Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
102s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/01/2025, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
nokeyfunction/nokeyfunction.exe
Resource
win10v2004-20241007-en
General
-
Target
nokeyfunction/nokeyfunction.exe
-
Size
503KB
-
MD5
055e6e64822e475ed15e37ddf39efbcc
-
SHA1
4c3b335d0742bb80df97fa4dc046e514c944db2e
-
SHA256
3f623e6a0c9ed4716e2f73cdb1e2079619c00b29e3930b5937882f3c6c6e1273
-
SHA512
7fd76cd302e895d908f238224e95b261331ee0274b4f70004162c85405b59be17445ea37794a46631d2c8ed3ffe51098ebc65796bdf19d8e7573987bbf13d56b
-
SSDEEP
12288:vztE0u86qlmk/xZ3/B+KI5sl+AAd6v0tXQJ:vO0uYlmsnPB+A+AKuUgJ
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Signatures
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1476 set thread context of 2088 1476 nokeyfunction.exe 79 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nokeyfunction.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nokeyfunction.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1692 1476 nokeyfunction.exe 78 PID 1476 wrote to memory of 1692 1476 nokeyfunction.exe 78 PID 1476 wrote to memory of 1692 1476 nokeyfunction.exe 78 PID 1476 wrote to memory of 2088 1476 nokeyfunction.exe 79 PID 1476 wrote to memory of 2088 1476 nokeyfunction.exe 79 PID 1476 wrote to memory of 2088 1476 nokeyfunction.exe 79 PID 1476 wrote to memory of 2088 1476 nokeyfunction.exe 79 PID 1476 wrote to memory of 2088 1476 nokeyfunction.exe 79 PID 1476 wrote to memory of 2088 1476 nokeyfunction.exe 79 PID 1476 wrote to memory of 2088 1476 nokeyfunction.exe 79 PID 1476 wrote to memory of 2088 1476 nokeyfunction.exe 79 PID 1476 wrote to memory of 2088 1476 nokeyfunction.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\nokeyfunction\nokeyfunction.exe"C:\Users\Admin\AppData\Local\Temp\nokeyfunction\nokeyfunction.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\nokeyfunction\nokeyfunction.exe"C:\Users\Admin\AppData\Local\Temp\nokeyfunction\nokeyfunction.exe"2⤵PID:1692
-
-
C:\Users\Admin\AppData\Local\Temp\nokeyfunction\nokeyfunction.exe"C:\Users\Admin\AppData\Local\Temp\nokeyfunction\nokeyfunction.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2088
-