Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/07/2024, 07:23

General

  • Target

    1526d5952d7956238a435ebb8737abdd40736309ffd533cdd21105ae9fd1ceef.exe

  • Size

    415KB

  • MD5

    b54b8cd2e321a3f31a07921940c351fa

  • SHA1

    926253e894b9afb824726e7312ac65220509acf9

  • SHA256

    1526d5952d7956238a435ebb8737abdd40736309ffd533cdd21105ae9fd1ceef

  • SHA512

    623c20242072f4ef03aed0eaacf90e9a35fabf04562d9fc6f86e653fb42e2f09df089c839402b652279fdb17dc097299d84dea6658165d54dc4cdf7deda7aa31

  • SSDEEP

    12288:CPXaOtGpmLb84Jjzo6yDBuKuJ+ITOCV0d:C7tGpmf8edychVV0d

Malware Config

Extracted

Family

stealc

Botnet

QLL

C2

http://85.28.47.70

Attributes
  • url_path

    /744f169d372be841.php

Extracted

Family

redline

Botnet

1307newbild

C2

185.215.113.67:40960

Extracted

Family

redline

Botnet

LiveTraffic

C2

20.52.165.210:39030

Extracted

Family

lumma

C2

https://edificedcampds.shop/api

https://unseaffarignsk.shop/api

https://shepherdlyopzc.shop/api

https://upknittsoappz.shop/api

https://liernessfornicsa.shop/api

https://outpointsozp.shop/api

https://callosallsaospz.shop/api

https://lariatedzugspd.shop/api

https://indexterityszcoxp.shop/api

https://reinforcedirectorywd.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1526d5952d7956238a435ebb8737abdd40736309ffd533cdd21105ae9fd1ceef.exe
    "C:\Users\Admin\AppData\Local\Temp\1526d5952d7956238a435ebb8737abdd40736309ffd533cdd21105ae9fd1ceef.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4492
    • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Users\Admin\AppData\Local\Temp\1000160001\Files.exe
        "C:\Users\Admin\AppData\Local\Temp\1000160001\Files.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:1392
          • C:\Users\Admin\AppData\Roaming\05pH5ZP5r5.exe
            "C:\Users\Admin\AppData\Roaming\05pH5ZP5r5.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2436
          • C:\Users\Admin\AppData\Roaming\2Xs6t3LAlC.exe
            "C:\Users\Admin\AppData\Roaming\2Xs6t3LAlC.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4904
      • C:\Users\Admin\AppData\Local\Temp\1000202001\567jn7x.exe
        "C:\Users\Admin\AppData\Local\Temp\1000202001\567jn7x.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4388
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:4376
      • C:\Users\Admin\AppData\Local\Temp\1000240001\newstart.exe
        "C:\Users\Admin\AppData\Local\Temp\1000240001\newstart.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1808
      • C:\Users\Admin\AppData\Local\Temp\1000253001\34v3vz.exe
        "C:\Users\Admin\AppData\Local\Temp\1000253001\34v3vz.exe"
        3⤵
        • Executes dropped EXE
        PID:4576
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 488
          4⤵
          • Program crash
          PID:540
      • C:\Users\Admin\AppData\Local\Temp\1000259001\gold.exe
        "C:\Users\Admin\AppData\Local\Temp\1000259001\gold.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4812
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4372
      • C:\Users\Admin\AppData\Local\Temp\1000303001\Voodooshield%20Pro.exe
        "C:\Users\Admin\AppData\Local\Temp\1000303001\Voodooshield%20Pro.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:1868
        • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
          C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
          4⤵
            PID:1312
        • C:\Users\Admin\AppData\Local\Temp\1000304001\acev.exe
          "C:\Users\Admin\AppData\Local\Temp\1000304001\acev.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2936
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4580
        • C:\Users\Admin\AppData\Local\Temp\1000305001\34v3vz.exe
          "C:\Users\Admin\AppData\Local\Temp\1000305001\34v3vz.exe"
          3⤵
          • Executes dropped EXE
          PID:3668
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 488
            4⤵
            • Program crash
            PID:5092
    • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
      C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
      1⤵
      • Executes dropped EXE
      PID:2444
    • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
      C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
      1⤵
      • Executes dropped EXE
      PID:3128
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4576 -ip 4576
      1⤵
        PID:3324
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3668 -ip 3668
        1⤵
          PID:2932
        • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
          C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
          1⤵
          • Executes dropped EXE
          PID:876

