Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/08/2023, 05:35

General

  • Target

    ChromerUpdaters.exe

  • Size

    4.1MB

  • MD5

    f3e0d472ca4f54f3f9d5594df385ce09

  • SHA1

    36609922e1f7e9134fd7d77f88d449aa4676fc2f

  • SHA256

    e138c56b6f9c968e96e0a614353a9b984139159e68abcbd3f69cdcf4f1419792

  • SHA512

    9f06028ea9fc330d66b37246b3f91beb744ccc1fde987f21974c3ea5626d7f2aebcd1e5d0e44517cdcd81f996d1d8c35f60f83de6f6d1f6ead9c1a91126e2df9

  • SSDEEP

    98304:ctEX1YiOuMl3yKyDihojFrznth/cj02Sc2SiR:cNh3rIpj/qd

Score
10/10

Malware Config

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ChromerUpdaters.exe
    "C:\Users\Admin\AppData\Local\Temp\ChromerUpdaters.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      #cmd
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1728-1413-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/1728-1415-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/1728-1414-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2868-172-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-176-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-138-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-140-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-142-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-144-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-146-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-148-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-150-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-152-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-154-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-156-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-158-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-160-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-162-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-164-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-166-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-168-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-170-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-133-0x00000145C7530000-0x00000145C7954000-memory.dmp

    Filesize

    4.1MB

  • memory/2868-137-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-178-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-174-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-180-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-182-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-184-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-186-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-188-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-190-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-192-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-194-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-196-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-200-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-198-0x00000145E2810000-0x00000145E28B3000-memory.dmp

    Filesize

    652KB

  • memory/2868-1405-0x00007FFF8B040000-0x00007FFF8BB01000-memory.dmp

    Filesize

    10.8MB

  • memory/2868-1406-0x00000145C7D20000-0x00000145C7D21000-memory.dmp

    Filesize

    4KB

  • memory/2868-1407-0x00000145C95F0000-0x00000145C9600000-memory.dmp

    Filesize

    64KB

  • memory/2868-1412-0x00007FFF8B040000-0x00007FFF8BB01000-memory.dmp

    Filesize

    10.8MB

  • memory/2868-136-0x00000145C7CF0000-0x00000145C7CF1000-memory.dmp

    Filesize

    4KB

  • memory/2868-135-0x00000145C95F0000-0x00000145C9600000-memory.dmp

    Filesize

    64KB

  • memory/2868-134-0x00007FFF8B040000-0x00007FFF8BB01000-memory.dmp

    Filesize

    10.8MB