Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
10/02/2022, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
nouactelegram.vmp.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
nouactelegram.vmp.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
nouactelegram.vmp.dll
-
Size
5.5MB
-
MD5
52703c8091a4e3ac70d95c6acbf7dd0d
-
SHA1
671467744181cd12695db8e5ba1d79b0d83271c0
-
SHA256
02dfd5448fecf132e9c2062dce335945d220e7fd1a0ab0885ac20d409da02bbf
-
SHA512
ae54f063f36e13f6f04971b54dc19cb915a774dd0f35035c13ca61ce716515b9740695cae5035ff66bc5a44cf9c9d4979f21e5eab2409920cb0ec0fdb781bf90
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet Payload 1 IoCs
resource yara_rule behavioral2/memory/4196-136-0x0000000010000000-0x0000000010017000-memory.dmp unk_chinese_botnet -
Blocklisted process makes network request 8 IoCs
flow pid Process 22 4196 rundll32.exe 25 4196 rundll32.exe 37 4196 rundll32.exe 50 4196 rundll32.exe 53 4196 rundll32.exe 54 4196 rundll32.exe 55 4196 rundll32.exe 60 4196 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4196 rundll32.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4196 rundll32.exe 4196 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4536 svchost.exe Token: SeCreatePagefilePrivilege 4536 svchost.exe Token: SeShutdownPrivilege 4536 svchost.exe Token: SeCreatePagefilePrivilege 4536 svchost.exe Token: SeShutdownPrivilege 4536 svchost.exe Token: SeCreatePagefilePrivilege 4536 svchost.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe Token: SeRestorePrivilege 1120 TiWorker.exe Token: SeSecurityPrivilege 1120 TiWorker.exe Token: SeBackupPrivilege 1120 TiWorker.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4320 wrote to memory of 4196 4320 rundll32.exe 84 PID 4320 wrote to memory of 4196 4320 rundll32.exe 84 PID 4320 wrote to memory of 4196 4320 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\nouactelegram.vmp.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\nouactelegram.vmp.dll,#12⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4196
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1120