Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 00:11
Behavioral task
behavioral1
Sample
264615ddcc134286d464215b5ed2e030N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
264615ddcc134286d464215b5ed2e030N.exe
Resource
win10v2004-20240802-en
General
-
Target
264615ddcc134286d464215b5ed2e030N.exe
-
Size
1.4MB
-
MD5
264615ddcc134286d464215b5ed2e030
-
SHA1
672406792e91fc5c2660c736b182a7aa5004a41f
-
SHA256
1c4f7e11acda75f16ce1ae288281a39cd3d3fd63c24717f57fd0d753552c7638
-
SHA512
c657601e3cc481a32081feab8db6cb4553196d11010b5bc1cd23ce633b1020fef37b315bc6862c4e5d2a8552294995d889d12e613b38f20f4160ad1d77cac0cf
-
SSDEEP
24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYM:Fo0c++OCokGs9Fa+rd1f26RNYM
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 11 IoCs
resource yara_rule behavioral1/memory/2172-0-0x0000000000880000-0x00000000009EB000-memory.dmp netwire behavioral1/files/0x00070000000120fd-3.dat netwire behavioral1/memory/1904-24-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2172-39-0x00000000034A0000-0x000000000360B000-memory.dmp netwire behavioral1/memory/2172-42-0x0000000000880000-0x00000000009EB000-memory.dmp netwire behavioral1/memory/2084-48-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/files/0x00070000000164cf-52.dat netwire behavioral1/memory/1440-54-0x0000000000270000-0x00000000003DB000-memory.dmp netwire behavioral1/memory/1440-83-0x0000000000270000-0x00000000003DB000-memory.dmp netwire behavioral1/memory/1188-91-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1748-118-0x0000000000270000-0x00000000003DB000-memory.dmp netwire -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
resource yara_rule behavioral1/memory/3032-29-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/3032-40-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2264-73-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral1/memory/2264-82-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat -
Executes dropped EXE 8 IoCs
pid Process 1904 Blasthost.exe 2084 Host.exe 1440 RtDCpl64.exe 1188 Blasthost.exe 2264 RtDCpl64.exe 1748 RtDCpl64.exe 904 Blasthost.exe 1484 RtDCpl64.exe -
Loads dropped DLL 13 IoCs
pid Process 2172 264615ddcc134286d464215b5ed2e030N.exe 2172 264615ddcc134286d464215b5ed2e030N.exe 2172 264615ddcc134286d464215b5ed2e030N.exe 2172 264615ddcc134286d464215b5ed2e030N.exe 1904 Blasthost.exe 1904 Blasthost.exe 1440 RtDCpl64.exe 1440 RtDCpl64.exe 1440 RtDCpl64.exe 1440 RtDCpl64.exe 1748 RtDCpl64.exe 1748 RtDCpl64.exe 1748 RtDCpl64.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2172-0-0x0000000000880000-0x00000000009EB000-memory.dmp autoit_exe behavioral1/memory/2172-39-0x00000000034A0000-0x000000000360B000-memory.dmp autoit_exe behavioral1/memory/2172-42-0x0000000000880000-0x00000000009EB000-memory.dmp autoit_exe behavioral1/files/0x00070000000164cf-52.dat autoit_exe behavioral1/memory/1440-54-0x0000000000270000-0x00000000003DB000-memory.dmp autoit_exe behavioral1/memory/1440-83-0x0000000000270000-0x00000000003DB000-memory.dmp autoit_exe behavioral1/memory/1748-118-0x0000000000270000-0x00000000003DB000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2172 set thread context of 3032 2172 264615ddcc134286d464215b5ed2e030N.exe 33 PID 1440 set thread context of 2264 1440 RtDCpl64.exe 41 PID 1748 set thread context of 1484 1748 RtDCpl64.exe 48 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 264615ddcc134286d464215b5ed2e030N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blasthost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 264615ddcc134286d464215b5ed2e030N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1940 schtasks.exe 2892 schtasks.exe 2664 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 1904 2172 264615ddcc134286d464215b5ed2e030N.exe 30 PID 2172 wrote to memory of 1904 2172 264615ddcc134286d464215b5ed2e030N.exe 30 PID 2172 wrote to memory of 1904 2172 264615ddcc134286d464215b5ed2e030N.exe 30 PID 2172 wrote to memory of 1904 2172 264615ddcc134286d464215b5ed2e030N.exe 30 PID 1904 wrote to memory of 2084 1904 Blasthost.exe 32 PID 1904 wrote to memory of 2084 1904 Blasthost.exe 32 PID 1904 wrote to memory of 2084 1904 Blasthost.exe 32 PID 1904 wrote to memory of 2084 1904 Blasthost.exe 32 PID 2172 wrote to memory of 3032 2172 264615ddcc134286d464215b5ed2e030N.exe 33 PID 2172 wrote to memory of 3032 2172 264615ddcc134286d464215b5ed2e030N.exe 33 PID 2172 wrote to memory of 3032 2172 264615ddcc134286d464215b5ed2e030N.exe 33 PID 2172 wrote to memory of 3032 2172 264615ddcc134286d464215b5ed2e030N.exe 33 PID 2172 