Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2024, 17:47

General

  • Target

    2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe

  • Size

    11.0MB

  • MD5

    1216b81c1f7b36aaad1ffed2c982fa2b

  • SHA1

    cc05886a6bc38396431fba11b14ddf4b4c576aa9

  • SHA256

    1702a224613323deeeba21fa405ec74979e7c6e474f2d5b11973ebf4e4155972

  • SHA512

    1d5fd317b16ba48b66edac90f2cdbc3ff44a048a9e9f3d92417ea12d50ee8b0ab90e097abcbc4d318a1483eda10860845e6f462ee023a1e8190d7cf545179c39

  • SSDEEP

    98304:mwIMFaSRnwIMFaSRcwIMFaSRfwIMFaSRIwIMFaSRQpFK0U8AmJNIo:7JRwJR5JRYJRtJRmFKzYN

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

xworm

Version

3.1

C2

23.26.201.172:8899

Mutex

REaMgxQu68UQguvi

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 9 IoCs
  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:412
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rgrkFqQ.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1456
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rgrkFqQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAE60.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2412
    • C:\Users\Admin\AppData\Local\Temp\2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Users\Admin\AppData\Local\Temp\._cache_2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3744
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3424
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rgrkFqQ.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4788
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rgrkFqQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF08A.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:3264
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe"
          4⤵
          • Executes dropped EXE
          PID:440
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:5008
          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:5056
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    11.0MB

    MD5

    1216b81c1f7b36aaad1ffed2c982fa2b

    SHA1

    cc05886a6bc38396431fba11b14ddf4b4c576aa9

    SHA256

    1702a224613323deeeba21fa405ec74979e7c6e474f2d5b11973ebf4e4155972

    SHA512

    1d5fd317b16ba48b66edac90f2cdbc3ff44a048a9e9f3d92417ea12d50ee8b0ab90e097abcbc4d318a1483eda10860845e6f462ee023a1e8190d7cf545179c39

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    faaf8941de4dc92e17137c5073de8312

    SHA1

    1e2a18d7b001b2ec612fe0561d8fe8da9b039526

    SHA256

    915bd36f2d0929f0efd611d30621c374219acab9d19c620bb355dcf7299b5213

    SHA512

    db604575f9360c2b5fefa6850bcb2c35c0005273a0e47ce6c1ee4e837b11f3e135d1e0f35a566f2cff2743690fac28cdf8800c110cda698f3c87a24bb6ff2ce8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    dad57971f1672d91268bdf55825a7558

    SHA1

    34fc2667c12a858c205cc0992515da3433c27636

    SHA256

    c97c0bbf402860cc799c2cacec861cd24341d54489d9cfd17b520073119d2375

    SHA512

    52196ddda84207ad04ae1252da96c5813fd43d2f485c92f14e6fe3e9e130abb8835005b5d3396f9c581b5321983d4928fa3602f0318f868a092d8ad95eae2c1a

  • C:\Users\Admin\AppData\Local\Temp\._cache_2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe

    Filesize

    33KB

    MD5

    0201f6d2fa823471b937234b7ea29d6b

    SHA1

    ee4e6d415a529e14381ebdf9a68347cdac57792d

    SHA256

    76a1329afd87d9c83bff12bb13f73917aaef94e5729f0ef460078d2876337fdb

    SHA512

    b9cad8c42d67b9854bfc8fe7b37fc6f7a39e59e556e8975eb26bd42de10c502fba8a848a04d8ef26679b6ffc8b7e22e1af1d46f1ddf85bda4fd35ef4c1cdfea4

  • C:\Users\Admin\AppData\Local\Temp\9jmrAjT8.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nfd5db0w.fq1.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmpAE60.tmp

    Filesize

    1KB

    MD5

    94c6c53188027726b39cd1d4e68274be

    SHA1

    3efb1d1f29e45151fa89df9d5fd5d851db753e30

    SHA256

    9e666787a3e1f509ff09b56689e9ef98b70579efe59e34372b62635f295aa3f6

    SHA512

    32d327654150f9c4c6a520934ac1fb7180ac353da6ee6323176b5a0b6b7fbab8a590419eb644c33ff8faf08caf10cefb0148a45a367b16c40351f84b5bfa6eae

  • memory/412-217-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/412-189-0x0000000070B50000-0x0000000070B9C000-memory.dmp

    Filesize

    304KB

  • memory/412-210-0x0000000007B40000-0x0000000007B48000-memory.dmp

    Filesize

    32KB

  • memory/412-15-0x0000000002BF0000-0x0000000002C26000-memory.dmp

    Filesize

    216KB

  • memory/412-16-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/412-17-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/412-20-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1456-176-0x0000000006F90000-0x0000000007033000-memory.dmp

