Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
07/02/2025, 05:27
Static task
static1
Behavioral task
behavioral1
Sample
9e2d25889bff5dd42a2876d66ce37ec7e3fd03da8922c76620d8097a3da5f0c4.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
9e2d25889bff5dd42a2876d66ce37ec7e3fd03da8922c76620d8097a3da5f0c4.dll
Resource
win10v2004-20250129-en
General
-
Target
9e2d25889bff5dd42a2876d66ce37ec7e3fd03da8922c76620d8097a3da5f0c4.dll
-
Size
2.2MB
-
MD5
0a2b923be8aefb8e3cd0d2787183ef35
-
SHA1
fa290453d165b30ad09f7fcb4a37ada363164bdd
-
SHA256
9e2d25889bff5dd42a2876d66ce37ec7e3fd03da8922c76620d8097a3da5f0c4
-
SHA512
498f1b18e75a00d0d2218cdd0a12d7ad254b3c2acd1bd98615c238f84053894053814d21c3e43ad4002e771c620ceee3d41316e62220267e016e69401b60e36c
-
SSDEEP
49152:/ZzQqIEjvDQPOnR5mSBn/VSlsBzXHWtSyZS:/YcxyZ
Malware Config
Extracted
latrodectus
1.4
https://apworsindos.com/test/
https://reminasolirol.com/test/
-
group
Mimikast
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Extracted
latrodectus
Signatures
-
Latrodectus family
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2868 2772 rundll32.exe 30 PID 2772 wrote to memory of 2868 2772 rundll32.exe 30 PID 2772 wrote to memory of 2868 2772 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e2d25889bff5dd42a2876d66ce37ec7e3fd03da8922c76620d8097a3da5f0c4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2772 -s 1322⤵PID:2868
-