped DLL 30 IoCs
pid Process 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe 1448 c-realV2.exe -
resource yara_rule behavioral2/files/0x00070000000233cf-32.dat upx behavioral2/memory/1448-36-0x00007FF8014B0000-0x00007FF801A99000-memory.dmp upx behavioral2/files/0x00070000000233b5-38.dat upx behavioral2/files/0x00070000000233ca-40.dat upx behavioral2/files/0x00070000000233b4-42.dat upx behavioral2/memory/1448-44-0x00007FF819270000-0x00007FF81927F000-memory.dmp upx behavioral2/files/0x00070000000233b8-46.dat upx behavioral2/memory/1448-43-0x00007FF810340000-0x00007FF810364000-memory.dmp upx behavioral2/memory/1448-49-0x00007FF810310000-0x00007FF81033D000-memory.dmp upx behavioral2/files/0x00070000000233bc-50.dat upx behavioral2/memory/1448-48-0x00007FF816460000-0x00007FF816479000-memory.dmp upx behavioral2/memory/1448-52-0x00007FF8102F0000-0x00007FF810309000-memory.dmp upx behavioral2/files/0x00070000000233d0-53.dat upx behavioral2/memory/1448-56-0x00007FF816610000-0x00007FF81661D000-memory.dmp upx behavioral2/files/0x00070000000233ce-55.dat upx behavioral2/memory/1448-59-0x00007FF8102B0000-0x00007FF8102E5000-memory.dmp upx behavioral2/files/0x00070000000233bb-58.dat upx behavioral2/memory/1448-61-0x00007FF8103C0000-0x00007FF8103CD000-memory.dmp upx behavioral2/files/0x00070000000233bd-62.dat upx behavioral2/files/0x00070000000233c9-64.dat upx behavioral2/memory/1448-66-0x00007FF8101F0000-0x00007FF81021E000-memory.dmp upx behavioral2/files/0x00070000000233cb-65.dat upx behavioral2/memory/1448-70-0x00007FF80F510000-0x00007FF80F5C8000-memory.dmp upx behavioral2/memory/1448-71-0x00000230BA3D0000-0x00000230BA745000-memory.dmp upx behavioral2/memory/1448-73-0x00007FF8014B0000-0x00007FF801A99000-memory.dmp upx behavioral2/memory/1448-72-0x00007FF800D10000-0x00007FF801085000-memory.dmp upx behavioral2/files/0x00070000000233b3-74.dat upx behavioral2/memory/1448-76-0x00007FF8101D0000-0x00007FF8101E5000-memory.dmp upx behavioral2/files/0x00070000000233ba-77.dat upx behavioral2/files/0x00070000000233b7-81.dat upx behavioral2/memory/1448-84-0x00007FF810070000-0x00007FF810084000-memory.dmp upx behavioral2/memory/1448-83-0x00007FF810310000-0x00007FF81033D000-memory.dmp upx behavioral2/memory/1448-82-0x00007FF810100000-0x00007FF810112000-memory.dmp upx behavioral2/files/0x00070000000233cd-80.dat upx behavioral2/files/0x00070000000233d3-86.dat upx behavioral2/memory/1448-87-0x00007FF8102F0000-0x00007FF810309000-memory.dmp upx behavioral2/files/0x00070000000233c2-96.dat upx behavioral2/files/0x00070000000233c0-95.dat upx behavioral2/memory/1448-93-0x00007FF80FE70000-0x00007FF80FE8B000-memory.dmp upx behavioral2/memory/1448-92-0x00007FF800880000-0x00007FF80099C000-memory.dmp upx behavioral2/files/0x00070000000233d5-91.dat