Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 08:41
Static task
static1
Behavioral task
behavioral1
Sample
c2eff0cff856c9df579f623ae7b7b58d.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c2eff0cff856c9df579f623ae7b7b58d.dll
Resource
win10v2004-20240226-en
General
-
Target
c2eff0cff856c9df579f623ae7b7b58d.dll
-
Size
654KB
-
MD5
c2eff0cff856c9df579f623ae7b7b58d
-
SHA1
527ffc1d274b2231e91e56145eadb5821b0f81a9
-
SHA256
91349a50706ec65faae325e5ac87c21ecbcde3f2b626168054289868737f17a1
-
SHA512
62919695f3df52499a96f30abef2a318a7b2e17447d7309ed9ada9f2e6473e995fdfff96fa4078f6a2ca21ea778e3a5cf1f0851d7ed1cb8eb297b615353b971a
-
SSDEEP
12288:QbcUPtAsi4iSgTYTY+BnbOmRtwFysBYaABtUO1OSnVVVVTDrh:/AtnLuTYZymSYaABt1QS
Malware Config
Extracted
hancitor
0308_spnv5
http://priekornat.com/8/forum.php
http://stionsomi.ru/8/forum.php
http://arviskeist.ru/8/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1572 2584 WerFault.exe 86 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2584 2548 rundll32.exe 86 PID 2548 wrote to memory of 2584 2548 rundll32.exe 86 PID 2548 wrote to memory of 2584 2548 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2eff0cff856c9df579f623ae7b7b58d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2eff0cff856c9df579f623ae7b7b58d.dll,#12⤵PID:2584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 6483⤵
- Program crash
PID:1572
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2584 -ip 25841⤵PID:2916