Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    99s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2024, 06:39

General

  • Target

    7ad095de4171dfb3458752e1f4406b726ea94327e529fd83e2189b8c04ffee86.exe

  • Size

    292KB

  • MD5

    a714209db1b2b68a95e680df111922ed

  • SHA1

    5533ed29bf3239839e6acf03965cf27ddf4f4138

  • SHA256

    7ad095de4171dfb3458752e1f4406b726ea94327e529fd83e2189b8c04ffee86

  • SHA512

    25ce432979995987a26e9442c2c9ac026d55ff9f4820d983ab30496d28a75dec508c4083b11a2433f5bc3c2f903828ed2849aa5542fc7de84394b44a29fbcf55

  • SSDEEP

    6144:V58+UTYNUsagLAxjDbXxw0HVmjE+IPgkeHeNQZzgSEO:1UTqUsJLunxDVm9IIVOw0SEO

Malware Config

Extracted

Family

vidar

C2

https://t.me/edm0d

https://steamcommunity.com/profiles/76561199768374681

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Extracted

Family

lumma

C2

https://keennylrwmqlw.shop/api

https://licenseodqwmqn.shop/api

https://tendencctywop.shop/api

https://tesecuuweqo.shop/api

https://relaxatinownio.shop/api

https://reggwardssdqw.shop/api

https://eemmbryequo.shop/api

https://tryyudjasudqo.shop/api

Signatures

  • Detect Vidar Stealer 13 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ad095de4171dfb3458752e1f4406b726ea94327e529fd83e2189b8c04ffee86.exe
    "C:\Users\Admin\AppData\Local\Temp\7ad095de4171dfb3458752e1f4406b726ea94327e529fd83e2189b8c04ffee86.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:868
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:5188
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:5196
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
          • Checks computer location settings
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5152
          • C:\ProgramData\CBFBKFIDHI.exe
            "C:\ProgramData\CBFBKFIDHI.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1700
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5264
          • C:\ProgramData\CBFBKFIDHI.exe
            "C:\ProgramData\CBFBKFIDHI.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5024
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2424
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BAAAKJDAAFBA" & exit
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5108
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 10
              4⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:2144

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\CBFBKFIDHI.exe

        Filesize

        352KB

        MD5

        6f4a0ae013610785ad54438f4af26f1a

        SHA1

        c8ff55002963dde8457db2b11f68e67a070ddb21

        SHA256

        ccb16a2e8b58be824d838d5607ecd4b07123de87f9fe9e42e64507d77b0f374d

        SHA512

        6f3a30e8ee4ff36cfaac09bfe1272ed4678783c4628dd82e47dd1ef23d4a8ef1c153a9a4e8951cb38b4c7a833f2bc744dbcc7dac1e550b2f44ffadc8181d8ee3

      • C:\ProgramData\mozglue.dll

        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      • C:\ProgramData\nss3.dll

        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CBFBKFIDHI.exe.log

        Filesize

        226B

        MD5

        916851e072fbabc4796d8916c5131092

        SHA1

        d48a602229a690c512d5fdaf4c8d77547a88e7a2

        SHA256

        7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

        SHA512

        07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

      • memory/868-1-0x0000000000390000-0x00000000003DA000-memory.dmp

        Filesize

        296KB

      • memory/868-2-0x00000000746D0000-0x0000000074E80000-memory.dmp

        Filesize

        7.7MB

      • memory/868-5-0x00000000746D0000-0x0000000074E80000-memory.dmp

        Filesize

        7.7MB

      • memory/868-7-0x00000000746D0000-0x0000000074E80000-memory.dmp

        Filesize

        7.7MB

      • memory/868-0-0x00000000746DE000-0x00000000746DF000-memory.dmp

        Filesize

        4KB

      • memory/1700-121-0x0000000071C10000-0x00000000723C0000-memory.dmp

        Filesize

        7.7MB

      • memory/1700-110-0x0000000071C1E000-0x0000000071C1F000-memory.dmp

        Filesize

        4KB

      • memory/1700-111-0x0000000000DE0000-0x0000000000E3A000-memory.dmp

        Filesize

        360KB

      • memory/1700-112-0x0000000071C10000-0x00000000723C0000-memory.dmp

        Filesize

        7.7MB

      • memory/5152-11-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5152-27-0x0000000022490000-0x00000000226EF000-memory.dmp

        Filesize

        2.4MB

      • memory/5152-59-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5152-43-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5152-84-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5152-85-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5152-92-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5152-93-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5152-42-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5152-60-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5152-26-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5152-25-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5152-4-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5152-10-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/5264-118-0x0000000000400000-0x000000000045C000-memory.dmp

        Filesize

        368KB

      • memory/5264-120-0x0000000000400000-0x000000000045C000-memory.dmp

        Filesize

        368KB

      • memory/5264-116-0x0000000000400000-0x000000000045C000-memory.dmp

        Filesize

        368KB