upx behavioral2/memory/1448-88-0x00007FF80FEE0000-0x00007FF80FEF4000-memory.dmp upx behavioral2/files/0x00070000000233c1-98.dat upx behavioral2/files/0x00070000000233c3-101.dat upx behavioral2/memory/1448-105-0x00007FF8072C0000-0x00007FF8072FE000-memory.dmp upx behavioral2/files/0x00070000000233c8-116.dat upx behavioral2/files/0x00070000000233c6-115.dat upx behavioral2/files/0x00070000000233c5-112.dat upx behavioral2/memory/1448-110-0x00007FF80EC30000-0x00007FF80EC3A000-memory.dmp upx behavioral2/memory/1448-109-0x00007FF80F500000-0x00007FF80F50E000-memory.dmp upx behavioral2/memory/1448-108-0x00007FF80F510000-0x00007FF80F5C8000-memory.dmp upx behavioral2/memory/1448-107-0x00007FF8101F0000-0x00007FF81021E000-memory.dmp upx behavioral2/files/0x00070000000233be-106.dat upx behavioral2/memory/1448-104-0x00007FF80EC40000-0x00007FF80EC55000-memory.dmp upx behavioral2/memory/1448-103-0x00007FF80FE50000-0x00007FF80FE62000-memory.dmp upx behavioral2/files/0x00070000000233b6-123.dat upx behavioral2/files/0x00070000000233d2-126.dat upx behavioral2/memory/1448-128-0x00007FF802010000-0x00007FF802022000-memory.dmp upx behavioral2/memory/1448-127-0x00007FF801EB0000-0x00007FF801EF3000-memory.dmp upx behavioral2/memory/1448-122-0x00007FF8101D0000-0x00007FF8101E5000-memory.dmp upx behavioral2/memory/1448-121-0x00007FF8072A0000-0x00007FF8072B6000-memory.dmp upx behavioral2/memory/1448-120-0x00007FF80CAC0000-0x00007FF80CAE4000-memory.dmp upx behavioral2/memory/1448-119-0x00007FF80D400000-0x00007FF80D40B000-memory.dmp upx behavioral2/memory/1448-118-0x00007FF800D10000-0x00007FF801085000-memory.dmp upx -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3564 wrote to memory of 1448 3564 c-realV2.exe 84 PID 3564 wrote to memory of 1448 3564 c-realV2.exe 84 PID 1448 wrote to memory of 3008 1448 c-realV2.exe 87 PID 1448 wrote to memory of 3008 1448 c-realV2.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\c-realV2.exe"C:\Users\Admin\AppData\Local\Temp\c-realV2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\c-realV2.exe"C:\Users\Admin\AppData\Local\Temp\c-realV2.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:3008
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
34KB
MD5cb95a91c8b907752b69c8f12a72bc40e
SHA11e9504a7bdc0e9abb8bb6e39da2ba4e0d7386efe
SHA2567d87702964e1e1faca0e30325900c3f075fe7acd05b3692f9f5e062b60e641cc
SHA512650d1d626df473858eac810dc2f8697e18d91a5a6d2a17f8643f89a6215e43018852b81b82123cce80ba21d1249258b3eee944fb4e9571f28e1fce6a6d7b9bc6
-
Filesize
46KB
MD5dafa6d12daef616d7afb2853d339b4d6
SHA1482ec0e8581ad99c42495fb76f42884191481399
SHA2563260d2120df53e7a4a3d68299e72d8919fbb956f30d92d2d0f75f055bd72262c
SHA5129358cb9a0b728567d5800efbb139f0fd6c4b016f2c6ef366d770f8f0aca92eb42d5769f48f4ea11e6bf064a04fdb3901f86db80b3f622d0ea8b8ccb1cf2c26f0
