Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/09/2022, 23:31

General

  • Target

    6B2D7C8BDEDB901D80C89717C9889ABF169C9059D8BB5.exe

  • Size

    5.1MB

  • MD5

    0727f10acffae1a2fbad5bdee8606d77

  • SHA1

    25a2190e389051017b0b512c0caa0e56d185d80a

  • SHA256

    6b2d7c8bdedb901d80c89717c9889abf169c9059d8bb545af6ca1960660324ad

  • SHA512

    f5fdd04b5dd1882b99dcff66e21ee2eb6efe5032f25130f3ca67fc089c841fbdd48e495fdf370e0460833e6f8848c48069174298181db45e8857bdb4c5bed781

  • SSDEEP

    98304:pAI+7WP8CGcEUNHnorSJwvvGBrHBHA8Fn6KhPpXjX2oPIn23U4jKuK5rQjKg0OFB:itM8C9EUN96viBHFn6Uhr/I23UEKuK58

Malware Config

Extracted

Family

privateloader

C2

http://212.193.30.45/proxies.txt

http://45.144.225.57/server.txt

http://wfsdragon.ru/api/setStats.php

2.56.59.42

Signatures

  • Detects Smokeloader packer 4 IoCs
  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

  • FFDroider payload 8 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 5 IoCs
  • Executes dropped EXE 7 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6B2D7C8BDEDB901D80C89717C9889ABF169C9059D8BB5.exe
    "C:\Users\Admin\AppData\Local\Temp\6B2D7C8BDEDB901D80C89717C9889ABF169C9059D8BB5.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\Program Files (x86)\Company\NewProduct\inst2.exe
      "C:\Program Files (x86)\Company\NewProduct\inst2.exe"
      2⤵
      • Executes dropped EXE
      PID:2972
    • C:\Program Files (x86)\Company\NewProduct\rtst1039.exe
      "C:\Program Files (x86)\Company\NewProduct\rtst1039.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1576
      • C:\Users\Admin\AppData\Local\Temp\11111.exe
        C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2024
    • C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe
      "C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4528
    • C:\Program Files (x86)\Company\NewProduct\toolspab2.exe
      "C:\Program Files (x86)\Company\NewProduct\toolspab2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4184
      • C:\Program Files (x86)\Company\NewProduct\toolspab2.exe
        "C:\Program Files (x86)\Company\NewProduct\toolspab2.exe"
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:2284
    • C:\Program Files (x86)\Company\NewProduct\Cube_WW9.exe
      "C:\Program Files (x86)\Company\NewProduct\Cube_WW9.exe"
      2⤵
      • Executes dropped EXE
      PID:2724

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Company\NewProduct\Cube_WW9.exe

    Filesize

    137KB

    MD5

    e88a59876ea9ad978cadc4fe3105f23f

    SHA1

    aa3a48f01218b9d0e55c3629bb689b05d135d508

    SHA256

    764cc1739087f72db37602c60fd7ec8303114f46c1c4a338fbf1ff3d9d181b03

    SHA512

    9fe4fa68b35d14095be5e31098fcff6d7b6b4a409fbc2800051ce8a6525e0f8344675aa07cd39d2d081e32acd31d9a2eed081113e14e9c0d23c2d2f0e5b68419

  • C:\Program Files (x86)\Company\NewProduct\Cube_WW9.exe

    Filesize

    137KB

    MD5

    e88a59876ea9ad978cadc4fe3105f23f

    SHA1

    aa3a48f01218b9d0e55c3629bb689b05d135d508

    SHA256

    764cc1739087f72db37602c60fd7ec8303114f46c1c4a338fbf1ff3d9d181b03

    SHA512

    9fe4fa68b35d14095be5e31098fcff6d7b6b4a409fbc2800051ce8a6525e0f8344675aa07cd39d2d081e32acd31d9a2eed081113e14e9c0d23c2d2f0e5b68419

  • C:\Program Files (x86)\Company\NewProduct\inst2.exe

    Filesize

    201KB

    MD5

    0aa9f08b7bc4d4bb3ce7d578f7b6005b

    SHA1

    c0b0f1ebfb84d3b571281e5adfbe0ad5b071a1c5

    SHA256

    a7536ca66bf434d6c9a5d1e56aa2c82e84c54dea530d0a4eabc3a30385d5ddcb

    SHA512

    7f8b6d0c4fb63dff3e7dd3c289d603c7ce253bd77ca35e87962a53aea7869a37410bf4a51e7bff95f859bbe207e00f36d9cdf0b4646406773a27daebc325c7fc

