Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 08:00
Behavioral task
behavioral1
Sample
71b29326e25cd4536eccf0f66c41b229.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
71b29326e25cd4536eccf0f66c41b229.exe
Resource
win10v2004-20231215-en
General
-
Target
71b29326e25cd4536eccf0f66c41b229.exe
-
Size
1.0MB
-
MD5
71b29326e25cd4536eccf0f66c41b229
-
SHA1
10754a00be9726f05671f69d1790a7e797af87ab
-
SHA256
7b9ed8b14141105159a339086596cc103523e615b309e53beb56e68fb82df384
-
SHA512
c290be316da8c240aefdbfc447c673473036a5ed3458b2141f06b0e3309faf0a4b4af385fde8aba0970568f618bd0d0bec44264aef6c0914e76f5f101ffec089
-
SSDEEP
24576:dvVoxa8cIWoSpaBFasuLcdm4RrU9hgauaEZsoVhka20y2o61yMWXQC+aSMysCP4V:ddoxa8cIWoSpaBFasuLcdrrU9hgauaEi
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/1392-13-0x0000000000400000-0x0000000000512000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation 71b29326e25cd4536eccf0f66c41b229.exe -
Executes dropped EXE 2 IoCs
pid Process 2164 4300_1.exe 4536 4300_1.exe -
resource yara_rule behavioral2/files/0x000600000002323b-4.dat upx behavioral2/memory/2164-12-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/2164-19-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2164 set thread context of 4536 2164 4300_1.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4536 4300_1.exe 4536 4300_1.exe 4536 4300_1.exe 4536 4300_1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2164 4300_1.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1392 wrote to memory of 2164 1392 71b29326e25cd4536eccf0f66c41b229.exe 87 PID 1392 wrote to memory of 2164 1392 71b29326e25cd4536eccf0f66c41b229.exe 87 PID 1392 wrote to memory of 2164 1392 71b29326e25cd4536eccf0f66c41b229.exe 87 PID 2164 wrote to memory of 4536 2164 4300_1.exe 88 PID 2164 wrote to memory of 4536 2164 4300_1.exe 88 PID 2164 wrote to memory of 4536 2164 4300_1.exe 88 PID 2164 wrote to memory of 4536 2164 4300_1.exe 88 PID 2164 wrote to memory of 4536 2164 4300_1.exe 88 PID 2164 wrote to memory of 4536 2164 4300_1.exe 88 PID 2164 wrote to memory of 4536 2164 4300_1.exe 88 PID 4536 wrote to memory of 3368 4536 4300_1.exe 47 PID 4536 wrote to memory of 3368 4536 4300_1.exe 47 PID 4536 wrote to memory of 3368 4536 4300_1.exe 47 PID 4536 wrote to memory of 3368 4536 4300_1.exe 47
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\71b29326e25cd4536eccf0f66c41b229.exe"C:\Users\Admin\AppData\Local\Temp\71b29326e25cd4536eccf0f66c41b229.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\4300_1.exe"C:\Users\Admin\AppData\Local\Temp\4300_1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\4300_1.exeC:\Users\Admin\AppData\Local\Temp\4300_1.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4536
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5f675d5cd6440557c1468544f7ef88298
SHA1a71b3c7a8bc4dd41773e93758f34e9b974e1d475
SHA25687aa72f7daf03411bef423c089496e95b7ee54737413b84c666f0c7920932fb6
SHA512f3798fa2b2274063bcfaf16c7a8881e33320faa75a1e2d16b835e0ccfde65182d89b63b047384f4942212132584f349a2c1f80de347a7439805ce81c111616d5