Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2024, 00:48 UTC

General

  • Target

    678b59032026b1ee8def37de26ac2561aa6c35d13f3516f276abbebd13777387.exe

  • Size

    90KB

  • MD5

    53b62972bc6236b5d7c58d21503d3159

  • SHA1

    c2bd5d71d6115ef9907dbc39a0be924cc13610ef

  • SHA256

    678b59032026b1ee8def37de26ac2561aa6c35d13f3516f276abbebd13777387

  • SHA512

    565e0c4f26188cf46e12e09beb54330e025d13267bb6431dea84c92f3a423376a94e23b0f2b51787e04bef087d9ea9209e8437fac59bff65a685515b66666d81

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDJ:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE37

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\678b59032026b1ee8def37de26ac2561aa6c35d13f3516f276abbebd13777387.exe
    "C:\Users\Admin\AppData\Local\Temp\678b59032026b1ee8def37de26ac2561aa6c35d13f3516f276abbebd13777387.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Users\Admin\AppData\Local\Temp\678b59032026b1ee8def37de26ac2561aa6c35d13f3516f276abbebd13777387.exe
      "C:\Users\Admin\AppData\Local\Temp\678b59032026b1ee8def37de26ac2561aa6c35d13f3516f276abbebd13777387.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JYWFG.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1868
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:2696
      • C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2380
        • C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3612
        • C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3180

Network

  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    0.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    23.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
No results found
  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    0.159.190.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    0.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    23.236.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    23.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
    129 B
    1
    1

    DNS Request

    billabong4102.no-ip.biz

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\JYWFG.txt

    Filesize

    145B

    MD5

    4eb61ec7816c34ec8c125acadc57ec1b

    SHA1

    b0015cc865c0bb1a027be663027d3829401a31cc

    SHA256

    08375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff

    SHA512

    f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1

  • C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe

    Filesize

    90KB

    MD5

    e61edc04eabf609cf72cf78071b406c7

    SHA1

    562c534308af375b622e7a8d769dbbe85d5d6636

    SHA256

    2e217fe929de7cf91b004b69ec99c1e6d17aa931198eb76918678f6c425bedaf

    SHA512

    f5e67798f9a27c14d6f814a59d92f54720c76da66df9429fb70fadc69a6a806b94027ef31c19a43f55596c1e7f504186f5e2f4219366cf1e19a98dd6a2f0985b

  • memory/2380-59-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2380-42-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2380-41-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/3180-64-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3180-56-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3180-58-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3180-55-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3180-53-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3180-50-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3612-63-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4468-12-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4468-60-0x0000000000410000-0x00000000004D9000-memory.dmp

    Filesize

    804KB

  • memory/4468-40-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4468-62-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4468-10-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4468-7-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/5056-15-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/5056-0-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/5056-6-0x0000000002440000-0x0000000002442000-memory.dmp

    Filesize

    8KB

  • memory/5056-3-0x0000000002410000-0x0000000002412000-memory.dmp

    Filesize

    8KB

  • memory/5056-4-0x0000000002420000-0x0000000002422000-memory.dmp

    Filesize

    8KB

  • memory/5056-5-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.