Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
07/02/2025, 18:15
Static task
static1
Behavioral task
behavioral1
Sample
977d78da0534365cafe5ca3bb0a4ff2b.exe
Resource
win7-20241010-en
General
-
Target
977d78da0534365cafe5ca3bb0a4ff2b.exe
-
Size
1.0MB
-
MD5
977d78da0534365cafe5ca3bb0a4ff2b
-
SHA1
a57c055a5c27e69af9bfdd1051de430ced04ceb3
-
SHA256
59b7172f66799f61df8d8763007d51af7483ee2401ec097642808bd8c56fb436
-
SHA512
bf36d059d8a825ef1a2cd180fb2ed27129c4dfe7316963047c46ff9be5cb634154d9d793e2ba828a28c9e3d6d18ed53c8d44002f469aed9a7610ddae791e535d
-
SSDEEP
24576:DZZAT0zTUF2bMMgjyPySWDYmHLQDmRKdLkCl5n8DXlt9NL:DZZAqTUMonoVuQmRK2C/8DVZ
Malware Config
Extracted
danabot
5
192.210.222.81:443
5.9.224.204:443
192.255.166.212:443
-
embedded_hash
100700D372965A717E89B8C909E1D8D4
-
type
loader
Signatures
-
Danabot Loader Component 5 IoCs
resource yara_rule behavioral1/files/0x0009000000012266-11.dat DanabotLoader2021 behavioral1/memory/2788-13-0x0000000000830000-0x0000000000990000-memory.dmp DanabotLoader2021 behavioral1/memory/2788-15-0x0000000000830000-0x0000000000990000-memory.dmp DanabotLoader2021 behavioral1/memory/2788-30-0x0000000000830000-0x0000000000990000-memory.dmp DanabotLoader2021 behavioral1/memory/2788-31-0x0000000000830000-0x0000000000990000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2788 rundll32.exe -
Loads dropped DLL 4 IoCs
pid Process 2788 rundll32.exe 2788 rundll32.exe 2788 rundll32.exe 2788 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 977d78da0534365cafe5ca3bb0a4ff2b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2788 2528 977d78da0534365cafe5ca3bb0a4ff2b.exe 30 PID 2528 wrote to memory of 2788 2528 977d78da0534365cafe5ca3bb0a4ff2b.exe 30 PID 2528 wrote to memory of 2788 2528 977d78da0534365cafe5ca3bb0a4ff2b.exe 30 PID 2528 wrote to memory of 2788 2528 977d78da0534365cafe5ca3bb0a4ff2b.exe 30 PID 2528 wrote to memory of 2788 2528 977d78da0534365cafe5ca3bb0a4ff2b.exe 30 PID 2528 wrote to memory of 2788 2528 977d78da0534365cafe5ca3bb0a4ff2b.exe 30 PID 2528 wrote to memory of 2788 2528 977d78da0534365cafe5ca3bb0a4ff2b.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\977d78da0534365cafe5ca3bb0a4ff2b.exe"C:\Users\Admin\AppData\Local\Temp\977d78da0534365cafe5ca3bb0a4ff2b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\977D78~1.DLL,s C:\Users\Admin\AppData\Local\Temp\977D78~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5506620e40b76249821ec15895f5a7916
SHA1c988fc38bcd21bb2e75db9362d8800b20d5d2f27
SHA256f98d18b321524bb09b2fd4436bbe0cb5a7ab628a84b18978fdfa5cc7e398b545
SHA5128910e2434c1f1101b42e03a0231270fcfc36f0eda6b4ee6a8b83268c49c3f2bf09e6555e3501bb46be67e6b4b6f776f0d007a402734207d1d2384c853d2a7d30