Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
11/02/2025, 00:51
Static task
static1
Behavioral task
behavioral1
Sample
a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a.exe
Resource
win10v2004-20250207-en
General
-
Target
a.exe
-
Size
3.5MB
-
MD5
7b26a25d7bf2be6fdc2810ba5f519b4a
-
SHA1
967f13ece757df4e6958f6a1b36a0f4b318c0adf
-
SHA256
7609a4fb8cfd6952fcd5c814697d48521969d238849ed093baffb04571838419
-
SHA512
16d060e1d5ddfec7362a56035f969084e2600ea236e08ed1406fcd72b24585ba75ed1cd9e09435755eeb0a835e27dc86a9d1e4200a8f9a00b47f03994d4eccce
-
SSDEEP
49152:VJ2wV+FziaAzOjCkh4Fg8eHTZmmI029l5QZEYijwTlHAYWOQSGn:6A+F42og8kTZu06XTV
Malware Config
Signatures
-
Detects Rhadamanthys payload 1 IoCs
resource yara_rule behavioral2/memory/4676-2-0x000001FFCBBA0000-0x000001FFCBCBE000-memory.dmp Rhadamanthys_v8 -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4676 created 3024 4676 a.exe 50 -
Downloads MZ/PE file 1 IoCs
flow pid Process 26 1324 Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1592 MicrosoftEdgeUpdate.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4676 a.exe 4676 a.exe 4676 a.exe 4676 a.exe 4676 a.exe 4676 a.exe 2028 svchost.exe 2028 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4676 wrote to memory of 2028 4676 a.exe 89 PID 4676 wrote to memory of 2028 4676 a.exe 89 PID 4676 wrote to memory of 2028 4676 a.exe 89 PID 4676 wrote to memory of 2028 4676 a.exe 89
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3024
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\a.exe"C:\Users\Admin\AppData\Local\Temp\a.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4676
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0E4RkY1NzMtOTZDMS00MDIxLUI4NTgtOTUyMzdCOUE0NTYwfSIgdXNlcmlkPSJ7NjlCMDU1MDAtNDkwMi00NUUyLUI2RDctOUMxMzc1NjNBNEMzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MUI1OUMzMTEtNEJGMi00QkE0LUI2N0MtRjBCMUNDMEY5MTMxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTEyNTg4MTM3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1592