Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1027f824a80e...71.exe
windows7-x64
1027f824a80e...71.exe
windows10-2004-x64
102c4115951e...47.exe
windows7-x64
102c4115951e...47.exe
windows10-2004-x64
10500c00d4d7...0a.exe
windows7-x64
1500c00d4d7...0a.exe
windows10-2004-x64
373592f050e...1c.exe
windows7-x64
1073592f050e...1c.exe
windows10-2004-x64
10b086986db5...76.exe
windows7-x64
10b086986db5...76.exe
windows10-2004-x64
10b99dab26a9...fc.exe
windows7-x64
10b99dab26a9...fc.exe
windows10-2004-x64
10c9fc6dc8c8...e6.exe
windows7-x64
10c9fc6dc8c8...e6.exe
windows10-2004-x64
10caf5832156...ad.exe
windows7-x64
10caf5832156...ad.exe
windows10-2004-x64
10cf18bda81a...a2.exe
windows7-x64
10cf18bda81a...a2.exe
windows10-2004-x64
10d1f1126921...3e.exe
windows7-x64
10d1f1126921...3e.exe
windows10-2004-x64
10e329eaa5c0...cd.exe
windows7-x64
10e329eaa5c0...cd.exe
windows10-2004-x64
10eba45a34e3...0b.exe
windows7-x64
10eba45a34e3...0b.exe
windows10-2004-x64
10Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/03/2025, 02:17
Behavioral task
behavioral1
Sample
27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral3
Sample
2c4115951e3a55fe85cf0ebb6fcf5e65ccbebfa0774a3f15db7856b74e8e6647.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
2c4115951e3a55fe85cf0ebb6fcf5e65ccbebfa0774a3f15db7856b74e8e6647.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral5
Sample
500c00d4d789bb18252fd5f3fe5ce41ae7afc1175dfeb0eb9553636c2c15450a.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
500c00d4d789bb18252fd5f3fe5ce41ae7afc1175dfeb0eb9553636c2c15450a.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral7
Sample
73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral9
Sample
b086986db5990b434fbf33a030d727d4a5316c5cc154ebf0c1b9433833670176.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
b086986db5990b434fbf33a030d727d4a5316c5cc154ebf0c1b9433833670176.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral11
Sample
b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral13
Sample
c9fc6dc8c8dbff7eff9a199440ef52348cf2d410da5d6940d3648d6fa1f568e6.exe
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
c9fc6dc8c8dbff7eff9a199440ef52348cf2d410da5d6940d3648d6fa1f568e6.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral15
Sample
caf5832156e063db5f23ccdb510600cefc45d65281d57771f19637daf7f3d7ad.exe
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
caf5832156e063db5f23ccdb510600cefc45d65281d57771f19637daf7f3d7ad.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral17
Sample
cf18bda81a0c95a61a47ece2c1fd879e86e3f1fbd64f3e291fee2d5ca96171a2.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
cf18bda81a0c95a61a47ece2c1fd879e86e3f1fbd64f3e291fee2d5ca96171a2.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral19
Sample
d1f112692188b7a7cd36cafc7751da401af6d5e6ff73a89ea988c553d00bd93e.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
d1f112692188b7a7cd36cafc7751da401af6d5e6ff73a89ea988c553d00bd93e.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral21
Sample
e329eaa5c013df43ea579571a5ae4d65f8cfd04809aeeb219551c80d6ff42bcd.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
e329eaa5c013df43ea579571a5ae4d65f8cfd04809aeeb219551c80d6ff42bcd.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral23
Sample
eba45a34e3dfa65dd307af9f5c018bf48aeb4a08fac42ca2899f9334b34e870b.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
eba45a34e3dfa65dd307af9f5c018bf48aeb4a08fac42ca2899f9334b34e870b.exe
Resource
win10v2004-20250217-en
General
-
Target
27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe
-
Size
1.3MB
-
MD5
2e6372abf5c58a233b273eb612950567
-
SHA1
aed459512d857a0a6248cc9cb5785963a335b47e
-
SHA256
27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71
-
SHA512
ce06d3aa738e8f466c0e2be8cd9e2a79c286f4af4c7ed88da95d8b93bfa998e705eb25b6f5c9ae8d1d11fe4787f0c743edefae985d8756e822b1b003fcd61107
-
SSDEEP
24576:7bx5ACyRtvPExqgcSSu5bqhD92oK8t7yz5b/UXq60Lnyx2M3TttxnvR:vAVRBPhbSFAhcKtYiq60LnKTVnp
Malware Config
Extracted
blustealer
Protocol: smtp- Host:
efinancet.shop - Port:
587 - Username:
[email protected] - Password:
HCYis3WEB8!Z
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Blustealer family
-
Executes dropped EXE 1 IoCs
pid Process 480 snto.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1276 set thread context of 2776 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snto.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1800 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe Token: SeDebugPrivilege 480 snto.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2776 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1276 wrote to memory of 2776 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 31 PID 1276 wrote to memory of 2776 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 31 PID 1276 wrote to memory of 2776 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 31 PID 1276 wrote to memory of 2776 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 31 PID 1276 wrote to memory of 2776 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 31 PID 1276 wrote to memory of 2776 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 31 PID 1276 wrote to memory of 2776 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 31 PID 1276 wrote to memory of 2776 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 31 PID 1276 wrote to memory of 2776 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 31 PID 1276 wrote to memory of 2688 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 32 PID 1276 wrote to memory of 2688 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 32 PID 1276 wrote to memory of 2688 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 32 PID 1276 wrote to memory of 2688 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 32 PID 1276 wrote to memory of 2732 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 33 PID 1276 wrote to memory of 2732 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 33 PID 1276 wrote to memory of 2732 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 33 PID 1276 wrote to memory of 2732 1276 27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe 33 PID 2688 wrote to memory of 1800 2688 cmd.exe 36 PID 2688 wrote to memory of 1800 2688 cmd.exe 36 PID 2688 wrote to memory of 1800 2688 cmd.exe 36 PID 2688 wrote to memory of 1800 2688 cmd.exe 36 PID 2136 wrote to memory of 480 2136 taskeng.exe 39 PID 2136 wrote to memory of 480 2136 taskeng.exe 39 PID 2136 wrote to memory of 480 2136 taskeng.exe 39 PID 2136 wrote to memory of 480 2136 taskeng.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe"C:\Users\Admin\AppData\Local\Temp\27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe"C:\Users\Admin\AppData\Local\Temp\27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2776
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\snto\snto.exe'" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\snto\snto.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1800
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe" "C:\Users\Admin\AppData\Roaming\snto\snto.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2732
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {96A3E92F-DA41-47DD-90C7-974CF51C2C74} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Roaming\snto\snto.exeC:\Users\Admin\AppData\Roaming\snto\snto.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD52e6372abf5c58a233b273eb612950567
SHA1aed459512d857a0a6248cc9cb5785963a335b47e
SHA25627f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71
SHA512ce06d3aa738e8f466c0e2be8cd9e2a79c286f4af4c7ed88da95d8b93bfa998e705eb25b6f5c9ae8d1d11fe4787f0c743edefae985d8756e822b1b003fcd61107