Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 09:31
Static task
static1
Behavioral task
behavioral1
Sample
4ac138770d03156be9e06ae8b15c1db7.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4ac138770d03156be9e06ae8b15c1db7.exe
Resource
win10v2004-20240802-en
General
-
Target
4ac138770d03156be9e06ae8b15c1db7.exe
-
Size
337KB
-
MD5
4ac138770d03156be9e06ae8b15c1db7
-
SHA1
43b48c74f3add50868ac8fe1272f15373a35ad4b
-
SHA256
dbef01c75b62431ede6a2b2b1e595771c71b4782700094048fc98b86c0e4fbac
-
SHA512
7cd6c64aa080e49511abb33027bef723ccbd21a30e09b05326e25d9d4efb8fa4aee9d1324bf758120ecfead39a9883dd56fe72406048aa259a7afe35b54f397e
-
SSDEEP
3072:0Rb8x8w8spF105inBx3mTvld6Cge4Nkz7RSx/iQ46oE6Tv6:0Z8Ow8GFC5W3mTvWChzlS41Rm
Malware Config
Extracted
raccoon
970bd7b21ef58eba844bcc1b35da559a
http://193.187.174.250:80/
http://176.113.115.103:80/
-
user_agent
MrBidenNeverKnow
Signatures
-
Raccoon Stealer V2 payload 5 IoCs
resource yara_rule behavioral1/memory/2432-6-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral1/memory/2432-8-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral1/memory/2432-3-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral1/memory/2516-55-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 behavioral1/memory/2432-56-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon_v2 -
Downloads MZ/PE file
-
Loads dropped DLL 3 IoCs
pid Process 2432 4ac138770d03156be9e06ae8b15c1db7.exe 2432 4ac138770d03156be9e06ae8b15c1db7.exe 2432 4ac138770d03156be9e06ae8b15c1db7.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 1852 set thread context of 2432 1852 4ac138770d03156be9e06ae8b15c1db7.exe 28 PID 1852 set thread context of 2516 1852 4ac138770d03156be9e06ae8b15c1db7.exe 30 PID 1852 set thread context of 2512 1852 4ac138770d03156be9e06ae8b15c1db7.exe 31 PID 1852 set thread context of 1144 1852 4ac138770d03156be9e06ae8b15c1db7.exe 34 PID 1852 set thread context of 2256 1852 4ac138770d03156be9e06ae8b15c1db7.exe 35 PID 1852 set thread context of 2276 1852 4ac138770d03156be9e06ae8b15c1db7.exe 36 PID 1852 set thread context of 1244 1852 4ac138770d03156be9e06ae8b15c1db7.exe 37 PID 1852 set thread context of 1948 1852 4ac138770d03156be9e06ae8b15c1db7.exe 38 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ac138770d03156be9e06ae8b15c1db7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ac138770d03156be9e06ae8b15c1db7.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2432 4ac138770d03156be9e06ae8b15c1db7.exe 2432 4ac138770d03156be9e06ae8b15c1db7.exe 2432 4ac138770d03156be9e06ae8b15c1db7.exe 2432 4ac138770d03156be9e06ae8b15c1db7.exe 2432 4ac138770d03156be9e06ae8b15c1db7.exe 2432 4ac138770d03156be9e06ae8b15c1db7.exe 2432 4ac138770d03156be9e06ae8b15c1db7.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2432 1852 4ac138770d03156be9e06ae8b15c1db7.exe 28 PID 1852 wrote to memory of 2432 1852 4ac138770d03156be9e06ae8b15c1db7.exe 28 PID 1852 wrote to memory of 2432 1852 4ac138770d03156be9e06ae8b15c1db7.exe 28 PID 1852 wrote to memory of 2432 1852 4ac138770d03156be9e06ae8b15c1db7.exe 28 PID 1852 wrote to memory of 2432 1852 4ac138770d03156be9e06ae8b15c1db7.exe 28 PID 1852 wrote to memory of 2432 1852 4ac138770d03156be9e06ae8b15c1db7.exe 28 PID 1852 wrote to memory of 2432 1852 4ac138770d03156be9e06ae8b15c1db7.exe 28 PID 1852 wrote to memory of 2432 1852 4ac138770d03156be9e06ae8b15c1db7.exe 28 PID 1852 wrote to memory of 2432 1852 4ac138770d03156be9e06ae8b15c1db7.exe 28 PID 1852 wrote to memory of 2516 1852 4ac138770d03156be9e06ae8b15c1db7.exe 30 PID 1852 wrote to memory of 2516 1852 4ac138770d03156be9e06ae8b15c1db7.exe 30 PID 1852 wrote to memory of 2516 1852 4ac138770d03156be9e06ae8b15c1db7.exe 30 PID 1852 wrote to memory of 2516 1852 4ac138770d03156be9e06ae8b15c1db7.exe 30 PID 1852 wrote to memory of 2516 1852 4ac138770d03156be9e06ae8b15c1db7.exe 30 PID 1852 wrote to memory of 2516 1852 4ac138770d03156be9e06ae8b15c1db7.exe 30 PID 1852 wrote to memory of 2516 1852 4ac138770d03156be9e06ae8b15c1db7.exe 30 PID 1852 wrote to memory of 2516 1852 4ac138770d03156be9e06ae8b15c1db7.exe 30 PID 1852 wrote to memory of 2516 1852 4ac138770d03156be9e06ae8b15c1db7.exe 30 PID 1852 wrote to memory of 2512 1852 4ac138770d03156be9e06ae8b15c1db7.exe 31 PID 1852 wrote to memory of 2512 1852 4ac138770d03156be9e06ae8b15c1db7.exe 31 PID 1852 wrote to memory of 2512 1852 4ac138770d03156be9e06ae8b15c1db7.exe 31 PID 1852 wrote to memory of 2512 1852 4ac138770d03156be9e06ae8b15c1db7.exe 31 PID 1852 wrote to memory of 2512 1852 4ac138770d03156be9e06ae8b15c1db7.exe 31 PID 1852 wrote to memory of 2512 1852 4ac138770d03156be9e06ae8b15c1db7.exe 31 PID 1852 wrote to memory of 2512 1852 4ac138770d03156be9e06ae8b15c1db7.exe 31 PID 1852 wrote to memory of 2512 1852 4ac138770d03156be9e06ae8b15c1db7.exe 31 PID 1852 wrote to memory of 2512 1852 4ac138770d03156be9e06ae8b15c1db7.exe 31 PID 1852 wrote to memory of 1144 1852 4ac138770d03156be9e06ae8b15c1db7.exe 34 PID 1852 wrote to memory of 1144 1852 4ac138770d03156be9e06ae8b15c1db7.exe 34 PID 1852 wrote to memory of 1144 1852 4ac138770d03156be9e06ae8b15c1db7.exe 34 PID 1852 wrote to memory of 1144 1852 4ac138770d03156be9e06ae8b15c1db7.exe 34 PID 1852 wrote to memory of 1144 1852 4ac138770d03156be9e06ae8b15c1db7.exe 34 PID 1852 wrote to memory of 1144 1852 4ac138770d03156be9e06ae8b15c1db7.exe 34 PID 1852 wrote to memory of 1144 1852 4ac138770d03156be9e06ae8b15c1db7.exe 34 PID 1852 wrote to memory of 1144 1852 4ac138770d03156be9e06ae8b15c1db7.exe 34 PID 1852 wrote to memory of 1144 1852 4ac138770d03156be9e06ae8b15c1db7.exe 34 PID 1852 wrote to memory of 2256 1852 4ac138770d03156be9e06ae8b15c1db7.exe 35 PID 1852 wrote to memory of 2256 1852 4ac138770d03156be9e06ae8b15c1db7.exe 35 PID 1852 wrote to memory of 2256 1852 4ac138770d03156be9e06ae8b15c1db7.exe 35 PID 1852 wrote to memory of 2256 1852 4ac138770d03156be9e06ae8b15c1db7.exe 35 PID 1852 wrote to memory of 2256 1852 