Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 18:24
Static task
static1
Behavioral task
behavioral1
Sample
ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe
Resource
win10v2004-20220812-en
General
-
Target
ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe
-
Size
404KB
-
MD5
ead7a0983267d4463c0b086a37dede9a
-
SHA1
633ce2e4b6232f426c78f0a2420d1433a5368c2a
-
SHA256
ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8
-
SHA512
2c326a5e9c53c5741904a471b8ef840bc3fb5bd2b334a875c8d491ad9472979254679e4eb8504cd74d1d94182e303c0024bcbda8f2a33f17f08a2526a6208b51
-
SSDEEP
6144:soiOGZ+YQh+zVZXbkBR23KtQZlq0f5srHyjwhz573pMV9UibW+c4:+e+zLqRr2ZMNowb73pMV97
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 4 IoCs
resource yara_rule behavioral2/memory/1492-135-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral2/memory/1492-137-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral2/memory/1492-148-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral2/memory/1492-155-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/2652-153-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral2/memory/2652-154-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Nirsoft 2 IoCs
resource yara_rule behavioral2/memory/2652-153-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/2652-154-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
resource yara_rule behavioral2/memory/4692-141-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4692-143-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4692-144-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4692-145-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4692-146-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2652-150-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2652-152-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2652-153-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2652-154-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BSILlzCwX = "\"C:\\Users\\Admin\\AppData\\Roaming\\BSILlzCwX\\BSILlzCwX.exe\"" RegSvcs.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4612 set thread context of 1492 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 80 PID 1492 set thread context of 4692 1492 RegSvcs.exe 81 PID 1492 set thread context of 2652 1492 RegSvcs.exe 82 PID 4612 set thread context of 3752 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 89 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1492 RegSvcs.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 4612 wrote to memory of 1492 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 80 PID 4612 wrote to memory of 1492 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 80 PID 4612 wrote to memory of 1492 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 80 PID 4612 wrote to memory of 1492 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 80 PID 4612 wrote to memory of 1492 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 80 PID 4612 wrote to memory of 1492 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 80 PID 4612 wrote to memory of 1492 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 80 PID 1492 wrote to memory of 4692 1492 RegSvcs.exe 81 PID 1492 wrote to memory of 4692 1492 RegSvcs.exe 81 PID 1492 wrote to memory of 4692 1492 RegSvcs.exe 81 PID 1492 wrote to memory of 4692 1492 RegSvcs.exe 81 PID 1492 wrote to memory of 4692 1492 RegSvcs.exe 81 PID 1492 wrote to memory of 4692 1492 RegSvcs.exe 81 PID 1492 wrote to memory of 4692 1492 RegSvcs.exe 81 PID 1492 wrote to memory of 4692 1492 RegSvcs.exe 81 PID 1492 wrote to memory of 2652 1492 RegSvcs.exe 82 PID 1492 wrote to memory of 2652 1492 RegSvcs.exe 82 PID 1492 wrote to memory of 2652 1492 RegSvcs.exe 82 PID 1492 wrote to memory of 2652 1492 RegSvcs.exe 82 PID 1492 wrote to memory of 2652 1492 RegSvcs.exe 82 PID 1492 wrote to memory of 2652 1492 RegSvcs.exe 82 PID 1492 wrote to memory of 2652 1492 RegSvcs.exe 82 PID 1492 wrote to memory of 2652 1492 RegSvcs.exe 82 PID 4612 wrote to memory of 3752 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 89 PID 4612 wrote to memory of 3752 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 89 PID 4612 wrote to memory of 3752 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 89 PID 4612 wrote to memory of 3752 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 89 PID 4612 wrote to memory of 3752 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 89 PID 4612 wrote to memory of 3752 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 89 PID 4612 wrote to memory of 3752 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 89 PID 4612 wrote to memory of 3752 4612 ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe"C:\Users\Admin\AppData\Local\Temp\ce1bbfd0bc2533735a974613ac9a724426a46911cd254c42a99b0c9efce5b9b8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe/scomma "C:\Users\Admin\AppData\Local\Temp\b9NbqB9m1s.ini"3⤵PID:4692
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe/scomma "C:\Users\Admin\AppData\Local\Temp\1soSKk746n.ini"3⤵
- Accesses Microsoft Outlook accounts
PID:2652
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" /BSILlzCwX /C:\Users\Admin\AppData\Roaming\BSILlzCwX\BSILlzCwX.exe2⤵
- Adds Run key to start application
PID:3752
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5d1ea279fb5559c020a1b4137dc4de237
SHA1db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3