Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/09/2024, 01:26

General

  • Target

    a0add2ff01fd0b1c7a259a9b0f0bdee713a7edbbf12fa18820fc95a373254e3b.exe

  • Size

    216KB

  • MD5

    9a29528b1463ae389bd3e03e4e686a56

  • SHA1

    0cefb61f8615c6ed5606360db20adecdedf4c59c

  • SHA256

    a0add2ff01fd0b1c7a259a9b0f0bdee713a7edbbf12fa18820fc95a373254e3b

  • SHA512

    34743dd19630de9802258476e6c9aacd14b7338c9e1c22c0369e759844b3248570b272c7edbc89079fe5eb8f375c7e2680e71f88ab5b8a4c01ba4d7ef116f9ae

  • SSDEEP

    6144:mebX1UAoZZJAttlJ7VTUEioaTwfyhv3pVdPRigEO:mejOA0ZJutHNI106hfpRhEO

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://46.8.231.109

Attributes
  • url_path

    /c4754d4f680ead72.php

Extracted

Family

vidar

Version

11

Botnet

3a15237aa92dcd8ccca447211fb5fc2a

C2

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

lumma

C2

https://appleboltelwk.shop/api

Signatures

  • Detect Vidar Stealer 13 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Stealc

    Stealc is an infostealer written in C++.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0add2ff01fd0b1c7a259a9b0f0bdee713a7edbbf12fa18820fc95a373254e3b.exe
    "C:\Users\Admin\AppData\Local\Temp\a0add2ff01fd0b1c7a259a9b0f0bdee713a7edbbf12fa18820fc95a373254e3b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Checks computer location settings
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3692
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminFIDGHIIECG.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3172
        • C:\Users\AdminFIDGHIIECG.exe
          "C:\Users\AdminFIDGHIIECG.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4524
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            5⤵
              PID:2924
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2400
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 1348
                6⤵
                • Program crash
                PID:3828
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminDBFIEHDHII.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5040
          • C:\Users\AdminDBFIEHDHII.exe
            "C:\Users\AdminDBFIEHDHII.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3024
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Checks computer location settings
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4548
              • C:\ProgramData\DHCGHDHIDH.exe
                "C:\ProgramData\DHCGHDHIDH.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5056
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:4912
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 1340
                    8⤵
                    • Program crash
                    PID:2168
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 1372
                    8⤵
                    • Program crash
                    PID:3868
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIJEBAECGCBK" & exit
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5040
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 10
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:2804
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2400 -ip 2400
      1⤵
        PID:5092
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4912 -ip 4912
        1⤵
          PID:2624
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4912 -ip 4912
          1⤵
            PID:2532

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\IIJEBAECGCBK\BAAFIJ

            Filesize

            11KB

            MD5

            215af8368351c91a3a17c670aaf73fb5

            SHA1

            4677928c0527b61935830cbb0e2839ba8b42e9ff

            SHA256

            fe928ec69efb9946657cbcae3a3fe35e43e21e816627bbbf4228d0daa1b35073

            SHA512

            60f330bc43eaea1b0f5f6346c9b20dba86b9386fd197df2e25a3c7c5a72470ce33cb5ff0f199b38a2662bc1ef2296cfb1396848a28926bbb933fd86415917c3e

          • C:\ProgramData\IIJEBAECGCBK\DAECGC

            Filesize

            116KB

            MD5

            f70aa3fa04f0536280f872ad17973c3d

            SHA1

            50a7b889329a92de1b272d0ecf5fce87395d3123

            SHA256

            8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

            SHA512

            30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

          • C:\ProgramData\IIJEBAECGCBK\EHJKKK

            Filesize

            114KB

            MD5

            242b4242b3c1119f1fb55afbbdd24105

            SHA1

            e1d9c1ed860b67b926fe18206038cd10f77b9c55

            SHA256

            2d0e57c642cc32f10e77a73015075c2d03276dd58689944b01139b2bde8a62a1

            SHA512

            7d1e08dc0cf5e241bcfe3be058a7879b530646726c018bc51cc4821a7a41121bcda6fbfdeeca563e3b6b5e7035bdd717781169c3fdbd2c74933390aa9450c684

