Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2024, 03:43

General

  • Target

    d3a80f61dbaca8dcea50c0c87bf8bc39ab4d725ed2587206bfa7e62de7278c9c.exe

  • Size

    3.1MB

  • MD5

    e35ed56f80a7af0634754dfecd4195ef

  • SHA1

    f6fea977c73c0eb49527c92ee98bde249ec6fc93

  • SHA256

    d3a80f61dbaca8dcea50c0c87bf8bc39ab4d725ed2587206bfa7e62de7278c9c

  • SHA512

    4a8296090a6d392512f60c26b9c0209079af8cd02daf951e7a079eb13eb687dbcf40b2a936564cb6ba999f5f959e174c756c120f1e172b7d59a517186f7db431

  • SSDEEP

    49152:7qBqsKm7aqtAChDwviQSLzaQvrVtzqy2S0tG8dBP4:7qkLmmq6ODwviQ2aQv5w93M2B

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Extracted

Family

lumma

C2

https://founpiuer.store/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3a80f61dbaca8dcea50c0c87bf8bc39ab4d725ed2587206bfa7e62de7278c9c.exe
    "C:\Users\Admin\AppData\Local\Temp\d3a80f61dbaca8dcea50c0c87bf8bc39ab4d725ed2587206bfa7e62de7278c9c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3624
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Users\Admin\AppData\Local\Temp\1004269001\3fbbbeaaf9.exe
        "C:\Users\Admin\AppData\Local\Temp\1004269001\3fbbbeaaf9.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:828
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 1492
          4⤵
          • Program crash
          PID:4740
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 1460
          4⤵
          • Program crash
          PID:3524
      • C:\Users\Admin\AppData\Local\Temp\1004270001\3bc3de5167.exe
        "C:\Users\Admin\AppData\Local\Temp\1004270001\3bc3de5167.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3460
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        3⤵
          PID:1716
        • C:\Users\Admin\AppData\Local\Temp\1004272001\6b4039ae94.exe
          "C:\Users\Admin\AppData\Local\Temp\1004272001\6b4039ae94.exe"
          3⤵
          • Modifies Windows Defender Real-time Protection settings
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Windows security modification
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3404
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 828 -ip 828
      1⤵
        PID:4260
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 828 -ip 828
        1⤵
          PID:4308
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:4964
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:1956

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\1004269001\3fbbbeaaf9.exe

          Filesize

          3.0MB

          MD5

          6d08ebf44054c99f460c913c598ba02d

          SHA1

          c589c3753833f54065bc47a23cdf368b8e952e31

          SHA256

          0479769de153dc824e12ab4da491f3cb5ec2cf4a0f680bef3d5ee4ab924d65a9

          SHA512

          bfe0841ae6bb8ea9aaa3bb72a523a75ddfd2be02b2ba3f3457f2d29662186a3b902736f5c0e2df843786a9fca65b68ff70da79b38b05b6fef6e43b3c9b5889b0

        • C:\Users\Admin\AppData\Local\Temp\1004270001\3bc3de5167.exe

          Filesize

          2.1MB

          MD5

          54f25d4b3425a633f6fdf9b3198a78ae

          SHA1

          21082149dd3b95338bb6c68fefc4c2fb193537a7

          SHA256

          62e51f303b867bd5398d15f9ab8ab8791d9f81b38a4d72ec86c0e3211d273665

          SHA512

          308e2213b9520a4fafbf2b9ca949fc6a5d58c3130e3b328ff05d221ec06accb2d48ceec1cf61527d77c06776f3ec5862e63e6021c5c36ac31d69d3a111388f5b

        • C:\Users\Admin\AppData\Local\Temp\1004272001\6b4039ae94.exe

          Filesize

          2.7MB

          MD5

          27935a420fa2f6b9490b752e59ec057f

          SHA1

          4c8398df51966d6148438ccf37ba3f676391cae2

          SHA256

          40e9f77cd81959cb9ce38c51653a9295650eff6e42dce00022ed5951ec59eb1f

          SHA512

          ee6a9134793cc0dae7aa96d48ddc3bf8f28980b60866e4bbd2db5026654e819d8114074b7b07fc97a78f0953d9afba9d0cc8524054f75e37b5f0fb7e4eb0f164

        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

          Filesize

          3.1MB

          MD5

          e35ed56f80a7af0634754dfecd4195ef

          SHA1

          f6fea977c73c0eb49527c92ee98bde249ec6fc93

          SHA256

          d3a80f61dbaca8dcea50c0c87bf8bc39ab4d725ed2587206bfa7e62de7278c9c

          SHA512

          4a8296090a6d392512f60c26b9c0209079af8cd02daf951e7a079eb13eb687dbcf40b2a936564cb6ba999f5f959e174c756c120f1e172b7d59a517186f7db431

        • memory/828-64-0x0000000000231000-0x0000000000289000-memory.dmp

          Filesize

          352KB

        • memory/828-38-0x0000000000230000-0x0000000000534000-memory.dmp

          Filesize

          3.0MB

        • memory/828-63-0x0000000000230000-0x0000000000534000-memory.dmp

          Filesize

          3.0MB

        • memory/828-43-0x0000000000230000-0x0000000000534000-memory.dmp

          Filesize

          3.0MB

        • memory/828-41-0x0000000000231000-0x0000000000289000-memory.dmp

          Filesize

          352KB

        • memory/828-42-0x0000000000230000-0x0000000000534000-memory.dmp

          Filesize

          3.0MB

        • memory/1956-104-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1956-103-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-96-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-98-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-39-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-40-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-22-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-21-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-20-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-109-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-52-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-108-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-107-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-106-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-105-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-16-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-101-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-100-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-99-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-86-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-97-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/1996-92-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/3404-84-0x0000000000D60000-0x0000000001014000-memory.dmp

          Filesize

          2.7MB

        • memory/3404-83-0x0000000000D60000-0x0000000001014000-memory.dmp

          Filesize

          2.7MB

        • memory/3404-88-0x0000000000D60000-0x0000000001014000-memory.dmp

          Filesize

          2.7MB

        • memory/3404-91-0x0000000000D60000-0x0000000001014000-memory.dmp

          Filesize

          2.7MB

        • memory/3404-85-0x0000000000D60000-0x0000000001014000-memory.dmp

          Filesize

          2.7MB

        • memory/3460-60-0x0000000000B70000-0x00000000012B1000-memory.dmp

          Filesize

          7.3MB

        • memory/3460-61-0x0000000000B70000-0x00000000012B1000-memory.dmp

          Filesize

          7.3MB

        • memory/3624-1-0x0000000077644000-0x0000000077646000-memory.dmp

          Filesize

          8KB

        • memory/3624-3-0x0000000000860000-0x0000000000B8A000-memory.dmp

          Filesize

          3.2MB

        • memory/3624-19-0x0000000000861000-0x00000000008C9000-memory.dmp

          Filesize

          416KB

        • memory/3624-5-0x0000000000860000-0x0000000000B8A000-memory.dmp

          Filesize

          3.2MB

        • memory/3624-0-0x0000000000860000-0x0000000000B8A000-memory.dmp

          Filesize

          3.2MB

        • memory/3624-18-0x0000000000860000-0x0000000000B8A000-memory.dmp

          Filesize

          3.2MB

        • memory/3624-2-0x0000000000861000-0x00000000008C9000-memory.dmp

          Filesize

          416KB

        • memory/4964-95-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB

        • memory/4964-94-0x0000000000560000-0x000000000088A000-memory.dmp

          Filesize

          3.2MB