  • C:\Program Files (x86)\Company\NewProduct\inst2.exe

    Filesize

    201KB

    MD5

    0aa9f08b7bc4d4bb3ce7d578f7b6005b

    SHA1

    c0b0f1ebfb84d3b571281e5adfbe0ad5b071a1c5

    SHA256

    a7536ca66bf434d6c9a5d1e56aa2c82e84c54dea530d0a4eabc3a30385d5ddcb

    SHA512

    7f8b6d0c4fb63dff3e7dd3c289d603c7ce253bd77ca35e87962a53aea7869a37410bf4a51e7bff95f859bbe207e00f36d9cdf0b4646406773a27daebc325c7fc

  • C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe

    Filesize

    4.1MB

    MD5

    03c055e021d1f56cfe74badffe93e7bc

    SHA1

    84493871e54d877a4aedf64f56c41ce3be8305c5

    SHA256

    8ec4968d0cb5229ccd04ce31658100c2c47cc7af99c33903447f5182ea3e5319

    SHA512

    5379616c9ba54e8a4b669e34b8ba589d1a8c59812d431355c48ea72278cce47d52d9eafad225a9bbae9c9cd92a31288232bb789bc2d28e2828dfb93da2fd7aae

  • C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe

    Filesize

    4.1MB

    MD5

    03c055e021d1f56cfe74badffe93e7bc

    SHA1

    84493871e54d877a4aedf64f56c41ce3be8305c5

    SHA256

    8ec4968d0cb5229ccd04ce31658100c2c47cc7af99c33903447f5182ea3e5319

    SHA512

    5379616c9ba54e8a4b669e34b8ba589d1a8c59812d431355c48ea72278cce47d52d9eafad225a9bbae9c9cd92a31288232bb789bc2d28e2828dfb93da2fd7aae

  • C:\Program Files (x86)\Company\NewProduct\rtst1039.exe

    Filesize

    2.0MB

    MD5

    fe18d0f0f56abf84f421f7961206d5d1

    SHA1

    6685e8c651d2b2342b7a6f717360cb05d5455fe7

    SHA256

    efd4d7544f985545e2fd3377d0a9af6852315fa2eb4d0b14b3c4ac36dee6ce80

    SHA512

    74c216d1dddee3108fb80c5139af62efa6b3c855ce5468c5a4ec057fd29ef2cf5df74a145bd45fe70235ed2f45ed2839b319358e9c5523f60d5cfeff54f07669

  • C:\Program Files (x86)\Company\NewProduct\rtst1039.exe

    Filesize

    2.0MB

    MD5

    fe18d0f0f56abf84f421f7961206d5d1

    SHA1

    6685e8c651d2b2342b7a6f717360cb05d5455fe7

    SHA256

    efd4d7544f985545e2fd3377d0a9af6852315fa2eb4d0b14b3c4ac36dee6ce80

    SHA512

    74c216d1dddee3108fb80c5139af62efa6b3c855ce5468c5a4ec057fd29ef2cf5df74a145bd45fe70235ed2f45ed2839b319358e9c5523f60d5cfeff54f07669

  • C:\Program Files (x86)\Company\NewProduct\toolspab2.exe

    Filesize

    300KB

    MD5

    8c23cc666860658e657dc4652a48ff91

    SHA1

    deebc6a7e00db0b79c52f1d922efa05dbca3333e

    SHA256

    a7ee420fd3a477e690dab56f47b264dd6c8376941101065d6645716bbf4b6333

    SHA512

    0cf8a4071903672291effbcf10ab5f801cf364ba72fd4ef87f96e3d5957df9921f2c36bae1ef1db1b735c7c52dd59f18fbdfbdf4cfe2006d3390df0c3ef00942

  • C:\Program Files (x86)\Company\NewProduct\toolspab2.exe

    Filesize

    300KB

    MD5

    8c23cc666860658e657dc4652a48ff91

    SHA1

    deebc6a7e00db0b79c52f1d922efa05dbca3333e

    SHA256

    a7ee420fd3a477e690dab56f47b264dd6c8376941101065d6645716bbf4b6333

    SHA512

    0cf8a4071903672291effbcf10ab5f801cf364ba72fd4ef87f96e3d5957df9921f2c36bae1ef1db1b735c7c52dd59f18fbdfbdf4cfe2006d3390df0c3ef00942

