Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
158s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
-
submitted
27/07/2024, 21:35 UTC
General
-
Target
CoinBase Checker/CoinBase Checker/libeay32.dll
-
Size
988KB
-
MD5
177bda0c92482dfa2c162a3750932b9c
-
SHA1
cb3b8a465fb55e9e0b4bb5a3298a481557a799d5
-
SHA256
17a4b75ef43a4fdeedaef86c39bead6719144e3e368b55898b79ecb371012854
-
SHA512
d6900cbcd53d2993ea639e70fe7d0b29595153c4ef54eb9c4a264c22963ca64d551dd633ce1c5d657bd371ddeebcff00419d50a13e423d44f25c8ac9f8ccf3d0
-
SSDEEP
12288:baTkV9YfAjvnC+pcU0MfHJQXA7WpVn2UNKQbox5b6j6iHk:bOBcnJpcTMve5pV9sQbsejrHk
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\CoinBase Checker\CoinBase Checker\libeay32.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\CoinBase Checker\CoinBase Checker\libeay32.dll",#12⤵
- System Location Discovery: System Language Discovery
-
Network
-
DNS68.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request68.159.190.20.in-addr.arpaIN PTRResponse -
DNS58.99.105.20.in-addr.arpaRemote address:8.8.8.8:53Request58.99.105.20.in-addr.arpaIN PTRResponse
-
DNSctldl.windowsupdate.comRemote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEctldl.windowsupdate.com.delivery.microsoft.comctldl.windowsupdate.com.delivery.microsoft.comIN CNAMEwu-b-net.trafficmanager.netwu-b-net.trafficmanager.netIN CNAMEdownload.windowsupdate.com.edgesuite.netdownload.windowsupdate.com.edgesuite.netIN CNAMEa767.dspw65.akamai.neta767.dspw65.akamai.netIN A92.123.140.25a767.dspw65.akamai.netIN A92.123.143.240
-
DNSself.events.data.microsoft.comRemote address:8.8.8.8:53Requestself.events.data.microsoft.comIN AResponseself.events.data.microsoft.comIN CNAMEself-events-data.trafficmanager.netself-events-data.trafficmanager.netIN CNAMEonedscolprdeus09.eastus.cloudapp.azure.comonedscolprdeus09.eastus.cloudapp.azure.comIN A20.42.73.26
-
DNS25.140.123.92.in-addr.arpaRemote address:8.8.8.8:53Request25.140.123.92.in-addr.arpaIN PTRResponse25.140.123.92.in-addr.arpaIN PTRa92-123-140-25deploystaticakamaitechnologiescom
-
DNSarc.msn.comRemote address:8.8.8.8:53Requestarc.msn.comIN AResponsearc.msn.comIN CNAMEarc.trafficmanager.netarc.trafficmanager.netIN CNAMEiris-de-prod-azsc-v2-weu.westeurope.cloudapp.azure.comiris-de-prod-azsc-v2-weu.westeurope.cloudapp.azure.comIN A20.103.156.88
-
DNSnexusrules.officeapps.live.comRemote address:8.8.8.8:53Requestnexusrules.officeapps.live.comIN AResponsenexusrules.officeapps.live.comIN CNAMEprod.nexusrules.live.com.akadns.netprod.nexusrules.live.com.akadns.netIN A52.111.243.31
-
DNS26.73.42.20.in-addr.arpaRemote address:8.8.8.8:53Request26.73.42.20.in-addr.arpaIN PTRResponse
-
150.171.27.10:443tse1.mm.bing.nettls
-
150.171.27.10:443tse1.mm.bing.nettls
-
150.171.27.10:443tse1.mm.bing.nettls
-
150.171.27.10:443tse1.mm.bing.nettls
-
150.171.27.10:443tse1.mm.bing.nettls
-
8.8.8.8:5368.159.190.20.in-addr.arpadns
DNS Request
68.159.190.20.in-addr.arpa
DNS Request
58.99.105.20.in-addr.arpa
DNS Request
ctldl.windowsupdate.com
DNS Response
92.123.140.2592.123.143.240
DNS Request
self.events.data.microsoft.com
DNS Response
20.42.73.26
-
8.8.8.8:5325.140.123.92.in-addr.arpadns
DNS Request
25.140.123.92.in-addr.arpa
DNS Request
arc.msn.com
DNS Response
20.103.156.88
DNS Request
nexusrules.officeapps.live.com
DNS Response
52.111.243.31
DNS Request
26.73.42.20.in-addr.arpa