Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 20:27 UTC
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe
Resource
win7-20240729-en
General
-
Target
2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe
-
Size
5.4MB
-
MD5
60bb08876657fa77f5ff832c114f6464
-
SHA1
2f8a1ee884425d7576e50a6a186bc44a9d22efba
-
SHA256
335f697c3be8cac622f3ebcd5107b0bad45ac1de22f7c06fffd334ebffe22f7a
-
SHA512
949ab1b4843a50dc17cb7fd1e25df8801ccbc4c756a92f06f72add76441763eea9ccfc02e03eba5d6eb22f8008aeb281bbc182283cfda12ef81169dcf97210af
-
SSDEEP
98304:ZrXpmjkwDeUdgOps8IlXP4YNqzruaI6HMaJTtGb:xIYOClf5aI6HMaJTtGb
Malware Config
Extracted
lumma
https://jokeprvffat.cyou/api
Signatures
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4388 set thread context of 1680 4388 2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe 96 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4388 wrote to memory of 1680 4388 2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe 96 PID 4388 wrote to memory of 1680 4388 2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe 96 PID 4388 wrote to memory of 1680 4388 2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe 96 PID 4388 wrote to memory of 1680 4388 2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe 96 PID 4388 wrote to memory of 1680 4388 2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe 96 PID 4388 wrote to memory of 1680 4388 2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe 96 PID 4388 wrote to memory of 1680 4388 2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe 96 PID 4388 wrote to memory of 1680 4388 2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe 96 PID 4388 wrote to memory of 1680 4388 2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-16_60bb08876657fa77f5ff832c114f6464_frostygoop_poet-rat_snatch.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1680
-
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.97.19.2.in-addr.arpaIN PTRResponse171.97.19.2.in-addr.arpaIN PTRa2-19-97-171deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request71.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request5.114.82.104.in-addr.arpaIN PTRResponse5.114.82.104.in-addr.arpaIN PTRa104-82-114-5deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestjokeprvffat.cyouIN AResponsejokeprvffat.cyouIN A104.21.32.1jokeprvffat.cyouIN A104.21.80.1jokeprvffat.cyouIN A104.21.112.1jokeprvffat.cyouIN A104.21.48.1jokeprvffat.cyouIN A104.21.96.1jokeprvffat.cyouIN A104.21.64.1jokeprvffat.cyouIN A104.21.16.1
-
Remote address:104.21.32.1:443RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: jokeprvffat.cyou
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=e2t6b8t76h5rijis1unrkjg5j6; expires=Thu, 15 May 2025 14:15:02 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a9slSYiELtPnpgcLNRnd%2BoIqgqY0EWpilnhQIOsK6qKy4w8i6Pgenh%2BDPNRiNuo93Hpr1%2FTbuFrw9x608ki0%2BI0IL9OXYoyv66O8M6yUWxgwHAF9PnPi0RXDu7wV8Wy8X2f2"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 904992292d286367-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=28556&min_rtt=26390&rtt_var=9423&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3299&recv_bytes=605&delivery_rate=134387&cwnd=253&unsent_bytes=0&cid=9ce5ac8da8e76615&ts=264&x=0"
-
Remote address:8.8.8.8:53Requeststrivehelpeu.bondIN AResponse
-
Remote address:8.8.8.8:53Requestcrookedfoshe.bondIN AResponse
-
Remote address:8.8.8.8:53Requestimmolatechallen.bondIN AResponse
-
Remote address:8.8.8.8:53Requeststripedre-lot.bondIN AResponse
-
Remote address:8.8.8.8:53Requestgrowthselec.bondIN AResponse
-
Remote address:8.8.8.8:53Requestjarry-deatile.bondIN AResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request1.32.21.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestpain-temper.bondIN AResponse
-
Remote address:8.8.8.8:53Requestjarry-fixxer.bondIN AResponse
-
Remote address:8.8.8.8:53Requeststeamcommunity.comIN AResponsesteamcommunity.comIN A23.78.42.184
-
Remote address:23.78.42.184:443RequestGET /profiles/76561199724331900 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Host: steamcommunity.com
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Date: Sun, 19 Jan 2025 20:28:25 GMT
Content-Length: 35613
Connection: keep-alive
Set-Cookie: sessionid=9c205df688868bd4f751103c; Path=/; Secure; SameSite=None
Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
-
Remote address:8.8.8.8:53Requestvladimir-ulyanov.comIN AResponse
-
Remote address:8.8.8.8:53Request184.42.78.23.in-addr.arpaIN PTRResponse184.42.78.23.in-addr.arpaIN PTRa23-78-42-184deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request8.153.16.2.in-addr.arpaIN PTRResponse8.153.16.2.in-addr.arpaIN PTRa2-16-153-8deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.173.189.20.in-addr.arpaIN PTRResponse
-
1.0kB 4.9kB 9 9
HTTP Request
POST https://jokeprvffat.cyou/apiHTTP Response
200 -
1.5kB 43.2kB 21 37
HTTP Request
GET https://steamcommunity.com/profiles/76561199724331900HTTP Response
200
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
171.97.19.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
71.31.126.40.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
5.114.82.104.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
133.211.185.52.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
212.20.149.52.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
62 B 174 B 1 1
DNS Request
jokeprvffat.cyou
DNS Response
104.21.32.1104.21.80.1104.21.112.1104.21.48.1104.21.96.1104.21.64.1104.21.16.1
-
63 B 128 B 1 1
DNS Request
strivehelpeu.bond
-
63 B 128 B 1 1
DNS Request
crookedfoshe.bond
-
66 B 131 B 1 1
DNS Request
immolatechallen.bond
-
64 B 129 B 1 1
DNS Request
stripedre-lot.bond
-
62 B 127 B 1 1
DNS Request
growthselec.bond
-
64 B 129 B 1 1
DNS Request
jarry-deatile.bond
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
70 B 132 B 1 1
DNS Request
1.32.21.104.in-addr.arpa
-
62 B 127 B 1 1
DNS Request
pain-temper.bond
-
63 B 128 B 1 1
DNS Request
jarry-fixxer.bond
-
64 B 80 B 1 1
DNS Request
steamcommunity.com
DNS Response
23.78.42.184
-
66 B 139 B 1 1
DNS Request
vladimir-ulyanov.com
-
71 B 135 B 1 1
DNS Request
184.42.78.23.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
8.153.16.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
29.243.111.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
15.173.189.20.in-addr.arpa