Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2022, 13:08
Static task
static1
Behavioral task
behavioral1
Sample
dbbd5f34648cc1a20d0022c47a6531a6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dbbd5f34648cc1a20d0022c47a6531a6.exe
Resource
win10v2004-20220812-en
General
-
Target
dbbd5f34648cc1a20d0022c47a6531a6.exe
-
Size
940KB
-
MD5
dbbd5f34648cc1a20d0022c47a6531a6
-
SHA1
84bc195e56cdc6804cb987af330608ef5b173a67
-
SHA256
f8612ea8ab764a3d09157a9b90dc418ec2a7b8af22b29ce63d375896f9ec9a28
-
SHA512
6d44509bfb38afe4490034736e20dc59cd97de0a4e8cdbdddcd353f7ba5a470a1288f6a2761fa31d4c81bfdf0f6dc8cd56581e27f138e783ecea3e520d9819b3
-
SSDEEP
24576:xuLJQ0+ai+JoMCXlTjcEa0s4Tj29W8AoqiVNWI:xUpRx+cEa0Q
Malware Config
Extracted
formbook
chof
1UnM9v3V2HuR2iE=
B4oRF6xBBhDKMJEdaPRiEAw0
r9++/ZEvBh3jRD0FzE01EA==
8qVuosqPI0JfNJGbZ15FT4J8Ng==
83F9+6BFk45ZYEWU04g=
aFPhK8qZoK5CUsemIC+pMoA=
hHkCihi3/HESewQJvpc=
GUMdYJRn7phVzbCTl1BDFg==
aqh5D/PNZYKH3xjDlAoz
P7NS0gXlNFVl
tS/FQFfydoZW6R2I
249T0dBwbVJp
7qNui6I3hCL3vpf5UgKVL+po4YZw
6A/tRMtieCQf/TMU1/8pJbScylADQJRwXA==
b6N1CLSByGdvSIFl6KkVYOlmEoA=
HNGX1Q3YXPxV7ceaT0w/T4J8Ng==
WwvO/0jw8ICLWo9w860VYelmEoA=
Mfa58tV8e9xs5FfhMi+pMoA=
ZOB69iIBTXJ2
EUENQq5AXeCoh8TO0BI5T4J8Ng==
gXELdRu8vHgoK4l6ToaDY0qpdJB2
ta0+dAEnNS8r3g==
VQrFVM9qqUdLS5l0RXiMcyJGO04G2g==
r+e19KJCAiYIabMvdvtiEAw0
mM+X2CgM/hPeV9YbHxExDw==
XcNh4+SnymQ7uKORl1BDFg==
WdM/cYkWX/KR46x3OHGagClGO04G2g==
EZAvpsqfYnRawf+RIC+pMoA=
i7+ABzQM1PIAbbgaLbYy9fot
qDe4BbViMVxMmWVYcfdiEAw0
QDaz5pg98wLCvaxC05ELYelmEoA=
LmY0xeSGGjM5vyh8hv9iEAw0
2AfUA5Ak+gqfNrO+iQ==
JeeW6aN0a8VFPyk=
JNmkLV467YU6G1Uh4ho8T4J8Ng==
xO2wGqQtNKx+b8iaHC+pMoA=
Pjes2krS3G5Dt/w59wTsFVDQMw==
i4kmpwfsNS8r3g==
moUpsz7hHqmJPtfMkA==
114cJsGrpkq1LVb0xk01EA==
kkAMpuCB/Asbe8ACvtKLT4J8Ng==
3NtobYxp8Ic7GBVdkCBWRBpFO04G2g==
iogankkbofjdyQ==
Pq1LrLsxofjdyQ==
woJbqLh8TolW6R2I
vSer9eC99JODPtfMkA==
Aj0Ik8OcXLN50BSK
XxvQ8yL8eRjNNBLwwQQ1T4J8Ng==
TVvoREBtofjdyQ==
SvfKCwmeIsaFdOXAl1BDFg==
7Bnc8NqfdHEcG0xmtIA=
Tm4ou0cZHMq+wQ==
oc2j6/eQF7Z5PEhOjUHnU4g=
kbt/0PENUGBv
5nHsEx7ibX594hGYIy+pMoA=
GGAZZ5Zc7eWZjnfbLC+pMoA=
nowYfSgENL7G0Uo+zZYLXelmEoA=
vjO7ODzipbmxO5zm4yZiEAw0
bhz3W4JEFznSkQiC
yTq19Rjkaw7APS4K5CZiEAw0
xHVXmkkeH0Yhlg7DlAoz
t+2+P0fcW/hW6R2I
fQGL1Nxp9AOvZ8AyegEnKGlGLeLL0g==
eN5lagri4S6g8SmK15MVYelmEoA=
saludentruiznatural.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 63 IoCs
resource yara_rule behavioral2/memory/1084-132-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-135-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-134-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-136-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-138-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-137-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-139-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-140-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-141-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-142-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-143-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-144-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-145-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-146-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-147-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-148-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-149-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-150-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-151-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-152-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-153-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-154-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-155-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-156-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-157-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-158-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-159-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-160-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-161-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-162-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-163-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-164-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-165-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-166-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-167-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-168-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-169-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-171-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-170-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-172-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-173-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-174-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-175-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-176-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-177-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-178-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-179-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-180-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-181-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-182-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-183-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-184-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-185-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-186-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-187-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-188-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-189-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-191-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-190-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-192-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-193-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-194-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 behavioral2/memory/1084-195-0x0000000003ED0000-0x0000000003F34000-memory.dmp modiloader_stage2 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pvyrhguhmgaurbqhsyxdecmyljns = "C:\\Users\\Public\\Libraries\\snjlymcedxyshqbruagmhughryvP.url" dbbd5f34648cc1a20d0022c47a6531a6.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2204 set thread context of 2212 2204 mspaint.exe 37 PID 4620 set thread context of 2212 4620 cmd.exe 37 -
description ioc Process Key created \Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 2204 mspaint.exe 2204 mspaint.exe 2204 mspaint.exe 2204 mspaint.exe 2204 mspaint.exe 2204 mspaint.exe 2204 mspaint.exe 2204 mspaint.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2212 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2204 mspaint.exe 2204 mspaint.exe 2204 mspaint.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe 4620 cmd.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2204 mspaint.exe Token: SeShutdownPrivilege 2212 Explorer.EXE Token: SeCreatePagefilePrivilege 2212 Explorer.EXE Token: SeDebugPrivilege 4620 cmd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1084 wrote to memory of 2204 1084 dbbd5f34648cc1a20d0022c47a6531a6.exe 89 PID 1084 wrote to memory of 2204 1084 dbbd5f34648cc1a20d0022c47a6531a6.exe 89 PID 1084 wrote to memory of 2204 1084 dbbd5f34648cc1a20d0022c47a6531a6.exe 89 PID 1084 wrote to memory of 2204 1084 dbbd5f34648cc1a20d0022c47a6531a6.exe 89 PID 1084 wrote to memory of 2204 1084 dbbd5f34648cc1a20d0022c47a6531a6.exe 89 PID 1084 wrote to memory of 2204 1084 dbbd5f34648cc1a20d0022c47a6531a6.exe 89 PID 2212 wrote to memory of 4620 2212 Explorer.EXE 91 PID 2212 wrote to memory of 4620 2212 Explorer.EXE 91 PID 2212 wrote to memory of 4620 2212 Explorer.EXE 91 PID 4620 wrote to memory of 4136 4620 cmd.exe 93 PID 4620 wrote to memory of 4136 4620 cmd.exe 93 PID 4620 wrote to memory of 4136 4620 cmd.exe 93
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\dbbd5f34648cc1a20d0022c47a6531a6.exe"C:\Users\Admin\AppData\Local\Temp\dbbd5f34648cc1a20d0022c47a6531a6.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\System32\mspaint.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2064
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4136
-
-