Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 11:38

General

  • Target

    file.exe

  • Size

    206KB

  • MD5

    4577f74ecd5c343bf097f627c7fdf868

  • SHA1

    1d5d68fd676ba379c899613f4f16bc8b28594f75

  • SHA256

    ec194b4917fd62caf00c742b4182bbce64b8e7e923ed43278fd11019ad9a1b42

  • SHA512

    22e8ea279a00ba57274c314e21329aaae6f6d91e102469927be75a7caa93f1a2b8cbbbd36165e8a6e16b7b511a8e12e49dae4d52ab1e77746fea5972773aeea6

  • SSDEEP

    6144:dk0CrnfGXbw2E122NCyFBM/8MCsOaqXd35beWzEkrXW6EO:d+fGXbPMNCwM0lRaUd3YoE0hEO

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://46.8.231.109

Attributes
  • url_path

    /c4754d4f680ead72.php

Extracted

Family

vidar

Version

10.8

Botnet

3cd4672c6baedc17edab0cb86e9453d1

C2

https://t.me/jamelwt

https://steamcommunity.com/profiles/76561199761128941

https://t.me/iyigunl

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Extracted

Family

lumma

C2

https://potentioallykeos.shop/api

Signatures

  • Detect Vidar Stealer 13 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Stealc

    Stealc is an infostealer written in C++.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Checks computer location settings
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3468
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminEGDAEBGIDB.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1380
        • C:\Users\AdminEGDAEBGIDB.exe
          "C:\Users\AdminEGDAEBGIDB.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4712
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            5⤵
              PID:2004
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3840
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 1136
                6⤵
                • Program crash
                PID:1812
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminEHCAEGDHJK.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1064
          • C:\Users\AdminEHCAEGDHJK.exe
            "C:\Users\AdminEHCAEGDHJK.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2196
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Checks computer location settings
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3992
              • C:\ProgramData\HJEBGHIEBF.exe
                "C:\ProgramData\HJEBGHIEBF.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4040
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:964
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 1228
                    8⤵
                    • Program crash
                    PID:2284
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 1248
                    8⤵
                    • Program crash
                    PID:4660
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BGDAAKJJDAAK" & exit
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3792
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 10
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:376
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3840 -ip 3840
      1⤵
        PID:1996
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 964 -ip 964
        1⤵
          PID:3248
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 964 -ip 964
          1⤵
            PID:1084

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\BGDAAKJJDAAK\BGIJEG

            Filesize

            11KB

            MD5

            b4302006333030eda0f958c0a5f3cc45

            SHA1

            b2f22e72f1e8800a05dba6be53a410b4acda791d

            SHA256

            1f1b3f466aa79200817ed242f8c2e3b778733367055c50f97a4e30bb2926fee4

            SHA512

            01e6eeab332f5b0a94481918d77a8236801f1e0df8f6f96a7090d63d01712cac9944036a7a925c486a4099b40b537fb1e41ce7f051afb158aba3bc4d7633916f

          • C:\ProgramData\BGDAAKJJDAAK\BKKFHI

            Filesize

            114KB

            MD5

            c3311360e96fcf6ea559c40a78ede854

            SHA1

            562ada1868020814b25b5dbbdbcb5a9feb9eb6ba

            SHA256

            9372c1ee21c8440368f6dd8f6c9aeda24f2067056050fab9d4e050a75437d75b

            SHA512

            fef308d10d04d9a3de7db431a9ab4a47dc120bfe0d7ae7db7e151802c426a46b00426b861e7e57ac4d6d21dde6289f278b2dbf903d4d1d6b117e77467ab9cf65

