Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 19:19
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe
Resource
win10v2004-20240802-en
General
-
Target
INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe
-
Size
596KB
-
MD5
bf3859ec3e62336825a3a771cab003d7
-
SHA1
b1b10e05ee0ad49b262e187a1e72d806c2b801df
-
SHA256
3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24
-
SHA512
e23aa6f95903b1b9bca1149b5cd2f9a53050c58639df03eaddaae87b134cad3601f9aaae7946e943730f3022c3fa6649dce5735f3148a205d529ae18337fce52
-
SSDEEP
12288:9r+oHDm3BygOebEJvhqHr6qJZrm7JHp+NMRN+p/wRyTooYkxiNtu:d+wDe9OeOvaeb7iytu
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.zoho.eu - Port:
587 - Username:
[email protected] - Password:
office12#
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
resource yara_rule behavioral2/memory/5040-24-0x0000000000400000-0x000000000041C000-memory.dmp family_snakekeylogger -
Executes dropped EXE 1 IoCs
pid Process 1564 xlo.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xlos = "C:\\Users\\Admin\\AppData\\Roaming\\xlo.exe" reg.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 38 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1564 set thread context of 5040 1564 xlo.exe 104 -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1200 cmd.exe 3232 PING.EXE 1660 cmd.exe 2536 PING.EXE 4092 PING.EXE -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 3232 PING.EXE 2536 PING.EXE 4092 PING.EXE -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 1564 xlo.exe 1564 xlo.exe 5040 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe Token: SeDebugPrivilege 1564 xlo.exe Token: SeDebugPrivilege 5040 InstallUtil.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 3128 wrote to memory of 1200 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 88 PID 3128 wrote to memory of 1200 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 88 PID 3128 wrote to memory of 1200 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 88 PID 1200 wrote to memory of 3232 1200 cmd.exe 90 PID 1200 wrote to memory of 3232 1200 cmd.exe 90 PID 1200 wrote to memory of 3232 1200 cmd.exe 90 PID 3128 wrote to memory of 1660 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 96 PID 3128 wrote to memory of 1660 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 96 PID 3128 wrote to memory of 1660 3128 INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe 96 PID 1660 wrote to memory of 2536 1660 cmd.exe 98 PID 1660 wrote to memory of 2536 1660 cmd.exe 98 PID 1660 wrote to memory of 2536 1660 cmd.exe 98 PID 1200 wrote to memory of 4272 1200 cmd.exe 100 PID 1200 wrote to memory of 4272 1200 cmd.exe 100 PID 1200 wrote to memory of 4272 1200 cmd.exe 100 PID 1660 wrote to memory of 4092 1660 cmd.exe 102 PID 1660 wrote to memory of 4092 1660 cmd.exe 102 PID 1660 wrote to memory of 4092 1660 cmd.exe 102 PID 1660 wrote to memory of 1564 1660 cmd.exe 103 PID 1660 wrote to memory of 1564 1660 cmd.exe 103 PID 1660 wrote to memory of 1564 1660 cmd.exe 103 PID 1564 wrote to memory of 5040 1564 xlo.exe 104 PID 1564 wrote to memory of 5040 1564 xlo.exe 104 PID 1564 wrote to memory of 5040 1564 xlo.exe 104 PID 1564 wrote to memory of 5040 1564 xlo.exe 104 PID 1564 wrote to memory of 5040 1564 xlo.exe 104 PID 1564 wrote to memory of 5040 1564 xlo.exe 104 PID 1564 wrote to memory of 5040 1564 xlo.exe 104 PID 1564 wrote to memory of 5040 1564 xlo.exe 104 PID 5040 wrote to memory of 3608 5040 InstallUtil.exe 105 PID 5040 wrote to memory of 3608 5040 InstallUtil.exe 105 PID 5040 wrote to memory of 3608 5040 InstallUtil.exe 105 PID 3608 wrote to memory of 1848 3608 cmd.exe 107 PID 3608 wrote to memory of 1848 3608 cmd.exe 107 PID 3608 wrote to memory of 1848 3608 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 28 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "xlos" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\xlo.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 283⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3232
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "xlos" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\xlo.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4272
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 29 > nul && copy "C:\Users\Admin\AppData\Local\Temp\INQUIRY_46789_JULY24_Waagner-Biro_Bridge_Gulf_PDF.exe" "C:\Users\Admin\AppData\Roaming\xlo.exe" && ping 127.0.0.1 -n 29 > nul && "C:\Users\Admin\AppData\Roaming\xlo.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 293⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2536
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 293⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4092
-
-
C:\Users\Admin\AppData\Roaming\xlo.exe"C:\Users\Admin\AppData\Roaming\xlo.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 36⤵
- System Location Discovery: System Language Discovery
PID:1848
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
596KB
MD5bf3859ec3e62336825a3a771cab003d7
SHA1b1b10e05ee0ad49b262e187a1e72d806c2b801df
SHA2563ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24
SHA512e23aa6f95903b1b9bca1149b5cd2f9a53050c58639df03eaddaae87b134cad3601f9aaae7946e943730f3022c3fa6649dce5735f3148a205d529ae18337fce52