Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/01/2025, 02:53
Static task
static1
Behavioral task
behavioral1
Sample
4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe
Resource
win10v2004-20241007-en
General
-
Target
4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe
-
Size
577KB
-
MD5
4d2ac4c9b9919a4cfd1643a0716d194d
-
SHA1
904dbd521da999b650472497b8a935a2a7affc7c
-
SHA256
4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6
-
SHA512
ebc622b9e9e69d5b7db332b2ad326bd8e8287cbf1eb7780231f2d9e90a97d769f15e16f5d53393c650e2c52ad4e9d06cf44e8b690de22cda596c318ff78ea8a4
-
SSDEEP
12288:ZbRKjP7neKaXDCgcWjwPtJbS4qSCXPg9:DKjP7edXDCgc9P/m4tr
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
dmweb.thedigitalmen.com - Port:
25 - Username:
[email protected] - Password:
l6MY62e8HKPM - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
resource yara_rule behavioral1/memory/3040-14-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/3040-12-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/3040-10-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/3040-7-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/3040-6-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Snakekeylogger family
-
Deletes itself 1 IoCs
pid Process 2252 cmd.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org 8 reallyfreegeoip.org 9 reallyfreegeoip.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2072 set thread context of 3040 2072 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3040 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3040 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2072 wrote to memory of 3040 2072 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 30 PID 2072 wrote to memory of 3040 2072 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 30 PID 2072 wrote to memory of 3040 2072 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 30 PID 2072 wrote to memory of 3040 2072 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 30 PID 2072 wrote to memory of 3040 2072 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 30 PID 2072 wrote to memory of 3040 2072 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 30 PID 2072 wrote to memory of 3040 2072 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 30 PID 2072 wrote to memory of 3040 2072 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 30 PID 2072 wrote to memory of 3040 2072 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 30 PID 3040 wrote to memory of 2252 3040 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 32 PID 3040 wrote to memory of 2252 3040 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 32 PID 3040 wrote to memory of 2252 3040 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 32 PID 3040 wrote to memory of 2252 3040 4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe 32 PID 2252 wrote to memory of 2844 2252 cmd.exe 34 PID 2252 wrote to memory of 2844 2252 cmd.exe 34 PID 2252 wrote to memory of 2844 2252 cmd.exe 34 PID 2252 wrote to memory of 2844 2252 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe"C:\Users\Admin\AppData\Local\Temp\4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe"C:\Users\Admin\AppData\Local\Temp\4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\4d59d590fcadb888c844987896fc67729f3fb835a3e18b8ce360d15a2ab3b9d6.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
- System Location Discovery: System Language Discovery
PID:2844
-
-
-