Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    24/07/2024, 11:17

General

  • Target

    0F8D2648166184BDE6562F33B7E4B620313FE7A21746720D37594213FBA7A604.exe

  • Size

    1.1MB

  • MD5

    16d76956de4e24c0067278a8c3a8e2dd

  • SHA1

    97a0a15c115ca7bd993df204117ff4d3a463c5a5

  • SHA256

    ef5c8d37fe7ad48a47e8127a1e3935fde4a37c0295d7b547ef067d97ea999434

  • SHA512

    41e7c87cbcd239f430557185fe0390c100aed95fbd0e70dd36755123d23930f90e31ef5b8aa9bc0ec8237b8a6af2e0fa922ae67e39dcf5077795e105a7829331

  • SSDEEP

    12288:dpKrcz9GQmikzLgiaYb0ZPzxwbwgyScsWMifc0FrdbH7+esjQajwROmBVe3Rac26:rAcz9EikngXP6NB8cyz73OH6k86

Malware Config

Extracted

Family

danabot

Botnet

5

C2

23.254.133.7:443

185.62.58.85:443

213.227.155.102:443

192.236.146.173:443

Attributes
  • embedded_hash

    63B180866F08EFD2B286E54429F1D1E4

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 64 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0F8D2648166184BDE6562F33B7E4B620313FE7A21746720D37594213FBA7A604.exe
    "C:\Users\Admin\AppData\Local\Temp\0F8D2648166184BDE6562F33B7E4B620313FE7A21746720D37594213FBA7A604.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Users\Admin\AppData\Local\Temp\KYkLsg.exe
      C:\Users\Admin\AppData\Local\Temp\KYkLsg.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\22a42e03.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2632
    • C:\Windows\syswow64\rundll32.exe
      "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
      2⤵
      • Blocklisted process makes network request
      • System Location Discovery: System Language Discovery
      PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\22a42e03.bat

    Filesize

    187B

    MD5

    b27a83358f82b5af6fb93092daaaf125

    SHA1

    078bde5a093bac99a0888e8c24c2f3c293c55031

    SHA256

    8bc34bf1f42ede91b34d1c89e18721f32e9671762b1d966852adb5294c9e4a7d

    SHA512

    2930ce213fc51eeffee12378faa30826360ab5e93ed6324f4908381ad5e9b12d8b9054075e200474cded510b6b05fafc97f8e8ad1677e663b4cf5b0fe6529b75

  • C:\Users\Admin\AppData\Local\Temp\37935CB2.exe

    Filesize

    4B

    MD5

    20879c987e2f9a916e578386d499f629

    SHA1

    c7b33ddcc42361fdb847036fc07e880b81935d5d

    SHA256

    9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

    SHA512

    bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

  • C:\Users\Admin\AppData\Local\Temp\KYkLsg.exe

    Filesize

    15KB

    MD5

    f7d21de5c4e81341eccd280c11ddcc9a

    SHA1

    d4e9ef10d7685d491583c6fa93ae5d9105d815bd

    SHA256

    4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794

    SHA512

    e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

  • memory/1700-11-0x0000000000D90000-0x0000000000D99000-memory.dmp

    Filesize

    36KB

  • memory/1700-60-0x0000000000D90000-0x0000000000D99000-memory.dmp

    Filesize

    36KB

  • memory/1948-9-0x0000000000400000-0x0000000000633000-memory.dmp

    Filesize

    2.2MB

  • memory/1948-12-0x0000000000D90000-0x0000000000D99000-memory.dmp

    Filesize

    36KB

  • memory/1948-10-0x0000000000D90000-0x0000000000D99000-memory.dmp

    Filesize

    36KB

  • memory/1948-15-0x0000000000310000-0x00000000003ED000-memory.dmp

    Filesize

    884KB

  • memory/1948-16-0x0000000000310000-0x00000000003ED000-memory.dmp

    Filesize

    884KB

  • memory/1948-17-0x0000000002060000-0x0000000002281000-memory.dmp

    Filesize

    2.1MB

  • memory/1948-18-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/1948-19-0x0000000000400000-0x0000000000633000-memory.dmp

    Filesize

    2.2MB

  • memory/1948-20-0x0000000000400000-0x0000000000633000-memory.dmp

    Filesize

    2.2MB

  • memory/1948-62-0x0000000000400000-0x0000000000633000-memory.dmp

    Filesize

    2.2MB

  • memory/1948-64-0x0000000002060000-0x0000000002281000-memory.dmp

    Filesize

    2.1MB

  • memory/1948-65-0x0000000000400000-0x000000000062E000-memory.dmp

    Filesize

    2.2MB

  • memory/1948-70-0x0000000000400000-0x0000000000633000-memory.dmp

    Filesize

    2.2MB

  • memory/1948-126-0x0000000000400000-0x0000000000633000-memory.dmp

    Filesize

    2.2MB

  • memory/2836-120-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-128-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-110-0x0000000000080000-0x0000000000082000-memory.dmp

    Filesize

    8KB

  • memory/2836-111-0x0000000077060000-0x0000000077061000-memory.dmp

    Filesize

    4KB

  • memory/2836-112-0x0000000075C60000-0x0000000075C61000-memory.dmp

    Filesize

    4KB

  • memory/2836-113-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-123-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-122-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-121-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-72-0x00000000002B0000-0x00000000002B2000-memory.dmp

    Filesize

    8KB

  • memory/2836-119-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-118-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-117-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-116-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-115-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-114-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-124-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-125-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-127-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-71-0x00000000002B0000-0x00000000002B2000-memory.dmp

    Filesize

    8KB

  • memory/2836-129-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-130-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-131-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-132-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-133-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-134-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-136-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-137-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-138-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/2836-142-0x0000000075C60000-0x0000000075C61000-memory.dmp

    Filesize

    4KB

  • memory/2836-146-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-147-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-148-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-152-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-151-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-150-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB

  • memory/2836-149-0x0000000075C40000-0x0000000075D40000-memory.dmp

    Filesize

    1024KB