Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 21:19
Behavioral task
behavioral1
Sample
43731fb112bf42f9002493ea76a1e09fab70d7b99a58324a5ba97e1b39c3ff4e.dll
Resource
win7-20240705-en
General
-
Target
43731fb112bf42f9002493ea76a1e09fab70d7b99a58324a5ba97e1b39c3ff4e.dll
-
Size
114KB
-
MD5
568ded92a61a9e9e06ef64ae45b5aa91
-
SHA1
e4e6c65310a4b3a6cc0059d6f9766e6c1689d846
-
SHA256
43731fb112bf42f9002493ea76a1e09fab70d7b99a58324a5ba97e1b39c3ff4e
-
SHA512
f84d008f812c5f607022729291336d06bd01a5b89a02a8e61e7ccffa6dd116015038b6c32843326de9ca2fdd94c6d329ac3e15fe65e8ad546018abf8e3d76592
-
SSDEEP
1536:Vkj5Rr5V0fYzLyucPyxXbfOP52ckj5Rr5V0fYzLukj5Rr5V0fYzLj:A5RfzI+zUYf5Rfz95Rfzn
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/memory/904-3-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat behavioral1/memory/904-2-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
resource yara_rule behavioral1/memory/904-3-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral1/memory/904-2-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral1/memory/904-1-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral1/memory/904-0-0x0000000010000000-0x0000000010011000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2396 wrote to memory of 904 2396 rundll32.exe 30 PID 2396 wrote to memory of 904 2396 rundll32.exe 30 PID 2396 wrote to memory of 904 2396 rundll32.exe 30 PID 2396 wrote to memory of 904 2396 rundll32.exe 30 PID 2396 wrote to memory of 904 2396 rundll32.exe 30 PID 2396 wrote to memory of 904 2396 rundll32.exe 30 PID 2396 wrote to memory of 904 2396 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\43731fb112bf42f9002493ea76a1e09fab70d7b99a58324a5ba97e1b39c3ff4e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\43731fb112bf42f9002493ea76a1e09fab70d7b99a58324a5ba97e1b39c3ff4e.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:904
-