  • C:\Program Files (x86)\Company\NewProduct\toolspab2.exe

    Filesize

    300KB

    MD5

    8c23cc666860658e657dc4652a48ff91

    SHA1

    deebc6a7e00db0b79c52f1d922efa05dbca3333e

    SHA256

    a7ee420fd3a477e690dab56f47b264dd6c8376941101065d6645716bbf4b6333

    SHA512

    0cf8a4071903672291effbcf10ab5f801cf364ba72fd4ef87f96e3d5957df9921f2c36bae1ef1db1b735c7c52dd59f18fbdfbdf4cfe2006d3390df0c3ef00942

  • C:\Users\Admin\AppData\Local\Temp\11111.exe

    Filesize

    391KB

    MD5

    7165e9d7456520d1f1644aa26da7c423

    SHA1

    177f9116229a021e24f80c4059999c4c52f9e830

    SHA256

    40ca14be87ccee1c66cce8ce07d7ed9b94a0f7b46d84f9147c4bbf6ddab75a67

    SHA512

    fe80996a7f5c64815c19db1fa582581aa1934ea8d1050e686b4f65bcdd000df1decdf711e0e4b1de8a2aa4fcb1ac95cebb0316017c42e80d8386bd3400fcaecb

  • C:\Users\Admin\AppData\Local\Temp\11111.exe

    Filesize

    391KB

    MD5

    7165e9d7456520d1f1644aa26da7c423

    SHA1

    177f9116229a021e24f80c4059999c4c52f9e830

    SHA256

    40ca14be87ccee1c66cce8ce07d7ed9b94a0f7b46d84f9147c4bbf6ddab75a67

    SHA512

    fe80996a7f5c64815c19db1fa582581aa1934ea8d1050e686b4f65bcdd000df1decdf711e0e4b1de8a2aa4fcb1ac95cebb0316017c42e80d8386bd3400fcaecb

  • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

    Filesize

    1KB

    MD5

    be84c357ee07d286e53d9d183f5b4529

    SHA1

    eef9d37e45b04e477a9ca046c9b4d1bcb429b3f8

    SHA256

    809da252b6acc51ab3cccd55bfa1e3dbbb2ad46426040c511fa9e57ce633047b

    SHA512

    b0be722a2ce85592319e8dcb4a7ebeef01e90d60305b114220782b4f6bb205f6161259af156320db9f500977a73dbb57ac6c0e469f32014465e4c9f421e1f4f7

  • memory/2024-158-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/2056-931-0x00000000074B0000-0x00000000074C0000-memory.dmp

    Filesize

    64KB

  • memory/2056-612-0x0000000007F20000-0x0000000007F30000-memory.dmp

    Filesize

    64KB

  • memory/2056-923-0x00000000028D0000-0x00000000028E0000-memory.dmp

    Filesize

    64KB

  • memory/2056-922-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/2056-610-0x00000000074B0000-0x00000000074C0000-memory.dmp

    Filesize

    64KB

  • memory/2056-921-0x00000000028E0000-0x00000000028F0000-memory.dmp

    Filesize

    64KB

  • memory/2056-611-0x00000000074D0000-0x00000000074E0000-memory.dmp

    Filesize

    64KB

  • memory/2056-920-0x00000000028D0000-0x00000000028E0000-memory.dmp

    Filesize

    64KB

  • memory/2056-614-0x0000000007F20000-0x0000000007F30000-memory.dmp

    Filesize

    64KB

  • memory/2056-929-0x0000000000A90000-0x0000000000AA0000-memory.dmp

    Filesize

    64KB

  • memory/2056-919-0x00000000074B0000-0x00000000074C0000-memory.dmp

    Filesize

    64KB

  • memory/2056-928-0x00000000074B0000-0x00000000074C0000-memory.dmp

    Filesize

    64KB

  • memory/2056-924-0x00000000028E0000-0x00000000028F0000-memory.dmp

    Filesize

    64KB

  • memory/2056-613-0x0000000007F20000-0x0000000007F30000-memory.dmp

    Filesize

    64KB

  • memory/2056-852-0x0000000007F20000-0x0000000007F30000-memory.dmp

    Filesize

    64KB

  • memory/2056-925-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/2056-853-0x0000000007F20000-0x0000000007F30000-memory.dmp

    Filesize

    64KB

  • memory/2056-851-0x0000000007F20000-0x0000000007F30000-memory.dmp

    Filesize

    64KB

  • memory/2284-167-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2284-163-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2284-238-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2972-138-0x0000000000550000-0x0000000000560000-memory.dmp

