Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
05/02/2025, 00:45
Static task
static1
Behavioral task
behavioral1
Sample
d29c5e424a41063b6cd023cac203b190dec79838693acb78c02a922be684467eN.dll
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
d29c5e424a41063b6cd023cac203b190dec79838693acb78c02a922be684467eN.dll
Resource
win10v2004-20241007-en
General
-
Target
d29c5e424a41063b6cd023cac203b190dec79838693acb78c02a922be684467eN.dll
-
Size
1.3MB
-
MD5
bc2e593d06093206b2b0e1d2f56f9da0
-
SHA1
9c86d7e4c68ea776cc8773328f8d5887a110285a
-
SHA256
d29c5e424a41063b6cd023cac203b190dec79838693acb78c02a922be684467e
-
SHA512
c710971d7cd89529b157d30904f9f3d98fb6a080486988ac412e1cf55f8dd6d53c50d5e71e9fc888d08efb9567a2ac6ca4abec0907f6a170560c010ea7e8496b
-
SSDEEP
24576:knCumpWmiJEtMMPk/bqfDYhgI2qpmiQYbvRdsQGLAT1Lv1Tqhy/NQIFDh:knCuAk/bjgITpm7YbXsQdT1Dl
Malware Config
Extracted
latrodectus
1.4
https://vivaforevew.com/test/
https://wersogkiwgow.com/test/
-
group
Omega
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Extracted
latrodectus
Signatures
-
Latrodectus family
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1512 wrote to memory of 2420 1512 rundll32.exe 30 PID 1512 wrote to memory of 2420 1512 rundll32.exe 30 PID 1512 wrote to memory of 2420 1512 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d29c5e424a41063b6cd023cac203b190dec79838693acb78c02a922be684467eN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1512 -s 1282⤵PID:2420
-