Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3binaries/E...64.dll
windows7-x64
1binaries/E...64.dll
windows10-2004-x64
1binaries/L...64.dll
windows7-x64
1binaries/L...64.dll
windows10-2004-x64
1binaries/S...ar.exe
windows7-x64
1binaries/S...ar.exe
windows10-2004-x64
1binaries/s...64.dll
windows7-x64
1binaries/s...64.dll
windows10-2004-x64
1binaries/s...me.dll
windows7-x64
1binaries/s...me.dll
windows10-2004-x64
1binaries/s...er.dll
windows7-x64
1binaries/s...er.dll
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/01/2024, 17:30
Static task
static1
Behavioral task
behavioral1
Sample
binaries/Emulator64.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
binaries/Emulator64.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
binaries/LinkNeverDie_Com_64.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
binaries/LinkNeverDie_Com_64.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
binaries/Switcher Spacewar.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
binaries/Switcher Spacewar.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
binaries/steam_api64.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
binaries/steam_api64.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
binaries/steam_api64_org_game.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
binaries/steam_api64_org_game.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
binaries/steam_api64_org_launcher.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
binaries/steam_api64_org_launcher.dll
Resource
win10v2004-20231222-en
General
-
Target
binaries/steam_api64_org_game.dll
-
Size
281KB
-
MD5
8fe4f5f3feefc50f25c5a1cd8485ba98
-
SHA1
c7eeddb97d831cf2d20e8d40d1fcc7d0ecd71a43
-
SHA256
e61ac9a9ac216d56abc70aaeefedc11708ef45aa1aa48f1dd313adfd9aa99150
-
SHA512
629cf1b35fcc6d28202647960b260277c90da28b080b8bcdd0426e34c449690a162159e9c7a5ea0c149e8014183748197f2e42da71063dd19759d86d21595cbf
-
SSDEEP
6144:cuondVdcyyQBzN6aNEAIyZAxioFDycCfbIj:knCIzQaNDx4ycCg
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2364 2128 rundll32.exe 16 PID 2128 wrote to memory of 2364 2128 rundll32.exe 16 PID 2128 wrote to memory of 2364 2128 rundll32.exe 16