Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
02/09/2021, 03:59
Static task
static1
Behavioral task
behavioral1
Sample
NOIOUIOOO.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
NOIOUIOOO.exe
Resource
win10v20210408
General
-
Target
NOIOUIOOO.exe
-
Size
450KB
-
MD5
e1b17f95e65af9b57c5f9b917a65c74c
-
SHA1
7041471174b43d635195c7dbcb380308659df69a
-
SHA256
b9dfdd034ca5c15f3af2ab24eb48ac79fca0417ef264603a129857cd103eee11
-
SHA512
45e3c7bfcc84fc4fdb6414b37d6b95496b0984717db7e45885c4c921282cdf6f2c09a3dc097e896415c452892f4bda089c58ba5076de912716ad123652d517c4
Malware Config
Signatures
-
A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty Payload 2 IoCs
resource yara_rule behavioral2/memory/2264-123-0x0000000000400000-0x0000000000418000-memory.dmp family_stormkitty behavioral2/memory/2264-124-0x0000000000412452-mapping.dmp family_stormkitty -
A310logger Executable 4 IoCs
resource yara_rule behavioral2/memory/2264-123-0x0000000000400000-0x0000000000418000-memory.dmp a310logger behavioral2/memory/2264-124-0x0000000000412452-mapping.dmp a310logger behavioral2/files/0x0003000000000691-127.dat a310logger behavioral2/files/0x0003000000000691-128.dat a310logger -
Executes dropped EXE 1 IoCs
pid Process 4056 MZ.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 25 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 416 set thread context of 640 416 NOIOUIOOO.exe 75 PID 640 set thread context of 1172 640 NOIOUIOOO.exe 76 PID 640 set thread context of 2324 640 NOIOUIOOO.exe 82 PID 640 set thread context of 2264 640 NOIOUIOOO.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 2020 1172 WerFault.exe 76 3544 2324 WerFault.exe 82 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 InstallUtil.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4056 MZ.exe 4056 MZ.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 640 NOIOUIOOO.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 416 NOIOUIOOO.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2264 InstallUtil.exe Token: SeDebugPrivilege 4056 MZ.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 640 NOIOUIOOO.exe 640 NOIOUIOOO.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 416 wrote to memory of 640 416 NOIOUIOOO.exe 75 PID 416 wrote to memory of 640 416 NOIOUIOOO.exe 75 PID 416 wrote to memory of 640 416 NOIOUIOOO.exe 75 PID 416 wrote to memory of 640 416 NOIOUIOOO.exe 75 PID 640 wrote to memory of 1172 640 NOIOUIOOO.exe 76 PID 640 wrote to memory of 1172 640 NOIOUIOOO.exe 76 PID 640 wrote to memory of 1172 640 NOIOUIOOO.exe 76 PID 640 wrote to memory of 1172 640 NOIOUIOOO.exe 76 PID 640 wrote to memory of 2324 640 NOIOUIOOO.exe 82 PID 640 wrote to memory of 2324 640 NOIOUIOOO.exe 82 PID 640 wrote to memory of 2324 640 NOIOUIOOO.exe 82 PID 640 wrote to memory of 2324 640 NOIOUIOOO.exe 82 PID 640 wrote to memory of 2324 640 NOIOUIOOO.exe 82 PID 640 wrote to memory of 2324 640 NOIOUIOOO.exe 82 PID 640 wrote to memory of 2264 640 NOIOUIOOO.exe 84 PID 640 wrote to memory of 2264 640 NOIOUIOOO.exe 84 PID 640 wrote to memory of 2264 640 NOIOUIOOO.exe 84 PID 640 wrote to memory of 2264 640 NOIOUIOOO.exe 84 PID 640 wrote to memory of 2264 640 NOIOUIOOO.exe 84 PID 640 wrote to memory of 2264 640 NOIOUIOOO.exe 84 PID 640 wrote to memory of 2264 640 NOIOUIOOO.exe 84 PID 640 wrote to memory of 2264 640 NOIOUIOOO.exe 84 PID 2264 wrote to memory of 4056 2264 InstallUtil.exe 86 PID 2264 wrote to memory of 4056 2264 InstallUtil.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOIOUIOOO.exe"C:\Users\Admin\AppData\Local\Temp\NOIOUIOOO.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\NOIOUIOOO.exe"C:\Users\Admin\AppData\Local\Temp\NOIOUIOOO.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"3⤵PID:1172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 884⤵
- Program crash
PID:2020
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"3⤵PID:2324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 244⤵
- Program crash
PID:3544
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056
-
-
-