Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
13/12/2023, 15:44
Behavioral task
behavioral1
Sample
Slaapkop_Server_Giveaway.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Slaapkop_Server_Giveaway.exe
Resource
win10v2004-20231127-en
General
-
Target
Slaapkop_Server_Giveaway.exe
-
Size
17.6MB
-
MD5
5abe4b4c293a8b8651d949cfaeb3f135
-
SHA1
4c93b6944596bf5d2cec3dd223b10faa072561e5
-
SHA256
fb89c444bd38067962cb3af49e0941e914414c30655524740003ec019bf7e126
-
SHA512
52db1929f5d85e59611ac3fd71364d7b7863c7df7c531e1f30a05f188948e96a51be02c3c69ecee60d1cc0fc9d8ffdc69e6b82b15c136a4eb86faa9eefa40da1
-
SSDEEP
393216:e1qPnLFXlrVgQpDOETgsvfGasgzlpvEcv54Z6Laq:FPLFXN6QoEQWcI4ZIL
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1832 Slaapkop_Server_Giveaway.exe -
resource yara_rule behavioral1/files/0x000500000001a31b-111.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1100 wrote to memory of 1832 1100 Slaapkop_Server_Giveaway.exe 28 PID 1100 wrote to memory of 1832 1100 Slaapkop_Server_Giveaway.exe 28 PID 1100 wrote to memory of 1832 1100 Slaapkop_Server_Giveaway.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Slaapkop_Server_Giveaway.exe"C:\Users\Admin\AppData\Local\Temp\Slaapkop_Server_Giveaway.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\Slaapkop_Server_Giveaway.exe"C:\Users\Admin\AppData\Local\Temp\Slaapkop_Server_Giveaway.exe"2⤵
- Loads dropped DLL
PID:1832
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378