Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
34s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
11/10/2024, 17:45
Static task
static1
Behavioral task
behavioral1
Sample
winmm.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
winmm.dll
Resource
win11-20240802-en
General
-
Target
winmm.dll
-
Size
841KB
-
MD5
d6a8c7fd490cd1149c0b51d961eab9f3
-
SHA1
73bb1220ead897fcc36df8d8622104ae82a9ad12
-
SHA256
119f71276feb0064a7382ae036cc9a7ef9a2cdef69f8b4ca65a0e0ce4643245a
-
SHA512
0273f74c072f48a3aaac1c6e808fcdcab465513651c5a7815fc75e767af85cd1654073f776a5f41ad2d9606264302333d4524cbe838dacfeae1e1d7ff413befc
-
SSDEEP
6144:oUCLuxLYxYooT5WjKkwxPQm9msflBOkV4ELEko/q+EIZtCn6Kyn3KzhJTTcAcYGR:TCv/o9rk8597u/PHvLKkAS84RQ8MoJ
Malware Config
Extracted
legion
dns-beast.com
-
url_paths
hittest.php
-
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Signatures
-
Legion, RobotDropper, Satacom
Legion aka 'RobotDropper' or 'Satacom' is a malware downloader written in C++ and Legion stealer is written C#.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1592 set thread context of 1652 1592 rundll32.exe 78 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1592 wrote to memory of 1652 1592 rundll32.exe 78 PID 1592 wrote to memory of 1652 1592 rundll32.exe 78 PID 1592 wrote to memory of 1652 1592 rundll32.exe 78 PID 1592 wrote to memory of 1652 1592 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\winmm.dll,#11⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:1652
-