Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

25/01/2025, 23:53

250125-3w9aqawpap 10

25/01/2025, 23:45

250125-3r6c9stre1 10

25/01/2025, 01:01

250125-bc9zcsypbn 10

13/01/2025, 17:50

250113-wewjza1pes 10

13/01/2025, 17:32

250113-v4m4fssrgj 10

General

  • Target

    New Text Document mod.exe.zip

  • Size

    392KB

  • Sample

    250113-wewjza1pes

  • MD5

    209c2bed74ce311f3de2c3040f5cbd8b

  • SHA1

    676dbe2bbf178ca27210c8a2e37aa9652f4e17d5

  • SHA256

    672ad2d52af206cc63cebe2c801181d3b406aae5891cc57bdaafd5eea3d61fe6

  • SHA512

    44b5207ce1a79c220ed014b7803ba4f3b89b0aa81f2232e152da9e5c8004c164a281d8806843a10590e3c55b902ef5e3f359bc117b80b11d052fe60324709324

  • SSDEEP

    6144:PiyQGVN3t3bmwUUoI7a+OjFjjGFEduVVZ4vELL2VzCGb49pRYCEheDmDUKUQWCCJ:P/HfRx7aNFXuhTL2I70SmpXCqry

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

other-little.gl.at.ply.gg:11758

0.tcp.in.ngrok.io:14296

Extazz24535-22930.portmap.host:22930

192.168.1.101:4782

Mutex

fbbc34bd-7320-405e-aebb-d4c666ee475f

Attributes
  • encryption_key

    FEA99DED4EFE826DE2850621FD7919E62525FD26

  • install_name

    DirectX111.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    DirectX

  • subdirectory

    SubDir

Extracted

Family

redline

Botnet

1V

C2

195.177.92.88:1912

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

0.tcp.in.ngrok.io:10147

38.240.58.195:6606

6.tcp.eu.ngrok.io:12925

172.204.136.22:1604

Mutex

Q52IWD1RYgpZ

Attributes
  • delay

    3

  • install

    false

  • install_file

    Listopener.exe

  • install_folder

    %AppData%

aes.plain
aes.plain
aes.plain
aes.plain

Extracted

Family

redline

Botnet

Standoff

C2

89.23.101.77:1912

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

C2

20.107.53.25:25535

Mutex

QSR_MUTEX_zQ0poF2lHhCSZKSUZ3

Attributes
  • encryption_key

    E2xbpJ93MnABcIqioTDL

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Extracted

Family

redline

Botnet

first

C2

212.56.41.77:1912

Extracted

Family

quasar

Version

1.4.1

Botnet

RuntimeBroker

C2

qrpn9be.localto.net:2810

Mutex

fc5edab1-6e8f-4963-98aa-bd077e08750f

Attributes
  • encryption_key

    F749DCAC94A1FC3102D2B0CFBBFCB76086F86568

  • install_name

    RuntimeBroker.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    RuntimeBroker

  • subdirectory

    a7

Extracted

Family

quasar

Version

1.3.0.0

Botnet

sigorta

C2

217.195.197.170:1604

Mutex

QSR_MUTEX_9WjAcLINYji1uqfzRt

Attributes
  • encryption_key

    B2vTTMiPGqHXv2xzSGYH

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Extracted

Family

quasar

Version

1.4.1

Botnet

ROBLOX EXECUTOR

C2

192.168.50.1:4782

10.0.0.113:4782

LETSQOOO-62766.portmap.host:62766

89.10.178.51:4782

Mutex

90faf922-159d-4166-b661-4ba16af8650e

Attributes
  • encryption_key

    FFEE70B90F5EBED6085600C989F1D6D56E2DEC26

  • install_name

    windows 3543.exe

  • log_directory

    roblox executor

  • reconnect_delay

    3000

  • startup_key

    windows background updater

  • subdirectory

    windows updater

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

wzt5xcg.localto.net:1604

wzt5xcg.localto.net:5274

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_file

    KYGOClient.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    131.153.205.3
  • Port:
    21
  • Username:
    root
  • Password:
    ADMIN

