Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
162s -
max time network
99s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
30/09/2021, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
4625fadd292dd4724204cea78edd13fd.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
4625fadd292dd4724204cea78edd13fd.exe
Resource
win10v20210408
General
-
Target
4625fadd292dd4724204cea78edd13fd.exe
-
Size
241KB
-
MD5
4625fadd292dd4724204cea78edd13fd
-
SHA1
9b9896fb6f66f1914e82ad984d5816403c8b5883
-
SHA256
d9d7046f7539fd97259759a51b02650790a961ddb0d8f0b9f31c76faf6d63a91
-
SHA512
ffaff488840a57bd5158b183b166b4c45683b7e8ef408b3d58b59619d8818602f5e7c1f1555c5fcdc7d9cc0c0f7c8aa15c012f8c4147dcfbbd84be84958a6381
Malware Config
Extracted
smokeloader
2020
http://fiskahlilian16.top/
http://paishancho17.top/
http://ydiannetter18.top/
http://azarehanelle19.top/
http://quericeriant20.top/
Extracted
raccoon
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
-
url4cnc
https://t.me/agrybirdsgamerept
Extracted
redline
Second BUILD
asyndenera.xyz:15667
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral2/memory/916-149-0x00000000023E0000-0x00000000023FF000-memory.dmp family_redline behavioral2/memory/916-152-0x0000000004EA0000-0x0000000004EBE000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
pid Process 744 FCD9.exe 3304 5E3.exe 916 InternodesPiets_2021-09-29_21-00.exe 3420 Money10k_.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Money10k_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Money10k_.exe -
Deletes itself 1 IoCs
pid Process 3056 Process not Found -
Loads dropped DLL 5 IoCs
pid Process 3304 5E3.exe 3304 5E3.exe 3304 5E3.exe 3304 5E3.exe 3304 5E3.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000c000000000685-138.dat themida behavioral2/memory/3420-142-0x0000000000C10000-0x0000000000C11000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Money10k_.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3420 Money10k_.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 804 set thread context of 996 804 4625fadd292dd4724204cea78edd13fd.exe 68 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4625fadd292dd4724204cea78edd13fd.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4625fadd292dd4724204cea78edd13fd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4625fadd292dd4724204cea78edd13fd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2204 timeout.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 996 4625fadd292dd4724204cea78edd13fd.exe 996 4625fadd292dd4724204cea78edd13fd.exe 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3056 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 996 4625fadd292dd4724204cea78edd13fd.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeDebugPrivilege 3420 Money10k_.exe Token: SeDebugPrivilege 916 InternodesPiets_2021-09-29_21-00.exe Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3056 Process not Found 3056 Process not Found 3056 Process not Found -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 804 wrote to memory of 996 804 4625fadd292dd4724204cea78edd13fd.exe 68 PID 804 wrote to memory of 996 804 4625fadd292dd4724204cea78edd13fd.exe 68 PID 804 wrote to memory of 996 804 4625fadd292dd4724204cea78edd13fd.exe 68 PID 804 wrote to memory of 996 804 4625fadd292dd4724204cea78edd13fd.exe 68 PID 804 wrote to memory of 996 804 4625fadd292dd4724204cea78edd13fd.exe 68 PID 804 wrote to memory of 996 804 4625fadd292dd4724204cea78edd13fd.exe 68 PID 3056 wrote to memory of 744 3056 Process not Found 75 PID 3056 wrote to memory of 744 3056 Process not Found 75 PID 3056 wrote to memory of 3304 3056 Process not Found 76 PID 3056 wrote to memory of 3304 3056 Process not Found 76 PID 3056 wrote to memory of 3304 3056 Process not Found 76 PID 3304 wrote to memory of 3112 3304 5E3.exe 78 PID 3304 wrote to memory of 3112 3304 5E3.exe 78 PID 3304 wrote to memory of 3112 3304 5E3.exe 78 PID 3112 wrote to memory of 2204 3112 cmd.exe 80 PID 3112 wrote to memory of 2204 3112 cmd.exe 80 PID 3112 wrote to memory of 2204 3112 cmd.exe 80 PID 744 wrote to memory of 916 744 FCD9.exe 81 PID 744 wrote to memory of 916 744 FCD9.exe 81 PID 744 wrote to memory of 916 744 FCD9.exe 81 PID 744 wrote to memory of 3420 744 FCD9.exe 83 PID 744 wrote to memory of 3420 744 FCD9.exe 83 PID 744 wrote to memory of 3420 744 FCD9.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\4625fadd292dd4724204cea78edd13fd.exe"C:\Users\Admin\AppData\Local\Temp\4625fadd292dd4724204cea78edd13fd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\4625fadd292dd4724204cea78edd13fd.exe"C:\Users\Admin\AppData\Local\Temp\4625fadd292dd4724204cea78edd13fd.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:996
-
-
C:\Users\Admin\AppData\Local\Temp\FCD9.exeC:\Users\Admin\AppData\Local\Temp\FCD9.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\InternodesPiets_2021-09-29_21-00.exe"C:\Users\Admin\AppData\Local\Temp\InternodesPiets_2021-09-29_21-00.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:916
-
-
C:\Users\Admin\AppData\Local\Temp\Money10k_.exe"C:\Users\Admin\AppData\Local\Temp\Money10k_.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
-
C:\Users\Admin\AppData\Local\Temp\5E3.exeC:\Users\Admin\AppData\Local\Temp\5E3.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\5E3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:2204
-
-