Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • submitted
    17/09/2024, 08:27

General

  • Target

    f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe

  • Size

    2.3MB

  • MD5

    9fb83bee6ff97065c498f48fc094f848

  • SHA1

    860112de5e833eb5fd9abaaf6db7c881c13220f8

  • SHA256

    f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c

  • SHA512

    103f87414802d1edd3d932626a370cd8b3e37666d541e7550257ffa5f5e6b0ce357f11dd14f13a5ff831d02da6a596d101682adf68855c1982093da03bdf8a96

  • SSDEEP

    49152:YMLtHPldWW5afLAUCweyFI0ZBAFCGLcRe2xTIYLEs:j5aMUzRe2M

Score
10/10

Malware Config

Extracted

Family

latrodectus

C2

https://pomaspoteraka.com/test/

https://finilamedima.com/test/

Signatures

  • Detects Latrodectus 7 IoCs

    Detects Latrodectus v1.4.

  • Latrodectus family
  • Latrodectus loader

    Latrodectus is a loader written in C++.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe
    "C:\Users\Admin\AppData\Local\Temp\f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe"
    1⤵
    • Deletes itself
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Roaming\Custom_update\Update_2163c29b.exe
      "C:\Users\Admin\AppData\Roaming\Custom_update\Update_2163c29b.exe"
      2⤵
      • Executes dropped EXE
      PID:2220
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {6360D928-3BCE-4EDD-AE91-60372DA799EB} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Users\Admin\AppData\Roaming\Custom_update\Update_2163c29b.exe
      C:\Users\Admin\AppData\Roaming\Custom_update\Update_2163c29b.exe
      2⤵
      • Executes dropped EXE
      PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\Custom_update\Update_2163c29b.exe

    Filesize

    2.3MB

    MD5

    9fb83bee6ff97065c498f48fc094f848

    SHA1

    860112de5e833eb5fd9abaaf6db7c881c13220f8

    SHA256

    f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c

    SHA512

    103f87414802d1edd3d932626a370cd8b3e37666d541e7550257ffa5f5e6b0ce357f11dd14f13a5ff831d02da6a596d101682adf68855c1982093da03bdf8a96

  • memory/1724-0-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/1724-1-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/1724-2-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/1724-7-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/1724-6-0x0000000140000000-0x0000000140254000-memory.dmp

    Filesize

    2.3MB

  • memory/2220-9-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/2220-12-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/2220-10-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB