Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 11:20
Static task
static1
Behavioral task
behavioral1
Sample
7b44bcbc214c78715d0f590b1635dfa9.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7b44bcbc214c78715d0f590b1635dfa9.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/fzltxxnfffs.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/fzltxxnfffs.dll
Resource
win10v2004-20240802-en
General
-
Target
$PLUGINSDIR/fzltxxnfffs.dll
-
Size
194KB
-
MD5
c1ee8fc3cb583c07338524ac89801344
-
SHA1
041872fd3d00b10c7983f641be1e579bb709e6b7
-
SHA256
2b1efdc452245df048688e006a8d7c103e5ec369cab07125060161752ea6d8b6
-
SHA512
bd59b363d5c6e01a5f92e17f3c8c86eda4793a7ca53fa062aa80632fdb2130df527991ceb3ac6f73edd09e22a8e71968d0b7ad6e50fb7a7f2f9ed417f82f0190
-
SSDEEP
6144:ZUtJEr7mQNzZ/vDXqxnfNahvFp1cck4X3rm6v:ZnCYFD6TG9pjni6v
Malware Config
Extracted
xloader
2.5
pnug
natureate.com
ita-pots.website
sucohansmushroom.com
produrielrosen.com
gosystemupdatenow.online
jiskra.art
janwiench.com
norfolkfoodhall.com
iloveaddictss.com
pogozip.com
buyinstapva.com
teardirectionfreedom.xyz
0205168.com
apaixonadosporpugs.online
jawscoinc.com
crafter.quest
wikipedianow.com
radiopuls.net
kendama-co.com
goodstudycanada.com
huzhoucs.com
asinment.com
fuchsundrudolph.com
arthurenathalia.com
globalcosmeticsstudios.com
brandrackley.com
freemanhub.one
utserver.online
fullspecter.com
wshowcase.com
airjordanshoes-retro.com
linguimatics.com
app-verlengen.icu
singpost.red
j4.claims
inoteapp.net
jrdautomotivellc.com
xn--beaupre-6xa.com
mypolicyportal.net
wdgjdhpg.com
anshulindla.com
m981070.com
vertentebike.com
claim-available.com
buyfudgybombs.com
adfnapoli.com
blackfuid.com
clambakedelivered.info
marketingworksonhold.com
xvyj.top
richardsonsfinest.com
gurimix.com
dorhop.com
mauigrowngreencoffee.net
juzytuu.xyz
pokorny.industries
floridapermitsolutions.com
right-on-target-store.com
ynaire.com
nextpar.com
disdrone.com
fruitfulvinebirth.com
africanfairytale.com
leisuresabah.com
safetyeats.asia
Signatures
-
Xloader payload 1 IoCs
resource yara_rule behavioral3/memory/2532-2-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1788 set thread context of 2532 1788 rundll32.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2988 wrote to memory of 1788 2988 rundll32.exe 30 PID 2988 wrote to memory of 1788 2988 rundll32.exe 30 PID 2988 wrote to memory of 1788 2988 rundll32.exe 30 PID 2988 wrote to memory of 1788 2988 rundll32.exe 30 PID 2988 wrote to memory of 1788 2988 rundll32.exe 30 PID 2988 wrote to memory of 1788 2988 rundll32.exe 30 PID 2988 wrote to memory of 1788 2988 rundll32.exe 30 PID 1788 wrote to memory of 2532 1788 rundll32.exe 31 PID 1788 wrote to memory of 2532 1788 rundll32.exe 31 PID 1788 wrote to memory of 2532 1788 rundll32.exe 31 PID 1788 wrote to memory of 2532 1788 rundll32.exe 31 PID 1788 wrote to memory of 2532 1788 rundll32.exe 31 PID 1788 wrote to memory of 2532 1788 rundll32.exe 31 PID 1788 wrote to memory of 2532 1788 rundll32.exe 31 PID 1788 wrote to memory of 2532 1788 rundll32.exe 31 PID 1788 wrote to memory of 2532 1788 rundll32.exe 31 PID 1788 wrote to memory of 2532 1788 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fzltxxnfffs.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fzltxxnfffs.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fzltxxnfffs.dll,#13⤵PID:2532
-
-