Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    26s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    05/02/2022, 08:24

General

  • Target

    ec0f8a5cc597e97224b6f32f462a1e97f10380c2c45ea31a89059c1d2c08a003.dll

  • Size

    561KB

  • MD5

    a01c8c45a9e54684ae643dd409110ac8

  • SHA1

    2124dc39d9ba939a83fbc5782772a0e062998f92

  • SHA256

    ec0f8a5cc597e97224b6f32f462a1e97f10380c2c45ea31a89059c1d2c08a003

  • SHA512

    d277f8b95fd331811c04221abe1d85ef0cf09c07590fe7025c7e46a268ccd5f5f0768a91aa2c2f7fcf9167e703bc14c9a7a047084906710b41308e5a636aaeb2

Malware Config

Extracted

Family

zloader

Botnet

08/04

C2

https://kuaxbdkvbbmivbxkrrev.com/wp-config.php

https://hwbblyyrb.pw/wp-config.php

Attributes
  • build_id

    134

rc4.plain

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec0f8a5cc597e97224b6f32f462a1e97f10380c2c45ea31a89059c1d2c08a003.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:964
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec0f8a5cc597e97224b6f32f462a1e97f10380c2c45ea31a89059c1d2c08a003.dll,#1
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/672-59-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB

  • memory/672-58-0x0000000000120000-0x0000000000153000-memory.dmp

    Filesize

    204KB

  • memory/672-60-0x0000000000120000-0x0000000000153000-memory.dmp

    Filesize

    204KB

  • memory/672-62-0x0000000000120000-0x0000000000153000-memory.dmp

    Filesize

    204KB

  • memory/960-54-0x00000000760F1000-0x00000000760F3000-memory.dmp

    Filesize

    8KB

  • memory/960-56-0x0000000074D80000-0x0000000074E2C000-memory.dmp

    Filesize

    688KB

  • memory/960-55-0x0000000074D80000-0x0000000074DB3000-memory.dmp

    Filesize

    204KB

  • memory/960-57-0x0000000000180000-0x0000000000181000-memory.dmp

    Filesize

    4KB