Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 10:57
Static task
static1
Behavioral task
behavioral1
Sample
x.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
x.exe
Resource
win10v2004-20241007-en
General
-
Target
x.exe
-
Size
874KB
-
MD5
f855e939535e3b89a3644603a0e38b8c
-
SHA1
b7b9e22379942087a093922c176948a6eaead6c5
-
SHA256
52ab9a7a2d982b27473dca8811901c8246845a83b8995f91a6cdf05fdd95f7ad
-
SHA512
e8e33cc00ab2dbf6f135ccc8912ef7a9d1292c77624fe54bc68f9ed19d3e3e189b2c4592336a6886bf0a7abd57f329648750a3c486050a823bb6b225b92724e0
-
SSDEEP
12288:EVMIrbUH6aafVt+cJjXQjN40tLkZQrWYck14AXNvr0ijAPiazXHd2Udy:5IMvafVYyXQjz5kZQr8kyAXNooedy
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral1/memory/1968-2-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-7-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-8-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-9-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-10-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-11-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-14-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-17-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-20-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-23-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-26-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-29-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-33-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-36-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-39-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-42-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-45-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-48-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-51-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-54-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-57-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-60-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-64-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-67-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-70-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-73-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-77-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-80-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-83-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-86-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-21-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-27-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-34-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-41-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-50-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-12-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-38-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-56-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-55-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-53-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-52-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-49-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-47-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-46-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-44-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-43-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-40-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-37-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-35-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-32-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-31-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-30-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-28-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-25-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-24-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-22-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-19-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-18-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-16-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-15-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 behavioral1/memory/1968-13-0x0000000003380000-0x0000000004380000-memory.dmp modiloader_stage2 -
Program crash 1 IoCs
pid pid_target Process procid_target 1712 1968 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1712 1968 x.exe 30 PID 1968 wrote to memory of 1712 1968 x.exe 30 PID 1968 wrote to memory of 1712 1968 x.exe 30 PID 1968 wrote to memory of 1712 1968 x.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 7282⤵
- Program crash
PID:1712
-