Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 12:22
Static task
static1
Behavioral task
behavioral1
Sample
rDieselPlantTechnicalSheet.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
rDieselPlantTechnicalSheet.exe
Resource
win10v2004-20240802-en
General
-
Target
rDieselPlantTechnicalSheet.exe
-
Size
1.1MB
-
MD5
9660374700b5c2eecc2efb7e2b63a3c3
-
SHA1
a887cd88cbf6b9262441758db842d48a7d8d8c12
-
SHA256
ba946ce742f0c1a802ef0b40a933f27ed7215baea0354f7c3b28b3f709308ba9
-
SHA512
d49fdf780bf86cc69c4c669f3e6c4e4ccce76352a4b60b330a73d540d734104560c0e51625ba2b940e0ca3a733f0272c09c5d7d3d27eb19c08e2f5a16644ab16
-
SSDEEP
24576:jkcL46wGlmCQ4dviebWBFREfuFlFnP06vtSRDZZdI39v5SPfWxtPtnwpZz2MXMGq:jQnrexf2dsjrMSehaaVt
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/2172-2-0x0000000003490000-0x0000000004490000-memory.dmp modiloader_stage2 -
Program crash 1 IoCs
pid pid_target Process procid_target 2316 2172 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rDieselPlantTechnicalSheet.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2316 2172 rDieselPlantTechnicalSheet.exe 31 PID 2172 wrote to memory of 2316 2172 rDieselPlantTechnicalSheet.exe 31 PID 2172 wrote to memory of 2316 2172 rDieselPlantTechnicalSheet.exe 31 PID 2172 wrote to memory of 2316 2172 rDieselPlantTechnicalSheet.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\rDieselPlantTechnicalSheet.exe"C:\Users\Admin\AppData\Local\Temp\rDieselPlantTechnicalSheet.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 7162⤵
- Program crash
PID:2316
-