Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2025, 21:23

General

  • Target

    olii.exe

  • Size

    270KB

  • MD5

    ba9d3f63058ea4041190e82e03ffd5f6

  • SHA1

    2bd055abacc3b9ad6f7cb1fa8613c7c44fd21943

  • SHA256

    bfb35a39b72e24ce801468a629e64b1806ae5cf8339ade1ee7f145ec4497be93

  • SHA512

    7e2d37dd5921cda5ebff477308644b1a7f1b2586e6792f17d6f59b911dc04ed91db2569032dd9d5f3fa29e9caefb906153336052c256297354cfe73fc58b5462

  • SSDEEP

    6144:wBlL/c5bsFKd4xN3dRWrJYoozpSbRugzPsVKiyJ:Ce5AEa6VYhpSgePQd6

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot2046248941:AAG5Z0PyWwtApmPaysBm59voK10ec9Rgnaw/sendDocument

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • AgentTesla payload 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\olii.exe
    "C:\Users\Admin\AppData\Local\Temp\olii.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2828
    • C:\Users\Admin\AppData\Local\Temp\olii.exe
      "C:\Users\Admin\AppData\Local\Temp\olii.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nseF1DF.tmp\aneyji.dll

    Filesize

    19KB

    MD5

    f7a30cb571aa862021ff786169f72a80

    SHA1

    d002635afeacd67ad2e5764d4dd07e0ec5f49ae3

    SHA256

    3c3b81e2f3de386bb78562b8005fcc582aa83d1bd5ac99aca14bd235f401c018

    SHA512

    7fc63a94a72b93ff57645d3e8c92726b7f77976ed5801461bfdaf4638dd8376565dad5f6663d1e0bd064e7521230b2b9f7aae90a5733f387fa003b22b501c69e

  • memory/2828-7-0x0000000010005000-0x0000000010007000-memory.dmp

    Filesize

    8KB

  • memory/2976-9-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2976-11-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2976-12-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2976-13-0x0000000004430000-0x000000000446C000-memory.dmp

    Filesize

    240KB