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\mozglue.dll

          Filesize

          593KB

          MD5

          c8fd9be83bc728cc04beffafc2907fe9

          SHA1

          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

          SHA256

          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

          SHA512

          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

        • C:\ProgramData\nss3.dll

          Filesize

          2.0MB

          MD5

          1cc453cdf74f31e4d913ff9c10acdde2

          SHA1

          6e85eae544d6e965f15fa5c39700fa7202f3aafe

          SHA256

          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

          SHA512

          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

          Filesize

          328B

          MD5

          c52b7c216f4d04a866d2b2a681cd297e

          SHA1

          50ddbbe736e5f091b6c8d2e6511df5ad6ad20682

          SHA256

          94abeb5fbda07285e14d046e1fe26a64919f02b48f0c7491b8ed7f6c9f8c73c7

          SHA512

          c51ccd369ed31d7fa1f7762ded8c285fbc45d2684ce3696675f7fec0699b2d5127b24a74c154bf71b04b8d280d223434d333e84a6aa1702a0524a123a65c02d8

        • C:\Users\Admin\AppData\Local\Temp\1000160001\Files.exe

          Filesize

          1.3MB

          MD5

          90b3832d4da1a85d18c9c515cb01780e

          SHA1

          57a70473e3046328cdce3da7943d13c1a79fe8c5

          SHA256

          ba82b9708925f266c292334bc5e20e963c6e20ce134f03f79892fd5c26e645f8

          SHA512

          3987c88a9a30a0c1b2ca03e784e3c0631f83e5576faa3243787ab2407f1fd0f9302a538e0caccc785d308802eabaf91ded96902cab70be51482513c72cd383e2

        • C:\Users\Admin\AppData\Local\Temp\1000202001\567jn7x.exe

          Filesize

          1.1MB

          MD5

          e8a1d35e54a6982c175c4351f3ce0dcd

          SHA1

          9e5c8167d0957701d549f4586f9b5e9861df5471

          SHA256

          6565ab8e7be0d3e8544a49cb90e79715df0120d03c187ba9443ab738ca4dca28

          SHA512

          6bb5a288d5fd7962e5bc80cb8785ecc67d83be49ec701bb61a88d7d3e0af90a0747d1f015506b07d2661becf98ac76f067cecf261d507b51dcfdbade9f31d78c

        • C:\Users\Admin\AppData\Local\Temp\1000240001\newstart.exe

          Filesize

          297KB

          MD5

          a20fc3377c07aa683a47397f9f5ff355

          SHA1

          13160e27dcea48dc9c5393948b7918cb2fcdd759

          SHA256

          f7891ca59e0907217db3eeafbe751e2d184317a871450b5ec401217a12df9d33

          SHA512

          dcdba7203efeea40366375fb54123b11bba972552795c64cbe912bef137698d308ea8e370732e5a65cba5687fbe6095bd53e5e1e49e3a6d8cf6912ebb61da254

        • C:\Users\Admin\AppData\Local\Temp\1000253001\34v3vz.exe

          Filesize

          330KB

          MD5

          61547b701d759958b78b75aeca77279c

          SHA1

          21e5b345bdcaaeadf6df1359f805f63aafabe223

          SHA256

          0a18067c173a7c4bdc24b8d3a847814b30733cecfdcc305c431a3d1fcc322536

          SHA512

          f65d898c13b09bd5f1102ad95e68d5b9982214a53d5a13db12cf287468d1740cfccee407d27534331c29f21705b8fed8b3bfecdda49224f2b9e33364392aaa1c

        • C:\Users\Admin\AppData\Local\Temp\1000259001\gold.exe

          Filesize

          527KB

          MD5

          3828babaa69c01aa31609e67ac8c1f71

          SHA1

          97c9185851f81f6d9cffa22105dc858add2768f8

          SHA256

          a13c3863d0fdb36d18368500bd07167cd058d7b6fb511a9356b2cf99d14ccb48

          SHA512

          b1baf57c8a90df0142d913e83046e532161c72e894dc5aa46d3368f9e8c6d9a97067def52d07367f5a15dba84a4f6a040c3ef289a819c48d5be5653583a69234

