Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2023, 07:10

General

  • Target

    XO0UY05.exe

  • Size

    789KB

  • MD5

    b62cbe2a191fee2243c8c28150ec777f

  • SHA1

    3992584fb9c29fc84f41f35ebca4bec27014c708

  • SHA256

    cdd43a1c420208cb24f8d8f45647107984ad55474db55fe0eee4a70c1deee718

  • SHA512

    41b3062daf23f531ac69038086c7678157da5a8f3a10db410ea9c177e8c586c36a28e55a889ce7af829f8ac171190bd4f3f0229a2f3f45e6608ff4da7ea256c8

  • SSDEEP

    12288:NMrAy90YN8degBdF/RIqaSVJ3zQFo/DiK+BZhzSLU2qQCNQmhZNysBG:pyF8dTBd9baS7QW7lkzSFuCyyss

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

LiveTraffic

C2

77.105.132.87:6731

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XO0UY05.exe
    "C:\Users\Admin\AppData\Local\Temp\XO0UY05.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1VN46DW0.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1VN46DW0.exe
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Adds Run key to start application
      • Drops file in System32 directory
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:1432
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:1012
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:4932
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 1780
        3⤵
        • Program crash
        PID:4244
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4uZ060Ph.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4uZ060Ph.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2652
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
    1⤵
      PID:2648
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
      1⤵
        PID:5052
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1432 -ip 1432
        1⤵
          PID:3484
        • C:\Users\Admin\AppData\Local\Temp\B844.exe
          C:\Users\Admin\AppData\Local\Temp\B844.exe
          1⤵
          • Executes dropped EXE
          PID:1728

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\B844.exe

          Filesize

          401KB

          MD5

          f88edad62a7789c2c5d8047133da5fa7

          SHA1

          41b1f056cdda764a1c7c402c6fa4f8ab2f3ce5f9

          SHA256

          eb2b1ce5574096b91eb9e0482117d2518ab188c0747a209dc77e88d30bb970dc

          SHA512

          e2d5b0ace5dfd3bd2321b2a42b7e7725071ca440389dc5ef12720a34727ae84c2907cd7befeae5d53568d9deaee8443f4cbda44b598cfc9b6316d9389be09a60

        • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

          Filesize

          57KB

          MD5

          99ce0ae115832abc40e2e57599ef78a0

          SHA1

          fd842bd20905ab8a03b5ccb5160dd5103b6aec55

          SHA256

          10b22af94e1e8a1892ea1fc7cc30cec8d75804adce908779f5f6c3ed8324fcb8

          SHA512

          cc5a374e0034db4f9500e103cf6413b434d6de63871f4afca61d2f0e01050a565c8ff78f1c6cccc486ef9b66e1d8f8548e1e5ab11d5c6bbe046cc9347e64a7ef

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1VN46DW0.exe

          Filesize

          1.6MB

          MD5

          9b10f741fad1d0dd09b89dc6638833ae

          SHA1

          1f0ffa6f136cd5433f202c9c79ce5956796b4151

          SHA256

          1b69a1dd5961241b926605f0a015fa17149c3b2759fb077a30a22d4ddcc273f6

          SHA512

          4c83e0b137338a8685481623e592d10039ff15032f059b1e200f8e6a7810978e2eb5047604d12c31923761a0e46146c01fcabc871b8748b61a546bd1a32891f7

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4uZ060Ph.exe

          Filesize

          37KB

          MD5

          8837a89b82d0d3b0259cc9f47b2e599b

          SHA1

          51dd86a6a717a8f1470fff7a65f96c983aa71f09

          SHA256

          ad5c98936429f847e6808a4efdb80faf452a5c5c31d91f9f7de2560e51478701

          SHA512

          4a6c660c78bc99916d68978243f1140203a5805a3a7ae7a1749c609bd5aaf06b9ac253c09c0a206acdb832b45bc1ab700a5beb98024131779a45c70b53c7bc71

        • memory/1728-108-0x0000000008990000-0x00000000089A2000-memory.dmp

          Filesize

          72KB

        • memory/1728-106-0x00000000089B0000-0x0000000008FC8000-memory.dmp

          Filesize

          6.1MB

        • memory/1728-113-0x0000000007760000-0x0000000007770000-memory.dmp

          Filesize

          64KB

        • memory/1728-95-0x00000000007D0000-0x000000000080C000-memory.dmp

          Filesize

          240KB

        • memory/1728-100-0x00000000746E0000-0x0000000074E90000-memory.dmp

          Filesize

          7.7MB

        • memory/1728-101-0x00000000079E0000-0x0000000007F84000-memory.dmp

          Filesize

          5.6MB

        • memory/1728-102-0x00000000074D0000-0x0000000007562000-memory.dmp

          Filesize

          584KB

        • memory/1728-103-0x0000000007760000-0x0000000007770000-memory.dmp

          Filesize

          64KB

        • memory/1728-104-0x00000000074A0000-0x00000000074AA000-memory.dmp

          Filesize

          40KB

        • memory/1728-112-0x00000000746E0000-0x0000000074E90000-memory.dmp

          Filesize

          7.7MB

        • memory/1728-111-0x000000000AF40000-0x000000000AFA6000-memory.dmp

          Filesize

          408KB

        • memory/1728-110-0x000000000A2B0000-0x000000000A2FC000-memory.dmp

          Filesize

          304KB

        • memory/1728-109-0x000000000A270000-0x000000000A2AC000-memory.dmp

          Filesize

          240KB

        • memory/1728-107-0x000000000A340000-0x000000000A44A000-memory.dmp

          Filesize

          1.0MB

        • memory/2652-86-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/2652-89-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/3120-87-0x0000000000A10000-0x0000000000A26000-memory.dmp

          Filesize

          88KB