Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 05:15
Behavioral task
behavioral1
Sample
GF.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
GF.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
run me as admin.bat
Resource
win7-20240903-en
General
-
Target
GF.dll
-
Size
6.9MB
-
MD5
c6e29164ff238c1f3a538722c7ab9871
-
SHA1
8e3c981e9dcd9d71c2128811652b4a62acd2622b
-
SHA256
4848cd7fd555e5551d94a1b8df19d19a9cf65727c0d8badbe2457516ee19ead7
-
SHA512
f9e736d37d83ad38255e22ec282ca6d137471a640981f5bcd039d04ddd3151e4036920d3d182230d1f442f8410ebdc4dc8ef95f7264450a517c4fa9ad3308a31
-
SSDEEP
196608:2r05756bdjFOVhF22yMRTvBmmzIzCMRo:2FdjUVhacB1sJRo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/1888-3-0x0000000010000000-0x00000000106EB000-memory.dmp family_blackmoon behavioral2/memory/1888-5-0x0000000010000000-0x00000000106EB000-memory.dmp family_blackmoon -
Blocklisted process makes network request 3 IoCs
flow pid Process 6 1888 rundll32.exe 15 1888 rundll32.exe 18 1888 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1888 rundll32.exe 1888 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1888 rundll32.exe 1888 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4952 wrote to memory of 1888 4952 rundll32.exe 83 PID 4952 wrote to memory of 1888 4952 rundll32.exe 83 PID 4952 wrote to memory of 1888 4952 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\GF.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\GF.dll,#12⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1888
-