Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25/06/2022, 01:36 UTC
Static task
static1
Behavioral task
behavioral1
Sample
41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe
Resource
win7-20220414-en
General
-
Target
41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe
-
Size
556KB
-
MD5
9f7a5855b985ec4e17c6483456050e0d
-
SHA1
af606f0c570da6a45345599eebd2db68f31cf79d
-
SHA256
41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28
-
SHA512
22d95d9dbcd176bb6e941899616ddefd840c7f04f9eebf3ee1c5b43d88a9374e9b3a2be8021c45ba9b47a7c412836ed1162a3ed25f4dc8e31990d5dd8a2eb61a
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Vidar log file 1 IoCs
Detects a log file produced by Vidar.
yara_rule vidar_log_file -
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4488 41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe 4488 41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe 4488 41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe 4488 41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe 4488 41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe 4488 41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe 4488 41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe 4488 41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe"C:\Users\Admin\AppData\Local\Temp\41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4488
Network
-
Remote address:8.8.8.8:53Requestkolobkoproms.ugIN AResponse
-
Remote address:8.8.8.8:53Requestip-api.comIN AResponseip-api.comIN A208.95.112.1
-
Remote address:208.95.112.1:80RequestPOST /line/ HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 25
Host: ip-api.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Content-Length: 161
Access-Control-Allow-Origin: *
X-Ttl: 31
X-Rl: 42
-
Remote address:8.8.8.8:53Request151.122.125.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestkolobkoproms.ugIN AResponse
-
208.95.112.1:80http://ip-api.com/line/http41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe709 B 504 B 5 4
HTTP Request
POST http://ip-api.com/line/HTTP Response
200 -
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
61 B 125 B 1 1
DNS Request
kolobkoproms.ug
-
56 B 72 B 1 1
DNS Request
ip-api.com
DNS Response
208.95.112.1
-
73 B 159 B 1 1
DNS Request
151.122.125.40.in-addr.arpa
-
61 B 125 B 1 1
DNS Request
kolobkoproms.ug