Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
07/02/2025, 18:15
Static task
static1
Behavioral task
behavioral1
Sample
977d78da0534365cafe5ca3bb0a4ff2b.exe
Resource
win7-20241010-en
General
-
Target
977d78da0534365cafe5ca3bb0a4ff2b.exe
-
Size
1.0MB
-
MD5
977d78da0534365cafe5ca3bb0a4ff2b
-
SHA1
a57c055a5c27e69af9bfdd1051de430ced04ceb3
-
SHA256
59b7172f66799f61df8d8763007d51af7483ee2401ec097642808bd8c56fb436
-
SHA512
bf36d059d8a825ef1a2cd180fb2ed27129c4dfe7316963047c46ff9be5cb634154d9d793e2ba828a28c9e3d6d18ed53c8d44002f469aed9a7610ddae791e535d
-
SSDEEP
24576:DZZAT0zTUF2bMMgjyPySWDYmHLQDmRKdLkCl5n8DXlt9NL:DZZAqTUMonoVuQmRK2C/8DVZ
Malware Config
Extracted
danabot
5
192.210.222.81:443
5.9.224.204:443
192.255.166.212:443
-
embedded_hash
100700D372965A717E89B8C909E1D8D4
-
type
loader
Signatures
-
Danabot Loader Component 4 IoCs
resource yara_rule behavioral2/files/0x000a000000023d92-9.dat DanabotLoader2021 behavioral2/memory/1628-11-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/1628-26-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/1628-27-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 8 1628 rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 1628 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 977d78da0534365cafe5ca3bb0a4ff2b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4740 wrote to memory of 1628 4740 977d78da0534365cafe5ca3bb0a4ff2b.exe 84 PID 4740 wrote to memory of 1628 4740 977d78da0534365cafe5ca3bb0a4ff2b.exe 84 PID 4740 wrote to memory of 1628 4740 977d78da0534365cafe5ca3bb0a4ff2b.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\977d78da0534365cafe5ca3bb0a4ff2b.exe"C:\Users\Admin\AppData\Local\Temp\977d78da0534365cafe5ca3bb0a4ff2b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\977D78~1.DLL,s C:\Users\Admin\AppData\Local\Temp\977D78~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD53568e127abe529d00865fd5e9c91f3f7
SHA19532bbace804683f26fc298ed75f2720904a8586
SHA25679d9761470ad90f9bcc410a77e83ca6024f4de7062290afeb7f4efc4c8be164d
SHA512c9985c1ccf8b733c12111f8fd3799d12b273bcb5a899a4b8354f1e22a6c509c1e52491314f0053b6e2c76f7d37951811cf644d24954ac1c552bfd317814e77e7