Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

bad1feef00...7d.exe

windows7-x64

10

bad1feef00...7d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2022, 05:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d.exe

  • Size

    1.5MB

  • MD5

    82a0a0bd6084c5a28081310e75e7f608

  • SHA1

    e5ce952e62af7efc484826c512a6f9b363b21877

  • SHA256

    bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d

  • SHA512

    19f0465a25d4fb885d42df63fa29191e2316a2acb35f1885d21d20d6706f1c1240a15a5dae618ee78ca98d9b5d11ce937d2f108740d0adbfd962eb28e1a9c27c

  • SSDEEP

    24576:Fs50MV0ORVeA8iFZwkyIVH8oPMp4ySs50MIpNSlzqs50M0IW9KK5jNSDUXNSW1:Fs5VXh8lkHVHLMSs5IpIlzqs50h9KajX

Score
10/10
azorultoskiraccoon5e4db353b88c002ba6466c06437973619aad03b3infostealerspywarestealertrojan

Malware Config

Extracted

Family

raccoon

Version

1.7.1-hotfix

Botnet

5e4db353b88c002ba6466c06437973619aad03b3

Attributes
  • url4cnc

    https://telete.in/brikitiki

rc4.plain
rc4.plain

Extracted

Family

oski

C2

taenaiaa.ac.ug

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski
  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer payload 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d.exe
    "C:\Users\Admin\AppData\Local\Temp\bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3808
    • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
      "C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
        "C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:4520
    • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
      "C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3568
      • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
        "C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:3784
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 1324
          4⤵
          • Program crash
          PID:3496
    • C:\Users\Admin\AppData\Local\Temp\bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d.exe
      "C:\Users\Admin\AppData\Local\Temp\bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1320
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3784 -ip 3784
    1⤵
      PID:3340

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
      Filesize

      420KB

      MD5

      d049fbafad4b2c9b7b87f1829bf7fbd3

      SHA1

      0f278439d7f8a2d2b59f7f2bcc170f95a73a801c

      SHA256

      21fcc232b455d672de28438316b81c83e8b76ae49f018e4ba9cb8591aafa5a75

      SHA512

      6fa0636060f30cdad98895e9619d8bb242fd99aea45e03e693193f0bf4f1de9d64dcb6c90126eeafe10eaf1f728ce82bcb7266fb1953042dc121af44bc9e107c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
      Filesize

      420KB

      MD5

      d049fbafad4b2c9b7b87f1829bf7fbd3

      SHA1

      0f278439d7f8a2d2b59f7f2bcc170f95a73a801c

      SHA256

      21fcc232b455d672de28438316b81c83e8b76ae49f018e4ba9cb8591aafa5a75

      SHA512

      6fa0636060f30cdad98895e9619d8bb242fd99aea45e03e693193f0bf4f1de9d64dcb6c90126eeafe10eaf1f728ce82bcb7266fb1953042dc121af44bc9e107c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
      Filesize

      420KB

      MD5

      d049fbafad4b2c9b7b87f1829bf7fbd3

      SHA1

      0f278439d7f8a2d2b59f7f2bcc170f95a73a801c

      SHA256

      21fcc232b455d672de28438316b81c83e8b76ae49f018e4ba9cb8591aafa5a75

      SHA512

      6fa0636060f30cdad98895e9619d8bb242fd99aea45e03e693193f0bf4f1de9d64dcb6c90126eeafe10eaf1f728ce82bcb7266fb1953042dc121af44bc9e107c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
      Filesize

      372KB

      MD5

      4063022826bcef08b84ff49f7fe4a985

      SHA1

      64a404f2a549d3e3652366c5b1dcb974385d5172

      SHA256

      1c41167bea31c704e8882e3bbd6af9e76b51969a6a1c3294ad8a6f911aa496d9

      SHA512

      32e95a50153f9b5a40314791acd894851551de222dd5ed42f05067cef49fcff0da8d6ecfc2c828f0c886dc28abb570123b79f9be641ba07ddaa589093b9ea0e4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
      Filesize

      372KB

      MD5

      4063022826bcef08b84ff49f7fe4a985

      SHA1

      64a404f2a549d3e3652366c5b1dcb974385d5172

      SHA256

      1c41167bea31c704e8882e3bbd6af9e76b51969a6a1c3294ad8a6f911aa496d9

      SHA512

      32e95a50153f9b5a40314791acd894851551de222dd5ed42f05067cef49fcff0da8d6ecfc2c828f0c886dc28abb570123b79f9be641ba07ddaa589093b9ea0e4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
      Filesize

      372KB

      MD5

      4063022826bcef08b84ff49f7fe4a985

      SHA1

      64a404f2a549d3e3652366c5b1dcb974385d5172

      SHA256

      1c41167bea31c704e8882e3bbd6af9e76b51969a6a1c3294ad8a6f911aa496d9

      SHA512

      32e95a50153f9b5a40314791acd894851551de222dd5ed42f05067cef49fcff0da8d6ecfc2c828f0c886dc28abb570123b79f9be641ba07ddaa589093b9ea0e4

      Download Submit

    • memory/1320-146-0x0000000000400000-0x0000000000493000-memory.dmp

      Filesize

      588KB

      Download

    • memory/3784-151-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

      Download

    • memory/3784-154-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

      Download

    • memory/3808-145-0x0000000002C90000-0x0000000002C97000-memory.dmp

      Filesize

      28KB

      Download

    • memory/4520-152-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4520-153-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

      Download