    Filesize

    64KB

  • memory/2972-139-0x0000000000A10000-0x0000000000A23000-memory.dmp

    Filesize

    76KB

  • memory/4184-153-0x0000000000030000-0x0000000000039000-memory.dmp

    Filesize

    36KB

  • memory/4184-165-0x00000000005C3000-0x00000000005D4000-memory.dmp

    Filesize

    68KB

  • memory/4184-151-0x00000000005C3000-0x00000000005D4000-memory.dmp

    Filesize

    68KB

  • memory/4528-183-0x0000000004D80000-0x0000000004D88000-memory.dmp

    Filesize

    32KB

  • memory/4528-181-0x0000000004BA0000-0x0000000004BA8000-memory.dmp

    Filesize

    32KB

  • memory/4528-192-0x0000000004BA0000-0x0000000004BA8000-memory.dmp

    Filesize

    32KB

  • memory/4528-193-0x0000000004EF0000-0x0000000004EF8000-memory.dmp

    Filesize

    32KB

  • memory/4528-194-0x0000000004DC0000-0x0000000004DC8000-memory.dmp

    Filesize

    32KB

  • memory/4528-219-0x0000000004A60000-0x0000000004A68000-memory.dmp

    Filesize

    32KB

  • memory/4528-220-0x0000000004A80000-0x0000000004A88000-memory.dmp

    Filesize

    32KB

  • memory/4528-221-0x0000000004B20000-0x0000000004B28000-memory.dmp

    Filesize

    32KB

  • memory/4528-222-0x00000000050B0000-0x00000000050B8000-memory.dmp

    Filesize

    32KB

  • memory/4528-223-0x0000000004A80000-0x0000000004A88000-memory.dmp

    Filesize

    32KB

  • memory/4528-224-0x00000000050B0000-0x00000000050B8000-memory.dmp

    Filesize

    32KB

  • memory/4528-225-0x0000000004A80000-0x0000000004A88000-memory.dmp

    Filesize

    32KB

  • memory/4528-185-0x0000000005050000-0x0000000005058000-memory.dmp

    Filesize

    32KB

  • memory/4528-401-0x0000000000400000-0x0000000000AF0000-memory.dmp

    Filesize

    6.9MB

  • memory/4528-184-0x0000000004DA0000-0x0000000004DA8000-memory.dmp

    Filesize

    32KB

  • memory/4528-187-0x0000000004DC0000-0x0000000004DC8000-memory.dmp

    Filesize

    32KB

  • memory/4528-191-0x0000000004EF0000-0x0000000004EF8000-memory.dmp

    Filesize

    32KB

  • memory/4528-180-0x0000000004B80000-0x0000000004B88000-memory.dmp

    Filesize

    32KB

  • memory/4528-182-0x0000000004C40000-0x0000000004C48000-memory.dmp

    Filesize

    32KB

  • memory/4528-174-0x00000000040A0000-0x00000000040B0000-memory.dmp

    Filesize

    64KB

  • memory/4528-168-0x0000000003F40000-0x0000000003F50000-memory.dmp

    Filesize

    64KB

  • memory/4528-166-0x0000000000400000-0x0000000000AF0000-memory.dmp

    Filesize

    6.9MB

  • memory/4528-902-0x0000000000400000-0x0000000000AF0000-memory.dmp

    Filesize

    6.9MB

  • memory/4528-190-0x0000000004DC0000-0x0000000004DC8000-memory.dmp

    Filesize

    32KB

  • memory/4528-159-0x0000000000400000-0x0000000000AF0000-memory.dmp

    Filesize

    6.9MB

  • memory/4528-154-0x0000000000400000-0x0000000000AF0000-memory.dmp

    Filesize

    6.9MB

  • memory/4528-152-0x0000000000400000-0x0000000000AF0000-memory.dmp

    Filesize

    6.9MB

  • memory/4528-186-0x0000000004F50000-0x0000000004F58000-memory.dmp

    Filesize

    32KB

  • memory/4528-150-0x0000000000400000-0x0000000000AF0000-memory.dmp

    Filesize

    6.9MB

  • memory/4528-149-0x0000000000400000-0x0000000000AF0000-memory.dmp

    Filesize

    6.9MB

  • memory/4528-148-0x0000000000400000-0x0000000000AF0000-memory.dmp

    Filesize

    6.9MB

  • memory/4528-188-0x0000000004BA0000-0x0000000004BA8000-memory.dmp

    Filesize

    32KB