Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    114s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/12/2024, 03:08

General

  • Target

    faa681151e56b327f655cafc8502c9ee6d75b75e4735fdda8a1be3445ad5a10bN.exe

  • Size

    6.8MB

  • MD5

    90ff543bba58fb76ee49d70c6626ee30

  • SHA1

    1c88f46fb33a5c44291a10fd45637b79522a0a30

  • SHA256

    faa681151e56b327f655cafc8502c9ee6d75b75e4735fdda8a1be3445ad5a10b

  • SHA512

    0f99c64662f309ee5d15a6547e0929f3a5314ded21b42377386fe42ee2a0dcd759855c5185e58221ed3b6c2972f05d6955e03b646173f4be52b85cc78ec40ab1

  • SSDEEP

    196608:I1oT3g4OZzTlzR6J8A/duq2ascuUyHn9NiltOlj1:coTwPpTVRw8rqZ2lqltO

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\faa681151e56b327f655cafc8502c9ee6d75b75e4735fdda8a1be3445ad5a10bN.exe
    "C:\Users\Admin\AppData\Local\Temp\faa681151e56b327f655cafc8502c9ee6d75b75e4735fdda8a1be3445ad5a10bN.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\C5E79.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\C5E79.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3576
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\w4Z01.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\w4Z01.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2848
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1o77l1.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1o77l1.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4156
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4464
            • C:\Users\Admin\AppData\Local\Temp\1013091001\b1e6e3774f.exe
              "C:\Users\Admin\AppData\Local\Temp\1013091001\b1e6e3774f.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Windows security modification
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3464
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2G6942.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2G6942.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1416
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 1612
            5⤵
            • Program crash
            PID:2696
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 1604
            5⤵
            • Program crash
            PID:4584
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3j94w.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3j94w.exe
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1836
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4V003L.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4V003L.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Windows security modification
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1520
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1416 -ip 1416
    1⤵
      PID:1384
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1416 -ip 1416
      1⤵
        PID:3104
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:4132
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:3616

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\1013091001\b1e6e3774f.exe

        Filesize

        2.6MB

        MD5

        9f3939ac568bc07b63e720ddfee5e229

        SHA1

        0b270aeaea0a4d281dd32e0c4128b41d0fed7e59

        SHA256

        e661e6e85a47abae31b1f2ad23f12d4d72f0817d30bf2406ae50d26bd8c1664d

        SHA512

        b6c32ac234345c864124288624aefc14953790360f23d0affa48b4cf9f333f00f608fa7818287894d9da13978e216c3ba44a0b4d4ffae2da45e8b6d0b5873389

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4V003L.exe

        Filesize

        2.7MB

        MD5

        866729211e3f05b5abb74efc9d8e6500

        SHA1

        dc40037e0de89878ddb739a3c0dc1bcd02a2be5e

        SHA256

        4f57f75da2ce5bf5e4c8703d961b3c0f3892c5cfb93bfdc71e621a71068c4289

        SHA512

        936270fe6d51956a3f0b4ece5e765d3055ec2a803dfa6f0427de43a96ea108ab3500a90c571178b675a2fb309a1c6d0cc3d15d74bbe111e5cb57bf121273a6df

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\C5E79.exe

        Filesize

        5.2MB

        MD5

        7770194bcc745eeaa433c91359cc3d93

        SHA1

        f39c621a7cfd8d960d6bf35ba3b112bbfd9134e2

        SHA256

        0a86aa1b41bf7b9cf77afb267b2b3bd12e83a08f1d94d5919e49a0c3fddd75e7

        SHA512

        5accfbc0e852f4564c6b3926d4c658aaa6c280cf026b6f90e6a7808f0c7b2850485ba2fa850ca6008b3efbd2df77267db715261e37812657191f83eeb4cac28b

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3j94w.exe

        Filesize

        4.9MB

        MD5

        96dbefde47d954a8540560efdb7e047c

        SHA1

        01baa3171dab8ca2fb5c70ed27084e2ead8e9280

        SHA256

        adb01c697d5baa4fc0d70955d6f40c33df2e0819239e995f3c3bb3fda0d0bfcf

        SHA512

        7aead2f069299db65ec5389f5d5cc8c1980669ce36d13ea1b1707d9830198e0a29a2ca985ad41eb4a31707d511c82b0ebfdc88117a43021dfe325ab175327bc8

