Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2023, 23:00
Behavioral task
behavioral1
Sample
fe7e6ab79f347ca092fcfd4c0c349dca.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fe7e6ab79f347ca092fcfd4c0c349dca.exe
Resource
win10v2004-20231215-en
General
-
Target
fe7e6ab79f347ca092fcfd4c0c349dca.exe
-
Size
651KB
-
MD5
fe7e6ab79f347ca092fcfd4c0c349dca
-
SHA1
e14d383c51074bd6073ae30f08306ebf10eaf27a
-
SHA256
22c0b06fc10fcc0244ca749e3ed55fcb3f6858178a5800a8cb98fd5ff28a0f02
-
SHA512
2cf78f968330ab6bbfc1dc7d4afb2dfde2dbfc48273bb95c8f5cc00c167e149bec5119073311dbc9b1c3ca94ee19df624c160229f27c3a21ba0fa4303e0c5341
-
SSDEEP
12288:kpyZT1lrCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1ljOD3SxcDDcNDqWYurL0
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 20 IoCs
resource yara_rule behavioral2/memory/2488-3-0x0000000000400000-0x000000000041C000-memory.dmp modiloader_stage2 behavioral2/memory/4428-7-0x0000000000400000-0x0000000000507000-memory.dmp modiloader_stage2 behavioral2/memory/4428-6-0x0000000000400000-0x0000000000507000-memory.dmp modiloader_stage2 behavioral2/memory/988-60-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/4428-65-0x0000000000400000-0x0000000000507000-memory.dmp modiloader_stage2 behavioral2/memory/3596-68-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/3596-71-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/3596-75-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/5096-85-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/3596-111-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/3596-114-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/3596-117-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/4428-118-0x0000000000400000-0x0000000000507000-memory.dmp modiloader_stage2 behavioral2/memory/3596-121-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/3596-123-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/3596-125-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/3596-127-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/3596-129-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/3596-131-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/3596-133-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 1344 dHY4IvP3.exe -
resource yara_rule behavioral2/memory/4428-0-0x0000000000400000-0x0000000000507000-memory.dmp upx behavioral2/memory/4428-7-0x0000000000400000-0x0000000000507000-memory.dmp upx behavioral2/memory/4428-6-0x0000000000400000-0x0000000000507000-memory.dmp upx behavioral2/memory/4428-5-0x0000000000400000-0x0000000000507000-memory.dmp upx behavioral2/memory/4428-1-0x0000000000400000-0x0000000000507000-memory.dmp upx behavioral2/memory/4428-65-0x0000000000400000-0x0000000000507000-memory.dmp upx behavioral2/memory/372-89-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/372-88-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/372-87-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/372-80-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/372-79-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4428-118-0x0000000000400000-0x0000000000507000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2488 set thread context of 4428 2488 fe7e6ab79f347ca092fcfd4c0c349dca.exe 73 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process 3220 372 WerFault.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 3652 tasklist.exe 3156 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1344 dHY4IvP3.exe 1344 dHY4IvP3.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4428 fe7e6ab79f347ca092fcfd4c0c349dca.exe 1344 dHY4IvP3.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2488 wrote to memory of 4428 2488 fe7e6ab79f347ca092fcfd4c0c349dca.exe 73 PID 2488 wrote to memory of 4428 2488 fe7e6ab79f347ca092fcfd4c0c349dca.exe 73 PID 2488 wrote to memory of 4428 2488 fe7e6ab79f347ca092fcfd4c0c349dca.exe 73 PID 2488 wrote to memory of 4428 2488 fe7e6ab79f347ca092fcfd4c0c349dca.exe 73 PID 2488 wrote to memory of 4428 2488 fe7e6ab79f347ca092fcfd4c0c349dca.exe 73 PID 2488 wrote to memory of 4428 2488 fe7e6ab79f347ca092fcfd4c0c349dca.exe 73 PID 2488 wrote to memory of 4428 2488 fe7e6ab79f347ca092fcfd4c0c349dca.exe 73 PID 2488 wrote to memory of 4428 2488 fe7e6ab79f347ca092fcfd4c0c349dca.exe 73 PID 2488 wrote to memory of 4428 2488 fe7e6ab79f347ca092fcfd4c0c349dca.exe 73 PID 4428 wrote to memory of 1344 4428 fe7e6ab79f347ca092fcfd4c0c349dca.exe 92 PID 4428 wrote to memory of 1344 4428 fe7e6ab79f347ca092fcfd4c0c349dca.exe 92 PID 4428 wrote to memory of 1344 4428 fe7e6ab79f347ca092fcfd4c0c349dca.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe7e6ab79f347ca092fcfd4c0c349dca.exe"C:\Users\Admin\AppData\Local\Temp\fe7e6ab79f347ca092fcfd4c0c349dca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\fe7e6ab79f347ca092fcfd4c0c349dca.exefe7e6ab79f347ca092fcfd4c0c349dca.exe2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\dHY4IvP3.exeC:\Users\Admin\dHY4IvP3.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del dHY4IvP3.exe4⤵PID:2816
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
PID:3652
-
-
-
C:\Users\Admin\taiozo.exe"C:\Users\Admin\taiozo.exe"4⤵PID:4928
-
-
-
C:\Users\Admin\azhost.exeC:\Users\Admin\azhost.exe3⤵PID:988
-
C:\Users\Admin\azhost.exeazhost.exe4⤵PID:4000
-
-
-
C:\Users\Admin\bzhost.exeC:\Users\Admin\bzhost.exe3⤵PID:3596
-
-
C:\Users\Admin\czhost.exeC:\Users\Admin\czhost.exe3⤵PID:5096
-
C:\Users\Admin\czhost.execzhost.exe4⤵PID:372
-
-
-
C:\Users\Admin\dzhost.exeC:\Users\Admin\dzhost.exe3⤵PID:4584
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:4540
-
-
-
C:\Users\Admin\ezhost.exeC:\Users\Admin\ezhost.exe3⤵PID:4644
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del fe7e6ab79f347ca092fcfd4c0c349dca.exe3⤵PID:4976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 372 -ip 3721⤵PID:2852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 2281⤵
- Program crash
PID:3220
-
C:\Windows\SysWOW64\tasklist.exetasklist1⤵
- Enumerates processes with tasklist
PID:3156