Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
9s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
09/02/2025, 02:27
Behavioral task
behavioral1
Sample
UpdaterTag.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
UpdaterTag.dll
Resource
win10v2004-20250207-en
General
-
Target
UpdaterTag.dll
-
Size
72KB
-
MD5
4d3511cedaddff8cdd991c1bcbbbf274
-
SHA1
9a6dcaa5d0a6bc5dc0e525d8495f81776c89f457
-
SHA256
25df81bebae736bf7e5cc42ef18b4756d1de8cd2cd4f1e508b6bf5108bac69e7
-
SHA512
3f201909ec716f5dd64df459d760ac44f9c2b14bec1a91ef68882c1817ed29564028bfc829be8998490f583895eb7f93a2b600c8472cd4781aaf1aa34a165918
-
SSDEEP
768:Vz7vRTYS4Oi5ONdWJ7HRCRuVnjhaQu7SDqRefml4I4QDqauXj57CHf8Idi+a7dHU:Vzh7eO6hHRCwhBfml4I6z5If8INaJ0
Malware Config
Extracted
latrodectus
1.4
https://apworsindos.com/test/
https://reminasolirol.com/test/
-
group
Mimikast
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Signatures
-
Detects Latrodectus 2 IoCs
Detects Latrodectus v1.4.
resource yara_rule behavioral1/files/0x00080000000193b8-1.dat family_latrodectus_1_4 behavioral1/memory/2604-6-0x000007FEFBB50000-0x000007FEFBB66000-memory.dmp family_latrodectus_1_4 -
Latrodectus family
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Deletes itself 1 IoCs
pid Process 2604 rundll32.exe -
Loads dropped DLL 4 IoCs
pid Process 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2604 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2160 2604 rundll32.exe 29 PID 2604 wrote to memory of 2160 2604 rundll32.exe 29 PID 2604 wrote to memory of 2160 2604 rundll32.exe 29 PID 2604 wrote to memory of 2396 2604 rundll32.exe 30 PID 2604 wrote to memory of 2396 2604 rundll32.exe 30 PID 2604 wrote to memory of 2396 2604 rundll32.exe 30 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UpdaterTag.dll,#11⤵
- Deletes itself
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_c1689d2d.dll", #12⤵
- Loads dropped DLL
PID:2160
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2604 -s 3122⤵PID:2396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD54d3511cedaddff8cdd991c1bcbbbf274
SHA19a6dcaa5d0a6bc5dc0e525d8495f81776c89f457
SHA25625df81bebae736bf7e5cc42ef18b4756d1de8cd2cd4f1e508b6bf5108bac69e7
SHA5123f201909ec716f5dd64df459d760ac44f9c2b14bec1a91ef68882c1817ed29564028bfc829be8998490f583895eb7f93a2b600c8472cd4781aaf1aa34a165918