Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 22:16

General

  • Target

    4eae1353dbeae131a25464acc5c3eca78f4a67c791ce5f12e3008a0db050b2a9.exe

  • Size

    86KB

  • MD5

    a3297494b465b89a6d58e742ab4e8438

  • SHA1

    59e5d31799dc0bc7b70da92fefed93ce3d3c62c4

  • SHA256

    4eae1353dbeae131a25464acc5c3eca78f4a67c791ce5f12e3008a0db050b2a9

  • SHA512

    c3cd65db947f1cba0fb0f83584d4e082c327ac6a184486b999799ab3844530795eb3c3bf96c92bff1fdf09b82c0c1163ce61e3b2f2d2518e3c67bb36c536aab2

  • SSDEEP

    1536:1Fgj6MBlXQhVMWMpdhy0XDsN9vsJWb7lZbxcDxcqO0CmuJd4BXac6:1CmylXQryf5qsQbraDCqOBbd4In

Malware Config

Extracted

Family

gozi

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Gozi family
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4eae1353dbeae131a25464acc5c3eca78f4a67c791ce5f12e3008a0db050b2a9.exe
    "C:\Users\Admin\AppData\Local\Temp\4eae1353dbeae131a25464acc5c3eca78f4a67c791ce5f12e3008a0db050b2a9.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Users\Admin\AppData\Local\Temp\4eae1353dbeae131a25464acc5c3eca78f4a67c791ce5f12e3008a0db050b2a9.exe
      C:\Users\Admin\AppData\Local\Temp\4eae1353dbeae131a25464acc5c3eca78f4a67c791ce5f12e3008a0db050b2a9.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\4eae1353dbeae131a25464acc5c3eca78f4a67c791ce5f12e3008a0db050b2a9.exe

    Filesize

    86KB

    MD5

    1afdf8a4f2260afd3c7ed7f0f7c61cc8

    SHA1

    5925b707f37335f9a32c5942e9feae65092744b5

    SHA256

    783e6457e3a42dcb2fbfede11992493b157436843570fcf433e33d2d2ae1d82b

    SHA512

    f92478ab351b579cac9ee05c9b2dcbb4e9fa3367adcd52d179e8e0995fe2d61883da6fe6f2f781fc84788e18d3ad9484e5fa9996d0effae44823a0c9e1fff169

  • memory/1288-0-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1288-1-0x00000000001B0000-0x00000000001BE000-memory.dmp

    Filesize

    56KB

  • memory/1288-3-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1288-13-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2416-12-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2416-14-0x00000000000C0000-0x00000000000CE000-memory.dmp

    Filesize

    56KB

  • memory/2416-15-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2416-24-0x00000000014C0000-0x00000000014DB000-memory.dmp

    Filesize

    108KB

  • memory/2416-20-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2416-26-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB