Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

b9253fd99b...0N.exe

windows7-x64

10

b9253fd99b...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b9253fd99b1e3519bae562e6807f8bb0N.exe

  • Size

    2.3MB

  • Sample

    240901-2383vsvfpe

  • MD5

    b9253fd99b1e3519bae562e6807f8bb0

  • SHA1

    7932803ddc64b7411eb697d5f91d59f2bfd08800

  • SHA256

    365ea7fd9bbe7ca9812eb77fe015d546ebd99a643746ad48cded7dd244bc3540

  • SHA512

    0fff0b99fc2570040668dad7b5f3e368bdebdb314ac97daa6d402d649b4ffa1859dbd28d95364fd28480b0887de10f83ef0e1b21d40f23290fd908f214c58c8a

  • SSDEEP

    49152:5uG1LzwL/5XkkofdmHMR7OW3vuKzNYMFjUKJyBWA:5b1L+RNofd17gelFv

Score
10/10
dcratcredential_accessinfostealerratspywarestealer

Malware Config

Targets

    • Target

      b9253fd99b1e3519bae562e6807f8bb0N.exe

    • Size

      2.3MB

    • MD5

      b9253fd99b1e3519bae562e6807f8bb0

    • SHA1

      7932803ddc64b7411eb697d5f91d59f2bfd08800

    • SHA256

      365ea7fd9bbe7ca9812eb77fe015d546ebd99a643746ad48cded7dd244bc3540

    • SHA512

      0fff0b99fc2570040668dad7b5f3e368bdebdb314ac97daa6d402d649b4ffa1859dbd28d95364fd28480b0887de10f83ef0e1b21d40f23290fd908f214c58c8a

    • SSDEEP

      49152:5uG1LzwL/5XkkofdmHMR7OW3vuKzNYMFjUKJyBWA:5b1L+RNofd17gelFv

    Score
    10/10
    dcratcredential_accessinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks