Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14/07/2021, 16:20
Static task
static1
Behavioral task
behavioral1
Sample
a1b3cb748176d91f760264b5349292eb.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
a1b3cb748176d91f760264b5349292eb.exe
Resource
win10v20210408
General
-
Target
a1b3cb748176d91f760264b5349292eb.exe
-
Size
958KB
-
MD5
a1b3cb748176d91f760264b5349292eb
-
SHA1
0629209324566660c0bf6151b4a9a894cde4086e
-
SHA256
8130e7cb38e727c9f90c9ec404685cffdff6c731d780ba7220af582cadadb30b
-
SHA512
a4fceea10bfc252168624c765e668b43f57e54bc4f31759eb595db2597f0b2744c355e687ea65674d9e7d88edd9d7de12fc73a337d384a81e0e45316f6ca7d24
Malware Config
Signatures
-
A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty Payload 2 IoCs
resource yara_rule behavioral2/files/0x000100000001ab41-131.dat family_stormkitty behavioral2/files/0x000100000001ab41-132.dat family_stormkitty -
A310logger Executable 2 IoCs
resource yara_rule behavioral2/files/0x000100000001ab41-131.dat a310logger behavioral2/files/0x000100000001ab41-132.dat a310logger -
Executes dropped EXE 2 IoCs
pid Process 1116 PASSWORDSNET4.exe 4012 CREDITCARDNET4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 800 set thread context of 2776 800 a1b3cb748176d91f760264b5349292eb.exe 78 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 PASSWORDSNET4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier PASSWORDSNET4.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2776 a1b3cb748176d91f760264b5349292eb.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 800 wrote to memory of 2776 800 a1b3cb748176d91f760264b5349292eb.exe 78 PID 800 wrote to memory of 2776 800 a1b3cb748176d91f760264b5349292eb.exe 78 PID 800 wrote to memory of 2776 800 a1b3cb748176d91f760264b5349292eb.exe 78 PID 800 wrote to memory of 2776 800 a1b3cb748176d91f760264b5349292eb.exe 78 PID 800 wrote to memory of 2776 800 a1b3cb748176d91f760264b5349292eb.exe 78 PID 800 wrote to memory of 2776 800 a1b3cb748176d91f760264b5349292eb.exe 78 PID 800 wrote to memory of 2776 800 a1b3cb748176d91f760264b5349292eb.exe 78 PID 800 wrote to memory of 2776 800 a1b3cb748176d91f760264b5349292eb.exe 78 PID 2776 wrote to memory of 1116 2776 a1b3cb748176d91f760264b5349292eb.exe 79 PID 2776 wrote to memory of 1116 2776 a1b3cb748176d91f760264b5349292eb.exe 79 PID 2776 wrote to memory of 4012 2776 a1b3cb748176d91f760264b5349292eb.exe 81 PID 2776 wrote to memory of 4012 2776 a1b3cb748176d91f760264b5349292eb.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1b3cb748176d91f760264b5349292eb.exe"C:\Users\Admin\AppData\Local\Temp\a1b3cb748176d91f760264b5349292eb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\a1b3cb748176d91f760264b5349292eb.exe"C:\Users\Admin\AppData\Local\Temp\a1b3cb748176d91f760264b5349292eb.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe3⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1116
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\CREDITCARDNET4.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\CREDITCARDNET4.exe3⤵
- Executes dropped EXE
PID:4012
-
-