Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2022, 09:09
Static task
static1
Behavioral task
behavioral1
Sample
cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe
Resource
win10v2004-20220721-en
General
-
Target
cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe
-
Size
266KB
-
MD5
47ac5b93c393ffb0f3451675855ebb15
-
SHA1
90ebc874f7c47f5e36182c552622c4ca6c284c0a
-
SHA256
cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683
-
SHA512
484beb7b5f9ea29d138c18ccb1e36e0a9a94156177c1bed68da3fd701340a15388fc10b540e1941c7eb3d925b21c601d9c3528872f835c74f3eb321530f6867d
Malware Config
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/4656-139-0x0000000001300000-0x000000000131A000-memory.dmp family_stormkitty -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 34 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2588 set thread context of 3768 2588 cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe 85 PID 3768 set thread context of 4656 3768 cvtres.exe 86 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4656 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3768 cvtres.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2588 wrote to memory of 3768 2588 cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe 85 PID 2588 wrote to memory of 3768 2588 cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe 85 PID 2588 wrote to memory of 3768 2588 cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe 85 PID 2588 wrote to memory of 3768 2588 cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe 85 PID 2588 wrote to memory of 3768 2588 cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe 85 PID 2588 wrote to memory of 3768 2588 cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe 85 PID 2588 wrote to memory of 3768 2588 cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe 85 PID 2588 wrote to memory of 3768 2588 cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe 85 PID 3768 wrote to memory of 4656 3768 cvtres.exe 86 PID 3768 wrote to memory of 4656 3768 cvtres.exe 86 PID 3768 wrote to memory of 4656 3768 cvtres.exe 86 PID 3768 wrote to memory of 4656 3768 cvtres.exe 86 PID 3768 wrote to memory of 4656 3768 cvtres.exe 86 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe"C:\Users\Admin\AppData\Local\Temp\cc958c7f5b0df9478942f85bc4c4d391e14199149a1c443dae217dd288017683.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4656
-
-