Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
21/03/2025, 08:05
General
-
Target
2025-03-21_d1170c53f980018cd047396765218e88_hacktools_icedid_remcos_rhadamanthys.exe
-
Size
4.7MB
-
MD5
d1170c53f980018cd047396765218e88
-
SHA1
97bcacedb8170ee1bf247096e16478c6d7f97f1c
-
SHA256
16fc904f2e318ce6d15d00f89922f2416b25855cc74d3c872d14c47eec309711
-
SHA512
5d42246ade63ab48dc963f673ef078b65886b64fa389f6022c44a9a70112bf7688e77f45147bc10b16a8f954cff5848d1fedeb4cdec43c0f37018c5761f862d7
-
SSDEEP
98304:DwN9V/TKWfxlcswUr+cIJA0QTJfT+E5/u0:C9V/TZlv/+cP0QTtyL0
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-21_d1170c53f980018cd047396765218e88_hacktools_icedid_remcos_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-21_d1170c53f980018cd047396765218e88_hacktools_icedid_remcos_rhadamanthys.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TPHelper.exeC:\Users\Admin\AppData\Local\Temp\\TPHelper.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.7MB
MD596e3edd563f3e3dd27fe84f7af57d903
SHA180775781177d1024650e09f14c1b11f7d7e5acb3
SHA2568e5b1315efd3b746aee033b988b4a9ae83d6e2ec6549c92f16529a77921eecdf
SHA512b9ba5aebe6385380699e7cafa57e8af0e5b26e0a0bbb24093a50dfa88088539ebcd974c868c566a4fcdf5955dbf63840ca8ad0c29b539c1828b7b55d84b8be7a
-
Filesize
2.6MB
MD54dd6f847ad5c98b2ba4675d460251f91
SHA1924a09e16965ef5ada4d9a05b42ff89481bba031
SHA256da9614f19e4cffcbc83bf7520cd9efee35319b090daf6744c65480477cf60719
SHA512fc2f48232aea2d34c66c8b71c44ef4596d92dcba1d029a8d22086e7fdce24772328af1f2b8d1221ca5cf89c4bc2b3839cc0c15f735f14864d5beac200f9ab187
-
Filesize
1.7MB
MD5228bd598b39d614d2958159b61c83dc7
SHA139a9d1fe91dcbd1e0a50c507559332d4a270c06f
SHA256a35b9cb35ecb31d7ad2f109c7480176ddff3488605e1bf3195646149bad7f1a4
SHA5123b3a5fff9ab5eafe8bee3404de57e1704e6a30b2c4a94646a2fef7356c0e5f0623fc7e006129b5efac375c2779dafc2479e286aa76bc624aca693ae6f676d719
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
2.6MB
-
Filesize
284KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
2.5MB
-
Filesize
2.6MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
2.5MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
2.5MB