Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
55s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
11/10/2022, 08:10
Static task
static1
General
-
Target
5ff77ec1caed268269b5eddbba772e9a71734d0e5218104574c3095c8230f0b2.exe
-
Size
1.3MB
-
MD5
36f320c2bac97670d986395b825d3831
-
SHA1
ad2073bd894877be5d14204c9b216d303c2e9f19
-
SHA256
5ff77ec1caed268269b5eddbba772e9a71734d0e5218104574c3095c8230f0b2
-
SHA512
a970658982f2d4273abff1b70291f7cac5888a5a669cf3250933a8c8148e47370b12047cb6d50c9078ac6670766fcf06ac85ab1cd28f1e6d38587cd7ba625e84
-
SSDEEP
24576:1SEZYsALHKyUW4J4yZfgas5DGvQCg/FdLZrSbZH9QZ6Pbh8daaki:1SKYsAWyUxayZfgz+QP3LA9d3Pbu4aF
Malware Config
Extracted
Family
danabot
Attributes
-
embedded_hash
56951C922035D696BFCE443750496462
-
type
loader
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3520 wrote to memory of 3680 3520 5ff77ec1caed268269b5eddbba772e9a71734d0e5218104574c3095c8230f0b2.exe 66 PID 3520 wrote to memory of 3680 3520 5ff77ec1caed268269b5eddbba772e9a71734d0e5218104574c3095c8230f0b2.exe 66 PID 3520 wrote to memory of 3680 3520 5ff77ec1caed268269b5eddbba772e9a71734d0e5218104574c3095c8230f0b2.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ff77ec1caed268269b5eddbba772e9a71734d0e5218104574c3095c8230f0b2.exe"C:\Users\Admin\AppData\Local\Temp\5ff77ec1caed268269b5eddbba772e9a71734d0e5218104574c3095c8230f0b2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵PID:3680
-