Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
10/02/2025, 12:16
Static task
static1
Behavioral task
behavioral1
Sample
Hermaean.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Hermaean.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250207-en
General
-
Target
Hermaean.exe
-
Size
1.0MB
-
MD5
a5350eaa7864ac06277c445e0f52f9d9
-
SHA1
9a589f6dcbb0ee908a1665501b3e249a00c05db8
-
SHA256
eab16fb9a96dba4a00c074dec9d6be01b5d93b680d69d230c21497fce96f9de5
-
SHA512
19cbd739728359dff2932ee72bf923598fe523ed2c08fc3d42f4e535e94e8cd7b0c4165eb1f3e4b54ef96b403396571b9ce9d3042ceacb996237d78b3347e2d1
-
SSDEEP
24576:NtLjOxH2phdL18qdTJhxEvGuw48Qw1J+FOZVKgyhz:NtLiwhd3dzxYfw4krkOZxy9
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
pid Process 3948 Hermaean.exe 3948 Hermaean.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Hermaean.exe Key opened \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Hermaean.exe Key opened \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Hermaean.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 28 drive.google.com 29 drive.google.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 61 checkip.dyndns.org 64 reallyfreegeoip.org 65 reallyfreegeoip.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 3844 Hermaean.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3948 Hermaean.exe 3844 Hermaean.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hermaean.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hermaean.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3844 Hermaean.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3948 Hermaean.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3844 Hermaean.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3844 Hermaean.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3948 wrote to memory of 3844 3948 Hermaean.exe 88 PID 3948 wrote to memory of 3844 3948 Hermaean.exe 88 PID 3948 wrote to memory of 3844 3948 Hermaean.exe 88 PID 3948 wrote to memory of 3844 3948 Hermaean.exe 88 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Hermaean.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Hermaean.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hermaean.exe"C:\Users\Admin\AppData\Local\Temp\Hermaean.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\Hermaean.exe"C:\Users\Admin\AppData\Local\Temp\Hermaean.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:3844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD516d513397f3c1f8334e8f3e4fc49828f
SHA14ee15afca81ca6a13af4e38240099b730d6931f0
SHA256d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
SHA5124a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
-
Filesize
11KB
MD57399323923e3946fe9140132ac388132
SHA1728257d06c452449b1241769b459f091aabcffc5
SHA2565a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
SHA512d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
-
Filesize
56B
MD5dafe25135ede7103cb267d1578e0c689
SHA1ef87a386d2c6b7494cf58f0c98c43af600632c42
SHA2560b8e7d7bf2483682129eda497da8a2119992e4aea40a6f9528afec01e1953653
SHA512f79caea14ae158bfebada8328cf2657fb028193d76597dafd228e982e00b6f59ff6631ea354a3d69bf83a8d0e99791f613e1c13a6cf2837a035e9c257d47ca48
-
Filesize
10B
MD59a53fc1d7126c5e7c81bb5c15b15537b
SHA1e2d13e0fa37de4c98f30c728210d6afafbb2b000
SHA256a7de06c22e4e67908840ec3f00ab8fe9e04ae94fb16a74136002afbaf607ff92
SHA512b0bffbb8072dbdcfc68f0e632f727c08fe3ef936b2ef332c08486553ff2cef7b0bcdb400e421a117e977bb0fac17ce4706a8097e32d558a918433646b6d5f1a1
-
Filesize
52B
MD55d04a35d3950677049c7a0cf17e37125
SHA1cafdd49a953864f83d387774b39b2657a253470f
SHA256a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
SHA512c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
-
Filesize
60B
MD586b1517dcafc4a4339179034c736b13a
SHA1dcaf657f694a70a5f41b45f9bd56b5adbfb9146c
SHA256a181b7d3e37b70dfa7393c75e56579969260257921b04a16798398b62298f355
SHA51214eff2d0277911af3956d652d26673e2f9d842f72b584ce0ff6f70dca311c18511b431febbce92ba2b88a4e78d54198db0c14371046ec2b9eb1ffc2971a5daf7
-
Filesize
30B
MD5f15bfdebb2df02d02c8491bde1b4e9bd
SHA193bd46f57c3316c27cad2605ddf81d6c0bde9301
SHA256c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043
SHA5121757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1
-
Filesize
33B
MD5340ad700cf73b73ea2313c044d40ea9a
SHA19b90cc3147d140fa936e308c2c320bdc385da93a
SHA25655a2b8f5ef1d17023fd8245e69830cc961c0ce629eddc7ac1043c288cb3915b5
SHA5124b31d10b80ae71197ac367c868569949224a4cd542bf0e9c188b816348ec8958f952525f939c827bddc8610f268dd12e310d6d2fc99071c741b3a38e062542b4