-
Filesize
56KB
MD5ee797ca2e9dae16f1afaf5350c0fe170
SHA1623a9ccbff3a0c9416e882e0ae4251caead84aa5
SHA2563496264fa3f5cc6cc5c7f359bfb1f3a2388065f45461479cbcc6ab88601065dc
SHA512dbb6abc1d738c783627db7ef9e553bfffe7af345f2bf0dadaa987d4ca6c883ce55ac9038da95995c68d1691f296f20283918119d803ad1f930f04fe8bd067018
-
Filesize
104KB
MD5e313e859ded9d57a93d5c9458841cf8a
SHA1d45c4ffce746691e1eb35ab6e2432a6c7095bb14
SHA256bd700d7b50849dcca44ad1df5f8ca8176fd287ba43614bc1c58a80a07a05f1e9
SHA512227560009c898ca7ab2c0da3885fdfa46fec7554eea2a914500a3e6baa83c8861ab4585000230b80259e2c60967eacf842a13ff369ac3e6359ff2df56796fcbc
-
Filesize
33KB
MD59b98ab14cc78ead3b6e25deaa45b66db
SHA1a49b4621a592fd1fe09bf9638917407c7df4450e
SHA25671c588c4d87a06acb3275537783ff34950e6dd651365545fac42c53ed5fba182
SHA5122fce844285e7f1a8cca88e80b132da736ffa3efb50a498daf687546ea410148693ef5d31d9da2a68784bcfd3e15e34d13c3868a90a814ecfabe006d911769cfc
-
Filesize
84KB
MD5d79bdfeb08765cedcb612cacf40cb667
SHA19008847fb90a7bcb84d6ebbb34611022a8118cb8
SHA2567909a4571b1af1f5aba469f6c2a642c1fbdc949890c96a89f4782a53a7fb5471
SHA512d53d11e75ef590e8578af5cb8be71fe77930f9cfded89c1afa0bb1d04410432cd655d4d4287c0c7c547d9c667dba7d2bd51ecfda727fb312bc2c38993c1360be
-
Filesize
30KB
MD57f766374428a6d7390724f659239ce69
SHA1c69be06cb7d8257f42d03815164323a746c525fa
SHA25640588139ae6eba475e5ab00d90eed826aa374b7d335298d106dc81153142e19d
SHA5124515f80e09281ae5bd619fb881e6a4683ac854c2c85f5d010aa2cd3600a08ccb80bdae48320c8582deafe41b0a7d0996a88bce38a66c97721c0772519d22b933
-
Filesize
24KB
MD58b91d1de78b7e337ad267cfeb5c22b15
SHA1f1f7d67859ad0007f1a4968a82ac0281829fa61c
SHA256981a27eff5e45b819c295cd669c905bec18faf661fb5183f255932b627d008d5
SHA512c52ea0bef75b33c912f089654af75aa684fb8337d452e326a2a0a764380c35219c1b8b8c979694bff1eb0b32aaf1dde98de4ec51b88e332545ff703e89ea0366
-
Filesize
41KB
MD598b4b4b16b28cea6bc7ad21e5b7099cb
SHA13d68d473e621ae6f4ea8d45f009d76fd31754a97
SHA256604c46e40e85ee8cfde8b6092d4785bb4c6b1c3692e648ce30fbabc119527014
SHA512e587ef54944d77189666c2f3ef9a4e27ebc17fa53ba12fbab6246815435bd63e7df4634b34f44b9e112f89f4cd56caaf1af066e14102d8c7fccf0355d2cc454c
-
Filesize
60KB
MD5cd4cd236dfd476e629c5e30597d0b5d6
SHA149df5575ecf1f58f3f61daa979518f43d6fde86a
SHA2560713d93a6c083f2ab1391dc78ad5d897c1ef4eef8a71648213d6631f0b6843e5
SHA512829b72f81cfe3563ada7ea71d815b1a4772469a3624dff600ea1a532b3aac554a4f3a64950087f6d05b67bebe937244ff75a9eeaf03b3f80fd883e7d52f859fe
-
Filesize
21KB
MD5adfcda65b24dba25a281160c8e2549b6
SHA1052d2b22afb1442025b5ff22501e18cccc017d04
SHA256cfda1ec3a28982545816b037799c0d1c089ad82d0a255efc97b23ff60571373c
SHA51276f45fb36e614fd96498bbb6a3de00730d12f4bf7f89a63f3f9d75a66c8598ab105d1acbb53227437b9a89b8fd81e6d6fbb059e62247bbed01815a4c0f6a52c5
