Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07/02/2025, 14:31
General
-
Target
6170e9d134809ea571ba213c0d32ff5301ec36bbb807a49c16252e0e2112f355.exe
-
Size
1.1MB
-
MD5
e59cb6aa20ab06646ce961ef626f7839
-
SHA1
4bbee31a5f7ce000df4c0a8bc5a4a67775c89a5c
-
SHA256
6170e9d134809ea571ba213c0d32ff5301ec36bbb807a49c16252e0e2112f355
-
SHA512
55a4f98ba57746c0e8899163a06bd2522f3023d641048e32c6a2e67df53b4fde6b214e84e2aa60fdb144d60eada70a1d0919502e65280fd80180ec5dc091451f
-
SSDEEP
24576:n3bKxqktJibWcB8nuQVmQaXGzt1yN/9JmLu+dzUdj+F/u:n3GNtJibWc6nPXQ/9Uaoqq/u
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.copinsa.com - Port:
587 - Username:
[email protected] - Password:
[T6rf{?-!HcL - Email To:
[email protected]
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6170e9d134809ea571ba213c0d32ff5301ec36bbb807a49c16252e0e2112f355.exe"C:\Users\Admin\AppData\Local\Temp\6170e9d134809ea571ba213c0d32ff5301ec36bbb807a49c16252e0e2112f355.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6170e9d134809ea571ba213c0d32ff5301ec36bbb807a49c16252e0e2112f355.exe"C:\Users\Admin\AppData\Local\Temp\6170e9d134809ea571ba213c0d32ff5301ec36bbb807a49c16252e0e2112f355.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38B
MD509e985a98beb49d2e4e39bcc53418fcb
SHA1115f25c7aac7f7109e072ddae02d0fda28633ce9
SHA2565edbc616b4c34d75203eb67a629506f1529cfc87576cd1e9a541e2614889a59e
SHA51222f3db81b752e634ed33c280b83c0a5fc02360cc8838f27650bbd647de7bf2dbdf894cb86cc28c9b35bb10c8ef59c4d8a844882b627b8765cb1a331af4d065a2
-
Filesize
5B
MD5e2fecc970546c3418917879fe354826c
SHA163f1c1dd01b87704a6b6c99fd9f141e0a3064f16
SHA256ff91566d755f5d038ae698a2cc0a7d4d14e5273afafc37b6f03afda163768fa0
SHA5123c4a68cbaee94f986515f43305a0e7620c14c30213d4a17db4a3e8a1b996764eb688bf733f472fc52073c2c80bb5229bb29411d7601aefe1c4370e230c341a0a
-
Filesize
46B
MD50553e87a8f74189e757bfada8ab0ab9e
SHA1f4c99fe7e957926b88a46ae93d2f02b855f6d88f
SHA2562ccb8084cb357c920cad749dcb3a4c25339f530c9947dfc8e1f1d54cb7b0ce24
SHA5128df3168e8f53b40ddf4b2e83d4e3cad2c88edfb484292e263ee5264d7992af6f1aa8a3618f5e90a02082a3642a894bfae43853b35abaef833a8aa5b590fc70fc
-
Filesize
12KB
MD5564bb0373067e1785cba7e4c24aab4bf
SHA17c9416a01d821b10b2eef97b80899d24014d6fc1
SHA2567a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
SHA51222c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
-
Filesize
4B
MD5cde63b34c142af0a38cbe83791c964f8
SHA1ece2b194b486118b40ad12c1f0e9425dd0672424
SHA25665e2d70166c9a802b7ad2a87129b8945f083e5f268878790a9d1f1c03f47938d
SHA5120559d3d34ad64ccc27e685431c24fc6ead0f645db14fa0e125a64fb67dbd158c15432c1fc5407811aac8a3486090dfbcfcbc3c6bf5aa0ec73f979ef62d14853c
-
Filesize
6B
MD550484c19f1afdaf3841a0d821ed393d2
SHA1c65a0fb7e74ffd2c9fc3a0f9aacb0f6a24b0a68b
SHA2566923dd1bc0460082c5d55a831908c24a282860b7f1cd6c2b79cf1bc8857c639c
SHA512d51a20d67571fe70bcd6c36e1382a3c342f42671c710090b75fcfc2405ce24488e03a7131eefe4751d0bd3aeaad816605ad10c8e3258d72fcf379e32416cbf3b
-
Filesize
8B
MD5c3cb69218b85c3260387fb582cb518dd
SHA1961c892ded09a4cbb5392097bb845ccba65902ad
SHA2561c329924865741e0222d3ead23072cfbed14f96e2b0432573068eb0640513101
SHA5122402fffeb89c531db742bf6f5466eee8fe13edf97b8ecfc2cace3522806b322924d1ca81dda25e59b4047b8f40ad11ae9216e0a0d5c7fc6beef4368eb9551422
-
Filesize
9B
MD52b3884fe02299c565e1c37ee7ef99293
SHA1d8e2ef2a52083f6df210109fea53860ea227af9c
SHA256ae789a65914ed002efb82dad89e5a4d4b9ec8e7faae30d0ed6e3c0d20f7d3858
SHA512aeb9374a52d0ad99336bfd4ec7bb7c5437b827845b8784d9c21f7d96a931693604689f6adc3ca25fad132a0ad6123013211ff550f427fa86e4f26c122ac6a0fe
-
Filesize
10B
MD59a53fc1d7126c5e7c81bb5c15b15537b
SHA1e2d13e0fa37de4c98f30c728210d6afafbb2b000
SHA256a7de06c22e4e67908840ec3f00ab8fe9e04ae94fb16a74136002afbaf607ff92
SHA512b0bffbb8072dbdcfc68f0e632f727c08fe3ef936b2ef332c08486553ff2cef7b0bcdb400e421a117e977bb0fac17ce4706a8097e32d558a918433646b6d5f1a1
-
Filesize
14B
MD5588cf7cdaab7fececa39c175c806ac8a
SHA1c05dd1da9fe6f60c6480d5a7fe568bd231efcc01
SHA2568ffa16681c60f9e5ae447896f50bebc45c5d27cb31e6ca97eaf3def44a2701f7
SHA5127264057bad861cbfbf4aeb62c211b726c94540247e5a2282057ef2e583c4b6f1bc1c441217f68c6d280c7f4990ceaab6cd7fc34758375b3d89e3eae25d75e567
-
Filesize
23B
MD5cc425c0e67a76a3ef42ffd875ac98788
SHA181867852fcd85548b1dc0d6a4acd4135055ff869
SHA2562787c54979c964e4cc50064d4d89581a327a02067a8efb1be41764f428e9b5ee
SHA512da263e2abfe2b2f1809edd4f67e76051141c16ddc1fd8c19f24e494c1e2bde6cdc099799bedac0cdcc2b5e06a1d6ea2d582023d4dbfb0cf03a690f7daa09d8a6
-
Filesize
27B
MD5a4fef08db3bf7402436db287f01bb2fc
SHA166c9356fcc83fdda2e04821fa06ab8bee4f26720
SHA25692bbc71aa04b34f3d6666861e615244db3d3be6f1287b3947115ea9d0e98a5d7
SHA5123da695803076c9b338d9fac3d9da91ac8e0f8b4fb28665ad175325684a5688e83f56bff62766d99583ea9b2a0e394ad64f4fff3fc45b3fe154e6b4026ef7a44a
-
Filesize
60B
MD5dc20d371a66b17ae4300313162f19370
SHA1e090de3b1594f45f496ca2c90e4c5a05413e7757
SHA256dc380ad18fa1ba0a6286fb304779e99981aaa461b64d44e81523c5cf04d50a44
SHA512d83b9b9ec8bf3a19e60bf372a2e61ecbd5afe12946562281f84c9469ed1d82d8a18bb2b789c1112430616b0bdfecaa29a81796d464bb3d6a8862787d15d79690
-
Filesize
26B
MD517425c43be7fbedcbfb1934f0dc3e914
SHA18217a08d1c7fdbf5499aa5297e476cf38c12b8a6
SHA2562e731782503bbf3b2fa333ff6e2da7c873dfeb1d11a25c5e7a013c11fb7028a1
SHA5123a8a521c6c0fd50b15fb086a3bbc9d03b048c06350cc2812f214fcc73720c5f6d931fce0889ed4f36d8f3fb1402ebe2f23167b206e18d969296658d28971aed2
-
Filesize
44B
MD5c28cb7c17eab97eb45ed898f2a6eabc5
SHA14f97fd794bd95bf8e33b4461af665fb45e85a007
SHA2563b57948c872ef93f0cf214c29a8845c604a2615d5ec00803caea145f6e17a456
SHA512ab07ea2aeb37dc66267e520f5195ad7532c720d026ca83914440d2f9e58d4f56fb9c660346745112c72cce6c650a0b2629dfeb99976de037d937cdd92718b339
-
Filesize
53B
MD5634a2be8aa840faec05e36922f5c5f4c
SHA1510025b8b6656006cf503cd6d3eb0eec4c56599b
SHA2560512df16ebad34af394f62351f39d1e89ad3af08edf57491a9b27b8ba7f520e7
SHA512730ecc67dd0637c0ec8409b73e9569adab96474038675190e2e2858127840ab1c73669c0b6704fcd2b9f53e926b95a357b6a19487d08113caea3a0ef20b96970
-
Filesize
33B
MD5cea01eef869275aa756d608e89aa08a0
SHA1263e370ea1719da6115da34655bb1cbe7a0ec1e2
SHA25686093ec9c019f200f7c265fffd5076c99d89f44cc04dfbe9aee58256cc381a29
SHA512b1e2efa2c361f1cc8db364d229f284594d0fa9b4769818356d32cf9c79aa3501a95d2d69f81179b1796dbb958bc90c21619bbe76d537885093ed0b324fe4dd08
-
Filesize
46.3MB
-
Filesize
46.3MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
46.3MB
-
Filesize
46.3MB
-
Filesize
18.3MB
-
Filesize
46.3MB
-
Filesize
18.3MB
-
Filesize
264KB
-
Filesize
5.6MB
-
Filesize
46.3MB
-
Filesize
624KB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
40KB