Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
65s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
4af5ec8b347bb948d8a32db7aceb56d96e295a673ca5f13aaa0a6e4558ac46ac.dll
Resource
win7-20240708-en
General
-
Target
4af5ec8b347bb948d8a32db7aceb56d96e295a673ca5f13aaa0a6e4558ac46ac.dll
-
Size
180KB
-
MD5
aba3f1a29bdc0bb2471e3bbdbf04464a
-
SHA1
9a770fb31fcc3a7d60bf41ca5316e784de8aa4dd
-
SHA256
4af5ec8b347bb948d8a32db7aceb56d96e295a673ca5f13aaa0a6e4558ac46ac
-
SHA512
369e25786976f3ccd678b0bce180e5b3b995151e783f3dd5c415c3c7b8b5f935a1c2720d3275bec3bf8b7c31a4e4a9a77fe907b0a067a3d517dac91af59408df
-
SSDEEP
3072:x3U+o/fwAUfM8+NmXhjlAZ+SWlxT5H3zipQIoZeErkxUNBG0:ZUZYxfM8+YXfq+SOxTxjipQjzk3
Malware Config
Extracted
dridex
111
94.126.8.2:443
81.2.235.131:1688
178.63.156.139:3388
Signatures
-
resource yara_rule behavioral1/memory/2220-1-0x0000000074F70000-0x0000000074F9E000-memory.dmp dridex_ldr behavioral1/memory/2220-2-0x0000000074F70000-0x0000000074F9E000-memory.dmp dridex_ldr -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2220 2212 rundll32.exe 30 PID 2212 wrote to memory of 2220 2212 rundll32.exe 30 PID 2212 wrote to memory of 2220 2212 rundll32.exe 30 PID 2212 wrote to memory of 2220 2212 rundll32.exe 30 PID 2212 wrote to memory of 2220 2212 rundll32.exe 30 PID 2212 wrote to memory of 2220 2212 rundll32.exe 30 PID 2212 wrote to memory of 2220 2212 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4af5ec8b347bb948d8a32db7aceb56d96e295a673ca5f13aaa0a6e4558ac46ac.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4af5ec8b347bb948d8a32db7aceb56d96e295a673ca5f13aaa0a6e4558ac46ac.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2220
-