-
Filesize
20KB
MD51f08cad759839d57af8ad8d3d66307f9
SHA13407c49d52c46778349d5583b08bcd55238b882b
SHA256926eda0ad4312561f65a0ac786f40de0e7edfb78467bbd3f2f647211bf3b895d
SHA512c2e82e7d40e92c2d5cf5a8181c63a20f31c4e7134fe3bce581de4969d8a00ffb3290d5a7eff99c262c5b8d7a9813ede275a784dbc0c1e9d34ec8a2aa24e9de74
-
Filesize
63KB
MD52b1aa1aecbe9c124ff07fd349c9b3c8f
SHA1cbe2a15c9e09ef0d9ef8ff61305deb14b0d937f1
SHA256402d8443e33b0223e28f6b9c3660073ed1f35527a921b455ada1398ff299a03c
SHA51270b206cbef196ef0555ec27edcd61a3a7a2278afa284aeefdb15dc7d583cbb4486bfc445c809dab0feec82756db5148deba2d18a35a4272bbd694643eebb0b8a
-
Filesize
19KB
MD51a75e171dbeeb2fb92ec885e2bc5652d
SHA137b31aa6ec621dafdba16f044c0f8349959168f2
SHA256d2057b4cfa5a1687601fcba4b2730d76b90da4db09a1d76b1943a4751961685a
SHA51255850a84cc065b36e7b5374ba840abf110f8a2f5fc3a9840e6a1163087e85a0cd2538ca1e6d42bae2fbd89513aced846dbb00bcfabd1dff4ee7a2f03728c05c2
-
Filesize
14KB
MD56e18d60399ab6e284f11dfae829bb8e6
SHA1b39dc183f9f002dcdc0a6ca07dcee64286cce764
SHA256edfadfab5ad2428365f9e0d6cd9e91fc4c29b78b9e3e6ac7cbcd118ed986f11f
SHA512452def3915a095e5410cbb0f4b6e7e1a885ee9217f4f84bd6bf63e8201602c03ea382270291dcf650a2132029e24bb11cd29278411c5d4ec904dfd306c8f59b8
-
Filesize
1.7MB
MD5e9c28bc7ae0276a2413d913fabe101cc
SHA1baefb0b00eac192113737106bc76b02244c17838
SHA2567ecd1dfe0dcc82c2e595729cb238acb890326adc87136334ce9c21a5f0c847bf
SHA512c25532849462e0dc1e3e7fd5f0dcc93a5dc18c7b29920819143ec30fec899f98cb8a538ab0084b9ba91f62705de3dededef6acfae02daf1efceabac3819804e9
-
Filesize
9KB
MD57f1584f25ffd99d876f6816db20d033e
SHA11b0e9d7d2e2779887299f29ad991dc5cda7eaa5e
SHA256ff381242e40a70510e0e69a34e3ab18fdcdb56865f5905425d20ddfff3452400
SHA5125f6a01985b820aeacdd5e54eade039d20e90643510fdf2a97be6b955436420bb38a86c44f6245aef0200fe4515800eaf231721ecfe50dfdbf57b96a966d828ed
-
Filesize
38KB
MD5c85002eed76b760e311b042f5831a4a6
SHA1a5ea6c4e3dfc6ae735f7ff9876839940507230fd
SHA256d2dba1513d01ca0a06024bbe7af43a6896c327d370153407d430ba8b5abea55e
SHA5120f7e1b4b80975945e9aabdb559c7a2a0ac43128d979f01d11d04092b93148ae2c1fab88b4ed5cf004305fb4d7dccad32d5bdcdf75cfd554d7329a2773c29d9e4
-
Filesize
24KB
MD52ff22166c3bdc9dcb9ea6de5e8d16bbe
SHA1d0dd16250d01150e93b0ff645cf2acc51ca5ca31
SHA256776214669dfab09c476e9a26be0e67bf8bb2df9e7b7bf2746e6b3d2a54b09d0f
SHA512c5ec6ac73e83c3e7879bfd90e662cf537784d37dc15c72fa6ab28331c756ccde5185c72dab4b1e56e1b4a2bedc4ff99233f194fbe32492c03eda3f8df7efb3d2
-
Filesize
1.1MB
MD58a0b20d8e0e7f225693d711d556adc8a
SHA19486b7bdba3682f29f918ec22ec3d3f0dd0101fd
SHA2560b7ba07933749e08f265ce5f9361a52cd00c86c84713db8c7b6955e75fb8359b
SHA512164b5138e708c494094c60084945b24c73ff345433c8231fcc79a8fa5059634374f8998b04d9a967e37cde8af88bd4ff4484eca641fe112952af4b98081d7bda
