Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    439s
  • max time network
    440s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-ja
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-jalocale:ja-jpos:windows10-2004-x64systemwindows
  • submitted
    01/02/2025, 20:57

General

  • Target

    MaxxSpeechAPO.dll

  • Size

    1.3MB

  • MD5

    5f7242ca1531d47595cacd4aed5bbc57

  • SHA1

    62d7345be6fda8ab94b8629c68926e431debe555

  • SHA256

    d45c0a2ded8679188f899e96e481b592a22303a1ee996e480c8893932de7f28d

  • SHA512

    35bcdfdb1be82ab7bfa5784ad3be639d8036515725e01db58396d20c1ad304919461baf83825e404f2d6dd5ad5b742333a95fe449c938ff9d6036ec6305223c4

  • SSDEEP

    24576:knCumpWmiJEtMMPk/bqfDYhgI2qpmiQYbvRdsQGLAT1Lv1Tqhy/NQIFDh:knCuAk/bjgITpm7YbXsQdT1Dl

Score
10/10

Malware Config

Extracted

Family

latrodectus

Version

1.4

C2

https://vivaforevew.com/test/

https://wersogkiwgow.com/test/

Attributes
  • group

    Omega

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)

aes.hex

Extracted

Family

latrodectus

aes.hex

Signatures

  • Latrodectus family
  • Latrodectus loader

    Latrodectus is a loader written in C++.

  • Blocklisted process makes network request 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\MaxxSpeechAPO.dll,USB_PORT
    1⤵
    • Deletes itself
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:5096
    • C:\Windows\system32\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_a16a60c9.dll", USB_PORT
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      PID:1472
  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_a16a60c9.dll", USB_PORT
    1⤵
    • Loads dropped DLL
    PID:5092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Custom_update\Update_a16a60c9.dll

    Filesize

    1.3MB

    MD5

    5f7242ca1531d47595cacd4aed5bbc57

    SHA1

    62d7345be6fda8ab94b8629c68926e431debe555

    SHA256

    d45c0a2ded8679188f899e96e481b592a22303a1ee996e480c8893932de7f28d

    SHA512

    35bcdfdb1be82ab7bfa5784ad3be639d8036515725e01db58396d20c1ad304919461baf83825e404f2d6dd5ad5b742333a95fe449c938ff9d6036ec6305223c4

  • memory/5096-0-0x0000000180000000-0x0000000181CB2000-memory.dmp

    Filesize

    28.7MB

  • memory/5096-4-0x00000206823A0000-0x0000020684050000-memory.dmp

    Filesize

    28.7MB

  • memory/5096-8-0x00007FFFDB4F0000-0x00007FFFDB64E000-memory.dmp

    Filesize

    1.4MB