Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 20:04
Static task
static1
Behavioral task
behavioral1
Sample
3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe
Resource
win10v2004-20240802-en
General
-
Target
3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe
-
Size
596KB
-
MD5
bf3859ec3e62336825a3a771cab003d7
-
SHA1
b1b10e05ee0ad49b262e187a1e72d806c2b801df
-
SHA256
3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24
-
SHA512
e23aa6f95903b1b9bca1149b5cd2f9a53050c58639df03eaddaae87b134cad3601f9aaae7946e943730f3022c3fa6649dce5735f3148a205d529ae18337fce52
-
SSDEEP
12288:9r+oHDm3BygOebEJvhqHr6qJZrm7JHp+NMRN+p/wRyTooYkxiNtu:d+wDe9OeOvaeb7iytu
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.zoho.eu - Port:
587 - Username:
[email protected] - Password:
office12#
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
resource yara_rule behavioral2/memory/928-24-0x0000000000400000-0x000000000041C000-memory.dmp family_snakekeylogger -
Executes dropped EXE 1 IoCs
pid Process 3456 xlo.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xlos = "C:\\Users\\Admin\\AppData\\Roaming\\xlo.exe" reg.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 42 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3456 set thread context of 928 3456 xlo.exe 104 -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2508 cmd.exe 3356 PING.EXE 4468 cmd.exe 4932 PING.EXE 1340 PING.EXE -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 3356 PING.EXE 4932 PING.EXE 1340 PING.EXE -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 3456 xlo.exe 3456 xlo.exe 928 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe Token: SeDebugPrivilege 3456 xlo.exe Token: SeDebugPrivilege 928 InstallUtil.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 4884 wrote to memory of 2508 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 88 PID 4884 wrote to memory of 2508 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 88 PID 4884 wrote to memory of 2508 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 88 PID 2508 wrote to memory of 3356 2508 cmd.exe 90 PID 2508 wrote to memory of 3356 2508 cmd.exe 90 PID 2508 wrote to memory of 3356 2508 cmd.exe 90 PID 4884 wrote to memory of 4468 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 96 PID 4884 wrote to memory of 4468 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 96 PID 4884 wrote to memory of 4468 4884 3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe 96 PID 4468 wrote to memory of 4932 4468 cmd.exe 98 PID 4468 wrote to memory of 4932 4468 cmd.exe 98 PID 4468 wrote to memory of 4932 4468 cmd.exe 98 PID 2508 wrote to memory of 4464 2508 cmd.exe 100 PID 2508 wrote to memory of 4464 2508 cmd.exe 100 PID 2508 wrote to memory of 4464 2508 cmd.exe 100 PID 4468 wrote to memory of 1340 4468 cmd.exe 102 PID 4468 wrote to memory of 1340 4468 cmd.exe 102 PID 4468 wrote to memory of 1340 4468 cmd.exe 102 PID 4468 wrote to memory of 3456 4468 cmd.exe 103 PID 4468 wrote to memory of 3456 4468 cmd.exe 103 PID 4468 wrote to memory of 3456 4468 cmd.exe 103 PID 3456 wrote to memory of 928 3456 xlo.exe 104 PID 3456 wrote to memory of 928 3456 xlo.exe 104 PID 3456 wrote to memory of 928 3456 xlo.exe 104 PID 3456 wrote to memory of 928 3456 xlo.exe 104 PID 3456 wrote to memory of 928 3456 xlo.exe 104 PID 3456 wrote to memory of 928 3456 xlo.exe 104 PID 3456 wrote to memory of 928 3456 xlo.exe 104 PID 3456 wrote to memory of 928 3456 xlo.exe 104 PID 928 wrote to memory of 1232 928 InstallUtil.exe 105 PID 928 wrote to memory of 1232 928 InstallUtil.exe 105 PID 928 wrote to memory of 1232 928 InstallUtil.exe 105 PID 1232 wrote to memory of 4944 1232 cmd.exe 107 PID 1232 wrote to memory of 4944 1232 cmd.exe 107 PID 1232 wrote to memory of 4944 1232 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe"C:\Users\Admin\AppData\Local\Temp\3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 29 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "xlos" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\xlo.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 293⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3356
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "xlos" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\xlo.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4464
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 34 > nul && copy "C:\Users\Admin\AppData\Local\Temp\3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe" "C:\Users\Admin\AppData\Roaming\xlo.exe" && ping 127.0.0.1 -n 34 > nul && "C:\Users\Admin\AppData\Roaming\xlo.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 343⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4932
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 343⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1340
-
-
C:\Users\Admin\AppData\Roaming\xlo.exe"C:\Users\Admin\AppData\Roaming\xlo.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 36⤵
- System Location Discovery: System Language Discovery
PID:4944
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
596KB
MD5bf3859ec3e62336825a3a771cab003d7
SHA1b1b10e05ee0ad49b262e187a1e72d806c2b801df
SHA2563ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24
SHA512e23aa6f95903b1b9bca1149b5cd2f9a53050c58639df03eaddaae87b134cad3601f9aaae7946e943730f3022c3fa6649dce5735f3148a205d529ae18337fce52