Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 17:35
Static task
static1
Behavioral task
behavioral1
Sample
d5b02188e29d9882ae02a128339e41ad800ce8da42d5470df8965b21fdd243de.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d5b02188e29d9882ae02a128339e41ad800ce8da42d5470df8965b21fdd243de.exe
Resource
win10v2004-20220901-en
General
-
Target
d5b02188e29d9882ae02a128339e41ad800ce8da42d5470df8965b21fdd243de.exe
-
Size
729KB
-
MD5
f742793837e460a809fa0356c82db7b4
-
SHA1
75034b12a3efab5c09128547281cbdc35606939d
-
SHA256
d5b02188e29d9882ae02a128339e41ad800ce8da42d5470df8965b21fdd243de
-
SHA512
8cd3011174bfdebc7a3bc1c5a45aa5408352eb427aca51a5f67f5f0e98fe09728600062c7360ec57764287ef1fe184642619c3d8dcb7928cd6f6b7ded4481345
-
SSDEEP
12288:68PxehZgYJYSh+0NysNwjiKI58ConJt2yGuVAu/Il5fJLUx7r:HsbgYJYe+00s2GK9CGtWuVinJL67r
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral1/memory/1948-55-0x0000000000400000-0x0000000000578000-memory.dmp modiloader_stage2 behavioral1/memory/1948-56-0x0000000000400000-0x0000000000578000-memory.dmp modiloader_stage2 behavioral1/memory/1948-58-0x0000000000400000-0x0000000000578000-memory.dmp modiloader_stage2 behavioral1/memory/1948-59-0x0000000000400000-0x0000000000578000-memory.dmp modiloader_stage2 behavioral1/memory/1948-61-0x0000000000400000-0x0000000000578000-memory.dmp modiloader_stage2 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt d5b02188e29d9882ae02a128339e41ad800ce8da42d5470df8965b21fdd243de.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 956 1948 d5b02188e29d9882ae02a128339e41ad800ce8da42d5470df8965b21fdd243de.exe 27 PID 1948 wrote to memory of 956 1948 d5b02188e29d9882ae02a128339e41ad800ce8da42d5470df8965b21fdd243de.exe 27 PID 1948 wrote to memory of 956 1948 d5b02188e29d9882ae02a128339e41ad800ce8da42d5470df8965b21fdd243de.exe 27 PID 1948 wrote to memory of 956 1948 d5b02188e29d9882ae02a128339e41ad800ce8da42d5470df8965b21fdd243de.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5b02188e29d9882ae02a128339e41ad800ce8da42d5470df8965b21fdd243de.exe"C:\Users\Admin\AppData\Local\Temp\d5b02188e29d9882ae02a128339e41ad800ce8da42d5470df8965b21fdd243de.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵PID:956
-