Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
abde681314cb2ac7e85de0de9968a169.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
abde681314cb2ac7e85de0de9968a169.exe
Resource
win10v2004-20240226-en
General
-
Target
abde681314cb2ac7e85de0de9968a169.exe
-
Size
267KB
-
MD5
abde681314cb2ac7e85de0de9968a169
-
SHA1
30c5e3285768cfba045e8c610c8f87021e15359e
-
SHA256
ca8ff130b779ec10cfa89d4964fe644698a70dfe5450b88416f149b7a5162cab
-
SHA512
08e2c3f61eb6acbc110723c0e1bf4bebc41805c523004f94a13708d91e2c41394c712a5dd69dfea6a9dc77b39db49c010f2a3eb377f1ea1631c58c5cb223ca1b
-
SSDEEP
6144:rJ01GYlMWwdKAHNU13B/7SGryfq/Xn4GMdKY2t+Y5bB7snG4WJP1:r+1fCWRTSG2y/X4G2KLt+YdB7snGTR1
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/2272-2-0x0000000000400000-0x0000000000501000-memory.dmp modiloader_stage2 behavioral1/memory/2272-5-0x0000000000400000-0x0000000000501000-memory.dmp modiloader_stage2 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt abde681314cb2ac7e85de0de9968a169.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2576 2272 abde681314cb2ac7e85de0de9968a169.exe 28 PID 2272 wrote to memory of 2576 2272 abde681314cb2ac7e85de0de9968a169.exe 28 PID 2272 wrote to memory of 2576 2272 abde681314cb2ac7e85de0de9968a169.exe 28 PID 2272 wrote to memory of 2576 2272 abde681314cb2ac7e85de0de9968a169.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\abde681314cb2ac7e85de0de9968a169.exe"C:\Users\Admin\AppData\Local\Temp\abde681314cb2ac7e85de0de9968a169.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵PID:2576
-