Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 21:34
Static task
static1
Behavioral task
behavioral1
Sample
7e0fe4e13b8d2a480d6fbaff31146e52.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7e0fe4e13b8d2a480d6fbaff31146e52.exe
Resource
win10v2004-20231215-en
General
-
Target
7e0fe4e13b8d2a480d6fbaff31146e52.exe
-
Size
208KB
-
MD5
7e0fe4e13b8d2a480d6fbaff31146e52
-
SHA1
5ac7f241001bda88ce19192d3c363cd8784efbdf
-
SHA256
161beb2b60b7ab52e7fef7fadfd369a96ae392d58ba0b3c5b2149bb20a271d0b
-
SHA512
77bf8f808fe92ee430486776bc185d9adafbcfcb52c1eecf980b5a912821a023becd02371af03279321a221f82156b8dc19b94714d9735cdcebd61931c27090a
-
SSDEEP
3072:2tgah3UfzCgI8EGnANZFAk195aDl6qvQrlLKjB6OK92tx/MOZG15t3EdwpDi0BeH:2iahkznANTAk15uGotFwbEqD32Hj
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/memory/5100-10-0x0000000000400000-0x0000000000434000-memory.dmp modiloader_stage2 behavioral2/memory/5100-15-0x0000000000400000-0x0000000000434000-memory.dmp modiloader_stage2 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).