Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2024, 20:21

General

  • Target

    7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe

  • Size

    886KB

  • MD5

    f508abf920fbd52e54dba67bcfd561ba

  • SHA1

    e4b6476bbb722f0c6513284d827b9290d6056489

  • SHA256

    7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853

  • SHA512

    fcfb71e4745b40d5a0366295202bc1732578c38adb2ec605938ebb5fe06f4c9fa64e090a4d713453fed17bea3c3fe34f9342ee10c69b00ce9206fd4527c34ca3

  • SSDEEP

    24576:6qyd9G4LZ5fO7p9zgAAdsyyq4ZZsVoAc:8d9G4tA9gAAdsdq4HV/

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

qr26

Decoy

libreriarenemoreno.com

searingrofivt.xyz

liveincare-online.com

nahda92.com

oki-net.com

onlinedelivery.biz

marianiartspace.online

wildeblum.biz

adelaideofficeinteriors.com

plickthepick.com

qhyingtu.com

enjoy2m.xyz

037yu.xyz

poseidonvips.com

intricatepainting.com

cwdestore.com

nordic-aesthetics.com

80cq926.top

arbiz.farm

yun183.xyz

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader family
  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe
    "C:\Users\Admin\AppData\Local\Temp\7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\AppData\Local\Temp\7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe
      "C:\Users\Admin\AppData\Local\Temp\7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2516-6-0x0000000005170000-0x000000000521E000-memory.dmp

    Filesize

    696KB

  • memory/2516-13-0x0000000074DA0000-0x000000007548E000-memory.dmp

    Filesize

    6.9MB

  • memory/2516-2-0x0000000000440000-0x0000000000450000-memory.dmp

    Filesize

    64KB

  • memory/2516-3-0x0000000074DA0000-0x000000007548E000-memory.dmp

    Filesize

    6.9MB

  • memory/2516-4-0x0000000074DAE000-0x0000000074DAF000-memory.dmp

    Filesize

    4KB

  • memory/2516-5-0x0000000074DA0000-0x000000007548E000-memory.dmp

    Filesize

    6.9MB

  • memory/2516-7-0x0000000000A50000-0x0000000000A80000-memory.dmp

    Filesize

    192KB

  • memory/2516-0-0x0000000074DAE000-0x0000000074DAF000-memory.dmp

    Filesize

    4KB

  • memory/2516-1-0x0000000000ED0000-0x0000000000FB4000-memory.dmp

    Filesize

    912KB

  • memory/2760-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2760-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2760-9-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2760-12-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2760-14-0x0000000000890000-0x0000000000B93000-memory.dmp

    Filesize

    3.0MB