Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

SecuriteIn...89.exe

windows7-x64

10

SecuriteIn...89.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 12:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.22789.exe

  • Size

    788KB

  • MD5

    dac9ddfbf75bd8ddda349414e66db972

  • SHA1

    2b9069eea5a71be7bcacda31830174ef6364ea2c

  • SHA256

    430a9487d85e5998d134ca3a890e0c6ff86101264d1fc4ae869953fac0755c3e

  • SHA512

    a66c0454aa430ff27765a79dfcae7c5903d3ff7928d54e68cbc51287583027b45beb9612fd7f9cf2d10801adf418c08dac0a9da0d82d725b75f44077334756c4

  • SSDEEP

    6144:x5+DIIVITsctz2d1vtvLcUFCkkX6SgS1y9uWnK14susBUaPNLL7+5QQk+orNLJlO:x4kIVczM1fPkr1e9BsXBLyuQX8nDO/

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5415235188:AAGqakDD6FZcw5LLX6hH5qVayV-1OGURlEo/sendMessage?chat_id=1372472614

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22789.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22789.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22789.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22789.exe"
      2⤵
        PID:1244
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22789.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22789.exe"
        2⤵
          PID:2792
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22789.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22789.exe"
          2⤵
            PID:1836
          • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22789.exe
            "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22789.exe"
            2⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4284
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              3⤵
              • Accesses Microsoft Outlook profiles
              • Checks processor information in registry
              • Suspicious use of AdjustPrivilegeToken
              • outlook_office_path
              • outlook_win_path
              PID:1028

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1028-150-0x0000000000820000-0x000000000083A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/3044-136-0x0000000008A30000-0x0000000008ACC000-memory.dmp

          Filesize

          624KB

          Download

        • memory/3044-137-0x0000000008BD0000-0x0000000008C36000-memory.dmp

          Filesize

          408KB

          Download

        • memory/3044-132-0x0000000000450000-0x000000000051A000-memory.dmp

          Filesize

          808KB

          Download

        • memory/3044-135-0x0000000004EC0000-0x0000000004ECA000-memory.dmp

          Filesize

          40KB

          Download

        • memory/3044-134-0x0000000004F60000-0x0000000004FF2000-memory.dmp

          Filesize

          584KB

          Download

        • memory/3044-133-0x0000000005510000-0x0000000005AB4000-memory.dmp

          Filesize

          5.6MB

          Download

        • memory/4284-142-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

          Download

        • memory/4284-144-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

          Download

        • memory/4284-147-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

          Download

        • memory/4284-148-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

          Download