          • C:\ProgramData\BGDAAKJJDAAK\GIECFI

            Filesize

            116KB

            MD5

            f70aa3fa04f0536280f872ad17973c3d

            SHA1

            50a7b889329a92de1b272d0ecf5fce87395d3123

            SHA256

            8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

            SHA512

            30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

          • C:\ProgramData\freebl3.dll

            Filesize

            669KB

            MD5

            550686c0ee48c386dfcb40199bd076ac

            SHA1

            ee5134da4d3efcb466081fb6197be5e12a5b22ab

            SHA256

            edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa

            SHA512

            0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

          • C:\ProgramData\mozglue.dll

            Filesize

            593KB

            MD5

            c8fd9be83bc728cc04beffafc2907fe9

            SHA1

            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

            SHA256

            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

            SHA512

            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

          • C:\ProgramData\msvcp140.dll

            Filesize

            439KB

            MD5

            5ff1fca37c466d6723ec67be93b51442

            SHA1

            34cc4e158092083b13d67d6d2bc9e57b798a303b

            SHA256

            5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

            SHA512

            4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

          • C:\ProgramData\nss3.dll

            Filesize

            2.0MB

            MD5

            1cc453cdf74f31e4d913ff9c10acdde2

            SHA1

            6e85eae544d6e965f15fa5c39700fa7202f3aafe

            SHA256

            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

            SHA512

            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

          • C:\ProgramData\softokn3.dll

            Filesize

            251KB

            MD5

            4e52d739c324db8225bd9ab2695f262f

            SHA1

            71c3da43dc5a0d2a1941e874a6d015a071783889

            SHA256

            74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a

            SHA512

            2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

          • C:\ProgramData\vcruntime140.dll

            Filesize

            78KB

            MD5

            a37ee36b536409056a86f50e67777dd7

            SHA1

            1cafa159292aa736fc595fc04e16325b27cd6750

            SHA256

            8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

            SHA512

            3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

          • C:\Users\AdminEGDAEBGIDB.exe

            Filesize

            277KB

            MD5

            8706191b083e3893406221c606f35f6f

            SHA1

            ba2c5578e4720ce57ad1498bebf5f6c6c2e0f65c

            SHA256

            04525f7fdcc5b5d6891f0a3ab3b6110b0cec2170d8695561cec9261964c334db

            SHA512

            3bed02fa46ae4cd79844831ae0c88658cafae4dcf2aefc281c1593cf3010b963c3c4ec23539997682c2326ba3cf3260470a7b1aced4e0cc0976a18b8c866d08f

          • C:\Users\AdminEHCAEGDHJK.exe

            Filesize

            191KB

            MD5

            f03b96b5a46ecbeda6d4616d7a3a5a5f

            SHA1

            90da4ae7a9cb8220b5c6bf9da2e8514e97201198

            SHA256

            b44da8b65f59bab4823e857a8d148ba663a99d6ba9d6e88f7db3cddfb1438ac2

            SHA512

            5c64c1ab62111a7e130c20e78044151ea93cdafe0e189c3e638efe4d571515fa1976ef50a49669c0b37e21c5f7002c05cb7261e55876d08823e197658cd3a0b4

          • memory/1608-0-0x00000000749DE000-0x00000000749DF000-memory.dmp

            Filesize

            4KB

          • memory/1608-7-0x00000000749D0000-0x0000000075180000-memory.dmp

            Filesize

            7.7MB

          • memory/1608-1-0x00000000000D0000-0x0000000000108000-memory.dmp

            Filesize

            224KB

          • memory/2196-102-0x0000000000E10000-0x0000000000E44000-memory.dmp

            Filesize

            208KB

          • memory/3468-111-0x0000000000400000-0x0000000000643000-memory.dmp

            Filesize

            2.3MB

          • memory/3468-9-0x0000000061E00000-0x0000000061EF3000-memory.dmp

            Filesize

            972KB

          • memory/3468-8-0x0000000000400000-0x0000000000643000-memory.dmp

            Filesize

            2.3MB

          • memory/3468-6-0x0000000000400000-0x0000000000643000-memory.dmp

            Filesize

            2.3MB

          • memory/3468-3-0x0000000000400000-0x0000000000643000-memory.dmp

            Filesize

            2.3MB

          • memory/3840-93-0x0000000000400000-0x000000000044C000-memory.dmp

            Filesize

            304KB

          • memory/3840-121-0x0000000000400000-0x000000000044C000-memory.dmp

            Filesize

            304KB

          • memory/3840-90-0x0000000000400000-0x000000000044C000-memory.dmp

            Filesize

            304KB

          • memory/3840-95-0x0000000000400000-0x000000000044C000-memory.dmp

            Filesize

            304KB

          • memory/3992-125-0x0000000022470000-0x00000000226CF000-memory.dmp

            Filesize

            2.4MB

          • memory/3992-158-0x0000000000400000-0x0000000000641000-memory.dmp

            Filesize

            2.3MB

          • memory/3992-139-0x0000000000400000-0x0000000000641000-memory.dmp

            Filesize

            2.3MB

          • memory/3992-140-0x0000000000400000-0x0000000000641000-memory.dmp

            Filesize

            2.3MB

          • memory/3992-123-0x0000000000400000-0x0000000000641000-memory.dmp

            Filesize

            2.3MB

          • memory/3992-156-0x0000000000400000-0x0000000000641000-memory.dmp

            Filesize

            2.3MB

          • memory/3992-195-0x0000000000400000-0x0000000000641000-memory.dmp

            Filesize

            2.3MB

          • memory/3992-108-0x0000000000400000-0x0000000000641000-memory.dmp

            Filesize

            2.3MB

          • memory/3992-104-0x0000000000400000-0x0000000000641000-memory.dmp

            Filesize

            2.3MB

          • memory/3992-122-0x0000000000400000-0x0000000000641000-memory.dmp

            Filesize

            2.3MB

          • memory/3992-202-0x0000000000400000-0x0000000000641000-memory.dmp

            Filesize

            2.3MB

          • memory/3992-106-0x0000000000400000-0x0000000000641000-memory.dmp

            Filesize

            2.3MB

          • memory/3992-203-0x0000000000400000-0x0000000000641000-memory.dmp

            Filesize

            2.3MB

          • memory/3992-194-0x0000000000400000-0x0000000000641000-memory.dmp

            Filesize

            2.3MB

          • memory/4712-87-0x00000000725CE000-0x00000000725CF000-memory.dmp

            Filesize

            4KB

          • memory/4712-157-0x00000000725C0000-0x0000000072D70000-memory.dmp

            Filesize

            7.7MB

          • memory/4712-94-0x00000000725C0000-0x0000000072D70000-memory.dmp

            Filesize

            7.7MB

          • memory/4712-88-0x0000000000B90000-0x0000000000BDA000-memory.dmp

            Filesize

            296KB