Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2024, 16:25

General

  • Target

    552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe

  • Size

    2.3MB

  • MD5

    bc055ee1a3e93a1f1cadb666d073aa39

  • SHA1

    3a0d99190c69380ce01a088d7b8850debe4cf0f8

  • SHA256

    552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752

  • SHA512

    e77c8e75f9b1bce8136ebdb1807915f81c37d80f03e29b55cde6ee3c1755484b312254f86264ccc7dac54e65d68e4a7a4987b615af1b0f9fd2c986d6c3a36988

  • SSDEEP

    24576:3qzIIUgC8d36kLBXlnB8j7v5Ta+hLLQ20JmXSeWwa1oWJQjk0svTS/PPsbb1hwRn:3sCOfN6X5tLLQTg20ITS/PPs/1kS4eW

Malware Config

Signatures

  • Blackmoon family
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 4 IoCs
  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe
    "C:\Users\Admin\AppData\Local\Temp\552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2540
    • \??\c:\xxxrrfr.exe
      c:\xxxrrfr.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1132
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 224
        3⤵
        • Program crash
        PID:3448
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1132 -ip 1132
    1⤵
      PID:4584

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\xxxrrfr.exe

      Filesize

      2.3MB

      MD5

      08f35484cecb2f7ddfadb7d7fd4e3d25

      SHA1

      3bf6f807eaee4d7b7c3d4305731561c4309c79ac

      SHA256

      0b3ee62632c27cd445c0af5b3330974b46f07bd8b7f9097c5471ed0dcc3c8859

      SHA512

      c43f56119350e1040f35ccd362e0822ddcf9021bff1b5ce64252a9e797d68237210f3bd432e692e30d4776efe8a0071edb7bd2677d111339763ac28807965745

    • memory/1132-6-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2540-0-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2540-5-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB