Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

5936b1537b...27.exe

windows7-x64

10

5936b1537b...27.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5ea10818a7aa9cb88ac1f17cc5e86989.zip

  • Size

    1.7MB

  • Sample

    240901-aw9bhavdpd

  • MD5

    fd2427e27b4a65198864c96846a07e5a

  • SHA1

    11b4cdcc1941972bf19f63a5e6c2c05ea9fa33a9

  • SHA256

    a6b8cff0d4cc4edc063ce8bb8cddd0bd5b14c7e6a1f6ca4859dabca6f953af90

  • SHA512

    4274ad527cdd9a8e2ed04c51d5344459f7422e1c291f41de494f230ddb93b3d45866ef31b3e0e5d07aeef2f14394aefb315b74573f8c0190ac9f4e30f6036e2b

  • SSDEEP

    24576:ImyDaFAQ2lDUVPVO/AHN5g5tx8XDhFzpPE0ZTjpRkLNrEhRQXvua64eOKFSEwlxr:2a+wSYqx87dcut4NrEkffkOUSEPQWDU

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      5936b1537b180e8f610f37000936fe1c8979d63616c3131ad1afe33a2c096a27

    • Size

      2.3MB

    • MD5

      5ea10818a7aa9cb88ac1f17cc5e86989

    • SHA1

      d253771029ab507d7c64642f6586831305a62a2c

    • SHA256

      5936b1537b180e8f610f37000936fe1c8979d63616c3131ad1afe33a2c096a27

    • SHA512

      e3c942832460f6f6ddfe3d0a0a7afa903193bf4b07a3c702d52e7314769f72839bb3096c9dff68bdd26a9cf5c195f49e6f08c468f6499e6de1d784893db8ba3f

    • SSDEEP

      49152:UbA30uCU+RsTSd6BGz+ASnjx3xUPJyP9nTuD:UbBvuxwzxSjLS3D

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks