Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
ZealotAlli...lp.chm
windows7-x64
1ZealotAlli...lp.chm
windows10-2004-x64
1ZealotAlli....2.dll
windows7-x64
3ZealotAlli....2.dll
windows10-2004-x64
3ZealotAlli....7.dll
windows7-x64
3ZealotAlli....7.dll
windows10-2004-x64
3ZealotAlli....0.dll
windows7-x64
1ZealotAlli....0.dll
windows10-2004-x64
1ZealotAlli...��.exe
windows7-x64
1ZealotAlli...��.exe
windows10-2004-x64
1ZealotAlli...er.exe
windows7-x64
1ZealotAlli...er.exe
windows10-2004-x64
1ZealotAlli...��.htm
windows7-x64
1ZealotAlli...��.htm
windows10-2004-x64
1ZealotAlli...��.url
windows7-x64
1ZealotAlli...��.url
windows10-2004-x64
1ZealotAlli...��.url
windows7-x64
1ZealotAlli...��.url
windows10-2004-x64
1ZealotAlli...��.url
windows7-x64
1ZealotAlli...��.url
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 21:48
Static task
static1
Behavioral task
behavioral1
Sample
ZealotAllideoConverter/All Video Converter/Help/Help.chm
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ZealotAllideoConverter/All Video Converter/Help/Help.chm
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
ZealotAllideoConverter/All Video Converter/libavidd-1.3.2.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
ZealotAllideoConverter/All Video Converter/libavidd-1.3.2.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
ZealotAllideoConverter/All Video Converter/libfilefmt-1.4.7.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
ZealotAllideoConverter/All Video Converter/libfilefmt-1.4.7.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
ZealotAllideoConverter/All Video Converter/libmcl-4.3.0.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
ZealotAllideoConverter/All Video Converter/libmcl-4.3.0.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
ZealotAllideoConverter/All Video Converter/soft2cn.com汉化说明.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
ZealotAllideoConverter/All Video Converter/soft2cn.com汉化说明.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
ZealotAllideoConverter/All Video Converter/videoconverter.exe
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
ZealotAllideoConverter/All Video Converter/videoconverter.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
ZealotAllideoConverter/All Video Converter/必看说明.htm
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
ZealotAllideoConverter/All Video Converter/必看说明.htm
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
ZealotAllideoConverter/All Video Converter/河源下载站.url
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
ZealotAllideoConverter/All Video Converter/河源下载站.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
ZealotAllideoConverter/All Video Converter/用firefox浏览器上网包安全.url
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
ZealotAllideoConverter/All Video Converter/用firefox浏览器上网包安全.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
ZealotAllideoConverter/All Video Converter/金山毒霸2007 无限升级版.url
Resource
win7-20220901-en
Behavioral task
behavioral20
Sample
ZealotAllideoConverter/All Video Converter/金山毒霸2007 无限升级版.url
Resource
win10v2004-20221111-en
General
-
Target
ZealotAllideoConverter/All Video Converter/libfilefmt-1.4.7.dll
-
Size
3.2MB
-
MD5
7dfc4512ad8f1febd65b1f1b9a7c2f8f
-
SHA1
1d0708a36281f1baef5b7e66a4c420b8f29c264b
-
SHA256
17154a1f78d12683f9e2758da951f51dec39c859ce56d2d3e7ec58696cd9185d
-
SHA512
3932f4b01529ac9abf83229373085c3acdb89a9341f903016848ad39ab3369738c6f7f4c7f1ecaed3341122b511b088707991bc6e5699446df4254ab2f3fe49a
-
SSDEEP
98304:QddVvEmIO7CFwc8tz3k3Ay9YKPa4TMoItu:QdfvEmX7YwBz3+Ay9Yqa4o1tu
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4884 4228 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1700 wrote to memory of 4228 1700 rundll32.exe 81 PID 1700 wrote to memory of 4228 1700 rundll32.exe 81 PID 1700 wrote to memory of 4228 1700 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZealotAllideoConverter\All Video Converter\libfilefmt-1.4.7.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZealotAllideoConverter\All Video Converter\libfilefmt-1.4.7.dll",#12⤵PID:4228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 6043⤵
- Program crash
PID:4884
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4228 -ip 42281⤵PID:3568