Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2024, 23:45

General

  • Target

    file.exe

  • Size

    292KB

  • MD5

    0c4b826cab211945649ac4bbb0c48c6b

  • SHA1

    fe0132f85b63833f55a41651fcc0f32c1c96124d

  • SHA256

    41b381e462f4108957fbab888701dfb9e605621507f8dd2d3f71a32b429c5f0c

  • SHA512

    6e4ea6a514002c61cadfea41ae6aa9e81178570dbae5f78b79e95f654dc6c7716a8f98b812c805ad45423f0e657fab260492e46b2e6bb45d25520d933dc27363

  • SSDEEP

    6144:D8zag1zxFKmMqtXpA8dI41MwJckA3/l6ah4LXeofOdLBhShSpk+JEO:OjNxjXrX1z1845DdfCLBxZEO

Malware Config

Extracted

Family

vidar

C2

https://t.me/edm0d

https://steamcommunity.com/profiles/76561199768374681

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Extracted

Family

lumma

C2

https://questionmwq.shop/api

https://chickerkuso.shop/api

https://achievenmtynwjq.shop/api

https://puredoffustow.shop/api

https://opponnentduei.shop/api

https://metallygaricwo.shop/api

https://milldymarskwom.shop/api

https://quotamkdsdqo.shop/api

https://carrtychaintnyw.shop/api

Signatures

  • Detect Vidar Stealer 22 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\ProgramData\EHJDHJKFIE.exe
        "C:\ProgramData\EHJDHJKFIE.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3004
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:2260
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:836
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              PID:632
          • C:\ProgramData\GDGHJEHJJD.exe
            "C:\ProgramData\GDGHJEHJJD.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2364
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:2200
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BFCFBKKKFHCF" & exit
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2800
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 10
              4⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:2580

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\DHIEHIIEHIEH\HCGCAA

        Filesize

        148KB

        MD5

        90a1d4b55edf36fa8b4cc6974ed7d4c4

        SHA1

        aba1b8d0e05421e7df5982899f626211c3c4b5c1

        SHA256

        7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

        SHA512

        ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

        Filesize

        471B

        MD5

        e4c9c228deb34fd1cfe809ad5d511938

        SHA1

        8bc49f78d86ba765d25d13e40dfeaa719c5cd6a4

        SHA256

        fb5db2210730bc192f671fa5786693678ea904d914aab03d09232a1c07acd5b5

        SHA512

        41f2e064008763af4512292d784daf27300b857add60dc5417bb6a9389e80b6863681d00e3e67b62686962c8f0f9afd7311ed028dc2f59e1d73174432ead1b69

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        fcdef6ac1bd03c73269e5fe7aa98aad2

        SHA1

        bde12ccb2ad44327afdf7e5998a5d8b97871a9ed

        SHA256

        19605028d116537d5e466e6baa37536b62178b2f668c808d25e6e69d186bd198

        SHA512

        62ab8b60f686ff15ea9d7990f8f49333645022c853a69a31cda9f15489c7d2441ce2fb9321f042e2be41b0ae363e8aadf55abe01c77eaf31e1e80b555dd17c71

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

        Filesize

        400B

        MD5

        5ae62f7f9da4343cd21aaad86c3501f1

        SHA1

        027937f56d354d63cd0f80f295f4166b6bd9cc55

        SHA256

        84344794c11258027bd7f46fb385b8dcb12a7e23dac4b771b0cb01447ec6ac93

        SHA512

        d06d124e4f7f89203edcdd2cca87cc4c2a98ffe79339660b86a4d285ca9753611f31a83eec7affef12ebb83de9bb5d967c7bf15903d6b828e92c58ae278ad0fc

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40WV1DY9\76561199768374681[1].htm

