Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 20:32
Static task
static1
Behavioral task
behavioral1
Sample
RFI von Aeris Impulsmoebel _RFI-9090.exe
Resource
win7-20240903-en
General
-
Target
RFI von Aeris Impulsmoebel _RFI-9090.exe
-
Size
769KB
-
MD5
ad35195080aaf247005d6ecab3f8db72
-
SHA1
1d4368b26588323743b5de77995260b2a08d3eab
-
SHA256
895f390d56ade378e72f343465d78ed3f3f98ab04a3fb3e2e2616184e566b6c5
-
SHA512
4f8deae3bb1f2c3253583cfb932a545097913aab555b498afc4225a5361d76ea2a704f4fecfcde8d44c0d79129d530d06211a974008ffaba372e738ec1b2215a
-
SSDEEP
24576:ckygsXzLhX0ab8kLDnyQCjVBW6Ymh6WPa:MFXXV0ab8kXnyQCjrRYg6W
Malware Config
Extracted
xloader
2.5
witq
cryptohavenpro.com
zildan.com
buyexcessinventory.com
telecluber.com
whhsdzyl.com
regionalkistel.com
ksusalinabookstore.com
firsttimergears.com
rzpsca.com
sakura-syoukai-t.com
zgvmeiti.com
99000444.com
kerisjatifurniture.com
photoparty.pro
monarchinvestiment.com
hkgjtrade.com
catholicsinglestv.com
nvtdigital.com
mariimportados.com
01mpt.xyz
everythingboleh.com
curledchips.net
timoks-posmotri.online
globalazurewebsites.net
ssxtwy.com
krisshang.com
civilcosmetics.com
experienceanewenchanting.com
shappilyeverafter.net
soulinsole-hotdeals.com
batteriespeicher.solar
infinitephoenix.space
nexusbalance.com
nifaji.com
onlinehealthusa.com
thewireguysllc.com
testlabanalytics.com
kite-safari.net
movingruznsk.com
czechcastingglass.com
invokethepowerofprayer.com
datunlock.tech
dadreview.club
fkldklreiofdklkdsklerf.store
sleepforsausages.com
shahjahantravel.com
bins101.com
tiendacomunicaciones.online
sigmagrup.com
tangerineden.com
henrywrench.com
freefotografos.com
healthykitab.com
revonate.space
bu3helo.com
ericnorthman.net
wrwrwr.xyz
balgomgroup.com
freehamrecords.com
gleichgesinnt.net
rimuovere-errori.com
integrityinstalls.com
theporchtv.com
aefkkkk89.net
spinez.net
Signatures
-
Xloader family
-
Xloader payload 4 IoCs
resource yara_rule behavioral1/memory/2736-10-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/2736-7-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/2736-13-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/3008-21-0x0000000000230000-0x0000000000259000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2136 set thread context of 2736 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 30 PID 2736 set thread context of 1184 2736 RmClient.exe 21 PID 3008 set thread context of 1184 3008 cscript.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFI von Aeris Impulsmoebel _RFI-9090.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RmClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 2736 RmClient.exe 2736 RmClient.exe 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe 3008 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2736 RmClient.exe 2736 RmClient.exe 2736 RmClient.exe 3008 cscript.exe 3008 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe Token: SeDebugPrivilege 2736 RmClient.exe Token: SeDebugPrivilege 3008 cscript.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2736 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 30 PID 2136 wrote to memory of 2736 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 30 PID 2136 wrote to memory of 2736 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 30 PID 2136 wrote to memory of 2736 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 30 PID 2136 wrote to memory of 2736 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 30 PID 2136 wrote to memory of 2736 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 30 PID 2136 wrote to memory of 2736 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 30 PID 2136 wrote to memory of 2736 2136 RFI von Aeris Impulsmoebel _RFI-9090.exe 30 PID 1184 wrote to memory of 3008 1184 Explorer.EXE 31 PID 1184 wrote to memory of 3008 1184 Explorer.EXE 31 PID 1184 wrote to memory of 3008 1184 Explorer.EXE 31 PID 1184 wrote to memory of 3008 1184 Explorer.EXE 31 PID 3008 wrote to memory of 2900 3008 cscript.exe 32 PID 3008 wrote to memory of 2900 3008 cscript.exe 32 PID 3008 wrote to memory of 2900 3008 cscript.exe 32 PID 3008 wrote to memory of 2900 3008 cscript.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\RFI von Aeris Impulsmoebel _RFI-9090.exe"C:\Users\Admin\AppData\Local\Temp\RFI von Aeris Impulsmoebel _RFI-9090.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\RmClient.exe"C:\Windows\SysWOW64\RmClient.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\RmClient.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2900
-
-