Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2023, 12:42
Static task
static1
Behavioral task
behavioral1
Sample
53640549adeafc14bff28e22e.exe
Resource
win7-20230703-en
General
-
Target
53640549adeafc14bff28e22e.exe
-
Size
750KB
-
MD5
53640549adeafc14bff28e22e378b681
-
SHA1
c46173128148a0fb90c7aa67553068035edc8d04
-
SHA256
f8be822eb877bfb50b6d04449004f9778ed732b877c4f2975313b8559cf6e842
-
SHA512
0c74669ac5fcc63f0579acd7a377bf286e5bb3b5e574efbc14e541471c87b46d88bc6e76e2bd974223a079944acda0a7a7f7ca829f2e2e8de0a88acc9653ff24
-
SSDEEP
12288:VS/nqdGGwe4kVt7eKS9HvO1WVZ08yDgG:cSwGwNZKMeX
Malware Config
Extracted
stealc
http://45.150.65.128/bcbdd35a8286b150.php
Signatures
-
Detects Stealc stealer 4 IoCs
resource yara_rule behavioral2/memory/4392-142-0x0000000000400000-0x0000000000629000-memory.dmp family_stealc behavioral2/memory/4392-145-0x0000000000400000-0x0000000000629000-memory.dmp family_stealc behavioral2/memory/4392-146-0x0000000000400000-0x0000000000629000-memory.dmp family_stealc behavioral2/memory/4392-147-0x0000000000400000-0x0000000000629000-memory.dmp family_stealc -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 53640549adeafc14bff28e22e.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 53640549adeafc14bff28e22e.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 53640549adeafc14bff28e22e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 53640549adeafc14bff28e22e.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 53640549adeafc14bff28e22e.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 53640549adeafc14bff28e22e.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4548 set thread context of 4392 4548 53640549adeafc14bff28e22e.exe 81 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 53640549adeafc14bff28e22e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 53640549adeafc14bff28e22e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4392 53640549adeafc14bff28e22e.exe 4392 53640549adeafc14bff28e22e.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4548 wrote to memory of 4392 4548 53640549adeafc14bff28e22e.exe 81 PID 4548 wrote to memory of 4392 4548 53640549adeafc14bff28e22e.exe 81 PID 4548 wrote to memory of 4392 4548 53640549adeafc14bff28e22e.exe 81 PID 4548 wrote to memory of 4392 4548 53640549adeafc14bff28e22e.exe 81 PID 4548 wrote to memory of 4392 4548 53640549adeafc14bff28e22e.exe 81 PID 4548 wrote to memory of 4392 4548 53640549adeafc14bff28e22e.exe 81 PID 4548 wrote to memory of 4392 4548 53640549adeafc14bff28e22e.exe 81 PID 4548 wrote to memory of 4392 4548 53640549adeafc14bff28e22e.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\53640549adeafc14bff28e22e.exe"C:\Users\Admin\AppData\Local\Temp\53640549adeafc14bff28e22e.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\53640549adeafc14bff28e22e.exe"{path}"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4392
-