Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
30/07/2024, 11:55
Static task
static1
Behavioral task
behavioral1
Sample
62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830.exe
Resource
win11-20240709-en
General
-
Target
62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830.exe
-
Size
6.3MB
-
MD5
db60dc357835c7379091e4f54c2f6f0e
-
SHA1
e9ecdb514686ba2707e2a6e4d8e8b28a06596d88
-
SHA256
62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830
-
SHA512
0116b2817fa9295cf69490a2020b82d9d6157268f227feedcd74bc23246182a8de2c88a48bd1a25cfa3051a2fbafa2be3b5959e3be8f02ab379f15b8e1558c7b
-
SSDEEP
98304:E08tPgotZXlKbXynnR6a8SPgJevPQ+pit+IaGcYVUFwBRXAn6l7CgTV8+pYIKu5W:EJLQXynRea3PQ+ppYVUFKRQL+u/uNm
Malware Config
Extracted
latrodectus
https://spikeliftall.com/live/
https://godfaetret.com/live/
Signatures
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Executes dropped EXE 4 IoCs
pid Process 3640 TVIYAUUXRW.exe 1964 CODWLWRUMZ.exe 3468 confrontation_1029e9d2.exe 4988 confrontation_1029e9d2.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CODWLWRUMZ.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3640 TVIYAUUXRW.exe 3640 TVIYAUUXRW.exe 3640 TVIYAUUXRW.exe 3640 TVIYAUUXRW.exe 3468 confrontation_1029e9d2.exe 3468 confrontation_1029e9d2.exe 3468 confrontation_1029e9d2.exe 3468 confrontation_1029e9d2.exe 1964 CODWLWRUMZ.exe 1964 CODWLWRUMZ.exe 4988 confrontation_1029e9d2.exe 4988 confrontation_1029e9d2.exe 4988 confrontation_1029e9d2.exe 4988 confrontation_1029e9d2.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3640 wrote to memory of 3468 3640 TVIYAUUXRW.exe 96 PID 3640 wrote to memory of 3468 3640 TVIYAUUXRW.exe 96 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830.exe"C:\Users\Admin\AppData\Local\Temp\62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830.exe"1⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\TVIYAUUXRW.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_1029e9d2.exe"C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_1029e9d2.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3468
-
-
-
C:\Users\Admin\AppData\Local\Temp\CODWLWRUMZ.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1964
-
-
C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_1029e9d2.exeC:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_1029e9d2.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
MD5de07e3ab87e46ac0b9a75687e5c61db6
SHA14c0bbfdcbad96e817e6777589b6bea8c40851e6e
SHA256532c9bc2e30150bef61a050386509dd5f3c152688898f6be616393f10b9262d3
SHA512d5201bc5e269c28a8523cbe2a450178e6265047bf38e1fecd60d0eb90160a3853c5b5cf424a39492599f556d341f2c6bcc934871b988a0e8729b9c6440ff273b
-
Filesize
367KB
MD5e1a8ca0eb72cbdd2a372c69a355d42be
SHA13d52f700bdb8e35ecbdd4238c2c4ca34644c467e
SHA25681bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb
SHA5125a52f994513cb35ea2dbe85a330753517620a1f2aaba01de7517792491ee480f1db06cd943b16a5f6e6837001e51a2e6fcf6d8e6939b81b9279a36359a3a08eb