Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/10/2024, 04:49
Behavioral task
behavioral1
Sample
3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe
Resource
win10v2004-20241007-en
General
-
Target
3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe
-
Size
1.4MB
-
MD5
0d951819064a22a5f28d902b6d3f9980
-
SHA1
51784b4e39d23a59f0fad33344bdee4b68f7eb52
-
SHA256
3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1
-
SHA512
b92f36521d78326bde3492a43a883eeb524465d3c70263f6d4a9900a3dd96504e569056f99455da6699dd93cee37d915b2f4f07a005b981b8848dbe53ebe45a6
-
SSDEEP
24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYZ:Fo0c++OCokGs9Fa+rd1f26RNYZ
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 15 IoCs
resource yara_rule behavioral1/memory/1680-0-0x00000000002A0000-0x000000000040B000-memory.dmp netwire behavioral1/files/0x0007000000012119-3.dat netwire behavioral1/memory/1776-24-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1680-40-0x00000000033E0000-0x000000000354B000-memory.dmp netwire behavioral1/memory/1680-42-0x00000000002A0000-0x000000000040B000-memory.dmp netwire behavioral1/memory/2408-48-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/files/0x0007000000015f71-50.dat netwire behavioral1/memory/3052-51-0x0000000000F40000-0x00000000010AB000-memory.dmp netwire behavioral1/memory/2932-79-0x0000000000F40000-0x00000000010AB000-memory.dmp netwire behavioral1/memory/3052-80-0x0000000000F40000-0x00000000010AB000-memory.dmp netwire behavioral1/memory/2408-87-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1332-89-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/776-116-0x0000000000F40000-0x00000000010AB000-memory.dmp netwire behavioral1/memory/2084-140-0x0000000000F40000-0x00000000010AB000-memory.dmp netwire behavioral1/memory/2084-158-0x0000000000F40000-0x00000000010AB000-memory.dmp netwire -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 2 IoCs
resource yara_rule behavioral1/memory/2244-39-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2244-29-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat -
Executes dropped EXE 11 IoCs
pid Process 1776 Blasthost.exe 2408 Host.exe 3052 RtDCpl64.exe 1332 Blasthost.exe 2932 RtDCpl64.exe 776 RtDCpl64.exe 1528 Blasthost.exe 1968 RtDCpl64.exe 2084 RtDCpl64.exe 1940 Blasthost.exe 2520 RtDCpl64.exe -
Loads dropped DLL 16 IoCs
pid Process 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 1776 Blasthost.exe 1776 Blasthost.exe 3052 RtDCpl64.exe 3052 RtDCpl64.exe 3052 RtDCpl64.exe 3052 RtDCpl64.exe 776 RtDCpl64.exe 776 RtDCpl64.exe 776 RtDCpl64.exe 2084 RtDCpl64.exe 2084 RtDCpl64.exe 2084 RtDCpl64.exe -
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1680-0-0x00000000002A0000-0x000000000040B000-memory.dmp autoit_exe behavioral1/memory/1680-40-0x00000000033E0000-0x000000000354B000-memory.dmp autoit_exe behavioral1/memory/1680-42-0x00000000002A0000-0x000000000040B000-memory.dmp autoit_exe behavioral1/files/0x0007000000015f71-50.dat autoit_exe behavioral1/memory/3052-51-0x0000000000F40000-0x00000000010AB000-memory.dmp autoit_exe behavioral1/memory/2932-79-0x0000000000F40000-0x00000000010AB000-memory.dmp autoit_exe behavioral1/memory/3052-80-0x0000000000F40000-0x00000000010AB000-memory.dmp autoit_exe behavioral1/memory/776-116-0x0000000000F40000-0x00000000010AB000-memory.dmp autoit_exe behavioral1/memory/2084-140-0x0000000000F40000-0x00000000010AB000-memory.dmp autoit_exe behavioral1/memory/2084-158-0x0000000000F40000-0x00000000010AB000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1680 set thread context of 2244 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 32 PID 3052 set thread context of 2932 3052 RtDCpl64.exe 41 PID 776 set thread context of 1968 776 RtDCpl64.exe 48 PID 2084 set thread context of 2520 2084 RtDCpl64.exe 55 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blasthost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2880 schtasks.exe 1132 schtasks.exe 2376 schtasks.exe 2988 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 1776 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 30 PID 1680 wrote to memory of 1776 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 30 PID 1680 wrote to memory of 1776 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 30 PID 1680 wrote to memory of 1776 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 30 PID 1776 wrote to memory of 2408 1776 Blasthost.exe 31 PID 1776 wrote to memory of 2408 1776 Blasthost.exe 31 PID 1776 wrote to memory of 2408 1776 Blasthost.exe 31 PID 1776 wrote to memory of 2408 1776 Blasthost.exe 31 PID 1680 wrote to memory of 2244 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 32 PID 1680 wrote to memory of 2244 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 32 PID 1680 wrote to memory of 2244 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 32 PID 1680 wrote to memory of 2244 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 32 PID 1680 wrote to memory of 2244 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 32 PID 1680 wrote to memory of 2244 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 32 PID 1680 wrote to memory of 2880 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 33 PID 1680 wrote to memory of 2880 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 33 PID 1680 wrote to memory of 2880 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 33 PID 1680 wrote to memory of 2880 1680 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 33 PID 2244 wrote to memory of 2768 2244 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 35 PID 2244 wrote to memory of 2768 2244 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 35 PID 2244 wrote to memory of 2768 2244 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 35 PID 2244 wrote to memory of 2768 2244 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 35 PID 2244 wrote to memory of 2768 2244 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 35 PID 2244 wrote to memory of 2768 2244 3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe 35 PID 2680 wrote to memory of 3052 2680 taskeng.exe 39 PID 2680 wrote to memory of 3052 2680 taskeng.exe 39 PID 2680 wrote to memory of 3052 2680 taskeng.exe 39 PID 2680 wrote to memory of 3052 2680 taskeng.exe 39 PID 3052 wrote to memory of 1332 3052 RtDCpl64.exe 40 PID 3052 wrote to memory of 1332 3052 RtDCpl64.exe 40 PID 3052 wrote to memory of 1332 3052 RtDCpl64.exe 40 PID 3052 wrote to memory of 1332 3052 RtDCpl64.exe 40 PID 3052 wrote to memory of 2932 3052 RtDCpl64.exe 41 PID 3052 wrote to memory of 2932 3052 RtDCpl64.exe 41 PID 3052 wrote to memory of 2932 3052 RtDCpl64.exe 41 PID 3052 wrote to memory of 2932 3052 RtDCpl64.exe 41 PID 3052 wrote to memory of 2932 3052 RtDCpl64.exe 41 PID 3052 wrote to memory of 2932 3052 RtDCpl64.exe 41 PID 3052 wrote to memory of 1132 3052 RtDCpl64.exe 42 PID 3052 wrote to memory of 1132 3052 RtDCpl64.exe 42 PID 3052 wrote to memory of 1132 3052 RtDCpl64.exe 42 PID 3052 wrote to memory of 1132 3052 RtDCpl64.exe 42 PID 2932 wrote to memory of 2720 2932 RtDCpl64.exe 43 PID 2932 wrote to memory of 2720 2932 RtDCpl64.exe 43 PID 2932 wrote to memory of 2720 2932 RtDCpl64.exe 43 PID 2932 wrote to memory of 2720 2932 RtDCpl64.exe 43 PID 2932 wrote to memory of 2720 2932 RtDCpl64.exe 43 PID 2932 wrote to memory of 2720 2932 RtDCpl64.exe 43 PID 2680 wrote to memory of 776 2680 taskeng.exe 46 PID 2680 wrote to memory of 776 2680 taskeng.exe 46 PID 2680 wrote to memory of 776 2680 taskeng.exe 46 PID 2680 wrote to memory of 776 2680 taskeng.exe 46 PID 776 wrote to memory of 1528 776 RtDCpl64.exe 47 PID 776 wrote to memory of 1528 776 RtDCpl64.exe 47 PID 776 wrote to memory of 1528 776 RtDCpl64.exe 47 PID 776 wrote to memory of 1528 776 RtDCpl64.exe 47 PID 776 wrote to memory of 1968 776 RtDCpl64.exe 48 PID 776 wrote to memory of 1968 776 RtDCpl64.exe 48 PID 776 wrote to memory of 1968 776 RtDCpl64.exe 48 PID 776 wrote to memory of 1968 776 RtDCpl64.exe 48 PID 776 wrote to memory of 1968 776 RtDCpl64.exe 48 PID 776 wrote to memory of 1968 776 RtDCpl64.exe 48 PID 776 wrote to memory of 2376 776 RtDCpl64.exe 49 PID 776 wrote to memory of 2376 776 RtDCpl64.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe"C:\Users\Admin\AppData\Local\Temp\3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:2408
-
-
-
C:\Users\Admin\AppData\Local\Temp\3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe"C:\Users\Admin\AppData\Local\Temp\3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2768
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2880
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {D0F5DEDF-B814-4307-8BFA-D49C471D92D3} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1332
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2720
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1132
-
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1528
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1356
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2376
-
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2084 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1940
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2520 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2876
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2988
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5e7cbf995d2049dbc9b00516232aae8d1
SHA12df4b3c7e220da4b33e782a18dd32563e06ead11
SHA256881f16dd34b31c761a93534ad984b42ff8d7914c3f5029f59145ee47863b501c
SHA5129f9541957d1e9a311ac0daba59754cc3b41c2f613489db64153eafb72b6852f5dd578fac2f1896c44d265196d3ad6c166fbc6f40ba544d183898c961713dddec
-
Filesize
132KB
MD56087bf6af59b9c531f2c9bb421d5e902
SHA18bc0f1596c986179b82585c703bacae6d2a00316
SHA2563a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292