Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
81s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26/09/2024, 11:28
Static task
static1
Behavioral task
behavioral1
Sample
f58290729b8d932d1dc1c5f7575fd7988aa2b7f1ff6cc7c8934f1737d9b702e8N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f58290729b8d932d1dc1c5f7575fd7988aa2b7f1ff6cc7c8934f1737d9b702e8N.exe
Resource
win10v2004-20240802-en
General
-
Target
f58290729b8d932d1dc1c5f7575fd7988aa2b7f1ff6cc7c8934f1737d9b702e8N.exe
-
Size
327KB
-
MD5
eb7eb4d037c9faa3e40e1dc0bbd6ab00
-
SHA1
2eda56e8cb9e2f1df2c48722699e7a14acafbe66
-
SHA256
f58290729b8d932d1dc1c5f7575fd7988aa2b7f1ff6cc7c8934f1737d9b702e8
-
SHA512
ca74ed1bb1ba1f2be74542aec2344f91f0ccd7d304b047fda4492135232c2bb84e2dc05be047e03b16ccc9f2d4ed302f822469cdd2606809112f9a3d1d6bc264
-
SSDEEP
6144:SU00cF8Nk7vKyI4ZkoNI8GFUng+O4Ro2KroYGxYbSqK1MjmxvB7HvGh0:C0cFwNYkeI8MIOio2KrDHz07H+h
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/2748-5-0x0000000000400000-0x000000000051D000-memory.dmp modiloader_stage2 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt f58290729b8d932d1dc1c5f7575fd7988aa2b7f1ff6cc7c8934f1737d9b702e8N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f58290729b8d932d1dc1c5f7575fd7988aa2b7f1ff6cc7c8934f1737d9b702e8N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2824 2748 f58290729b8d932d1dc1c5f7575fd7988aa2b7f1ff6cc7c8934f1737d9b702e8N.exe 31 PID 2748 wrote to memory of 2824 2748 f58290729b8d932d1dc1c5f7575fd7988aa2b7f1ff6cc7c8934f1737d9b702e8N.exe 31 PID 2748 wrote to memory of 2824 2748 f58290729b8d932d1dc1c5f7575fd7988aa2b7f1ff6cc7c8934f1737d9b702e8N.exe 31 PID 2748 wrote to memory of 2824 2748 f58290729b8d932d1dc1c5f7575fd7988aa2b7f1ff6cc7c8934f1737d9b702e8N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\f58290729b8d932d1dc1c5f7575fd7988aa2b7f1ff6cc7c8934f1737d9b702e8N.exe"C:\Users\Admin\AppData\Local\Temp\f58290729b8d932d1dc1c5f7575fd7988aa2b7f1ff6cc7c8934f1737d9b702e8N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵PID:2824
-