Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240214-en
  • resource tags

    arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/03/2024, 17:30

General

  • Target

    a95b60573d18671bea63aafbb3f8dad7b94e3a30f51d9dbfaefdb8c96eccb956.exe

  • Size

    397KB

  • MD5

    36c49ce4084f9ed89e8897d38fac5086

  • SHA1

    1b2ae8d85f8fd6666e8e5d9597f4810f07c809c8

  • SHA256

    a95b60573d18671bea63aafbb3f8dad7b94e3a30f51d9dbfaefdb8c96eccb956

  • SHA512

    60f9e9145556f73af8c9a19841c53441612287cf37d7bd46b7177e432e91974b2c96b9471c65bad4c7bb21ec9c0bb659c120777b1291a2b5783a6bceea54533c

  • SSDEEP

    6144:Kici2Jk2Qs+04iUiCLsMcOTjqXVbeH0g3/ODSLwmpeEI7UJYOd1swUa3R6l:gi2JJv+KUiZMcoSeT3gm9zJYOMwRol

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a95b60573d18671bea63aafbb3f8dad7b94e3a30f51d9dbfaefdb8c96eccb956.exe
    "C:\Users\Admin\AppData\Local\Temp\a95b60573d18671bea63aafbb3f8dad7b94e3a30f51d9dbfaefdb8c96eccb956.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Local\Temp\u1q0.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u1q0.0.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4528
      • C:\Users\Admin\AppData\Local\Temp\u1q0.0.exe
        "C:\Users\Admin\AppData\Local\Temp\u1q0.0.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:332
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JJKEBGHJKF.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4684
          • C:\Users\Admin\AppData\Local\Temp\JJKEBGHJKF.exe
            "C:\Users\Admin\AppData\Local\Temp\JJKEBGHJKF.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4980
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\JJKEBGHJKF.exe
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2000
              • C:\Windows\SysWOW64\PING.EXE
                ping 2.2.2.2 -n 1 -w 3000
                7⤵
                • Runs ping.exe
                PID:3944
    • C:\Users\Admin\AppData\Local\Temp\u1q0.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u1q0.1.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3664
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2980
        • C:\Windows\SysWOW64\chcp.com
          chcp 1251
          4⤵
            PID:1712
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
            4⤵
            • Creates scheduled task(s)
            PID:2536
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 1168
        2⤵
        • Program crash
        PID:4216
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2232 -ip 2232
      1⤵
        PID:2736

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Are.docx

        Filesize

        11KB

        MD5

        a33e5b189842c5867f46566bdbf7a095

        SHA1

        e1c06359f6a76da90d19e8fd95e79c832edb3196

        SHA256

        5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

        SHA512

        f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

      • C:\ProgramData\mozglue.dll

        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      • C:\ProgramData\nss3.dll

        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      • C:\Users\Admin\AppData\Local\Temp\JJKEBGHJKF.exe

        Filesize

        106KB

        MD5

        fe380780b5c35bd6d54541791151c2be

        SHA1

        7fe3a583cf91474c733f85cebf3c857682e269e1

        SHA256

        b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

        SHA512

        ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

      • C:\Users\Admin\AppData\Local\Temp\u1q0.0.exe

        Filesize

        128KB

        MD5

        cbde922a54807227ceef482690a297c1

        SHA1

        4c8f0930fdeb8f80c1f18ba3c56002ee9345392f

        SHA256

        88dbe3590bca82272a797659a8fa3c5df2254d5f1c49991c8dc3dd538c99e01d

        SHA512

        10a81dc6de91b09860576ca3221c8ea2184c6946bf4199d4ee5d0b412cf8c15afbe514d6e800beeb7bd57fb41080016a6152557f188423909b8d1e3a1d29a469

      • C:\Users\Admin\AppData\Local\Temp\u1q0.0.exe

        Filesize

        252KB

        MD5

        acd6011cb4295e007f9a48622c84c041

        SHA1

        f3ef79d906d8dd1334c595d592378c6b71ec31b0

        SHA256

        169e50e0e5bb1323a52dcc3ac8224cb2839b3bd7a68c58101762d1ba92c4d3e5

        SHA512

        d8d2a41eb1edcde700356c0941e7cc8ccd06dcf41959d6cf72c0c5461ef540bfe5a7dfa7873bf90a532312d5c74ee0edb58c748ec0b232e5195ea182cabab3b0

      • C:\Users\Admin\AppData\Local\Temp\u1q0.1.exe

        Filesize

        1.7MB

        MD5

        eee5ddcffbed16222cac0a1b4e2e466e

        SHA1

        28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

        SHA256

        2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

        SHA512

        8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

      • C:\Users\Admin\AppData\Roaming\Temp\Task.bat

        Filesize

        128B

        MD5

        11bb3db51f701d4e42d3287f71a6a43e

        SHA1

        63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

        SHA256

        6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

        SHA512

        907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

      • memory/332-36-0x0000000061E00000-0x0000000061EF3000-memory.dmp

        Filesize

        972KB

      • memory/332-134-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/332-20-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/332-124-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/332-108-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/332-19-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/332-13-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/332-85-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/2232-2-0x00000000023F0000-0x000000000245E000-memory.dmp

        Filesize

        440KB

      • memory/2232-3-0x0000000000400000-0x0000000000568000-memory.dmp

        Filesize

        1.4MB

      • memory/2232-1-0x0000000000710000-0x0000000000810000-memory.dmp

        Filesize

        1024KB

      • memory/2232-78-0x0000000000400000-0x0000000000568000-memory.dmp

        Filesize

        1.4MB

      • memory/3664-32-0x0000000001040000-0x0000000001041000-memory.dmp

        Filesize

        4KB

      • memory/3664-111-0x0000000001040000-0x0000000001041000-memory.dmp

        Filesize

        4KB

      • memory/3664-31-0x0000000000400000-0x0000000000930000-memory.dmp

        Filesize

        5.2MB

      • memory/3664-92-0x0000000000400000-0x0000000000930000-memory.dmp

        Filesize

        5.2MB

      • memory/4528-15-0x00000000007E0000-0x0000000000807000-memory.dmp

        Filesize

        156KB

      • memory/4528-14-0x0000000000840000-0x0000000000940000-memory.dmp

        Filesize

        1024KB

      • memory/4980-141-0x0000000004F70000-0x0000000004F80000-memory.dmp

        Filesize

        64KB

      • memory/4980-140-0x0000000073840000-0x0000000073FF1000-memory.dmp

        Filesize

        7.7MB

      • memory/4980-139-0x0000000000550000-0x0000000000570000-memory.dmp

        Filesize

        128KB

      • memory/4980-144-0x0000000073840000-0x0000000073FF1000-memory.dmp

        Filesize

        7.7MB