Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 00:48
Static task
static1
Behavioral task
behavioral1
Sample
1dc4be7d64ed0e95933acf70c794d390N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1dc4be7d64ed0e95933acf70c794d390N.exe
Resource
win10v2004-20240709-en
General
-
Target
1dc4be7d64ed0e95933acf70c794d390N.exe
-
Size
4.1MB
-
MD5
1dc4be7d64ed0e95933acf70c794d390
-
SHA1
b452bc2bed972cc44c597f19f1ad55f6a3f3ec8f
-
SHA256
64ddfa4747bad726483b9dd99d16071449fdca3a4947623245d7c707dfdb7a85
-
SHA512
e9fb88aecb4ac50e1c235265d67cd809653dda8cfd0c818d5a36fcf60287fe2b579e9ffda1dc9443a33e594f947f1a0452a293fcc0d4e0229e06f07ea2890b20
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBfB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpsbVz8eLFcz
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe 1dc4be7d64ed0e95933acf70c794d390N.exe -
Executes dropped EXE 2 IoCs
pid Process 2244 ecxopti.exe 2708 xdobloc.exe -
Loads dropped DLL 2 IoCs
pid Process 3024 1dc4be7d64ed0e95933acf70c794d390N.exe 3024 1dc4be7d64ed0e95933acf70c794d390N.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesK0\\xdobloc.exe" 1dc4be7d64ed0e95933acf70c794d390N.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintH5\\bodxsys.exe" 1dc4be7d64ed0e95933acf70c794d390N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3024 1dc4be7d64ed0e95933acf70c794d390N.exe 3024 1dc4be7d64ed0e95933acf70c794d390N.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe 2244 ecxopti.exe 2708 xdobloc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2244 3024 1dc4be7d64ed0e95933acf70c794d390N.exe 30 PID 3024 wrote to memory of 2244 3024 1dc4be7d64ed0e95933acf70c794d390N.exe 30 PID 3024 wrote to memory of 2244 3024 1dc4be7d64ed0e95933acf70c794d390N.exe 30 PID 3024 wrote to memory of 2244 3024 1dc4be7d64ed0e95933acf70c794d390N.exe 30 PID 3024 wrote to memory of 2708 3024 1dc4be7d64ed0e95933acf70c794d390N.exe 31 PID 3024 wrote to memory of 2708 3024 1dc4be7d64ed0e95933acf70c794d390N.exe 31 PID 3024 wrote to memory of 2708 3024 1dc4be7d64ed0e95933acf70c794d390N.exe 31 PID 3024 wrote to memory of 2708 3024 1dc4be7d64ed0e95933acf70c794d390N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dc4be7d64ed0e95933acf70c794d390N.exe"C:\Users\Admin\AppData\Local\Temp\1dc4be7d64ed0e95933acf70c794d390N.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2244
-
-
C:\FilesK0\xdobloc.exeC:\FilesK0\xdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD59a3a231b24bf5346311f9ffa02dfd0c7
SHA19090e247f8806523576cf36fb1aa2e72a3fabc01
SHA25603bf167a59c940f381336c37158f35851f9cf43aaa1fd5bd33a8797249c69ac6
SHA51229242c1cb4bd2b8be20f343a8bcf4e5b99a54e49069e2f3d83d7e52e7a8f40d4c22128535d4ffc5b82c6359fdbb3140d11360087e3dc06acbb28c7d629a85122
-
Filesize
4.1MB
MD5473f6d6bcc9cc70393e8ba9462ba3ac6
SHA17dfc6d31acf03b2469c876cf4aeaf9006c140bcd
SHA2563a217a66ebfba62bd643a7cec88202b684b413d9471938da4d2c23cb76196847
SHA512abf491119b4fd982fce8bb56a71f19fdbee3c4b8d6cb579fe0d24ae648925e38d66ca1556dc7f5b6855907f36a2a10ffe3981c435ee3c8d8fcd07019815b6d76
-
Filesize
168B
MD5a2abacc19315c999ee8ae4ef057b315d
SHA1dcfeb3cbb9742c9bdcd6dec3a5032933a03eafdb
SHA2566b21f2cc10ac6f428596f9fd938c13236f387a694c89e743b594560ac9fbeb71
SHA51283a54ee8dc6b01a66b5746d55c7f5c4a0950eaeca661491dbd66f141d473483adcfd8c427447b5dd10ca377799e2887129774eca2f021650a42ae57f058a6874
-
Filesize
200B
MD5d7c12f730311bb0fd8c493e759fef080
SHA1d7fefc5b3934622b7622a7eff6c9fa6410792fc2
SHA25612bf15a56af04892a51315ed34ffe028f1888af1f7c872bba3594b68e2c62f48
SHA512c6f82eedab19201df0782c7dcd6fc1ac8d7cfe1486795cf2e7b881966e3da9e37677b905a51bfeb0cc276d622e51e0f199913426af325066b85b04fcf0db8b5f
-
Filesize
4.1MB
MD56749f5543eb0c585cb092e1e12334a3a
SHA15fefa29d4b72c44e832160f2bccdb8b2ca49038d
SHA256c88ca2d6398ceafa7b2e48457dc40a2455c99a8e5b3465c5418231005032eb1d
SHA512cfadf1b710c7593348430a3246902f9659910e04d09010cc31530311dfb6a0a687a01225957bd9303c093827d8e1e750c98430325c726221c05569fabee25464