-
Filesize
27KB
MD5aaf07947fe7aa9980900dfd10145c32f
SHA179b605e95c55524ef13ed130fddb277df121aaee
SHA25655210e5a2e9885c30624cda41bf4a83b2598e661590349e7997ab28be70569a4
SHA512e17463ecdad0c5fda59197b0bfd2f35ae0580e8791eaad5ef52c2ad876e993709fbe7b6c10e5a16eba276c7f8163f5acffd86fe500652854407ae036b8befabe
-
Filesize
203KB
MD55fba49b16f11befe297103bc28f20940
SHA1412a4d12b6837314826b3ab8f868182da12b1f1a
SHA256cc147f1b1467d4646450b66a8e59d26980a50f36fd3176eb2701e7bd28b22c72
SHA51262881a3b70afea335819ca2fafe85711607ce526f45a628fa775574c36ff3b287d5c9b9a8449131831e15644048a5e8255c3cae91487bd8cdd90e684748dec98
-
Filesize
20KB
MD5926e67372520a3bb5afaf00ecc0a2baa
SHA17cd4cddde1a7c6b12168551ce88fbc8e6a9486e1
SHA2565c120e3ffa9c3ed47455d3e2ea63da488ec77937236c9e91f1213810f9ca1146
SHA512bc64b93d144b56560f145dccad1849e8e8b982126df074546f08a0276ee33b7d5cf53241eca80223ef7f989f1b10cbdd7e0a5690f9b3d0de433cf1ca7af79195
-
Filesize
86KB
MD5a9ee1c53c76d3c2c622a5c4649edcbf2
SHA1c9b0e3269d9eb5e6aa47c39619f70b3e8b208924
SHA256446f5b0e6fb174ba8f2c8ffb45d093e87f12b02b1119e9b4baa9642c981321ce
SHA512e256b074dbf40a662398f0b2eb909a498051e16eb7fedcdd5afe247f80632a60a8cb01cc5aeec52f1d392c90b5aaaa94ca4b72ed2d3e0d4018a840d7408b2fef
-
Filesize
1.6MB
MD55ef44effa518fc9b3acda79684381d75
SHA1df6d1a46e691dce3373800b188137eed4ce97dfc
SHA25690fe310cce48c73f05b7e678a36f2d6bb8870c316b9f12495255b60ad7787777
SHA512ca52ccd9dedfb03d38544cb2f5a248d52873f7ef143ee3693d2fe11e941e81c5a48da277dbe0cdcf5b01701778ba083d0355fdfef0c13faa59411e7e12e5928c
-
Filesize
24KB
MD5ccdb37c527ce2db915e3701ee204c7dd
SHA18454bc2761504ea11fbaa6f2683bbca36a3989a9
SHA2560f8d10473924f0bee9430be8824f8bd626fa4efaf98cdc10eee64e70dd4ef3f0
SHA5123e04fecf39585445f2541d5ee16c3e522770daa9b1778a5e51db68261d4080e1b5373ded5a9a46f5f2204de1049be85814f86b28dd882ced8cff0632c34b70d7
-
Filesize
19KB
MD57537313d97bdcf7cac86f9e9a00527cd
SHA1f4afaafc207e06222b9c828cd15b4fd75e620d0d
SHA256c8bda770244b2966588758752f19c735efc71e3a86d077555040d3ff0f47ada7
SHA5121dbb67202d248a825188a52ec0cf7bbd05ac8d687c0976836b518c89ae23fc722ce98dfacc08def9c27f066643860dcde9935a104c5ddaa11b19afb4c68f5dd5
-
Filesize
294KB
MD554386c35a62c1a9eb63a29863f623a63
SHA17bb961b23816d30b727448c20bb65a57f64c95a1
SHA2568066be8a9e752be80afff19fb21449998964dc8882cbe947230629ab21dc1009
SHA512f7294832edc2e0bf87359bee12d60aac6eb397bcdd848317c0444a22b855f986d7c550a0268bf47902d78e9f0aecd206ee487e2081dee6665158f0ceb327e5e6
-
Filesize
30KB
MD5a364a3210e1b7c35f9bb9c1672ad5fc1
SHA1d1c65204c9ef8d601eb2800fb96925cb85cbf274
SHA2568ec8b9b6f9cab2aaf787d29e16f1e6a19fe3a88ab1948c4e25922f20f3e22f09
SHA512b7f96701f284abda7dcd8a6d25cb34a9314c04a401799863672199e84ba72ee207bf92b80ad7135379fde4cd8da078b982a446c11e14d086ed6eb49cbde8d862