    Filesize

    652KB

  • memory/1456-203-0x00000000070D0000-0x00000000070EA000-memory.dmp

    Filesize

    104KB

  • memory/1456-18-0x0000000004F80000-0x00000000055A8000-memory.dmp

    Filesize

    6.2MB

  • memory/1456-24-0x0000000005720000-0x0000000005786000-memory.dmp

    Filesize

    408KB

  • memory/1456-23-0x00000000055B0000-0x0000000005616000-memory.dmp

    Filesize

    408KB

  • memory/1456-25-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1456-19-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1456-40-0x00000000057A0000-0x0000000005AF4000-memory.dmp

    Filesize

    3.3MB

  • memory/1456-216-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1456-209-0x0000000007410000-0x000000000742A000-memory.dmp

    Filesize

    104KB

  • memory/1456-22-0x0000000004DE0000-0x0000000004E02000-memory.dmp

    Filesize

    136KB

  • memory/1456-208-0x0000000007310000-0x0000000007324000-memory.dmp

    Filesize

    80KB

  • memory/1456-51-0x0000000005D80000-0x0000000005D9E000-memory.dmp

    Filesize

    120KB

  • memory/1456-52-0x0000000005E30000-0x0000000005E7C000-memory.dmp

    Filesize

    304KB

  • memory/1456-207-0x0000000007300000-0x000000000730E000-memory.dmp

    Filesize

    56KB

  • memory/1456-206-0x00000000072D0000-0x00000000072E1000-memory.dmp

    Filesize

    68KB

  • memory/1456-123-0x0000000070B50000-0x0000000070B9C000-memory.dmp

    Filesize

    304KB

  • memory/1456-205-0x0000000007350000-0x00000000073E6000-memory.dmp

    Filesize

    600KB

  • memory/1456-133-0x0000000006F60000-0x0000000006F7E000-memory.dmp

    Filesize

    120KB

  • memory/1456-204-0x0000000007140000-0x000000000714A000-memory.dmp

    Filesize

    40KB

  • memory/1456-120-0x0000000006360000-0x0000000006392000-memory.dmp

    Filesize

    200KB

  • memory/1456-202-0x0000000007710000-0x0000000007D8A000-memory.dmp

    Filesize

    6.5MB

  • memory/1480-317-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

    Filesize

    64KB

  • memory/1480-321-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

    Filesize

    64KB

  • memory/1480-320-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

    Filesize

    64KB

  • memory/1480-318-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

    Filesize

    64KB

  • memory/1480-319-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

    Filesize

    64KB

  • memory/1480-322-0x00007FFCEFE70000-0x00007FFCEFE80000-memory.dmp

    Filesize

    64KB

  • memory/1480-334-0x00007FFCEFE70000-0x00007FFCEFE80000-memory.dmp

    Filesize

    64KB

  • memory/2372-46-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/2372-45-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/3016-48-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/3016-4-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/3016-5-0x0000000005D10000-0x0000000005D1A000-memory.dmp

    Filesize

    40KB

  • memory/3016-3-0x0000000005D40000-0x0000000005DD2000-memory.dmp

    Filesize

    584KB

  • memory/3016-2-0x0000000006250000-0x00000000067F4000-memory.dmp

    Filesize

    5.6MB

  • memory/3016-6-0x0000000006F00000-0x0000000006F10000-memory.dmp

    Filesize

    64KB

  • memory/3016-9-0x0000000007890000-0x000000000799C000-memory.dmp

    Filesize

    1.0MB

  • memory/3016-8-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/3016-7-0x000000007442E000-0x000000007442F000-memory.dmp

    Filesize

    4KB

  • memory/3016-1-0x0000000000800000-0x00000000012FE000-memory.dmp

    Filesize

    11.0MB

  • memory/3016-10-0x0000000009F20000-0x0000000009FBC000-memory.dmp

    Filesize

    624KB

  • memory/3016-0-0x000000007442E000-0x000000007442F000-memory.dmp

    Filesize

    4KB

  • memory/3424-303-0x0000000070B30000-0x0000000070B7C000-memory.dmp

    Filesize

    304KB

  • memory/3424-316-0x0000000007380000-0x0000000007423000-memory.dmp

    Filesize

    652KB

  • memory/3424-247-0x0000000006180000-0x00000000061CC000-memory.dmp

    Filesize

    304KB

  • memory/3424-333-0x0000000007660000-0x0000000007671000-memory.dmp

    Filesize

    68KB

  • memory/3424-335-0x00000000076A0000-0x00000000076B4000-memory.dmp

    Filesize

    80KB

  • memory/3424-220-0x0000000005AA0000-0x0000000005DF4000-memory.dmp

    Filesize

    3.3MB

  • memory/3744-122-0x0000000000A40000-0x0000000000A4E000-memory.dmp

    Filesize

    56KB

  • memory/4788-323-0x0000000070B30000-0x0000000070B7C000-memory.dmp

    Filesize

    304KB

  • memory/5008-233-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/5008-348-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/5008-347-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/5008-355-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/5008-379-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB