Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18/10/2024, 04:49 UTC

General

  • Target

    3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe

  • Size

    1.4MB

  • MD5

    0d951819064a22a5f28d902b6d3f9980

  • SHA1

    51784b4e39d23a59f0fad33344bdee4b68f7eb52

  • SHA256

    3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1

  • SHA512

    b92f36521d78326bde3492a43a883eeb524465d3c70263f6d4a9900a3dd96504e569056f99455da6699dd93cee37d915b2f4f07a005b981b8848dbe53ebe45a6

  • SSDEEP

    24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYZ:Fo0c++OCokGs9Fa+rd1f26RNYZ

Malware Config

Extracted

Family

netwire

C2

Wealthy2019.com.strangled.net:20190

wealthyme.ddns.net:20190

Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    sunshineslisa

  • install_path

    %AppData%\Imgburn\Host.exe

  • keylogger_dir

    %AppData%\Logs\Imgburn\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    sucess

  • registry_autorun

    false

  • use_mutex

    false

Extracted

Family

warzonerat

C2

wealth.warzonedns.com:5202

Signatures

  • NetWire RAT payload 15 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 2 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 16 IoCs
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe
    "C:\Users\Admin\AppData\Local\Temp\3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Roaming\Blasthost.exe
      "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1776
      • C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
        "C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
        3⤵
        • Executes dropped EXE
        PID:2408
    • C:\Users\Admin\AppData\Local\Temp\3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe
      "C:\Users\Admin\AppData\Local\Temp\3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2768
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2880
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {D0F5DEDF-B814-4307-8BFA-D49C471D92D3} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
      C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Users\Admin\AppData\Roaming\Blasthost.exe
        "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
        3⤵
        • Executes dropped EXE
        PID:1332
      • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
        "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2720
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1132
    • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
      C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:776
      • C:\Users\Admin\AppData\Roaming\Blasthost.exe
        "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
        3⤵
        • Executes dropped EXE
        PID:1528
      • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
        "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1968
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1356
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2376
    • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
      C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:2084
      • C:\Users\Admin\AppData\Roaming\Blasthost.exe
        "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
        3⤵
        • Executes dropped EXE
        PID:1940
      • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
        "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2520
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2876
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2988

Network

  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
No results found
  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

    Filesize

    1.4MB

    MD5

    e7cbf995d2049dbc9b00516232aae8d1

    SHA1

    2df4b3c7e220da4b33e782a18dd32563e06ead11

    SHA256

    881f16dd34b31c761a93534ad984b42ff8d7914c3f5029f59145ee47863b501c

    SHA512

    9f9541957d1e9a311ac0daba59754cc3b41c2f613489db64153eafb72b6852f5dd578fac2f1896c44d265196d3ad6c166fbc6f40ba544d183898c961713dddec

  • \Users\Admin\AppData\Roaming\Blasthost.exe

    Filesize

    132KB

    MD5

    6087bf6af59b9c531f2c9bb421d5e902

    SHA1

    8bc0f1596c986179b82585c703bacae6d2a00316

    SHA256

    3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c

    SHA512

    c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292

  • memory/776-116-0x0000000000F40000-0x00000000010AB000-memory.dmp

    Filesize

    1.4MB

  • memory/1332-89-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/1356-120-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/1680-0-0x00000000002A0000-0x000000000040B000-memory.dmp

    Filesize

    1.4MB

  • memory/1680-26-0x0000000000490000-0x0000000000491000-memory.dmp

    Filesize

    4KB

  • memory/1680-40-0x00000000033E0000-0x000000000354B000-memory.dmp

    Filesize

    1.4MB

  • memory/1680-42-0x00000000002A0000-0x000000000040B000-memory.dmp

    Filesize

    1.4MB

  • memory/1776-24-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2084-158-0x0000000000F40000-0x00000000010AB000-memory.dmp

    Filesize

    1.4MB

  • memory/2084-140-0x0000000000F40000-0x00000000010AB000-memory.dmp

    Filesize

    1.4MB

  • memory/2244-36-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2244-27-0x0000000000080000-0x000000000009D000-memory.dmp

    Filesize

    116KB

  • memory/2244-29-0x0000000000080000-0x000000000009D000-memory.dmp

    Filesize

    116KB

  • memory/2244-39-0x0000000000080000-0x000000000009D000-memory.dmp

    Filesize

    116KB

  • memory/2408-48-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2408-87-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2720-84-0x0000000000120000-0x0000000000121000-memory.dmp

    Filesize

    4KB

  • memory/2768-43-0x0000000000120000-0x0000000000121000-memory.dmp

    Filesize

    4KB

  • memory/2768-45-0x0000000000120000-0x0000000000121000-memory.dmp

    Filesize

    4KB

  • memory/2932-79-0x0000000000F40000-0x00000000010AB000-memory.dmp

    Filesize

    1.4MB

  • memory/2932-75-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/3052-80-0x0000000000F40000-0x00000000010AB000-memory.dmp

    Filesize

    1.4MB

  • memory/3052-51-0x0000000000F40000-0x00000000010AB000-memory.dmp

    Filesize

    1.4MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.