Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25/06/2022, 01:36 UTC
General
-
Target
41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe
-
Size
556KB
-
MD5
9f7a5855b985ec4e17c6483456050e0d
-
SHA1
af606f0c570da6a45345599eebd2db68f31cf79d
-
SHA256
41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28
-
SHA512
22d95d9dbcd176bb6e941899616ddefd840c7f04f9eebf3ee1c5b43d88a9374e9b3a2be8021c45ba9b47a7c412836ed1162a3ed25f4dc8e31990d5dd8a2eb61a
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar log file 1 IoCs
Detects a log file produced by Vidar.
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe"C:\Users\Admin\AppData\Local\Temp\41839e491ad6d2fef519c25fd4476cfc9749f49831dc6f53a8274e39e1f43e28.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
-
DNSkolobkoproms.ugRemote address:8.8.8.8:53Requestkolobkoproms.ugIN AResponse -
DNSip-api.comRemote address:8.8.8.8:53Requestip-api.comIN AResponseip-api.comIN A208.95.112.1
-
POSThttp://ip-api.com/line/Remote address:208.95.112.1:80RequestPOST /line/ HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 25
Host: ip-api.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 25 Jun 2022 01:36:45 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 161
Access-Control-Allow-Origin: *
X-Ttl: 31
X-Rl: 42
-
DNS151.122.125.40.in-addr.arpaRemote address:8.8.8.8:53Request151.122.125.40.in-addr.arpaIN PTRResponse
-
DNSkolobkoproms.ugRemote address:8.8.8.8:53Requestkolobkoproms.ugIN AResponse
-
208.95.112.1:80http://ip-api.com/line/http
HTTP Request
POST http://ip-api.com/line/HTTP Response
200 -
93.184.220.29:80
-
104.110.191.133:80 -
104.110.191.133:80
-
20.189.173.15:443
-
104.110.191.133:80
-
104.110.191.133:80
-
104.110.191.133:80
-
8.8.8.8:53kolobkoproms.ugdns
DNS Request
kolobkoproms.ug
-
8.8.8.8:53ip-api.comdns
DNS Request
ip-api.com
DNS Response
208.95.112.1
-
8.8.8.8:53151.122.125.40.in-addr.arpadns
DNS Request
151.122.125.40.in-addr.arpa
-
8.8.8.8:53kolobkoproms.ugdns
DNS Request
kolobkoproms.ug