Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
7aee69123b1...85.exe
windows7-x64
10aee69123b1...85.exe
windows10-2004-x64
10$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$TEMP/BroomSetup.exe
windows7-x64
7$TEMP/BroomSetup.exe
windows10-2004-x64
7$TEMP/syncUpd.exe
windows7-x64
10$TEMP/syncUpd.exe
windows10-2004-x64
10General
-
Target
aee69123b1343627ff86660780cd54ede826fce88c9f784a8e20d5cc27bb8385
-
Size
2.0MB
-
Sample
240312-m9yhdahd34
-
MD5
a334c1ff7038253a31efd9245a950302
-
SHA1
f3b75796a3be4ba2f8995caa3213711d0569fe00
-
SHA256
aee69123b1343627ff86660780cd54ede826fce88c9f784a8e20d5cc27bb8385
-
SHA512
3e3d197afdaef5622bc2b4d7ec35d5847b1215d7f5990a97225a8bc740e67fdd2ca6ccbcb111dc354b3e49062f436568f1d5a21ae45335b4efeb2bdb1e64491d
-
SSDEEP
49152:LNOQ4MjVdkzbWG4vk6CNGIHfo9J+4BteTYHw:5rVhd1GQshfm0cyYQ
Behavioral task
behavioral1
Sample
aee69123b1343627ff86660780cd54ede826fce88c9f784a8e20d5cc27bb8385.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aee69123b1343627ff86660780cd54ede826fce88c9f784a8e20d5cc27bb8385.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMP/BroomSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$TEMP/BroomSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$TEMP/syncUpd.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/syncUpd.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
stealc
http://185.172.128.145
-
url_path
/3cd2b41cbde8fc9c.php
Targets
-
-
Target
aee69123b1343627ff86660780cd54ede826fce88c9f784a8e20d5cc27bb8385
-
Size
2.0MB
-
MD5
a334c1ff7038253a31efd9245a950302
-
SHA1
f3b75796a3be4ba2f8995caa3213711d0569fe00
-
SHA256
aee69123b1343627ff86660780cd54ede826fce88c9f784a8e20d5cc27bb8385
-
SHA512
3e3d197afdaef5622bc2b4d7ec35d5847b1215d7f5990a97225a8bc740e67fdd2ca6ccbcb111dc354b3e49062f436568f1d5a21ae45335b4efeb2bdb1e64491d
-
SSDEEP
49152:LNOQ4MjVdkzbWG4vk6CNGIHfo9J+4BteTYHw:5rVhd1GQshfm0cyYQ
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
$PLUGINSDIR/INetC.dll
-
Size
21KB
-
MD5
2b342079303895c50af8040a91f30f71
-
SHA1
b11335e1cb8356d9c337cb89fe81d669a69de17e
-
SHA256
2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
-
SHA512
550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
SSDEEP
384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
Score3/10 -
-
-
Target
$TEMP/BroomSetup.exe
-
Size
1.7MB
-
MD5
eee5ddcffbed16222cac0a1b4e2e466e
-
SHA1
28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
-
SHA256
2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
-
SHA512
8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
-
SSDEEP
49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
Score7/10 -
-
-
Target
$TEMP/syncUpd.exe
-
Size
199KB
-
MD5
220cb1b1688c2364b9ab272e37b896f3
-
SHA1
3cb7b248bb15c6e51b0f58ec71c1f12c443c37b9
-
SHA256
24db4554df7ef6ba312c16c14f72d20471da31e494f688ab01462c5a02124fe7
-
SHA512
f2b18a3f0adaa70f871afa689c32591744e867dd1fae3b24344b842202ab9dc73723309391b7b98b72b45a55ef506b981db38d7a753b9d6712a198700a427e37
-
SSDEEP
3072:5EDOdYXCI4YRr894Olhr7W+HOqGWhhaWodg9jID8l7lhImC:mNX74YRLOLvGWL0Ah0
Score10/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-