Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20/09/2022, 21:58 UTC

General

  • Target

    UHAP Sorgu.exe

  • Size

    274KB

  • MD5

    918437b1fb7cb9007f0d439396cc392c

  • SHA1

    1889c245e9eb55889f40f42efdd2315c40ce414e

  • SHA256

    05192de4246ba6acd7799d2137b4a1f1ec5520d129d68cec2b2976b2c1bea90e

  • SHA512

    b2df6e41d0376f4f7c8b2144aec63f5dd55f82e8acc8d25b318ffb443bf32de637ae6c1c0ecc00278bef9d59c2fca515cead5690c9b19669adefdbc6205aa0ef

  • SSDEEP

    6144:Yf+BLtABPDlgj1xw1eO5rbEMzpgUsY3hiGUClYeJilA1D0c3/:1161eO5rbrHsY3hiG7lYeV1Df/

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/922935347015462933/U9oJsXDPRrEd39o5K-4lVEYCqki7VlOAgiWIlgpKTFSm1UWAneR5bQBsRr3zcmw4JPEL

Signatures

  • 44Caliber

    An open source infostealer written in C#.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UHAP Sorgu.exe
    "C:\Users\Admin\AppData\Local\Temp\UHAP Sorgu.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1148

Network

  • flag-us
    DNS
    freegeoip.app
    UHAP Sorgu.exe
    Remote address:
    8.8.8.8:53
    Request
    freegeoip.app
    IN A
    Response
    freegeoip.app
    IN A
    188.114.96.0
    freegeoip.app
    IN A
    188.114.97.0
  • flag-us
    GET
    https://freegeoip.app/xml/
    UHAP Sorgu.exe
    Remote address:
    188.114.96.0:443
    Request
    GET /xml/ HTTP/1.1
    Host: freegeoip.app
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Tue, 20 Sep 2022 21:59:07 GMT
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: max-age=3600
    Expires: Tue, 20 Sep 2022 22:59:07 GMT
    Location: https://ipbase.com/xml/
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NEIgi%2FiEl%2FetCX%2Fp19oVDSWHJV7J%2BfPpDOnJcHyloZ%2FnHUhb5kDut3SXKxNgcTOmMECoqX5vpzUNwqhYP87BPC953WjxXu4BJfJiISA%2FRJsCpAmxjD5GIxufjlm0%2FMt8"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 74ddd38d5bc3b920-AMS
    alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
  • flag-us
    DNS
    ipbase.com
    UHAP Sorgu.exe
    Remote address:
    8.8.8.8:53
    Request
    ipbase.com
    IN A
    Response
    ipbase.com
    IN A
    75.2.60.5
    ipbase.com
    IN A
    99.83.231.61
  • flag-us
    GET
    https://ipbase.com/xml/
    UHAP Sorgu.exe
    Remote address:
    75.2.60.5:443
    Request
    GET /xml/ HTTP/1.1
    Host: ipbase.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 404 Not Found
    Age: 5398
    Cache-Control: public, max-age=0, must-revalidate
    Content-Length: 3082
    Content-Type: text/html; charset=utf-8
    Date: Tue, 20 Sep 2022 20:29:09 GMT
    Etag: 1649775430-ssl
    Server: Netlify
    Strict-Transport-Security: max-age=31536000
    X-Nf-Request-Id: 01GDEEJX6TZXS1NY57SPY74JBP
  • 188.114.96.0:443
    https://freegeoip.app/xml/
    tls, http
    UHAP Sorgu.exe
    760 B
    3.8kB
    9
    8

    HTTP Request

    GET https://freegeoip.app/xml/

    HTTP Response

    301
  • 75.2.60.5:443
    https://ipbase.com/xml/
    tls, http
    UHAP Sorgu.exe
    800 B
    8.2kB
    10
    12

    HTTP Request

    GET https://ipbase.com/xml/

    HTTP Response

    404
  • 8.8.8.8:53
    freegeoip.app
    dns
    UHAP Sorgu.exe
    59 B
    91 B
    1
    1

    DNS Request

    freegeoip.app

    DNS Response

    188.114.96.0
    188.114.97.0

  • 8.8.8.8:53
    ipbase.com
    dns
    UHAP Sorgu.exe
    56 B
    88 B
    1
    1

    DNS Request

    ipbase.com

    DNS Response

    75.2.60.5
    99.83.231.61

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1148-120-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-121-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-122-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-123-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-124-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-125-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-126-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-127-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-128-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-129-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-130-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-131-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-132-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-133-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-134-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-135-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-136-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-137-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-138-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-139-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-140-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-141-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-142-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-143-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-144-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-145-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-146-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-147-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-148-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-149-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-150-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-151-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-152-0x0000000000690000-0x00000000006DA000-memory.dmp

    Filesize

    296KB

  • memory/1148-153-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-154-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-155-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-156-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-157-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-158-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-159-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-160-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-161-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-162-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-163-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-164-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-165-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-166-0x0000000005A30000-0x0000000005AC2000-memory.dmp

    Filesize

    584KB

  • memory/1148-167-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-168-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-169-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-170-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-171-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-172-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-173-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-174-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-175-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-176-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-177-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-178-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-179-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-180-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-181-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-182-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-183-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-184-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-185-0x0000000076FB0000-0x000000007713E000-memory.dmp

    Filesize

    1.6MB

  • memory/1148-198-0x00000000061D0000-0x00000000066CE000-memory.dmp

    Filesize

    5.0MB

  • memory/1148-203-0x0000000006110000-0x0000000006176000-memory.dmp

    Filesize

    408KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.