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\w4Z01.exe

        Filesize

        3.6MB

        MD5

        0572f3cb174e9a02a1e195dca148bcab

        SHA1

        d63289e1bfdfe52e2a7269df2a5507a51859b91b

        SHA256

        eae808cff71c189d7fdc3fd34be9c745fbedc0e61cb624c4ea1d11fedd3ef361

        SHA512

        1adcf45bfceb4b1467b7586110c031dde8cf2c9110fcf1b0b8d6a67efe6ff4f8d87955b711b246795661b54bbf96b7fc6f383e223189434eab69c74988aff7aa

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1o77l1.exe

        Filesize

        3.1MB

        MD5

        622b39d29223faa56bb88e68fa3e094b

        SHA1

        35e1dda97dc60ff96ec21eca3ec32d266e378f17

        SHA256

        08a67ca07dea6343d4cd50dba90801e6696b52fba55c42c6959ddd5c9ec1d0e2

        SHA512

        f6fd87dc767ce59d55b8bd66388ef1b1b3b9b5827cfcd635335a3bd5e39bde730c046128e6c2ad75fa893c12426a1d55c28f0afe90e27074897c69f35ccd2001

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2G6942.exe

        Filesize

        1.8MB

        MD5

        693daf9c664603475cf7849dd970b489

        SHA1

        735b80173ab93760d209de23eafc1e5196b57f1c

        SHA256

        3f004d973822550e8c7ce81ddd381b4e6b8839adeea05cfd44386c32097385c7

        SHA512

        e99627078de2f3ef33d0ee106064bf727125042ba989dc7501c0145f241d20a7080e7e272e7a340ba128ab244b7c24d208602319eb525a349ced0586c09bd0fc

      • memory/1416-64-0x0000000000890000-0x0000000000D2C000-memory.dmp

        Filesize

        4.6MB

      • memory/1416-62-0x0000000000890000-0x0000000000D2C000-memory.dmp

        Filesize

        4.6MB

      • memory/1416-39-0x0000000000890000-0x0000000000D2C000-memory.dmp

        Filesize

        4.6MB

      • memory/1520-87-0x00000000006B0000-0x000000000096A000-memory.dmp

        Filesize

        2.7MB

      • memory/1520-73-0x00000000006B0000-0x000000000096A000-memory.dmp

        Filesize

        2.7MB

      • memory/1520-75-0x00000000006B0000-0x000000000096A000-memory.dmp

        Filesize

        2.7MB

      • memory/1520-76-0x00000000006B0000-0x000000000096A000-memory.dmp

        Filesize

        2.7MB

      • memory/1520-84-0x00000000006B0000-0x000000000096A000-memory.dmp

        Filesize

        2.7MB

      • memory/1836-70-0x00000000007B0000-0x0000000000C99000-memory.dmp

        Filesize

        4.9MB

      • memory/1836-68-0x00000000007B0000-0x0000000000C99000-memory.dmp

        Filesize

        4.9MB

      • memory/3464-60-0x0000000000FC0000-0x0000000001264000-memory.dmp

        Filesize

        2.6MB

      • memory/3464-59-0x0000000000FC0000-0x0000000001264000-memory.dmp

        Filesize

        2.6MB

      • memory/3464-58-0x0000000000FC0000-0x0000000001264000-memory.dmp

        Filesize

        2.6MB

      • memory/3464-77-0x0000000000FC0000-0x0000000001264000-memory.dmp

        Filesize

        2.6MB

      • memory/3464-81-0x0000000000FC0000-0x0000000001264000-memory.dmp

        Filesize

        2.6MB

      • memory/3616-98-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4132-90-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4156-21-0x0000000000610000-0x000000000092F000-memory.dmp

        Filesize

        3.1MB

      • memory/4156-35-0x0000000000610000-0x000000000092F000-memory.dmp

        Filesize

        3.1MB

      • memory/4464-33-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4464-67-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4464-88-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4464-82-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4464-91-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4464-92-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4464-93-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4464-94-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4464-95-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4464-96-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4464-61-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4464-99-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB

      • memory/4464-100-0x0000000000FD0000-0x00000000012EF000-memory.dmp

        Filesize

        3.1MB