Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Centrotus.exe
windows7-x64
10Centrotus.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Flexibel/P...er.jad
windows7-x64
3Flexibel/P...er.jad
windows10-2004-x64
3Synfuel/Huspil81.asp
windows7-x64
3Synfuel/Huspil81.asp
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
Centrotus.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Centrotus.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Flexibel/Pygalgia/medlever.jad
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
Flexibel/Pygalgia/medlever.jad
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Synfuel/Huspil81.asp
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Synfuel/Huspil81.asp
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
3d2adaa3d221fda021e6c08d987bdaad
-
SHA1
2e4739d2d1bff8e4c093b913f3f4523ffc977cfa
-
SHA256
28ad93c4a8d4357a13c17c615f21a2166984e2a438c1a1c1dd2e1c99d3640b16
-
SHA512
294e84892356e2abfbb14f00ad4fd5457dd63a6740bfd0de3457f321eae7807d4b06d2fda81aad1bbf0af4d9188c332c0578f224550d82745bdff03dd370d0f4
-
SSDEEP
96:St4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KAB5VVDyssKZ:St4Vlw1Iul5J8T1vK20I5VVGsb
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4216 3192 WerFault.exe 80 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3192 2660 rundll32.exe 80 PID 2660 wrote to memory of 3192 2660 rundll32.exe 80 PID 2660 wrote to memory of 3192 2660 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#12⤵PID:3192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 6123⤵
- Program crash
PID:4216
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3192 -ip 31921⤵PID:244