          • C:\ProgramData\freebl3.dll

            Filesize

            669KB

            MD5

            550686c0ee48c386dfcb40199bd076ac

            SHA1

            ee5134da4d3efcb466081fb6197be5e12a5b22ab

            SHA256

            edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa

            SHA512

            0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

          • C:\ProgramData\mozglue.dll

            Filesize

            593KB

            MD5

            c8fd9be83bc728cc04beffafc2907fe9

            SHA1

            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

            SHA256

            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

            SHA512

            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

          • C:\ProgramData\msvcp140.dll

            Filesize

            439KB

            MD5

            5ff1fca37c466d6723ec67be93b51442

            SHA1

            34cc4e158092083b13d67d6d2bc9e57b798a303b

            SHA256

            5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

            SHA512

            4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

          • C:\ProgramData\nss3.dll

            Filesize

            2.0MB

            MD5

            1cc453cdf74f31e4d913ff9c10acdde2

            SHA1

            6e85eae544d6e965f15fa5c39700fa7202f3aafe

            SHA256

            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

            SHA512

            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

          • C:\ProgramData\softokn3.dll

            Filesize

            251KB

            MD5

            4e52d739c324db8225bd9ab2695f262f

            SHA1

            71c3da43dc5a0d2a1941e874a6d015a071783889

            SHA256

            74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a

            SHA512

            2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

          • C:\ProgramData\vcruntime140.dll

            Filesize

            78KB

            MD5

            a37ee36b536409056a86f50e67777dd7

            SHA1

            1cafa159292aa736fc595fc04e16325b27cd6750

            SHA256

            8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

            SHA512

            3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

          • C:\Users\AdminDBFIEHDHII.exe

            Filesize

            413KB

            MD5

            76b81bbaa929e92a0885267869e62fdf

            SHA1

            16ee3b53fd9d0fe6bd7fc75ac961a21bfd9fae51

            SHA256

            f59f82ea9cbaa95389bbec5f80b427daa2e575c2827eaaede006590810809f9c

            SHA512

            67d4fb8ed2c767871a307c54fddc86fa4df07ccfa943eeb61e6e8960c4038fb8a38118a69cbb7a6364dde6c11fd3139b8c5f91e029a437dad0d39202383ac3cd

          • C:\Users\AdminFIDGHIIECG.exe

            Filesize

            381KB

            MD5

            f5a1956973dce107d4c0b6267ce88870

            SHA1

            79a19513d7c9cff939f2881c4172a05dbaef735b

            SHA256

            7b794c5bdb820791f0359da90a9a4f258412b8feef9c6e6a0411f6aead9d3a04

            SHA512

            f42180c75c0ae8dc083c6fff98a66c0d875fadb400d7945816ea330a54777632a3a7752d3e78b90e45f58ed3d04d6708b1dcea51d82711356e6d14e405a7c579

          • memory/1828-12-0x0000000074CB0000-0x0000000075460000-memory.dmp

            Filesize

            7.7MB

          • memory/1828-1-0x00000000002F0000-0x0000000000328000-memory.dmp

            Filesize

            224KB

          • memory/1828-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

            Filesize

            4KB

          • memory/1828-2-0x0000000074CB0000-0x0000000075460000-memory.dmp

            Filesize

            7.7MB

          • memory/1828-7-0x0000000074CB0000-0x0000000075460000-memory.dmp

            Filesize

            7.7MB

          • memory/2400-105-0x0000000000400000-0x0000000000464000-memory.dmp

            Filesize

            400KB

          • memory/2400-103-0x0000000000400000-0x0000000000464000-memory.dmp

            Filesize

            400KB

          • memory/2400-107-0x0000000000400000-0x0000000000464000-memory.dmp

            Filesize

            400KB

          • memory/3024-108-0x0000000000470000-0x00000000004D8000-memory.dmp

            Filesize

            416KB

          • memory/3692-13-0x0000000061E00000-0x0000000061EF3000-memory.dmp

            Filesize

            972KB

          • memory/3692-100-0x0000000000400000-0x0000000000643000-memory.dmp

            Filesize

            2.3MB

          • memory/3692-10-0x0000000000400000-0x0000000000643000-memory.dmp

            Filesize

            2.3MB

          • memory/3692-11-0x0000000000400000-0x0000000000643000-memory.dmp

            Filesize

            2.3MB

          • memory/3692-5-0x0000000000400000-0x0000000000643000-memory.dmp

            Filesize

            2.3MB

          • memory/4524-110-0x0000000072E50000-0x0000000073600000-memory.dmp

            Filesize

            7.7MB

          • memory/4524-93-0x0000000072E50000-0x0000000073600000-memory.dmp

            Filesize

            7.7MB

          • memory/4524-91-0x0000000072E5E000-0x0000000072E5F000-memory.dmp

            Filesize

            4KB

          • memory/4524-92-0x0000000000360000-0x00000000003C0000-memory.dmp

            Filesize

            384KB

          • memory/4548-113-0x0000000000400000-0x0000000000676000-memory.dmp

            Filesize

            2.5MB

          • memory/4548-144-0x0000000000400000-0x0000000000676000-memory.dmp

            Filesize

            2.5MB

          • memory/4548-160-0x0000000000400000-0x0000000000676000-memory.dmp

            Filesize

            2.5MB

          • memory/4548-161-0x0000000000400000-0x0000000000676000-memory.dmp

            Filesize

            2.5MB

          • memory/4548-129-0x00000000248A0000-0x0000000024AFF000-memory.dmp

            Filesize

            2.4MB

          • memory/4548-128-0x0000000000400000-0x0000000000676000-memory.dmp

            Filesize

            2.5MB

          • memory/4548-117-0x0000000000400000-0x0000000000676000-memory.dmp

            Filesize

            2.5MB

          • memory/4548-127-0x0000000000400000-0x0000000000676000-memory.dmp

            Filesize

            2.5MB

          • memory/4548-143-0x0000000000400000-0x0000000000676000-memory.dmp

            Filesize

            2.5MB

          • memory/4548-191-0x0000000000400000-0x0000000000676000-memory.dmp

            Filesize

            2.5MB

          • memory/4548-192-0x0000000000400000-0x0000000000676000-memory.dmp

            Filesize

            2.5MB

          • memory/4548-115-0x0000000000400000-0x0000000000676000-memory.dmp

            Filesize

            2.5MB

          • memory/4548-199-0x0000000000400000-0x0000000000676000-memory.dmp

            Filesize

            2.5MB

          • memory/4548-200-0x0000000000400000-0x0000000000676000-memory.dmp

            Filesize

            2.5MB