Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2d640e53d6...02.exe

windows10-1703-x64

10

2d640e53d6...02.exe

windows7-x64

10

2d640e53d6...02.exe

windows10-2004-x64

10

95de56b7b2...57.exe

windows10-1703-x64

10

95de56b7b2...57.exe

windows7-x64

10

95de56b7b2...57.exe

windows10-2004-x64

10

d950b50f5f...4e.exe

windows10-1703-x64

10

d950b50f5f...4e.exe

windows7-x64

10

d950b50f5f...4e.exe

windows10-2004-x64

10

d62c1f65b0...b4.exe

windows10-1703-x64

10

d62c1f65b0...b4.exe

windows7-x64

10

d62c1f65b0...b4.exe

windows10-2004-x64

10

Resubmissions

25/12/2022, 14:22 UTC

221225-rppf7abf39 10

25/12/2022, 14:22 UTC

221225-rpkg8seg4s 10

25/12/2022, 14:21 UTC

221225-rpexraeg31 10

25/12/2022, 14:21 UTC

221225-rn92haeg3z 10

25/12/2022, 14:13 UTC

221225-rjx65seg3w 10

Analysis

  • max time kernel
    143s
  • max time network
    115s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2022, 14:22 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe

  • Size

    9.1MB

  • MD5

    58ec0acfe4edcc15917b97ef91596f07

  • SHA1

    60e610685d9a549926e7a9b0cb6bcc6509708d3c

  • SHA256

    2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02

  • SHA512

    5769c348149efc107d94bd02e6bbb16440c7974533b843cc42fb7c23fb3e2209754ab69ca9f04a0ba4c56c83e5c30983568a1b1d5f9861c1328befdf09e78736

  • SSDEEP

    196608:K2ejh9Qo2P3Cgnpmtw69DvGSfkDpVpyPc9izcM/WaQCf:Kd4CHx3IyP4izp+Uf

Score
10/10
allcomeevasionstealerthemidatrojan

Malware Config

Extracted

Family

allcome

C2

http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw

Signatures

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

    stealerallcome
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
    "C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:900
    • C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
      "C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"
      2⤵
        PID:1488
      • C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
        "C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"
        2⤵
          PID:1844
        • C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
          "C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"
          2⤵
            PID:1780
          • C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
            "C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1864
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
              3⤵
              • Creates scheduled task(s)
              PID:1184
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {FFB3F19D-01B2-4A22-9EF5-FBA43B52328C} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:364
          • C:\Users\Admin\AppData\Local\cache\MoUSO.exe
            C:\Users\Admin\AppData\Local\cache\MoUSO.exe
            2⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Executes dropped EXE
            • Checks BIOS information in registry
            • Checks whether UAC is enabled
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1588
            • C:\Users\Admin\AppData\Local\cache\MoUSO.exe
              "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
              3⤵
                PID:968

          Network

          • flag-unknown
            DNS
            dba692117be7b6d3480fe5220fdd58b38bf.xyz
            2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
            Remote address:
            8.8.8.8:53
            Request
            dba692117be7b6d3480fe5220fdd58b38bf.xyz
            IN A
            Response
            dba692117be7b6d3480fe5220fdd58b38bf.xyz
            IN A
            194.67.71.118
          • flag-unknown
            GET
            http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw
            2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
            Remote address:
            194.67.71.118:80
            Request
            GET /API/2/configure.php?cf6zrlhn=finarnw HTTP/1.1
            User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.174 YaBrowser/22.1.2.834 Yowser/2.5 Safari/537.36
            Host: dba692117be7b6d3480fe5220fdd58b38bf.xyz
            Response
            HTTP/1.1 404 Not Found
            Server: nginx
            Date: Sun, 25 Dec 2022 14:23:48 GMT
            Content-Type: text/html
            Transfer-Encoding: chunked
            Connection: keep-alive
          • 194.67.71.118:80
            http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw
            http
            2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
            675 B
             11.3kB
             9
            11

            HTTP Request

            GET http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw

            HTTP Response

            404
          • 8.8.8.8:53
            dba692117be7b6d3480fe5220fdd58b38bf.xyz
            dns
            2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
            85 B
             101 B
             1
            1

            DNS Request

            dba692117be7b6d3480fe5220fdd58b38bf.xyz

            DNS Response

            194.67.71.118

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\cache\MoUSO.exe
            Filesize

            9.1MB

            MD5

            58ec0acfe4edcc15917b97ef91596f07

            SHA1

            60e610685d9a549926e7a9b0cb6bcc6509708d3c

            SHA256

            2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02

            SHA512

            5769c348149efc107d94bd02e6bbb16440c7974533b843cc42fb7c23fb3e2209754ab69ca9f04a0ba4c56c83e5c30983568a1b1d5f9861c1328befdf09e78736

            Download Submit

          • C:\Users\Admin\AppData\Local\cache\MoUSO.exe
            Filesize

            9.1MB

            MD5

            58ec0acfe4edcc15917b97ef91596f07

            SHA1

            60e610685d9a549926e7a9b0cb6bcc6509708d3c

            SHA256

            2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02

            SHA512

            5769c348149efc107d94bd02e6bbb16440c7974533b843cc42fb7c23fb3e2209754ab69ca9f04a0ba4c56c83e5c30983568a1b1d5f9861c1328befdf09e78736

            Download Submit

          • memory/900-58-0x00000000008D0000-0x0000000000900000-memory.dmp

            Filesize

            192KB

            Download

          • memory/900-91-0x000000000E830000-0x000000000F14E000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/900-59-0x0000000000620000-0x0000000000638000-memory.dmp

            Filesize

            96KB

            Download

          • memory/900-60-0x00000000009B0000-0x00000000012CE000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/900-61-0x0000000000990000-0x00000000009AA000-memory.dmp

            Filesize

            104KB

            Download

          • memory/900-62-0x0000000000940000-0x0000000000946000-memory.dmp

            Filesize

            24KB

            Download

          • memory/900-57-0x00000000009B0000-0x00000000012CE000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/900-56-0x00000000009B0000-0x00000000012CE000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/900-108-0x00000000009B0000-0x00000000012CE000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/900-102-0x000000000E830000-0x000000000F14E000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/900-101-0x000000000E830000-0x000000000F14E000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/900-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1488-74-0x00000000009B0000-0x00000000012CE000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/1488-64-0x0000000000080000-0x00000000000A3000-memory.dmp

            Filesize

            140KB

            Download

          • memory/1488-69-0x0000000000080000-0x00000000000A3000-memory.dmp

            Filesize

            140KB

            Download

          • memory/1488-70-0x0000000000080000-0x00000000000A3000-memory.dmp

            Filesize

            140KB

            Download

          • memory/1488-68-0x0000000000080000-0x00000000000A3000-memory.dmp

            Filesize

            140KB

            Download

          • memory/1488-63-0x0000000000080000-0x00000000000A3000-memory.dmp

            Filesize

            140KB

            Download

          • memory/1488-66-0x0000000000080000-0x00000000000A3000-memory.dmp

            Filesize

            140KB

            Download

          • memory/1588-118-0x0000000000220000-0x0000000000B3E000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/1588-117-0x0000000000220000-0x0000000000B3E000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/1864-111-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

            Download

          • memory/1864-109-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

            Download

          • memory/1864-107-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

            Download

          • memory/1864-103-0x0000000000400000-0x0000000000423000-memory.dmp

            Filesize

            140KB

            Download

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.