wrote to memory of 3032 2172 264615ddcc134286d464215b5ed2e030N.exe 33 PID 2172 wrote to memory of 3032 2172 264615ddcc134286d464215b5ed2e030N.exe 33 PID 2172 wrote to memory of 2664 2172 264615ddcc134286d464215b5ed2e030N.exe 34 PID 2172 wrote to memory of 2664 2172 264615ddcc134286d464215b5ed2e030N.exe 34 PID 2172 wrote to memory of 2664 2172 264615ddcc134286d464215b5ed2e030N.exe 34 PID 2172 wrote to memory of 2664 2172 264615ddcc134286d464215b5ed2e030N.exe 34 PID 3032 wrote to memory of 2768 3032 264615ddcc134286d464215b5ed2e030N.exe 36 PID 3032 wrote to memory of 2768 3032 264615ddcc134286d464215b5ed2e030N.exe 36 PID 3032 wrote to memory of 2768 3032 264615ddcc134286d464215b5ed2e030N.exe 36 PID 3032 wrote to memory of 2768 3032 264615ddcc134286d464215b5ed2e030N.exe 36 PID 3032 wrote to memory of 2768 3032 264615ddcc134286d464215b5ed2e030N.exe 36 PID 3032 wrote to memory of 2768 3032 264615ddcc134286d464215b5ed2e030N.exe 36 PID 2348 wrote to memory of 1440 2348 taskeng.exe 39 PID 2348 wrote to memory of 1440 2348 taskeng.exe 39 PID 2348 wrote to memory of 1440 2348 taskeng.exe 39 PID 2348 wrote to memory of 1440 2348 taskeng.exe 39 PID 1440 wrote to memory of 1188 1440 RtDCpl64.exe 40 PID 1440 wrote to memory of 1188 1440 RtDCpl64.exe 40 PID 1440 wrote to memory of 1188 1440 RtDCpl64.exe 40 PID 1440 wrote to memory of 1188 1440 RtDCpl64.exe 40 PID 1440 wrote to memory of 2264 1440 RtDCpl64.exe 41 PID 1440 wrote to memory of 2264 1440 RtDCpl64.exe 41 PID 1440 wrote to memory of 2264 1440 RtDCpl64.exe 41 PID 1440 wrote to memory of 2264 1440 RtDCpl64.exe 41 PID 1440 wrote to memory of 2264 1440 RtDCpl64.exe 41 PID 1440 wrote to memory of 2264 1440 RtDCpl64.exe 41 PID 1440 wrote to memory of 1940 1440 RtDCpl64.exe 42 PID 1440 wrote to memory of 1940 1440 RtDCpl64.exe 42 PID 1440 wrote to memory of 1940 1440 RtDCpl64.exe 42 PID 1440 wrote to memory of 1940 1440 RtDCpl64.exe 42 PID 2264 wrote to memory of 1920 2264 RtDCpl64.exe 43 PID 2264 wrote to memory of 1920 2264 RtDCpl64.exe 43 PID 2264 wrote to memory of 1920 2264 RtDCpl64.exe 43 PID 2264 wrote to memory of 1920 2264 RtDCpl64.exe 43 PID 2264 wrote to memory of 1920 2264 RtDCpl64.exe 43 PID 2264 wrote to memory of 1920 2264 RtDCpl64.exe 43 PID 2348 wrote to memory of 1748 2348 taskeng.exe 46 PID 2348 wrote to memory of 1748 2348 taskeng.exe 46 PID 2348 wrote to memory of 1748 2348 taskeng.exe 46 PID 2348 wrote to memory of 1748 2348 taskeng.exe 46 PID 1748 wrote to memory of 904 1748 RtDCpl64.exe 47 PID 1748 wrote to memory of 904 1748 RtDCpl64.exe 47 PID 1748 wrote to memory of 904 1748 RtDCpl64.exe 47 PID 1748 wrote to memory of 904 1748 RtDCpl64.exe 47 PID 1748 wrote to memory of 1484 1748 RtDCpl64.exe 48 PID 1748 wrote to memory of 1484 1748 RtDCpl64.exe 48 PID 1748 wrote to memory of 1484 1748 RtDCpl64.exe 48 PID 1748 wrote to memory of 1484 1748 RtDCpl64.exe 48 PID 1748 wrote to memory of 1484 1748 RtDCpl64.exe 48 PID 1748 wrote to memory of 1484 1748 RtDCpl64.exe 48 PID 1484 wrote to memory of 2444 1484 RtDCpl64.exe 49 PID 1484 wrote to memory of 2444 1484 RtDCpl64.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\264615ddcc134286d464215b5ed2e030N.exe"C:\Users\Admin\AppData\Local\Temp\264615ddcc134286d464215b5ed2e030N.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:2084
-
-
-
C:\Users\Admin\AppData\Local\Temp\264615ddcc134286d464215b5ed2e030N.exe"C:\Users\Admin\AppData\Local\Temp\264615ddcc134286d464215b5ed2e030N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2768
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2664
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {7774789E-7227-4D74-B488-39F43CBAA981} S-1-5-21-1385883288-3042840365-2734249351-1000:RPXOCQRF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1188
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1920
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1940
-
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:904
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2444
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2892
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5aae2750bad6d3dbfdbb0f65ea468152e
SHA1736e5788d9a477cad9b15c2c355a40367a4f7e20
SHA256d80d13982b12ff1b653393710c0b1145b8050bb88d5250d5a5ff6cafcb814313
SHA512c60c7237a8f2e707e1dbb7b4e940285c0a62f328ab3b77de3ed16f9a69475a8c13c64dcefbf1b0b4511f10865b0ac28ba63a538515a6696117e1c50ef820dd26
-
Filesize
132KB
MD56087bf6af59b9c531f2c9bb421d5e902
SHA18bc0f1596c986179b82585c703bacae6d2a00316
SHA2563a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292