Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    111s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 13:04 UTC

General

  • Target

    e38bd93e7494d62b91d0445138d215387c568aa6b6e9ae0a92842ba7b1999228.exe

  • Size

    1.2MB

  • MD5

    2cf5d69da271a679e8aa11c6fd68bcbc

  • SHA1

    592e89ba9a032d875c9955e3c80e9d852f0bc704

  • SHA256

    e38bd93e7494d62b91d0445138d215387c568aa6b6e9ae0a92842ba7b1999228

  • SHA512

    b1fe414b8e9d1c7c56c5265a3c1386f9dd37c97af64a65f7a04e9460bbdae8d8143d84090392bb0bd51f053b1e3b21ca20b3c9953844de542059408eb9f2e929

  • SSDEEP

    24576:0jqhS297HFlZVrmEP33ZaogYUspWkRR5sC96E4:0WTFlZVrmEZikyw

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e38bd93e7494d62b91d0445138d215387c568aa6b6e9ae0a92842ba7b1999228.exe
    "C:\Users\Admin\AppData\Local\Temp\e38bd93e7494d62b91d0445138d215387c568aa6b6e9ae0a92842ba7b1999228.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:348
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2224
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4540
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 348
        2⤵
        • Program crash
        PID:956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 348 -ip 348
      1⤵
        PID:4256

      Network

      • flag-us
        DNS
        22.160.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        22.160.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        77.190.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        77.190.18.2.in-addr.arpa
        IN PTR
        Response
        77.190.18.2.in-addr.arpa
        IN PTR
        a2-18-190-77deploystaticakamaitechnologiescom
      • flag-us
        DNS
        64.47.45.147.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        64.47.45.147.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        55.36.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        55.36.223.20.in-addr.arpa
        IN PTR
        Response
      • flag-nl
        GET
        https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
        Remote address:
        23.62.61.106:443
        Request
        GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
        host: www.bing.com
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-type: image/png
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        content-length: 1107
        date: Fri, 10 May 2024 13:05:11 GMT
        alt-svc: h3=":443"; ma=93600
        x-cdn-traceid: 0.663d3e17.1715346311.1269d12
      • flag-us
        DNS
        106.61.62.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        106.61.62.23.in-addr.arpa
        IN PTR
        Response
        106.61.62.23.in-addr.arpa
        IN PTR
        a23-62-61-106deploystaticakamaitechnologiescom
      • flag-us
        DNS
        86.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        86.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        24.121.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        24.121.18.2.in-addr.arpa
        IN PTR
        Response
        24.121.18.2.in-addr.arpa
        IN PTR
        a2-18-121-24deploystaticakamaitechnologiescom
      • flag-us
        DNS
        24.121.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        24.121.18.2.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        24.121.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        24.121.18.2.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        24.121.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        24.121.18.2.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        48.229.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        48.229.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        79.190.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        79.190.18.2.in-addr.arpa
        IN PTR
        Response
        79.190.18.2.in-addr.arpa
        IN PTR
        a2-18-190-79deploystaticakamaitechnologiescom
      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      • 147.45.47.64:11837
        RegAsm.exe
        2.9MB
        65.7kB
        2071
        985
      • 23.62.61.106:443
        https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
        tls, http2
        1.4kB
        6.4kB
        16
        12

        HTTP Request

        GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

        HTTP Response

        200
      • 8.8.8.8:53
        22.160.190.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        22.160.190.20.in-addr.arpa

      • 8.8.8.8:53
        77.190.18.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        77.190.18.2.in-addr.arpa

      • 8.8.8.8:53
        64.47.45.147.in-addr.arpa
        dns
        71 B
        126 B
        1
        1

        DNS Request

        64.47.45.147.in-addr.arpa

      • 8.8.8.8:53
        55.36.223.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        55.36.223.20.in-addr.arpa

      • 8.8.8.8:53
        106.61.62.23.in-addr.arpa
        dns
        71 B
        135 B
        1
        1

        DNS Request

        106.61.62.23.in-addr.arpa

      • 8.8.8.8:53
        86.23.85.13.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        86.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        206.23.85.13.in-addr.arpa
        dns
        284 B
        145 B
        4
        1

        DNS Request

        206.23.85.13.in-addr.arpa

        DNS Request

        206.23.85.13.in-addr.arpa

        DNS Request

        206.23.85.13.in-addr.arpa

        DNS Request

        206.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        24.121.18.2.in-addr.arpa
        dns
        280 B
        133 B
        4
        1

        DNS Request

        24.121.18.2.in-addr.arpa

        DNS Request

        24.121.18.2.in-addr.arpa

        DNS Request

        24.121.18.2.in-addr.arpa

        DNS Request

        24.121.18.2.in-addr.arpa

      • 8.8.8.8:53
        48.229.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        48.229.111.52.in-addr.arpa

      • 8.8.8.8:53
        79.190.18.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        79.190.18.2.in-addr.arpa

      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
        128 B
        1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/348-0-0x0000000000382000-0x0000000000383000-memory.dmp

        Filesize

        4KB

      • memory/4540-1-0x0000000000400000-0x000000000044A000-memory.dmp

        Filesize

        296KB

      • memory/4540-2-0x0000000074B5E000-0x0000000074B5F000-memory.dmp

        Filesize

        4KB

      • memory/4540-3-0x0000000005990000-0x0000000005F34000-memory.dmp

        Filesize

        5.6MB

      • memory/4540-4-0x0000000005310000-0x00000000053A2000-memory.dmp

        Filesize

        584KB

      • memory/4540-5-0x0000000074B50000-0x0000000075300000-memory.dmp

        Filesize

        7.7MB

      • memory/4540-6-0x00000000053C0000-0x00000000053CA000-memory.dmp

        Filesize

        40KB

      • memory/4540-7-0x0000000006960000-0x0000000006F78000-memory.dmp

        Filesize

        6.1MB

      • memory/4540-8-0x00000000064A0000-0x00000000065AA000-memory.dmp

        Filesize

        1.0MB

      • memory/4540-9-0x00000000063D0000-0x00000000063E2000-memory.dmp

        Filesize

        72KB

      • memory/4540-10-0x0000000006430000-0x000000000646C000-memory.dmp

        Filesize

        240KB

      • memory/4540-11-0x00000000065B0000-0x00000000065FC000-memory.dmp

        Filesize

        304KB

      • memory/4540-12-0x0000000006730000-0x0000000006796000-memory.dmp

        Filesize

        408KB

      • memory/4540-13-0x0000000007080000-0x00000000070F6000-memory.dmp

        Filesize

        472KB

      • memory/4540-14-0x00000000061C0000-0x00000000061DE000-memory.dmp

        Filesize

        120KB

      • memory/4540-15-0x0000000007F00000-0x00000000080C2000-memory.dmp

        Filesize

        1.8MB

      • memory/4540-16-0x0000000008BB0000-0x00000000090DC000-memory.dmp

        Filesize

        5.2MB

      • memory/4540-18-0x0000000074B50000-0x0000000075300000-memory.dmp

        Filesize

        7.7MB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.