Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    301s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24/05/2024, 00:54

General

  • Target

    99ed77594a138de377aa2f032a51ef44e8db6584dca85e0acde90d91c6f230bf.exe

  • Size

    2.4MB

  • MD5

    591deb3212cb1720fa03640f6257b5dc

  • SHA1

    5ffd579886eae9148141746294e2ee3ae922c8cc

  • SHA256

    99ed77594a138de377aa2f032a51ef44e8db6584dca85e0acde90d91c6f230bf

  • SHA512

    670374e657a9ba7b81d220e4105316707984ce7f5bfac04f97c473d8f8ef65c137f77fbdc9c889490e89d8823bc1c2add4adda4241f34ca64f27af5336e4e573

  • SSDEEP

    49152:P9Ay1zb37wq+3GQQvFOsAMSgcCNvQE5qh4OLzooa2ZgEPmBTI7pJLOjq5:ay1/7wq+36FBLNvQvm9n2Zm1wp9Om

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

  • Detect Vidar Stealer 11 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 1 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99ed77594a138de377aa2f032a51ef44e8db6584dca85e0acde90d91c6f230bf.exe
    "C:\Users\Admin\AppData\Local\Temp\99ed77594a138de377aa2f032a51ef44e8db6584dca85e0acde90d91c6f230bf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4112
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\99ed77594a138de377aa2f032a51ef44e8db6584dca85e0acde90d91c6f230bf.exe" & rd /s /q "C:\ProgramData\BFBGCFCFHCFH" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1192
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 10
        3⤵
        • Delays execution with timeout.exe
        PID:4640

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\BFBGCFCFHCFH\AAKJEG

    Filesize

    2.0MB

    MD5

    a3196b72e39cc4c9bb6286195ec07fd0

    SHA1

    a315739c102020d8832c41c17efd7124eb10c406

    SHA256

    3ad8aeb01d4efdcacbe13b104ec92c325427d54d64a3a859b6d29e3ace2fac0f

    SHA512

    3003d72886cb6d6c3af8af6d18078151e2e78e1bed43ba82ce1c268a722f39723de095a9a629ba63d0f9bd9cc98d6cc71042cfc949b2cd2ebbc1a81e005f1211

  • C:\ProgramData\BFBGCFCFHCFH\CGHCFB

    Filesize

    8KB

    MD5

    0b32ba08e2eb0e377b35ce5bfb105182

    SHA1

    cebdfe6aaf774946707a4b921f1d4359b6092cf9

    SHA256

    88a8a97ce133e8dab44b0980a20e7376ceaf7015734302824f34d5fbd569c581

    SHA512

    9fdc156eb815628ae4354f1f4b8d4f24989ed56e5e3166c2da1265131718fd80698b47f90c74ca62c706e9d2906e0d1540ceb55a8aa7f60c54c7eb1a4236242b

  • C:\ProgramData\BFBGCFCFHCFH\GCFCFC

    Filesize

    46KB

    MD5

    02d2c46697e3714e49f46b680b9a6b83

    SHA1

    84f98b56d49f01e9b6b76a4e21accf64fd319140

    SHA256

    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

    SHA512

    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

  • C:\ProgramData\BFBGCFCFHCFH\KFIEHI

    Filesize

    593B

    MD5

    91f5bc87fd478a007ec68c4e8adf11ac

    SHA1

    d07dd49e4ef3b36dad7d038b7e999ae850c5bef6

    SHA256

    92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9

    SHA512

    fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9

  • C:\ProgramData\BFBGCFCFHCFH\VCRUNT~1.DLL

    Filesize

    78KB

    MD5

    a37ee36b536409056a86f50e67777dd7

    SHA1

    1cafa159292aa736fc595fc04e16325b27cd6750

    SHA256

    8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

    SHA512

    3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

  • C:\ProgramData\BFBGCFCFHCFH\msvcp140.dll

    Filesize

    439KB

    MD5

    5ff1fca37c466d6723ec67be93b51442

    SHA1

    34cc4e158092083b13d67d6d2bc9e57b798a303b

    SHA256

    5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

    SHA512

    4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

  • C:\ProgramData\BFBGCFCFHCFH\softokn3.dll

    Filesize

    251KB

    MD5

    4e52d739c324db8225bd9ab2695f262f

    SHA1

    71c3da43dc5a0d2a1941e874a6d015a071783889

    SHA256

    74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a

    SHA512

    2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

  • \ProgramData\BFBGCFCFHCFH\mozglue.dll

    Filesize

    593KB

    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

  • \ProgramData\BFBGCFCFHCFH\nss3.dll

    Filesize

    2.0MB

    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

  • memory/4112-224-0x00000000009D0000-0x00000000015D4000-memory.dmp

    Filesize

    12.0MB

  • memory/4112-110-0x00000000009D0000-0x00000000015D4000-memory.dmp

    Filesize

    12.0MB

  • memory/4112-283-0x00000000009D0000-0x00000000015D4000-memory.dmp

    Filesize

    12.0MB

  • memory/4112-165-0x00000000009D0000-0x00000000015D4000-memory.dmp

    Filesize

    12.0MB

  • memory/4112-312-0x00000000009D0000-0x00000000015D4000-memory.dmp

    Filesize

    12.0MB

  • memory/4112-366-0x00000000009D0000-0x00000000015D4000-memory.dmp

    Filesize

    12.0MB

  • memory/4112-442-0x00000000009D0000-0x00000000015D4000-memory.dmp

    Filesize

    12.0MB

  • memory/4112-0-0x00000000009D0000-0x00000000015D4000-memory.dmp

    Filesize

    12.0MB

  • memory/4112-97-0x00000000009D0000-0x00000000015D4000-memory.dmp

    Filesize

    12.0MB

  • memory/4112-544-0x00000000009D0000-0x00000000015D4000-memory.dmp

    Filesize

    12.0MB

  • memory/4112-549-0x00000000009D0000-0x00000000015D4000-memory.dmp

    Filesize

    12.0MB

  • memory/4112-87-0x00000000009D0000-0x00000000015D4000-memory.dmp

    Filesize

    12.0MB

  • memory/4112-15-0x0000000052420000-0x000000005267F000-memory.dmp

    Filesize

    2.4MB

  • memory/4112-1-0x000000007F770000-0x000000007FB41000-memory.dmp

    Filesize

    3.8MB