Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 05:16

General

  • Target

    29a157fe9d33e9520dd77b8e0dfe6dcd.exe

  • Size

    499KB

  • MD5

    29a157fe9d33e9520dd77b8e0dfe6dcd

  • SHA1

    0378da0ae8305b9b54999f3b9e42352ecb464df6

  • SHA256

    715bfe03c147757c14e668fa318ef48287fa96ff8eb888431a84500f062ca789

  • SHA512

    15f24b270c25022e11ea3b6fdce7b6b6af2f2185d173c49a1bf2a9479801fe326c7df49dbff49d9fce737a43627d3cd9bd22e68851eb1315ec43d898c6aa53f4

  • SSDEEP

    12288:RQcRdz8fLCUuoTeAa5tF3Z4mxxnzRwd/2eK+TggG:hdEL6oTe5QmXnz+M5ht

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29a157fe9d33e9520dd77b8e0dfe6dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\29a157fe9d33e9520dd77b8e0dfe6dcd.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del
      2⤵
        PID:3036
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k remoteservice
      1⤵
      • Loads dropped DLL
      PID:2604

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\windows\SysWOW64\sys.dll

      Filesize

      333KB

      MD5

      a0de1d1cfffe0fbcd2d2a2c85d087cc0

      SHA1

      d80e16e1194af186cd25ce5635244fef006a71a9

      SHA256

      860b9788e602dec6c9bd4915602a192d1ff90a42b674273f2f9123ac49aab4d7

      SHA512

      200f5fb9bc3b5e341d6a3d4e12439d36bef82007d11cfc2211696878d4f7d861a7fc998f1394f6a1bbe195e52fcfecbc03afe9ed4238dc309cd8c50f2ed679f5

    • memory/2084-2-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

      Filesize

      4KB

    • memory/2084-1-0x0000000001E10000-0x0000000001E11000-memory.dmp

      Filesize

      4KB

    • memory/2084-0-0x0000000000400000-0x00000000004B9000-memory.dmp

      Filesize

      740KB

    • memory/2084-4-0x0000000001DD0000-0x0000000001DD1000-memory.dmp

      Filesize

      4KB

    • memory/2084-5-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

      Filesize

      4KB

    • memory/2084-3-0x0000000001E40000-0x0000000001E41000-memory.dmp

      Filesize

      4KB

    • memory/2084-8-0x0000000001E50000-0x0000000001E51000-memory.dmp

      Filesize

      4KB

    • memory/2084-11-0x00000000031D0000-0x00000000031D2000-memory.dmp

      Filesize

      8KB

    • memory/2084-10-0x00000000031E0000-0x00000000031E1000-memory.dmp

      Filesize

      4KB

    • memory/2084-9-0x0000000001DE0000-0x0000000001DE1000-memory.dmp

      Filesize

      4KB

    • memory/2084-7-0x0000000001E20000-0x0000000001E21000-memory.dmp

      Filesize

      4KB

    • memory/2084-6-0x0000000001E30000-0x0000000001E31000-memory.dmp

      Filesize

      4KB

    • memory/2084-12-0x0000000003220000-0x0000000003221000-memory.dmp

      Filesize

      4KB

    • memory/2084-14-0x0000000001E60000-0x0000000001E61000-memory.dmp

      Filesize

      4KB

    • memory/2084-13-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

      Filesize

      4KB

    • memory/2084-16-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

    • memory/2084-15-0x00000000003B0000-0x00000000003B1000-memory.dmp

      Filesize

      4KB

    • memory/2084-17-0x00000000031F0000-0x00000000031F1000-memory.dmp

      Filesize

      4KB

    • memory/2084-18-0x00000000023F0000-0x00000000023F1000-memory.dmp

      Filesize

      4KB

    • memory/2084-19-0x0000000002340000-0x0000000002341000-memory.dmp

      Filesize

      4KB

    • memory/2084-20-0x0000000002550000-0x0000000002551000-memory.dmp

      Filesize

      4KB

    • memory/2084-21-0x0000000003240000-0x0000000003241000-memory.dmp

      Filesize

      4KB

    • memory/2084-22-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/2084-23-0x0000000003260000-0x0000000003261000-memory.dmp

      Filesize

      4KB

    • memory/2084-24-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/2084-26-0x0000000003270000-0x0000000003271000-memory.dmp

      Filesize

      4KB

    • memory/2084-25-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2084-27-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/2084-29-0x00000000032C0000-0x00000000032C1000-memory.dmp

      Filesize

      4KB

    • memory/2084-28-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2084-30-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/2084-31-0x00000000032E0000-0x00000000032E1000-memory.dmp

