Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

b56d3e6d1b...f9.exe

windows7-x64

10

b56d3e6d1b...f9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22acd327c5273659a31e56d94cefed20.bin

  • Size

    2.0MB

  • Sample

    240705-bqxwysyfln

  • MD5

    81df1cb6e4c6d782868e86cec6f39f13

  • SHA1

    2625730db76400bf98dec98ab061b9583586d2db

  • SHA256

    bfa0c423e604775804fc07a8da4ca2c01bc2b6be1fc18b9546bcf04b8872cdca

  • SHA512

    b80066372d2d6f2b318c798db58662dd5eda07c936b18299ad63ae395e4cd6b57856c8fc2a935b3002d6a95a241ea73cf93f1dd4cfc9dff0545dce96e87981a4

  • SSDEEP

    49152:7hPnCL/mt+k4Y7xgzUjGaF62CsHyhyHdcdE9CmgZC:lPnkmUHmGzUjF6phCudEOC

Score
10/10
dcratevasioninfostealerrat

Malware Config

Targets

    • Target

      b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9.exe

    • Size

      2.7MB

    • MD5

      22acd327c5273659a31e56d94cefed20

    • SHA1

      0c3534ab1f3f2fbc3b2410b50c0bd3450e8b7e20

    • SHA256

      b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9

    • SHA512

      046edff80da24dd5a8a4717c8f4059967faea2d82b45270e93c1386ca7ac27031aad61ce7552a26aef1ae1c59afad969602f1f72ae497817500ff6b43f605724

    • SSDEEP

      49152:fcg4fLmoCxQVw7OocLXGQ7xEnei4LnuINVRtEOmksWP1gPJ:fr4fLmdWzxLB7ineruitaRWmPJ

    Score
    10/10
    dcratevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks