Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17/04/2022, 14:49
Static task
static1
Behavioral task
behavioral1
Sample
3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6.dll
Resource
win7-20220414-en
General
-
Target
3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6.dll
-
Size
269KB
-
MD5
93f753348d597c11766bbec6543e95a5
-
SHA1
128dbeb3464799d9ac4873a40c067691b9fb06e5
-
SHA256
3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6
-
SHA512
e5df0a6513bc1b4201cd54e3d6ab12ad80724e0918ede61c9f070ae8b5b86bddd691bf053404c44deef132adc049272136233190711bf65c353b3dbbe02d06ba
Malware Config
Extracted
zloader
kev
15/10
https://combotraining.fr/wpdrxl.php
https://jokilink.com/4wjgxc.php
https://latinosconstruction.com/adfuon.php
https://liciousbbl.com/vuadtm.php
https://kingbhavthanbetepos.tk/wp-smarts.php
https://piksellat.com/tcsrog.php
-
build_id
169
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4904 wrote to memory of 624 4904 rundll32.exe 83 PID 4904 wrote to memory of 624 4904 rundll32.exe 83 PID 4904 wrote to memory of 624 4904 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6.dll,#12⤵PID:624
-