4ac138770d03156be9e06ae8b15c1db7.exe 35 PID 1852 wrote to memory of 2256 1852 4ac138770d03156be9e06ae8b15c1db7.exe 35 PID 1852 wrote to memory of 2256 1852 4ac138770d03156be9e06ae8b15c1db7.exe 35 PID 1852 wrote to memory of 2256 1852 4ac138770d03156be9e06ae8b15c1db7.exe 35 PID 1852 wrote to memory of 2256 1852 4ac138770d03156be9e06ae8b15c1db7.exe 35 PID 1852 wrote to memory of 2276 1852 4ac138770d03156be9e06ae8b15c1db7.exe 36 PID 1852 wrote to memory of 2276 1852 4ac138770d03156be9e06ae8b15c1db7.exe 36 PID 1852 wrote to memory of 2276 1852 4ac138770d03156be9e06ae8b15c1db7.exe 36 PID 1852 wrote to memory of 2276 1852 4ac138770d03156be9e06ae8b15c1db7.exe 36 PID 1852 wrote to memory of 2276 1852 4ac138770d03156be9e06ae8b15c1db7.exe 36 PID 1852 wrote to memory of 2276 1852 4ac138770d03156be9e06ae8b15c1db7.exe 36 PID 1852 wrote to memory of 2276 1852 4ac138770d03156be9e06ae8b15c1db7.exe 36 PID 1852 wrote to memory of 2276 1852 4ac138770d03156be9e06ae8b15c1db7.exe 36 PID 1852 wrote to memory of 2276 1852 4ac138770d03156be9e06ae8b15c1db7.exe 36 PID 1852 wrote to memory of 1244 1852 4ac138770d03156be9e06ae8b15c1db7.exe 37 PID 1852 wrote to memory of 1244 1852 4ac138770d03156be9e06ae8b15c1db7.exe 37 PID 1852 wrote to memory of 1244 1852 4ac138770d03156be9e06ae8b15c1db7.exe 37 PID 1852 wrote to memory of 1244 1852 4ac138770d03156be9e06ae8b15c1db7.exe 37 PID 1852 wrote to memory of 1244 1852 4ac138770d03156be9e06ae8b15c1db7.exe 37 PID 1852 wrote to memory of 1244 1852 4ac138770d03156be9e06ae8b15c1db7.exe 37 PID 1852 wrote to memory of 1244 1852 4ac138770d03156be9e06ae8b15c1db7.exe 37 PID 1852 wrote to memory of 1244 1852 4ac138770d03156be9e06ae8b15c1db7.exe 37 PID 1852 wrote to memory of 1244 1852 4ac138770d03156be9e06ae8b15c1db7.exe 37 PID 1852 wrote to memory of 1948 1852 4ac138770d03156be9e06ae8b15c1db7.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2432
-
-
C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"2⤵PID:2516
-
-
C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"2⤵PID:2512
-
-
C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"2⤵PID:1144
-
-
C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"2⤵PID:2256
-
-
C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"2⤵PID:2276
-
-
C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"2⤵PID:1244
-
-
C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"C:\Users\Admin\AppData\Local\Temp\4ac138770d03156be9e06ae8b15c1db7.exe"2⤵PID:1948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5f98745d81e8b84f39630844a63afc1ee
SHA1d7977c2dab5de25630f7d869f9b16a8502cd3bb3
SHA2569c34e13f0d2852fb4a8a53a4727a59d24691a507edb6ff1965024a6147799a83
SHA512e6b1bf12139e627d6aa2b25c9d7e8ebab1e86fc3025655bf88bc735413f55b10490f0237b8d11fd5db0eb6045f6176e93228c70d8e940a62ea4324816c31a3dd
-
Filesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
Filesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
Filesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1