Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

dddd/Guna.UI2.dll

windows7-x64

1

dddd/Guna.UI2.dll

windows10-2004-x64

1

dddd/Gén�...um.exe

windows7-x64

3

dddd/Gén�...um.exe

windows10-2004-x64

10

dddd/LogIn...xi.dll

windows7-x64

1

dddd/LogIn...xi.dll

windows10-2004-x64

1

dddd/theme.dll

windows7-x64

1

dddd/theme.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    102s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 17:01 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dddd/Générateur Scorpion-Premium.exe

  • Size

    1.1MB

  • MD5

    c7936aa7c0ed1759dbaa45ed4e13a548

  • SHA1

    1b7cec2a815a93e7d0f5d6480d9dbdd30953245f

  • SHA256

    0f760af630a93cd72a6580ffbebaf7eea6912255435b48f4e7dc4a696c0d3662

  • SHA512

    88b0d35114f3a6ed167774062f6d7d89125d61a3132b72d41c8293eef940a05ac8d487ebb5659d6b4ff6616967c3e27d5e9698c84680e948fff7d1df0915b930

  • SSDEEP

    12288:oo+H5nseophtd5FJgeF9CMIXSvIlclxXSvIlclHXSvIlcl:odMhlFnC5cl5clbcl

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla payload 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dddd\Générateur Scorpion-Premium.exe
    "C:\Users\Admin\AppData\Local\Temp\dddd\Générateur Scorpion-Premium.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:4156

Network

  • flag-us
    DNS
    178.223.142.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    178.223.142.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    40.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    40.134.221.88.in-addr.arpa
    IN PTR
    Response
    40.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-40deploystaticakamaitechnologiescom
  • flag-us
    DNS
    keyauth.win
    Générateur Scorpion-Premium.exe
    Remote address:
    8.8.8.8:53
    Request
    keyauth.win
    IN A
    Response
    keyauth.win
    IN A
    172.67.72.57
    keyauth.win
    IN A
    104.26.0.5
    keyauth.win
    IN A
    104.26.1.5
  • flag-us
    POST
    https://keyauth.win/api/1.2/
    Générateur Scorpion-Premium.exe
    Remote address:
    172.67.72.57:443
    Request
    POST /api/1.2/ HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Host: keyauth.win
    Content-Length: 111
    Expect: 100-continue
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Fri, 29 Mar 2024 17:01:42 GMT
    Content-Type: application/json; charset=UTF-8
    Content-Length: 417
    Connection: keep-alive
    signature: 0490dd3c9db7859c1679b89fed0142ea703eb2b3de7b2a660eb6d3ceac3597ed
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ULyMc5sjvvFFDdeAwFHJmMUqLURzE49VEdZEV0RRF1Wb43KMi5UbXzspQJNsHOGR6SnEZKrPfU2ayMdh%2B3g6nGAdDm%2FcwMrQBhSJf%2B%2FrICC6ilhn6aK8uSufmi8r"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Acknowledge: Credit to VaultCord.com
    X-Powered-By: VaultCord.com
    content-security-policy: upgrade-insecure-requests
    permissions-policy: accelerometer=(), camera=(), fullscreen=*, geolocation=(self), gyroscope=(), microphone=(), payment=*
    referrer-policy: strict-origin-when-cross-origin
    strict-transport-security: max-age=31536000; includeSubDomains
    x-content-security-policy: img-src *; media-src * data:;
    x-content-type-options: nosniff
    x-frame-options: DENY
    x-xss-protection: 1; mode=block
    Access-Control-Allow-Headers: *
    Access-Control-Allow-Methods: *
    Access-Control-Allow-Origin: *
    Server: cloudflare
    CF-RAY: 86c16c655e7224d1-LHR
  • flag-us
    DNS
    68.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    57.72.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    57.72.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    218.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    218.135.221.88.in-addr.arpa
    IN PTR
    Response
    218.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-218deploystaticakamaitechnologiescom
  • flag-us
    DNS
    21.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    41.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.134.221.88.in-addr.arpa
    IN PTR
    Response
    41.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-41deploystaticakamaitechnologiescom
  • 172.67.72.57:443
    https://keyauth.win/api/1.2/
    tls, http
    Générateur Scorpion-Premium.exe
    1.1kB
     6.9kB
     12
    13

    HTTP Request

    POST https://keyauth.win/api/1.2/

    HTTP Response

    200
  • 8.8.8.8:53
    178.223.142.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    178.223.142.52.in-addr.arpa

  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    40.134.221.88.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    40.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    keyauth.win
    dns
    Générateur Scorpion-Premium.exe
    57 B
     105 B
     1
    1

    DNS Request

    keyauth.win

    DNS Response

    172.67.72.57
    104.26.0.5
    104.26.1.5

  • 8.8.8.8:53
    68.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    68.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    57.72.67.172.in-addr.arpa
    dns
    71 B
     133 B
     1
    1

    DNS Request

    57.72.67.172.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    219 B
     144 B
     3
    1

    DNS Request

    240.221.184.93.in-addr.arpa

    DNS Request

    240.221.184.93.in-addr.arpa

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    218.135.221.88.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    218.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    21.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    21.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    41.134.221.88.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    41.134.221.88.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4156-0-0x0000000074D30000-0x00000000754E0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4156-1-0x0000000000450000-0x000000000056A000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/4156-2-0x0000000005560000-0x0000000005B04000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/4156-3-0x0000000004FB0000-0x0000000005042000-memory.dmp

    Filesize

    584KB

    Download

  • memory/4156-4-0x0000000005370000-0x0000000005382000-memory.dmp

    Filesize

    72KB

    Download

  • memory/4156-5-0x0000000005400000-0x0000000005410000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4156-6-0x0000000005500000-0x000000000550A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4156-7-0x0000000005F10000-0x0000000006106000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4156-8-0x0000000005B30000-0x0000000005B4C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/4156-9-0x0000000005400000-0x0000000005410000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4156-10-0x0000000008B40000-0x0000000008B7C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4156-11-0x0000000074D30000-0x00000000754E0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4156-12-0x0000000005400000-0x0000000005410000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4156-13-0x0000000005400000-0x0000000005410000-memory.dmp

    Filesize

    64KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.