Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09/11/2020, 20:50
Behavioral task
behavioral1
Sample
9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe
Resource
win10v20201028
General
-
Target
9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe
-
Size
1.1MB
-
MD5
598b8633e7ca22ed1fb1f90d13215880
-
SHA1
01cd937912b153bad8bb9ee2c7314cb03b65fc5e
-
SHA256
9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96
-
SHA512
5899fdff91b6901363fad1f9b88f7150a264eba207f47819540af4576a44f03f64b267cf5dfb5b699d4b6955eda1708c18e59dbb5e66cbc3ac53b4849cddf601
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\RedTools\\networker.exe\"" networker.exe -
Buer Loader 3 IoCs
Detects Buer loader in memory or disk.
resource yara_rule behavioral2/files/0x000300000001a0e3-1.dat buer behavioral2/files/0x000300000001a0e3-2.dat buer behavioral2/memory/3684-4-0x0000000000000000-mapping.dmp buer -
Executes dropped EXE 1 IoCs
pid Process 3640 networker.exe -
resource yara_rule behavioral2/files/0x000300000001a0e3-1.dat vmprotect behavioral2/files/0x000300000001a0e3-2.dat vmprotect -
Deletes itself 1 IoCs
pid Process 3640 networker.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: networker.exe File opened (read-only) \??\A: networker.exe File opened (read-only) \??\E: networker.exe File opened (read-only) \??\F: networker.exe File opened (read-only) \??\G: networker.exe File opened (read-only) \??\N: networker.exe File opened (read-only) \??\O: networker.exe File opened (read-only) \??\P: networker.exe File opened (read-only) \??\S: networker.exe File opened (read-only) \??\U: networker.exe File opened (read-only) \??\V: networker.exe File opened (read-only) \??\Y: networker.exe File opened (read-only) \??\H: networker.exe File opened (read-only) \??\K: networker.exe File opened (read-only) \??\Q: networker.exe File opened (read-only) \??\W: networker.exe File opened (read-only) \??\X: networker.exe File opened (read-only) \??\Z: networker.exe File opened (read-only) \??\B: networker.exe File opened (read-only) \??\I: networker.exe File opened (read-only) \??\J: networker.exe File opened (read-only) \??\L: networker.exe File opened (read-only) \??\M: networker.exe File opened (read-only) \??\R: networker.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3640 networker.exe 3640 networker.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 984 wrote to memory of 3640 984 9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe 78 PID 984 wrote to memory of 3640 984 9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe 78 PID 984 wrote to memory of 3640 984 9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe 78 PID 3640 wrote to memory of 3684 3640 networker.exe 79 PID 3640 wrote to memory of 3684 3640 networker.exe 79 PID 3640 wrote to memory of 3684 3640 networker.exe 79 PID 3640 wrote to memory of 3684 3640 networker.exe 79 PID 3640 wrote to memory of 3684 3640 networker.exe 79 PID 3640 wrote to memory of 3684 3640 networker.exe 79 PID 3640 wrote to memory of 3684 3640 networker.exe 79 PID 3640 wrote to memory of 3684 3640 networker.exe 79 PID 3640 wrote to memory of 3684 3640 networker.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe"C:\Users\Admin\AppData\Local\Temp\9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\ProgramData\RedTools\networker.exeC:\ProgramData\RedTools\networker.exe "C:\Users\Admin\AppData\Local\Temp\9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Deletes itself
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\RedTools\networker.exe3⤵PID:3684
-
-