Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
31/08/2024, 08:44
Behavioral task
behavioral1
Sample
92fcf8a5096e83dea0dcb77251f22c06da713ad6082a22bd07ef1756e23ab924.dll
Resource
win7-20240708-en
General
-
Target
92fcf8a5096e83dea0dcb77251f22c06da713ad6082a22bd07ef1756e23ab924.dll
-
Size
1.3MB
-
MD5
0b80b66459a9d4cbad76473e2f2fe6c3
-
SHA1
3eb1f651c975d5ce9a9023ec040edc3792d9716a
-
SHA256
92fcf8a5096e83dea0dcb77251f22c06da713ad6082a22bd07ef1756e23ab924
-
SHA512
7333f72f6836f06fb62e77d39c3e4dc6edfce83c58730f8aa8376b05440dc47c5b758c99cd144f8c10000861570f6767c6ef9f01b59275e6c8dcff4fa8048ae7
-
SSDEEP
24576:GncFdh7rbCc1XupdscfiyWOrLYgt4LCpo+TJgag:lhe6xOTyP+T
Malware Config
Extracted
danabot
4
192.119.110.73:443
192.236.147.159:443
192.210.222.88:443
-
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
-
type
loader
Signatures
-
Danabot Loader Component 15 IoCs
resource yara_rule behavioral1/memory/2588-0-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-1-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-2-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-3-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-4-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-5-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-6-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-7-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-8-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-9-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-10-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-11-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-12-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-13-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 behavioral1/memory/2588-14-0x0000000001FC0000-0x0000000002123000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2588 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2948 wrote to memory of 2588 2948 rundll32.exe 30 PID 2948 wrote to memory of 2588 2948 rundll32.exe 30 PID 2948 wrote to memory of 2588 2948 rundll32.exe 30 PID 2948 wrote to memory of 2588 2948 rundll32.exe 30 PID 2948 wrote to memory of 2588 2948 rundll32.exe 30 PID 2948 wrote to memory of 2588 2948 rundll32.exe 30 PID 2948 wrote to memory of 2588 2948 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92fcf8a5096e83dea0dcb77251f22c06da713ad6082a22bd07ef1756e23ab924.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92fcf8a5096e83dea0dcb77251f22c06da713ad6082a22bd07ef1756e23ab924.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2588
-