        • C:\Users\Admin\AppData\Local\Temp\1000303001\Voodooshield%20Pro.exe

          Filesize

          8.1MB

          MD5

          04f2041c323e7a4211bc8eab6804c27f

          SHA1

          1b3658865262fdf74e069fcc827924ac15014768

          SHA256

          d26465b96a165933cc46829b6f9caece3b59bac96d78dd54f733ed931a3553b9

          SHA512

          e5b5103907be2be75c44853c3702c4022af8c7007739e9f6e962ebb491a5ef46912060ddb059a91aac6bf3b8536a90ea8f37d95970fa9ec31006a7844b1dabed

        • C:\Users\Admin\AppData\Local\Temp\1000304001\acev.exe

          Filesize

          681KB

          MD5

          4f5771aa008fb55801a3f9fba7130f69

          SHA1

          eaace725791c08810198c08907b84b8850d4ef5b

          SHA256

          447ed0bdf4f8d0479545724b9578d2a3296b6bc5e2162d7ba405276234eccf0d

          SHA512

          0ce8c4c44338d92f4a5f07f38a93812a85ce5524a4ed0c4e4d616127ea6fe02e94df0938075b4d2dc3eead2fac4a827230b0d2e1333bb51146d92417b1a5bfec

        • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe

          Filesize

          415KB

          MD5

          b54b8cd2e321a3f31a07921940c351fa

          SHA1

          926253e894b9afb824726e7312ac65220509acf9

          SHA256

          1526d5952d7956238a435ebb8737abdd40736309ffd533cdd21105ae9fd1ceef

          SHA512

          623c20242072f4ef03aed0eaacf90e9a35fabf04562d9fc6f86e653fb42e2f09df089c839402b652279fdb17dc097299d84dea6658165d54dc4cdf7deda7aa31

        • C:\Users\Admin\AppData\Roaming\05pH5ZP5r5.exe

          Filesize

          381KB

          MD5

          1b75671fb234ae1fb72406a317fa752a

          SHA1

          bd47c38b7fb55d013b85c60cd51c8c5ee56f3757

          SHA256

          499d5830b76daff19e04393ba05f63baa893f8d86ae358fc59365a5938177cbe

          SHA512

          4c96d2c40862f73314394f48bc9c0930d5c51bfaa389185518c84ac921ceafab0f296df48655a9640d4232265daf67f3b0f4b886bfd31d230e8ec9ed11bbc2f5

        • C:\Users\Admin\AppData\Roaming\2Xs6t3LAlC.exe

          Filesize

          503KB

          MD5

          2c2be38fb507206d36dddb3d03096518

          SHA1

          a16edb81610a080096376d998e5ddc3e4b54bbd6

          SHA256

          0c7173daaa5ad8dabe7a2cde6dbd0eee1ca790071443aa13b01a1e731053491e

          SHA512

          e436954d7d5b77feb32f200cc48cb01f94b449887443a1e75ebef2f6fa2139d989d65f5ea7a71f8562c3aae2fea4117efc87e8aae905e1ba466fbc8bb328b316

        • C:\Users\Admin\AppData\Roaming\d3d9.dll

          Filesize

          649KB

          MD5

          103c525aa49b81407e72a346baa3ec19

          SHA1

          1ae74f6ef71b929472d28d064fc0c17d0fc54d1c

          SHA256

          0593eef89f1bde96f5d469281de905717e9b38a70d9b374c9c3193fcb740a22d

          SHA512

          4fb74f42fce676b37208b75ce378f4b91772f4c088a7c3c8d120f92c67d337dad99e21f26da5adaff0a2566158ec33de35e8341415a1f6a729d5840cee69ef8b

