Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2352-0-0x0000000180000000-0x0000000181CB2000-memory.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2352-0-0x0000000180000000-0x0000000181CB2000-memory.dll
Resource
win10v2004-20250207-en
General
-
Target
2352-0-0x0000000180000000-0x0000000181CB2000-memory.dmp
-
Size
28.7MB
-
MD5
543302f696b5e0d62325bbf9355fd42b
-
SHA1
8d04ddc8147464d796c58236377c5b8876fc4067
-
SHA256
e94d18cb4423342defc76dc26e1a23803b54e3230b0fc773f417b09514ca7322
-
SHA512
f9da4e96085c2571d59822c40ea02343b49a78ce9cdf25cc0a106242fda051fea213660ee0db58c8a5db78c156198b6f6e99d830c395627494bd5e893c93eca4
-
SSDEEP
768:ez7vRTYS4Oi5ONdWJ7HRCRuVnjhaQu7SDqRefml4I4QDqauXj57CHf8IdF+a7dHU:ezh7eO6hHRCwhBfml4I6z5If8IiaJ0
Malware Config
Extracted
latrodectus
1.4
https://apworsindos.com/test/
https://reminasolirol.com/test/
-
group
Mimikast
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Signatures
-
Latrodectus family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2352-0-0x0000000180000000-0x0000000181CB2000-memory.dmp
Files
-
2352-0-0x0000000180000000-0x0000000181CB2000-memory.dmp.dll windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 59KB - Virtual size: 2048.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2048.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 2048.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2048.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 2048.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