Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
27/09/2022, 10:50
General
-
Target
243d9f816762d16fe794ef86361142bc8c36d67e36d48ec5cd2bafaaa140198a.exe
-
Size
319KB
-
MD5
930d62b9f2be3b2783e46063b801a764
-
SHA1
612973b1544afdf7a5dc6ea5e19f374a20103120
-
SHA256
243d9f816762d16fe794ef86361142bc8c36d67e36d48ec5cd2bafaaa140198a
-
SHA512
a2a5d117c04ee7e1a428f4f0f94d0d35798c3f7e8880793786575fd0afc6a98cfefa5b38c761085404769e845523d79bf4997589e7c3057af3030a24632d0080
-
SSDEEP
3072:MSXPGXtyP73pPN25p7CKVe6eZ8SG8pmmoADt4rIIJ/0KDf6AFM/h3BsxkgaBChU/:MSQiPubKpH74rxJ/0g6AFnigabwVf
Malware Config
Extracted
danabot
198.15.112.179:443
185.62.56.245:443
153.92.223.225:443
192.119.70.159:443
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Extracted
redline
insmix
jamesmillion2.xyz:9420
-
auth_value
f388a05524f756108c9e4b0f4c4bafb6
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Detects Smokeloader packer 1 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Deletes itself 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\243d9f816762d16fe794ef86361142bc8c36d67e36d48ec5cd2bafaaa140198a.exe"C:\Users\Admin\AppData\Local\Temp\243d9f816762d16fe794ef86361142bc8c36d67e36d48ec5cd2bafaaa140198a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3E8.exeC:\Users\Admin\AppData\Local\Temp\3E8.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
-
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 6162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 5922⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\758F.exeC:\Users\Admin\AppData\Local\Temp\758F.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5c3d9b67e3712664e2fd81eea6d22a6ac
SHA1301e9bcc30d2eca221d84488204c19e4fec38e97
SHA2566547ea9ddf6ffa77af349ad55994f39e84323dee6fdc57d0f671ba4688474acc
SHA512ebb59aeaa124dbf4e29014520271fe85e33ffe77ef9cb3bef7a677e9819efa2a45a545fbcca4d1a035a11d0cfafecf04b580ccc71aa49bf929d1d97158cac3cc
-
Filesize
1.4MB
MD5c3d9b67e3712664e2fd81eea6d22a6ac
SHA1301e9bcc30d2eca221d84488204c19e4fec38e97
SHA2566547ea9ddf6ffa77af349ad55994f39e84323dee6fdc57d0f671ba4688474acc
SHA512ebb59aeaa124dbf4e29014520271fe85e33ffe77ef9cb3bef7a677e9819efa2a45a545fbcca4d1a035a11d0cfafecf04b580ccc71aa49bf929d1d97158cac3cc
-
Filesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
Filesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
576KB
-
Filesize
576KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
36KB
-
Filesize
1.3MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
320KB
-
Filesize
1.3MB
-
Filesize
1.6MB
-
Filesize
6.0MB
-
Filesize
472KB
-
Filesize
5.2MB
-
Filesize
184KB
-
Filesize
1.0MB
-
Filesize
5.0MB
-
Filesize
192KB
-
Filesize
1.6MB
-
Filesize
220KB
-
Filesize
1.3MB
-
Filesize
300KB
-
Filesize
1.8MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.2MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
1.2MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.9MB
-
Filesize
2.9MB