Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2024, 20:33
Static task
static1
Behavioral task
behavioral1
Sample
Order 4566789.exe
Resource
win7-20241010-en
General
-
Target
Order 4566789.exe
-
Size
838KB
-
MD5
2d9ded5e11d7f45bf9f534b7257b1759
-
SHA1
98dc535995c9cf3eb2b448b313e738dd3cfe9da8
-
SHA256
44642b64aeb3a5366b70e88c307e938aefb25fea2e6f5a5520c8829f19552f9c
-
SHA512
4d25c22e478a6fae64f147a973a12911148ce408f429f3444df433ecd71fb516495bd717a65b07cc33eade85221d309b7d763d83f45c6fd70c1876d496953d45
-
SSDEEP
12288:lg8edcf0v6QWTSG1A8FVxlrNStv8Q7BHe40p6pmAupZCmH6hTcWDpMoaU7yo4LPi:lgv6QWTz1dPSt0QFH0KmAum
Malware Config
Extracted
xloader
2.5
inga
21sq.xyz
aleimanpaper.com
soulworkerrush.com
lianxiwan.xyz
gorastionse.store
nuhuo333.xyz
greenft.xyz
upisout.com
mgav23.xyz
2day-recv.info
emdestak.com
generatorgmer.xyz
inmyhindi.com
meenubhosale.com
feinquebrantabledoc.com
valgtrizoma.quest
impqtantaou.com
nomorewarnow.com
gmcrjizppcx.mobi
eludice.net
allmoves.net
directionsettingpoint.xyz
gasandliquidcontrols.com
creativeportraitstudios.com
algurg-living.com
plotniska.net
njjbds.com
afromoorishfilms.com
fifihill.com
lamphuchai.xyz
j3ebx4thyf5h.biz
medicinalweed.lat
ankaraogrenciescort.xyz
vendasaprovadaonline.com
joinlegacyforge.com
onthemarket-smartboard.com
anatox-lab.fr
chouwakarunewssokuhou.com
lovawood.com
bethesdaclinicllc.com
sourcemycandles.com
losangelescapainters.com
powersforsupervillains.com
cumbrebomberos.com
mintnft.fund
sxuseon.com
scmce.com
nidoumenojinsei.online
qywyfeo8.xyz
ptmetaverse.com
geoplates.com
csfromsinai.com
xiraji21.com
r-souls.com
findinvest.xyz
stealthcarrier.com
d72gmj3bpdhc.biz
keepitng.com
hobe.agency
coach2college.com
thephilangies.com
adforalums.com
webwideoffers.com
seattlerealestateauction.com
seacoasttractor.com
Signatures
-
Xloader family
-
Xloader payload 4 IoCs
resource yara_rule behavioral2/memory/3548-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3548-17-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/552-25-0x0000000000430000-0x0000000000459000-memory.dmp xloader behavioral2/memory/552-27-0x0000000000430000-0x0000000000459000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3932 set thread context of 3548 3932 Order 4566789.exe 95 PID 3548 set thread context of 3508 3548 Order 4566789.exe 56 PID 552 set thread context of 3508 552 msiexec.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Order 4566789.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 3548 Order 4566789.exe 3548 Order 4566789.exe 3548 Order 4566789.exe 3548 Order 4566789.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe 552 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3548 Order 4566789.exe 3548 Order 4566789.exe 3548 Order 4566789.exe 552 msiexec.exe 552 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3548 Order 4566789.exe Token: SeDebugPrivilege 552 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3932 wrote to memory of 3548 3932 Order 4566789.exe 95 PID 3932 wrote to memory of 3548 3932 Order 4566789.exe 95 PID 3932 wrote to memory of 3548 3932 Order 4566789.exe 95 PID 3932 wrote to memory of 3548 3932 Order 4566789.exe 95 PID 3932 wrote to memory of 3548 3932 Order 4566789.exe 95 PID 3932 wrote to memory of 3548 3932 Order 4566789.exe 95 PID 3508 wrote to memory of 552 3508 Explorer.EXE 96 PID 3508 wrote to memory of 552 3508 Explorer.EXE 96 PID 3508 wrote to memory of 552 3508 Explorer.EXE 96 PID 552 wrote to memory of 3324 552 msiexec.exe 99 PID 552 wrote to memory of 3324 552 msiexec.exe 99 PID 552 wrote to memory of 3324 552 msiexec.exe 99
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\Order 4566789.exe"C:\Users\Admin\AppData\Local\Temp\Order 4566789.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\Order 4566789.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3548
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order 4566789.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3324
-
-