Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    21/03/2023, 14:32 UTC

General

  • Target

    4bbf8447f25f44cabc87e9e20bf6594475f999a58e86c76bbad265d1db9bd513.exe

  • Size

    4.2MB

  • MD5

    446215913dd436aae1317ad90bf75677

  • SHA1

    6f9c887f3fe17b16045fd2fa2d754c744447a4d2

  • SHA256

    4bbf8447f25f44cabc87e9e20bf6594475f999a58e86c76bbad265d1db9bd513

  • SHA512

    dd1b3f89efb92245640289b43ceedbf3bb562578286966d3a72bd03ff145f36054788353d39804489174c6f9018624820f54cad560394be7cf09f5127188acb3

  • SSDEEP

    98304:scyyd+oHduCY3f3rFQtAjgyzZdGxHeqWF0KfgOjCH:sAswQFQtLUGFeqlm

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

185.246.220.122:1488

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • tor_process

    tor

Extracted

Family

redline

C2

185.246.220.122:7164

Attributes
  • auth_value

    bc36aaf1c6447fa611401422deaa29dd

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bbf8447f25f44cabc87e9e20bf6594475f999a58e86c76bbad265d1db9bd513.exe
    "C:\Users\Admin\AppData\Local\Temp\4bbf8447f25f44cabc87e9e20bf6594475f999a58e86c76bbad265d1db9bd513.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1532
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:936
    • C:\Users\Admin\AppData\Local\Temp\rr.exe
      "C:\Users\Admin\AppData\Local\Temp\rr.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:596
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
          PID:320

    Network

      No results found
    • 185.246.220.122:7164
      vbc.exe
      152 B
      3
    • 185.246.220.122:1488
      vbc.exe
      152 B
      3
    • 185.246.220.122:1488
      vbc.exe
      152 B
      3
    • 185.246.220.122:7164
      vbc.exe
      152 B
      3
    • 185.246.220.122:7164
      vbc.exe
      152 B
      3
    • 185.246.220.122:1488
      vbc.exe
      152 B
      3
    • 185.246.220.122:7164
      vbc.exe
      152 B
      3
    • 185.246.220.122:1488
      vbc.exe
      152 B
      3
    • 185.246.220.122:7164
      vbc.exe
      152 B
      3
    • 185.246.220.122:7164
      vbc.exe
      104 B
      2
    • 185.246.220.122:1488
      vbc.exe
      52 B
      1
    No results found

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\rr.exe

      Filesize

      328KB

      MD5

      3f2f9975e1964be99f7e51ddc30f8c07

      SHA1

      1e6d873c70d4ac66daf350087a50409050eeeaff

      SHA256

      843dc782676a45c6e1ab1197fe4d16ba3bc57943423eca12ec2b69ece68ac32f

      SHA512

      89848eb83bced651355f5d8f5fe767fe7830ebe4287be4345223438318246089710e5393a4a75b7cf5c5eb2df22429ebd56f248b46e628c44ea8f5df88c5fb0d

    • C:\Users\Admin\AppData\Local\Temp\rr.exe

      Filesize

      328KB

      MD5

      3f2f9975e1964be99f7e51ddc30f8c07

      SHA1

      1e6d873c70d4ac66daf350087a50409050eeeaff

      SHA256

      843dc782676a45c6e1ab1197fe4d16ba3bc57943423eca12ec2b69ece68ac32f

      SHA512

      89848eb83bced651355f5d8f5fe767fe7830ebe4287be4345223438318246089710e5393a4a75b7cf5c5eb2df22429ebd56f248b46e628c44ea8f5df88c5fb0d

    • \Users\Admin\AppData\Local\Temp\rr.exe

      Filesize

      328KB

      MD5

      3f2f9975e1964be99f7e51ddc30f8c07

      SHA1

      1e6d873c70d4ac66daf350087a50409050eeeaff

      SHA256

      843dc782676a45c6e1ab1197fe4d16ba3bc57943423eca12ec2b69ece68ac32f

      SHA512

      89848eb83bced651355f5d8f5fe767fe7830ebe4287be4345223438318246089710e5393a4a75b7cf5c5eb2df22429ebd56f248b46e628c44ea8f5df88c5fb0d

    • memory/320-78-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/320-80-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/320-87-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/320-85-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/320-83-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/320-82-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/320-81-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/320-101-0x0000000002310000-0x0000000002350000-memory.dmp

      Filesize

      256KB

    • memory/320-79-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/320-90-0x0000000002310000-0x0000000002350000-memory.dmp

      Filesize

      256KB

    • memory/596-77-0x00000000009A0000-0x00000000009D0000-memory.dmp

      Filesize

      192KB

    • memory/596-76-0x0000000001270000-0x00000000012C6000-memory.dmp

      Filesize

      344KB

    • memory/596-100-0x0000000004B00000-0x0000000004B40000-memory.dmp

      Filesize

      256KB

    • memory/596-88-0x0000000004B00000-0x0000000004B40000-memory.dmp

      Filesize

      256KB

    • memory/936-64-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-96-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-68-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-109-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-108-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-63-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/936-62-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-61-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-60-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-59-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-58-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-57-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-91-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-93-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-95-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-69-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-97-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-107-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-99-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-56-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-106-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-102-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-103-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-105-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/936-104-0x0000000000400000-0x00000000007CE000-memory.dmp

      Filesize

      3.8MB

    • memory/1532-55-0x0000000006730000-0x0000000006B4A000-memory.dmp

      Filesize

      4.1MB

    • memory/1532-98-0x00000000009E0000-0x0000000000A20000-memory.dmp

      Filesize

      256KB

    • memory/1532-65-0x00000000009E0000-0x0000000000A20000-memory.dmp

      Filesize

      256KB

    • memory/1532-54-0x00000000001E0000-0x0000000000616000-memory.dmp

      Filesize

      4.2MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.