      Filesize

      4KB

    • memory/2084-32-0x00000000032D0000-0x00000000032D1000-memory.dmp

      Filesize

      4KB

    • memory/2084-33-0x0000000003400000-0x0000000003401000-memory.dmp

      Filesize

      4KB

    • memory/2084-34-0x00000000033F0000-0x00000000033F1000-memory.dmp

      Filesize

      4KB

    • memory/2084-35-0x0000000003420000-0x0000000003421000-memory.dmp

      Filesize

      4KB

    • memory/2084-36-0x0000000003410000-0x0000000003411000-memory.dmp

      Filesize

      4KB

    • memory/2084-37-0x0000000003440000-0x0000000003441000-memory.dmp

      Filesize

      4KB

    • memory/2084-38-0x0000000003430000-0x0000000003431000-memory.dmp

      Filesize

      4KB

    • memory/2084-39-0x0000000003460000-0x0000000003461000-memory.dmp

      Filesize

      4KB

    • memory/2084-40-0x0000000003450000-0x0000000003451000-memory.dmp

      Filesize

      4KB

    • memory/2084-41-0x0000000003480000-0x0000000003481000-memory.dmp

      Filesize

      4KB

    • memory/2084-42-0x0000000003470000-0x0000000003471000-memory.dmp

      Filesize

      4KB

    • memory/2084-43-0x00000000034A0000-0x00000000034A1000-memory.dmp

      Filesize

      4KB

    • memory/2084-44-0x0000000003490000-0x0000000003491000-memory.dmp

      Filesize

      4KB

    • memory/2084-45-0x00000000034C0000-0x00000000034C1000-memory.dmp

      Filesize

      4KB

    • memory/2084-46-0x00000000034B0000-0x00000000034B1000-memory.dmp

      Filesize

      4KB

    • memory/2084-47-0x00000000034E0000-0x00000000034E1000-memory.dmp

      Filesize

      4KB

    • memory/2084-48-0x00000000034D0000-0x00000000034D1000-memory.dmp

      Filesize

      4KB

    • memory/2084-49-0x0000000003500000-0x0000000003501000-memory.dmp

      Filesize

      4KB

    • memory/2084-50-0x00000000034F0000-0x00000000034F1000-memory.dmp

      Filesize

      4KB

    • memory/2084-51-0x0000000003510000-0x0000000003511000-memory.dmp

      Filesize

      4KB

    • memory/2084-52-0x0000000001C40000-0x0000000001C94000-memory.dmp

      Filesize

      336KB

    • memory/2084-53-0x0000000003520000-0x0000000003521000-memory.dmp

      Filesize

      4KB

    • memory/2084-58-0x00000000036A0000-0x00000000036A1000-memory.dmp

      Filesize

      4KB

    • memory/2084-57-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/2084-56-0x0000000003540000-0x0000000003541000-memory.dmp

      Filesize

      4KB

    • memory/2084-59-0x0000000003690000-0x0000000003691000-memory.dmp

      Filesize

      4KB

    • memory/2084-60-0x00000000036C0000-0x00000000036C1000-memory.dmp

      Filesize

      4KB

    • memory/2084-61-0x00000000036B0000-0x00000000036B1000-memory.dmp

      Filesize

      4KB

    • memory/2084-62-0x00000000036E0000-0x00000000036E1000-memory.dmp

      Filesize

      4KB

    • memory/2084-64-0x0000000003700000-0x0000000003701000-memory.dmp

      Filesize

      4KB

    • memory/2084-63-0x00000000036D0000-0x00000000036D1000-memory.dmp

      Filesize

      4KB

    • memory/2084-65-0x00000000036F0000-0x00000000036F1000-memory.dmp

      Filesize

      4KB

    • memory/2084-75-0x0000000000400000-0x00000000004B9000-memory.dmp

      Filesize

      740KB

    • memory/2604-70-0x0000000000460000-0x00000000004BB000-memory.dmp

      Filesize

      364KB

    • memory/2604-77-0x0000000000460000-0x00000000004BB000-memory.dmp

      Filesize

      364KB

    • memory/2604-79-0x0000000000460000-0x00000000004BB000-memory.dmp

      Filesize

      364KB

    • memory/2604-81-0x0000000000460000-0x00000000004BB000-memory.dmp

      Filesize

      364KB

    • memory/2604-87-0x0000000000460000-0x00000000004BB000-memory.dmp

      Filesize

      364KB

    • memory/2604-89-0x0000000000460000-0x00000000004BB000-memory.dmp

      Filesize

      364KB