Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2022, 21:18
Static task
static1
Behavioral task
behavioral1
Sample
conceptions.dll
Resource
win7-20220812-en
3 signatures
150 seconds
General
-
Target
conceptions.dll
-
Size
883KB
-
MD5
d5b106db0aebeb2edceec3fb0f19c046
-
SHA1
95d23823714fe000403ff3ef32bf18e71949eab9
-
SHA256
4b46f3597b581e577e93abd1ebd24cba17af94a46d38d22ad3b6119724246005
-
SHA512
f206d6356cbf3a7115c9d3adc7fae85a56fd24d2c892cda2836848c98228e0cb4b00eb0124fccce729ad8a8e9dd2e9f4360f61a750c32df6c73507e36e2c96aa
-
SSDEEP
24576:2f6BQALM7DbRurHhQtfUt9D3cnVBQ8praeLyv2unUN74:2f6CALMt0hx3D36B7ZaersUNc
Malware Config
Extracted
Family
bumblebee
Botnet
0211r
C2
193.109.120.156:443
192.111.146.184:443
104.219.233.113:443
rc4.plain
Signatures
-
Blocklisted process makes network request 6 IoCs
flow pid Process 16 4888 rundll32.exe 21 4888 rundll32.exe 36 4888 rundll32.exe 41 4888 rundll32.exe 43 4888 rundll32.exe 44 4888 rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4888 rundll32.exe