        Filesize

        33KB

        MD5

        108ef984013d36a48ce1d38dca7c147e

        SHA1

        56b0f8f9b2f18470e675b9b689e94aba360fb2ac

        SHA256

        7ce59f85ad964b4b4203415fbbdf9dbcda8fcc34f3addd0c0e9c3846adc2a2aa

        SHA512

        03cc8713e9be93d718b9297f07826b07386d9c10af45779757e026ab8ebafdfce2c370ed51a1e50da14b1a456858b184bfc4fb5f8eac0a2968104afca53b5c41

      • C:\Users\Admin\AppData\Local\Temp\Cab48E4.tmp

        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      • C:\Users\Admin\AppData\Local\Temp\Tar48F7.tmp

        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

      • \ProgramData\EHJDHJKFIE.exe

        Filesize

        354KB

        MD5

        384a847ad2833788fa253433fd2eea8d

        SHA1

        1984d8788fe40bd95a90d7d4e9dea6c4e4ff6201

        SHA256

        de30491736617249b3e80fc9436ecf0f7675b3c3014509398c3db7298f93336a

        SHA512

        bcdbd44837629d8881c29a7c7f6a2d4e98b52fbc49952bad2c89340a1dee18fac9987aaa8a3d91905a1f88a216c0e2501201a8665f3df7d5f627ff71a2418aac

      • \ProgramData\GDGHJEHJJD.exe

        Filesize

        292KB

        MD5

        4a8a0ccfecc930091116324c79c1006e

        SHA1

        d790befcbc31a4befafeaf08879e15f99633b2a1

        SHA256

        146b7006b041d25b6846c797234f38387ec4b141c4a7e4f100d0e6d2eda29088

        SHA512

        ffef04766c2a9f9d038ccf6156ac7f03a0e0809adaf245a1347e5ece6ad31f9b37f283d71d34c031350456f30036078d5a3e97fa563bf6af6a8fcf6edeeb25d2

      • \ProgramData\mozglue.dll

        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      • \ProgramData\nss3.dll

        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      • memory/632-551-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

      • memory/632-557-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

      • memory/632-559-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

      • memory/632-553-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

      • memory/632-556-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

      • memory/632-555-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/632-545-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

      • memory/632-549-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

      • memory/632-547-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

      • memory/2200-604-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2200-594-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2200-751-0x000000001DD30000-0x000000001DF8F000-memory.dmp

        Filesize

        2.4MB

      • memory/2200-606-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2200-732-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2200-713-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2200-603-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2200-600-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2200-592-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2200-598-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2200-596-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2364-536-0x0000000000D80000-0x0000000000DCA000-memory.dmp

        Filesize

        296KB

      • memory/2640-14-0x00000000744E0000-0x0000000074BCE000-memory.dmp

        Filesize

        6.9MB

      • memory/2640-4-0x00000000744E0000-0x0000000074BCE000-memory.dmp

        Filesize

        6.9MB

      • memory/2640-2-0x00000000744E0000-0x0000000074BCE000-memory.dmp

        Filesize

        6.9MB

      • memory/2640-0-0x00000000744EE000-0x00000000744EF000-memory.dmp

        Filesize

        4KB

      • memory/2640-1-0x0000000000850000-0x000000000089A000-memory.dmp

        Filesize

        296KB

      • memory/2788-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2788-7-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-231-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-6-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-8-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-10-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-13-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-18-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-212-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-17-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-159-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-198-0x0000000020A60000-0x0000000020CBF000-memory.dmp

        Filesize

        2.4MB

      • memory/2788-362-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-381-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-178-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-5-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-9-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-443-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/2788-424-0x0000000000400000-0x0000000000657000-memory.dmp

        Filesize

        2.3MB

      • memory/3004-497-0x0000000072D9E000-0x0000000072D9F000-memory.dmp

        Filesize

        4KB

      • memory/3004-498-0x0000000000850000-0x00000000008AA000-memory.dmp

        Filesize

        360KB

      • memory/3004-499-0x0000000072D90000-0x000000007347E000-memory.dmp

        Filesize

        6.9MB

      • memory/3004-560-0x0000000072D90000-0x000000007347E000-memory.dmp

        Filesize

        6.9MB