Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc

  • Size

    13.3MB

  • Sample

    231009-1sf4nagf4z

  • MD5

    2eadf9045ac431174e4bd101584983a8

  • SHA1

    3d1b54d531afad80e51ec04dcc80e00f53b6505e

  • SHA256

    c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc

  • SHA512

    d5056860dbfa0f5e9f49a31d73f1af62f0c92db6c80bd1819791098d58375cbf7733599e49b3513c5bfbf54ab216e8de4f1bb6d91fb1aaf9c84f0f0298f48599

  • SSDEEP

    196608:vJ53FaC5MGewrlcf7qE4C11FO4Pt651rdH1cfdSp3+JHmeNFSutuomP+3B:vJ5wWDewrGefCAKw5efdM3+EepupP8

Malware Config

Extracted

Family

stealc

C2

http://5.42.65.39

Attributes
  • url_path

    /bed95ea4798a5204.php

rc4.plain

Extracted

Family

smokeloader

Botnet

up3

Targets

    • Target

      c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc

    • Size

      13.3MB

    • MD5

      2eadf9045ac431174e4bd101584983a8

    • SHA1

      3d1b54d531afad80e51ec04dcc80e00f53b6505e

    • SHA256

      c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc

    • SHA512

      d5056860dbfa0f5e9f49a31d73f1af62f0c92db6c80bd1819791098d58375cbf7733599e49b3513c5bfbf54ab216e8de4f1bb6d91fb1aaf9c84f0f0298f48599

    • SSDEEP

      196608:vJ53FaC5MGewrlcf7qE4C11FO4Pt651rdH1cfdSp3+JHmeNFSutuomP+3B:vJ5wWDewrGefCAKw5efdM3+EepupP8

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Stealc

      Stealc is an infostealer written in C++.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Modifies Windows Firewall

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks