Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe
-
Size
878KB
-
MD5
0c285a3c76e1f5f981de6282fedf1919
-
SHA1
dc3f467ff13529349090edc5c1a9aa597bd65e41
-
SHA256
d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a
-
SHA512
ac1fe6ac984c63adb12c15c27ca74f2120dfae406a2ba532c29d545ab56739b9ad8915447204e4770cc1d3e822ac0d7271e36c43d71c43e8a4b245878dd5a43d
-
SSDEEP
24576:miGFaq43NvCZXv/+2JujTrlCJREBJ/QOead:miGFu3Nvw3+XdrJ/qad
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
webmail.berkeleyindia.com - Port:
587 - Username:
[email protected] - Password:
2szbiev2pciv
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 2 IoCs
resource yara_rule behavioral2/memory/2660-297-0x00000000004A0000-0x00000000016F4000-memory.dmp family_snakekeylogger behavioral2/memory/2660-300-0x00000000004A0000-0x00000000004C6000-memory.dmp family_snakekeylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe -
Loads dropped DLL 1 IoCs
pid Process 2368 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 29 drive.google.com 28 drive.google.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 41 checkip.dyndns.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2660 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2368 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe 2660 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2368 set thread context of 2660 2368 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe 89 -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\resources\0409\figenkaktusses\Ea40.ini d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe File opened for modification C:\Windows\Fonts\heraclitic.Wom d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe File opened for modification C:\Windows\storsejlenes\blackweed.hor d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe File opened for modification C:\Windows\Arder.lnk d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe File created C:\Windows\Arder.lnk d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2660 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2368 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2660 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2660 2368 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe 89 PID 2368 wrote to memory of 2660 2368 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe 89 PID 2368 wrote to memory of 2660 2368 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe 89 PID 2368 wrote to memory of 2660 2368 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe 89 PID 2368 wrote to memory of 2660 2368 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe 89 PID 2660 wrote to memory of 4484 2660 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe 91 PID 2660 wrote to memory of 4484 2660 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe 91 PID 2660 wrote to memory of 4484 2660 d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe 91 PID 4484 wrote to memory of 2984 4484 cmd.exe 93 PID 4484 wrote to memory of 2984 4484 cmd.exe 93 PID 4484 wrote to memory of 2984 4484 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe"C:\Users\Admin\AppData\Local\Temp\d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe"C:\Users\Admin\AppData\Local\Temp\d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe"2⤵
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\d5dbb09b7ecb1ba95cc42d1757a2e72e0c4bbd86cca5dd43dabf3a0d9425432a.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
- System Location Discovery: System Language Discovery
PID:2984
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD534442e1e0c2870341df55e1b7b3cccdc
SHA199b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA256269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
SHA5124a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
-
Filesize
722B
MD5414c5a6597d948e954a35ac198c779d2
SHA1e98e8d654d519eab73d6e2f645428ffe4a9919b5
SHA256a961e1115e37d5c988779cd452121c1cb6940b0d13f2a17bcdfcef24804aada6
SHA5124af01f7913bd68d2bd469c65da64fbadf8b80dae2e03a39e247238639aed6c8ff3f495070ae8df6881a7419c0bd2072fd7cdcb0691b0c43b1f9a4e02010431bb