Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
07/02/2025, 05:01
Static task
static1
Behavioral task
behavioral1
Sample
756f72ccaaf7ba0333af2031bbba3accb7d5911f2be8cb4af9ee0e1e367e8d50.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
756f72ccaaf7ba0333af2031bbba3accb7d5911f2be8cb4af9ee0e1e367e8d50.dll
Resource
win10v2004-20250129-en
General
-
Target
756f72ccaaf7ba0333af2031bbba3accb7d5911f2be8cb4af9ee0e1e367e8d50.dll
-
Size
2.2MB
-
MD5
d50ffbac62a261820dcc9b5b43013ddd
-
SHA1
424602a2cdfdaee1badccfeced38c6af977d4db9
-
SHA256
756f72ccaaf7ba0333af2031bbba3accb7d5911f2be8cb4af9ee0e1e367e8d50
-
SHA512
beba03c7c678d28a824a8d641c10e86772aad91e95a31edc01835e7e5241662ad75d468e18572d4bbb88def839f6ab24c4422ab3d426f56f64db9c93c18acddf
-
SSDEEP
49152:/ZzQqIEjvDQPOnR5mSBn/VSlsBzXHWtSyZS:/YcxyZ
Malware Config
Extracted
latrodectus
Extracted
latrodectus
1.4
https://apworsindos.com/test/
https://reminasolirol.com/test/
-
group
Mimikast
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Signatures
-
Latrodectus family
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2272 2096 rundll32.exe 31 PID 2096 wrote to memory of 2272 2096 rundll32.exe 31 PID 2096 wrote to memory of 2272 2096 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\756f72ccaaf7ba0333af2031bbba3accb7d5911f2be8cb4af9ee0e1e367e8d50.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2096 -s 1282⤵PID:2272
-