        • memory/1312-290-0x0000000000B90000-0x0000000000BE4000-memory.dmp

          Filesize

          336KB

        • memory/1312-288-0x0000000000B90000-0x0000000000BE4000-memory.dmp

          Filesize

          336KB

        • memory/1392-28-0x0000000000400000-0x0000000000516000-memory.dmp

          Filesize

          1.1MB

        • memory/1392-52-0x0000000000400000-0x0000000000516000-memory.dmp

          Filesize

          1.1MB

        • memory/1392-27-0x0000000000400000-0x0000000000516000-memory.dmp

          Filesize

          1.1MB

        • memory/1392-29-0x0000000000400000-0x0000000000516000-memory.dmp

          Filesize

          1.1MB

        • memory/1392-32-0x0000000000FD0000-0x0000000000FD3000-memory.dmp

          Filesize

          12KB

        • memory/1392-31-0x0000000000400000-0x0000000000516000-memory.dmp

          Filesize

          1.1MB

        • memory/1808-219-0x0000000008000000-0x0000000008050000-memory.dmp

          Filesize

          320KB

        • memory/1808-115-0x0000000006290000-0x00000000062DC000-memory.dmp

          Filesize

          304KB

        • memory/1808-114-0x0000000000DD0000-0x0000000000E20000-memory.dmp

          Filesize

          320KB

        • memory/1868-289-0x00007FF70B770000-0x00007FF70C014000-memory.dmp

          Filesize

          8.6MB

        • memory/1868-286-0x00007FF70B770000-0x00007FF70C014000-memory.dmp

          Filesize

          8.6MB

        • memory/2156-26-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

          Filesize

          4KB

        • memory/2436-59-0x0000000004FE0000-0x0000000005072000-memory.dmp

          Filesize

          584KB

        • memory/2436-68-0x0000000009260000-0x00000000092C6000-memory.dmp

          Filesize

          408KB

        • memory/2436-57-0x0000000000530000-0x0000000000596000-memory.dmp

          Filesize

          408KB

        • memory/2436-58-0x0000000005590000-0x0000000005B34000-memory.dmp

          Filesize

          5.6MB

        • memory/2436-60-0x0000000004FA0000-0x0000000004FAA000-memory.dmp

          Filesize

          40KB

        • memory/2436-72-0x000000000A460000-0x000000000A98C000-memory.dmp

          Filesize

          5.2MB

        • memory/2436-71-0x0000000009D60000-0x0000000009F22000-memory.dmp

          Filesize

          1.8MB

        • memory/2436-61-0x00000000086C0000-0x0000000008CD8000-memory.dmp

          Filesize

          6.1MB

        • memory/2936-255-0x00000000005D0000-0x0000000000680000-memory.dmp

          Filesize

          704KB

        • memory/2936-256-0x0000000002930000-0x0000000002936000-memory.dmp

          Filesize

          24KB

        • memory/4372-185-0x0000000000400000-0x0000000000450000-memory.dmp

          Filesize

          320KB

        • memory/4376-94-0x0000000000400000-0x0000000000643000-memory.dmp

          Filesize

          2.3MB

        • memory/4376-93-0x0000000000400000-0x0000000000643000-memory.dmp

          Filesize

          2.3MB

        • memory/4376-131-0x0000000061E00000-0x0000000061EF3000-memory.dmp

          Filesize

          972KB

        • memory/4388-91-0x0000000000DB0000-0x0000000000F26000-memory.dmp

          Filesize

          1.5MB

        • memory/4388-95-0x0000000000DB0000-0x0000000000F26000-memory.dmp

          Filesize

          1.5MB

        • memory/4580-263-0x0000000000400000-0x000000000047C000-memory.dmp

          Filesize

          496KB

        • memory/4904-62-0x0000000008120000-0x000000000822A000-memory.dmp

          Filesize

          1.0MB

        • memory/4904-63-0x0000000008060000-0x0000000008072000-memory.dmp

          Filesize

          72KB

        • memory/4904-64-0x00000000080C0000-0x00000000080FC000-memory.dmp

          Filesize

          240KB

        • memory/4904-70-0x00000000094E0000-0x00000000094FE000-memory.dmp

          Filesize

          120KB

        • memory/4904-65-0x0000000008230000-0x000000000827C000-memory.dmp

          Filesize

          304KB

        • memory/4904-56-0x00000000007C0000-0x0000000000844000-memory.dmp

          Filesize

          528KB

        • memory/4904-69-0x0000000009540000-0x00000000095B6000-memory.dmp

          Filesize

          472KB