Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2024, 20:39
Static task
static1
Behavioral task
behavioral1
Sample
ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe
Resource
win7-20241023-en
General
-
Target
ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe
-
Size
490KB
-
MD5
a71c8201b883c7f1c5f44a4cf3a0c9ab
-
SHA1
80446ce90d92add24f70d48614a90766e142d6bb
-
SHA256
ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199
-
SHA512
04e165efc0df1ab7fa9f60d14772f4e0bbe9db04d1468a1580f63a7f77d530a8e91ac0e0f55a478b0d07adf75e2795f81f4bd3e0912b545b50a1a6fc33568341
-
SSDEEP
12288:qT/EP9uNF0WGHj03MCrysaUz3gyALnhTEgu9VeSbr1GMntyeDF:tP9uNF0WuQcCrye8y0hTEBDealtyeD
Malware Config
Extracted
xloader
2.5
ok4e
drtuba.one
mosescorrea.com
xn--sxqt5eu0oo9u9la.xn--czru2d
hellounio.com
teamtigers.club
oceansaquariumnyc.com
pordges.com
pinewoodfairwayshoa.com
961115694.xyz
adeelrazza.com
baymillsstudios.com
kobaygym.com
highwaymenstickers.com
ulysse-cazarbonne.com
mintnft.fund
enjoycarousel.com
odemix.com
craftncloud.com
linuxsauce.net
sirtechie.xyz
uvcdiffusers.com
bentancoder.club
manue.net
life-on-the-veg.com
amilawda.com
ezhandianfu.com
thesolarohio.com
omnitrainsolutions.com
audraandjackson.com
hoskmap.com
astiazhmobilya.com
theveganfusspot.com
agathejacquillat.com
desfralde.online
exqvia.com
nehaladel.com
moleculairescent.com
lawlocally.com
arthamadvisory.com
judicatio.info
wrxworld.net
whatsnextseniors.com
attarco-jo.com
buchler-immo.com
villadestanpatara.xyz
miaocharge.com
moshivongdieuhoa.store
motispeach.biz
palmiyekorsantaksi.com
corumescort6.xyz
sd-shenghe.com
disbeta.com
danielaandjason.com
sandpointwindows.com
pinnaclesaltservices.com
ideaevcharging.com
meeteem.com
fr-signup.com
tkmedved.store
j9mkt62.com
hjemmelavet.info
wclm888.com
alexandrakisarchitecture.com
carts-amazon.com
nituqes.xyz
Signatures
-
Xloader family
-
Xloader payload 1 IoCs
resource yara_rule behavioral2/memory/1984-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4980 set thread context of 1984 4980 ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe 99 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1984 ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe 1984 ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4980 wrote to memory of 1984 4980 ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe 99 PID 4980 wrote to memory of 1984 4980 ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe 99 PID 4980 wrote to memory of 1984 4980 ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe 99 PID 4980 wrote to memory of 1984 4980 ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe 99 PID 4980 wrote to memory of 1984 4980 ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe 99 PID 4980 wrote to memory of 1984 4980 ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe"C:\Users\Admin\AppData\Local\Temp\ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe"C:\Users\Admin\AppData\Local\Temp\ec2fec19768b0cb797d08cdc4c1de72faeab5550bde249633e6fbb5c00771199.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984
-