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    216.36.241.3
  • Port:
    21
  • Username:
    ftp
  • Password:
    apple

Extracted

Family

vipkeylogger

Extracted

Family

quasar

Version

1.4.1

Botnet

ZJEB

C2

VIPEEK1990-25013.portmap.host:25013

Mutex

ad21b115-2c1b-40cb-adba-a50736b76c21

Attributes
  • encryption_key

    3EBA8BC34FA983893A9B07B831E7CEB183F7492D

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Security Service

  • subdirectory

    SubDir

Extracted

Family

quasar

Version

1.4.1

Botnet

Helper Atanka

C2

193.203.238.136:8080

Mutex

14f39659-ca5b-4af7-8045-bed3500c385f

Attributes
  • encryption_key

    11049F2AEBDCF8E3A57474CD5FBA40FB2FFC5424

  • install_name

    diskutil.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    diskutil

  • subdirectory

    diskutil

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office

C2

85.192.29.60:5173

45.136.51.217:5173

Mutex

QAPB6w0UbYXMvQdKRF

Attributes
  • encryption_key

    pxC3g4rfVijQxK1hMGwM

  • install_name

    csrss.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    NET framework

  • subdirectory

    SubDir

Extracted

Family

redline

Botnet

@glowfy0

C2

91.214.78.86:1912

Targets

    • Target

      New Text Document mod.exe.zip

    • Size

      392KB

    • MD5

      209c2bed74ce311f3de2c3040f5cbd8b

    • SHA1

      676dbe2bbf178ca27210c8a2e37aa9652f4e17d5

    • SHA256

      672ad2d52af206cc63cebe2c801181d3b406aae5891cc57bdaafd5eea3d61fe6

    • SHA512

      44b5207ce1a79c220ed014b7803ba4f3b89b0aa81f2232e152da9e5c8004c164a281d8806843a10590e3c55b902ef5e3f359bc117b80b11d052fe60324709324

    • SSDEEP

      6144:PiyQGVN3t3bmwUUoI7a+OjFjjGFEduVVZ4vELL2VzCGb49pRYCEheDmDUKUQWCCJ:P/HfRx7aNFXuhTL2I70SmpXCqry

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Detect Xworm Payload

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

    • Meduza Stealer payload

    • Meduza family

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

    • Mimikatz family

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • XMRig Miner payload

    • Xmrig family

    • Xred

      Xred is backdoor written in Delphi.

    • Xred family

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Async RAT payload

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • mimikatz is an open source tool to dump credentials on Windows

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Contacts a large (874) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates new service(s)

    • Downloads MZ/PE file

    • Indicator Removal: Network Share Connection Removal

      Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    • Modifies Windows Firewall

    • Stops running service(s)

    • Suspicious Office macro

      Office document equipped with macros.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Drops startup file

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Indicator Removal: Clear Windows Event Logs

      Clear Windows Event Logs to hide the activity of an intrusion.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Network Service Discovery

      Attempt to gather information on host's network.

    • Network Share Discovery

      Attempt to gather information on host network.

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

static1

xred
Score
10/10

behavioral1

asyncratmeduzamimikatzquasarredlinexmrigxred1vdefaultfirstoffice04roblox executorruntimebrokersigortastandoffbackdoorcollectiondefense_evasiondiscoveryevasionexecutionimpactinfostealermacrominerpersistenceransomwareratspywarestealertrojanupx
Score
10/10

behavioral2

asyncratmeduzamimikatzquasarredlinexmrigxred1vdefaultfirstoffice04roblox executorruntimebrokersigortastandoffbackdoorcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerminerpersistenceransomwareratspywarestealertrojanupx
Score
10/10

behavioral3

asyncratmeduzamimikatzquasarredlinevipkeyloggerxmrigxredxworm1v@glowfy0defaultfirsthelper atankaofficeoffice04roblox executorruntimebrokersigortastandoffzjebbackdoorcollectiondefense_evasiondiscoveryevasionexecutionimpactinfostealerkeyloggerminerpersistenceransomwareratspywarestealertrojanupx
Score
10/10