Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    14/07/2021, 16:20

General

  • Target

    a1b3cb748176d91f760264b5349292eb.exe

  • Size

    958KB

  • MD5

    a1b3cb748176d91f760264b5349292eb

  • SHA1

    0629209324566660c0bf6151b4a9a894cde4086e

  • SHA256

    8130e7cb38e727c9f90c9ec404685cffdff6c731d780ba7220af582cadadb30b

  • SHA512

    a4fceea10bfc252168624c765e668b43f57e54bc4f31759eb595db2597f0b2744c355e687ea65674d9e7d88edd9d7de12fc73a337d384a81e0e45316f6ca7d24

Malware Config

Signatures

  • A310logger

    A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty Payload 2 IoCs
  • A310logger Executable 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1b3cb748176d91f760264b5349292eb.exe
    "C:\Users\Admin\AppData\Local\Temp\a1b3cb748176d91f760264b5349292eb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:800
    • C:\Users\Admin\AppData\Local\Temp\a1b3cb748176d91f760264b5349292eb.exe
      "C:\Users\Admin\AppData\Local\Temp\a1b3cb748176d91f760264b5349292eb.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        PID:1116
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\CREDITCARDNET4.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\CREDITCARDNET4.exe
        3⤵
        • Executes dropped EXE
        PID:4012

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/800-120-0x0000000005090000-0x0000000005091000-memory.dmp

    Filesize

    4KB

  • memory/800-118-0x0000000005160000-0x0000000005161000-memory.dmp

    Filesize

    4KB

  • memory/800-122-0x00000000050C0000-0x00000000050D0000-memory.dmp

    Filesize

    64KB

  • memory/800-123-0x0000000005DC0000-0x0000000005E7C000-memory.dmp

    Filesize

    752KB

  • memory/800-124-0x0000000005FF0000-0x0000000006068000-memory.dmp

    Filesize

    480KB

  • memory/800-121-0x0000000005200000-0x0000000005201000-memory.dmp

    Filesize

    4KB

  • memory/800-116-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

    Filesize

    4KB

  • memory/800-117-0x00000000055C0000-0x00000000055C1000-memory.dmp

    Filesize

    4KB

  • memory/800-114-0x00000000006F0000-0x00000000006F1000-memory.dmp

    Filesize

    4KB

  • memory/800-119-0x00000000050C0000-0x00000000055BE000-memory.dmp

    Filesize

    5.0MB

  • memory/1116-133-0x0000000000460000-0x0000000000461000-memory.dmp

    Filesize

    4KB

  • memory/2776-125-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/2776-135-0x0000000002B80000-0x0000000002B82000-memory.dmp

    Filesize

    8KB

  • memory/2776-129-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/4012-139-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB