Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/09/2024, 23:05

General

  • Target

    86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe

  • Size

    4.9MB

  • MD5

    32015ffa59e656dea9ca43bc953655f5

  • SHA1

    dc2d352d93c7d5baf01caa82be5ab07f0a472dc2

  • SHA256

    86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8

  • SHA512

    502eca2738943139cb57e884b862aadd052940fe4900ffd46f60f735273bb02a74d51b33dbc6e2a89765be3b4234f47f3056fddb13651f27f7ec77ec943148be

  • SSDEEP

    98304:6ikaW9Vf1T25iCHZWqqVN9iUf4B7iHw3EItOOaQ1+5PxPU:/8hC53q79iz779U5+

Malware Config

Extracted

Family

gozi

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 1 IoCs
  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe
    "C:\Users\Admin\AppData\Local\Temp\86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c netsh int ip delete addr 1 142.171.156.37
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4124
      • C:\Windows\SysWOW64\netsh.exe
        netsh int ip delete addr 1 142.171.156.37
        3⤵
          PID:2896
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 142.171.156.38
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3984
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 142.171.156.38
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4864
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 107.173.181.10
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:668
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 107.173.181.10
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2420
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 172.245.81.183
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1100
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 172.245.81.183
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3492
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 119.23.226.242
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4388
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 119.23.226.242
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2952
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 107.173.164.86
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:612
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 107.173.164.86
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3948
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 142.171.156.35
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:464
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 142.171.156.35
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4892
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 142.171.156.36
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4988
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 142.171.156.36
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4360
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 104.168.13.130
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4972
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 104.168.13.130
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:2556
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 107.148.43.234
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 107.148.43.234
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:456
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 23.94.59.195
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:536
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 23.94.59.195
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3588
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 198.46.235.16
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4076
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 198.46.235.16
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2620
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 119.23.226.242
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3392
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 119.23.226.242
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:4492
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 172.245.79.53
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4252
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 172.245.79.53
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:2228
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 142.171.156.38
        2⤵
        • System Location Discovery: System Language Discovery
        PID:692
        • C:\Windows\SysWOW64\netsh.exe
          netsh int ip delete addr 1 142.171.156.38
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:1292
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh int ip delete addr 1 119.23.231.153
        2⤵
          PID:3496
          • C:\Windows\SysWOW64\netsh.exe
            netsh int ip delete addr 1 119.23.231.153
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1608
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c netsh int ip delete addr 1 45.248.11.118
          2⤵
          • System Location Discovery: System Language Discovery
          PID:640
          • C:\Windows\SysWOW64\netsh.exe
            netsh int ip delete addr 1 45.248.11.118
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4288
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c netsh int ip delete addr 1 198.46.251.179
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1984
          • C:\Windows\SysWOW64\netsh.exe
            netsh int ip delete addr 1 198.46.251.179
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:1408
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c netsh int ip delete addr 1 107.174.67.185
          2⤵
          • System Location Discovery: System Language Discovery
          PID:412
          • C:\Windows\SysWOW64\netsh.exe
            netsh int ip delete addr 1 107.174.67.185
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2276
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c netsh int ip delete addr 1 101.37.166.183
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1472
          • C:\Windows\SysWOW64\netsh.exe
            netsh int ip delete addr 1 101.37.166.183
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:2552
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c netsh int ip delete addr 1 23.94.122.207
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1768
          • C:\Windows\SysWOW64\netsh.exe
            netsh int ip delete addr 1 23.94.122.207
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1612
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c netsh int ip delete addr 1 107.174.66.181
          2⤵
          • System Location Discovery: System Language Discovery
          PID:5044
          • C:\Windows\SysWOW64\netsh.exe
            netsh int ip delete addr 1 107.174.66.181
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4380
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c netsh int ip delete addr 1 8.141.85.57
          2⤵
            PID:2488
            • C:\Windows\SysWOW64\netsh.exe
              netsh int ip delete addr 1 8.141.85.57
              3⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:1892
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c netsh int ip delete addr 1 8.141.95.146
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2672
            • C:\Windows\SysWOW64\netsh.exe
              netsh int ip delete addr 1 8.141.95.146
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3028
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c netsh int ip delete addr 1 8.137.102.250
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4404
            • C:\Windows\SysWOW64\netsh.exe
              netsh int ip delete addr 1 8.137.102.250
              3⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:2020
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c netsh int ip delete addr 1 198.46.131.29
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3728
            • C:\Windows\SysWOW64\netsh.exe
              netsh int ip delete addr 1 198.46.131.29
              3⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:2556
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c netsh int ip delete addr 1 23.94.136.193
            2⤵
              PID:3532
              • C:\Windows\SysWOW64\netsh.exe
                netsh int ip delete addr 1 23.94.136.193
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2468
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c netsh int ip delete addr 1 47.97.170.38
              2⤵
                PID:2960
                • C:\Windows\SysWOW64\netsh.exe
                  netsh int ip delete addr 1 47.97.170.38
                  3⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:4900
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c netsh int ip delete addr 1 47.109.24.161
                2⤵
                  PID:4688
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh int ip delete addr 1 47.109.24.161
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2324
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c netsh int ip delete addr 1 111.68.8.29
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:2288
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh int ip delete addr 1 111.68.8.29
                    3⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:3144
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c netsh int ip delete addr 1 199.15.77.140
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1700
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh int ip delete addr 1 199.15.77.140
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2840
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c netsh int ip delete addr 1 45.248.10.237
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:2724
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh int ip delete addr 1 45.248.10.237
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:1360
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c netsh int ip delete addr 1 103.36.167.56
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:4520
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh int ip delete addr 1 103.36.167.56
                    3⤵
                      PID:1620
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c netsh int ip delete addr 1 103.57.248.57
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:4084
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh int ip delete addr 1 103.57.248.57
                      3⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      PID:2420
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c netsh int ip delete addr 1 193.124.0.99
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:5112
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh int ip delete addr 1 193.124.0.99
                      3⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:3492
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c netsh int ip delete addr 1 36.134.129.18
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:548
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh int ip delete addr 1 36.134.129.18
                      3⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:4380
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c netsh int ip delete addr 1 103.194.184.122
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1572
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh int ip delete addr 1 103.194.184.122
                      3⤵
                        PID:4364
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c netsh int ip delete addr 1 47.121.190.173
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:3664
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh int ip delete addr 1 47.121.190.173
                        3⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:3988
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c netsh int ip delete addr 1 111.68.8.29
                      2⤵
                        PID:2240
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh int ip delete addr 1 111.68.8.29
                          3⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:4496
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c netsh int ip delete addr 1 199.15.77.140
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:4560
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh int ip delete addr 1 199.15.77.140
                          3⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          PID:2152
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c netsh int ip delete addr 1 45.248.10.237
                        2⤵
                          PID:456
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh int ip delete addr 1 45.248.10.237
                            3⤵
                            • Event Triggered Execution: Netsh Helper DLL
                            PID:1416
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c netsh int ip delete addr 1 103.36.167.56
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:452
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh int ip delete addr 1 103.36.167.56
                            3⤵
                            • Event Triggered Execution: Netsh Helper DLL
                            • System Location Discovery: System Language Discovery
                            PID:4804
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c netsh int ip delete addr 1 103.57.248.57
                          2⤵
                            PID:1088
                            • C:\Windows\SysWOW64\netsh.exe
                              netsh int ip delete addr 1 103.57.248.57
                              3⤵
                              • Event Triggered Execution: Netsh Helper DLL
                              PID:2620
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c netsh int ip delete addr 1 193.124.0.99
                            2⤵
                              PID:716
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh int ip delete addr 1 193.124.0.99
                                3⤵
                                • Event Triggered Execution: Netsh Helper DLL
                                • System Location Discovery: System Language Discovery
                                PID:3124
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c netsh int ip delete addr 1 36.134.129.18
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:1728
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh int ip delete addr 1 36.134.129.18
                                3⤵
                                • Event Triggered Execution: Netsh Helper DLL
                                PID:3548

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • memory/2520-0-0x00000000004BB000-0x00000000006F3000-memory.dmp

                            Filesize

                            2.2MB

                          • memory/2520-1-0x0000000000B80000-0x0000000000B81000-memory.dmp

                            Filesize

                            4KB

                          • memory/2520-3-0x0000000010000000-0x0000000010024000-memory.dmp

                            Filesize

                            144KB

                          • memory/2520-2-0x0000000000400000-0x0000000000900000-memory.dmp

                            Filesize

                            5.0MB

                          • memory/2520-4-0x0000000000400000-0x0000000000900000-memory.dmp

                            Filesize

                            5.0MB

                          • memory/2520-5-0x00000000004BB000-0x00000000006F3000-memory.dmp

                            Filesize

                            2.2MB