Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    12/07/2024, 00:48

General

  • Target

    1dc4be7d64ed0e95933acf70c794d390N.exe

  • Size

    4.1MB

  • MD5

    1dc4be7d64ed0e95933acf70c794d390

  • SHA1

    b452bc2bed972cc44c597f19f1ad55f6a3f3ec8f

  • SHA256

    64ddfa4747bad726483b9dd99d16071449fdca3a4947623245d7c707dfdb7a85

  • SHA512

    e9fb88aecb4ac50e1c235265d67cd809653dda8cfd0c818d5a36fcf60287fe2b579e9ffda1dc9443a33e594f947f1a0452a293fcc0d4e0229e06f07ea2890b20

  • SSDEEP

    49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBfB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpsbVz8eLFcz

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1dc4be7d64ed0e95933acf70c794d390N.exe
    "C:\Users\Admin\AppData\Local\Temp\1dc4be7d64ed0e95933acf70c794d390N.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2244
    • C:\FilesK0\xdobloc.exe
      C:\FilesK0\xdobloc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\FilesK0\xdobloc.exe

    Filesize

    4.1MB

    MD5

    9a3a231b24bf5346311f9ffa02dfd0c7

    SHA1

    9090e247f8806523576cf36fb1aa2e72a3fabc01

    SHA256

    03bf167a59c940f381336c37158f35851f9cf43aaa1fd5bd33a8797249c69ac6

    SHA512

    29242c1cb4bd2b8be20f343a8bcf4e5b99a54e49069e2f3d83d7e52e7a8f40d4c22128535d4ffc5b82c6359fdbb3140d11360087e3dc06acbb28c7d629a85122

  • C:\MintH5\bodxsys.exe

    Filesize

    4.1MB

    MD5

    473f6d6bcc9cc70393e8ba9462ba3ac6

    SHA1

    7dfc6d31acf03b2469c876cf4aeaf9006c140bcd

    SHA256

    3a217a66ebfba62bd643a7cec88202b684b413d9471938da4d2c23cb76196847

    SHA512

    abf491119b4fd982fce8bb56a71f19fdbee3c4b8d6cb579fe0d24ae648925e38d66ca1556dc7f5b6855907f36a2a10ffe3981c435ee3c8d8fcd07019815b6d76

  • C:\Users\Admin\253086396416_6.1_Admin.ini

    Filesize

    168B

    MD5

    a2abacc19315c999ee8ae4ef057b315d

    SHA1

    dcfeb3cbb9742c9bdcd6dec3a5032933a03eafdb

    SHA256

    6b21f2cc10ac6f428596f9fd938c13236f387a694c89e743b594560ac9fbeb71

    SHA512

    83a54ee8dc6b01a66b5746d55c7f5c4a0950eaeca661491dbd66f141d473483adcfd8c427447b5dd10ca377799e2887129774eca2f021650a42ae57f058a6874

  • C:\Users\Admin\253086396416_6.1_Admin.ini

    Filesize

    200B

    MD5

    d7c12f730311bb0fd8c493e759fef080

    SHA1

    d7fefc5b3934622b7622a7eff6c9fa6410792fc2

    SHA256

    12bf15a56af04892a51315ed34ffe028f1888af1f7c872bba3594b68e2c62f48

    SHA512

    c6f82eedab19201df0782c7dcd6fc1ac8d7cfe1486795cf2e7b881966e3da9e37677b905a51bfeb0cc276d622e51e0f199913426af325066b85b04fcf0db8b5f

  • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe

    Filesize

    4.1MB

    MD5

    6749f5543eb0c585cb092e1e12334a3a

    SHA1

    5fefa29d4b72c44e832160f2bccdb8b2ca49038d

    SHA256

    c88ca2d6398ceafa7b2e48457dc40a2455c99a8e5b3465c5418231005032eb1d

    SHA512

    cfadf1b710c7593348430a3246902f9659910e04d09010cc31530311dfb6a0a687a01225957bd9303c093827d8e1e750c98430325c726221c05569fabee25464