Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/02/2023, 03:27
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_Technical evalution.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
RFQ_Technical evalution.exe
Resource
win10v2004-20220812-en
General
-
Target
RFQ_Technical evalution.exe
-
Size
523KB
-
MD5
cac4348fb51dea6158f27b0f8b7a79bb
-
SHA1
402740d268dde6b07e9855b85e9cefd1abd712d1
-
SHA256
f2bf8ee81960e00ff117376675a5b662b18ca10d58164de0f5fbb560aa4199fd
-
SHA512
f13bcf56612fff85b2dee304fa622aeacfca2dd745fab79ddc0acd80352cc43f228df22fa6e74bf3840f7d1d88a3c7ddaa3c7ffa5f95f84e27ef8b33d11853c7
-
SSDEEP
12288:/YFYF0yZC++1vwE721swz90NsT6JIR/sXOcYQK6EqxapW:/YFOC5IP0+T6yRkXJKfOp
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 2 IoCs
pid Process 3436 zxqfgpaz.exe 4968 zxqfgpaz.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3436 set thread context of 4968 3436 zxqfgpaz.exe 80 PID 4968 set thread context of 372 4968 zxqfgpaz.exe 81 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 25 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3436 zxqfgpaz.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4968 zxqfgpaz.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3996 wrote to memory of 3436 3996 RFQ_Technical evalution.exe 79 PID 3996 wrote to memory of 3436 3996 RFQ_Technical evalution.exe 79 PID 3996 wrote to memory of 3436 3996 RFQ_Technical evalution.exe 79 PID 3436 wrote to memory of 4968 3436 zxqfgpaz.exe 80 PID 3436 wrote to memory of 4968 3436 zxqfgpaz.exe 80 PID 3436 wrote to memory of 4968 3436 zxqfgpaz.exe 80 PID 3436 wrote to memory of 4968 3436 zxqfgpaz.exe 80 PID 4968 wrote to memory of 372 4968 zxqfgpaz.exe 81 PID 4968 wrote to memory of 372 4968 zxqfgpaz.exe 81 PID 4968 wrote to memory of 372 4968 zxqfgpaz.exe 81 PID 4968 wrote to memory of 372 4968 zxqfgpaz.exe 81 PID 4968 wrote to memory of 372 4968 zxqfgpaz.exe 81 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Technical evalution.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Technical evalution.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\zxqfgpaz.exe"C:\Users\Admin\AppData\Local\Temp\zxqfgpaz.exe" C:\Users\Admin\AppData\Local\Temp\odawqbyia.ahw2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\zxqfgpaz.exe"C:\Users\Admin\AppData\Local\Temp\zxqfgpaz.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe4⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:372
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD521761e60350efbe540e06efe70e5a778
SHA12bcbfe31f98cde18eae54354bd4c7c0214f72fc7
SHA256aa2a8cbd219071ae0f6c1ac89ffa17bda1ba46e7118c54b7fd944c693d50355e
SHA5121eecd2a151ab1d52b70bf152f35a97d0af05d223d46a127d9257ab6057fef70954db200098ff5aa34bc702653446cf01f3d6e3e5ddffe8d7805ffad7361b931e
-
Filesize
460KB
MD5551b36d99045bd8dd1b2024e9cb29196
SHA180a4a057df9ba3baa237555089df124ec9b4f332
SHA25609815be9c7d57ebfb580f871986f0a84e1b0a306e1a9c6728b952cc9b845534a
SHA51287c6a4ce8112598cc67e3aa99e80ef6bf713100ab16c9dda739ed5ac402b50d3d411b7f49c17ed3e975fbc1b07e5a8c69f34df0638b18b65fa7f718ef492e5d2
-
Filesize
98KB
MD5ebeae598ab6a10ddca67dee57a71a7bd
SHA116f3d99b6d822130bd59fc1d7cdfb772ec0d0314
SHA2566d0677f44b72d41fedbf3b766023378951fc1a21aba3cf32be57596e74feee9d
SHA512d029c4817f996f6f3f4aaa6628e5733546ea2bd40950dbf5e7f4393a1d1d0ca01394167eab2c6521866a52144a74e40d514203c74dbed9152eb32e96a16dd5b3
-
Filesize
98KB
MD5ebeae598ab6a10ddca67dee57a71a7bd
SHA116f3d99b6d822130bd59fc1d7cdfb772ec0d0314
SHA2566d0677f44b72d41fedbf3b766023378951fc1a21aba3cf32be57596e74feee9d
SHA512d029c4817f996f6f3f4aaa6628e5733546ea2bd40950dbf5e7f4393a1d1d0ca01394167eab2c6521866a52144a74e40d514203c74dbed9152eb32e96a16dd5b3
-
Filesize
98KB
MD5ebeae598ab6a10ddca67dee57a71a7bd
SHA116f3d99b6d822130bd59fc1d7cdfb772ec0d0314
SHA2566d0677f44b72d41fedbf3b766023378951fc1a21aba3cf32be57596e74feee9d
SHA512d029c4817f996f6f3f4aaa6628e5733546ea2bd40950dbf5e7f4393a1d1d0ca01394167eab2c6521866a52144a74e40d514203c74dbed9152eb32e96a16dd5b3