Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Purchase Order.exe

  • Size

    636KB

  • Sample

    230425-lm61kahf98

  • MD5

    b4998c696f853894b0c61c6554da3683

  • SHA1

    977f2760b3ab960c036fcbd45d8980e95bf54c5f

  • SHA256

    d19ccea3327e9aeb00c9fc78791c20b50a28f43cfa075485efd610b498d3f2b2

  • SHA512

    76a098ef7fccf8ab19c6e176b0001751e82224805f71ee8a2d41b9e26f0a1702c311bf6a5ff340703a6daa2c2220cb312989b6a2a684cad0cf06b44137558d09

  • SSDEEP

    12288:B4+3RUx0MSNgVkrYtW/6aRcyzi2nHdDra9o6:1Mmek0tW/6zK9DmK

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.mkt-marketing.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Lim5106Ivy

Targets

    • Target

      Purchase Order.exe

    • Size

      636KB

    • MD5

      b4998c696f853894b0c61c6554da3683

    • SHA1

      977f2760b3ab960c036fcbd45d8980e95bf54c5f

    • SHA256

      d19ccea3327e9aeb00c9fc78791c20b50a28f43cfa075485efd610b498d3f2b2

    • SHA512

      76a098ef7fccf8ab19c6e176b0001751e82224805f71ee8a2d41b9e26f0a1702c311bf6a5ff340703a6daa2c2220cb312989b6a2a684cad0cf06b44137558d09

    • SSDEEP

      12288:B4+3RUx0MSNgVkrYtW/6aRcyzi2nHdDra9o6:1Mmek0tW/6zK9DmK

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks