Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 06:16
Static task
static1
Behavioral task
behavioral1
Sample
37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe
Resource
win10v2004-20220812-en
General
-
Target
37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe
-
Size
364KB
-
MD5
480e7e6c7be0a1821c4e763b57443980
-
SHA1
3ff6c922bc738696605689cee0d016a4f51a2189
-
SHA256
37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f
-
SHA512
58f88816ac799ab4151ed1c55d6b2012d2c6bc0142acd739b3873e38633fff647d9a4497ae5e24bdc6943fb0832a91c1ae4435aec974eef0cb3557f3ce669b9a
-
SSDEEP
6144:IX/C2VA/SPtTkRhtTaZueKsddg5qvIFUVy60DfIYVbcT3q6SmDGyCdByONZF2GMi:IPCtApSmizdkONZ5d
Malware Config
Signatures
-
Detect XtremeRAT payload 6 IoCs
resource yara_rule behavioral2/memory/3060-134-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/3060-135-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/3060-137-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/3060-139-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/3060-140-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/3060-141-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4208 set thread context of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81 -
Program crash 1 IoCs
pid pid_target Process procid_target 4836 3060 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4208 wrote to memory of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81 PID 4208 wrote to memory of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81 PID 4208 wrote to memory of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81 PID 4208 wrote to memory of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81 PID 4208 wrote to memory of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81 PID 4208 wrote to memory of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81 PID 4208 wrote to memory of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81 PID 4208 wrote to memory of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81 PID 4208 wrote to memory of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81 PID 4208 wrote to memory of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81 PID 4208 wrote to memory of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81 PID 4208 wrote to memory of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81 PID 4208 wrote to memory of 3060 4208 37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe"C:\Users\Admin\AppData\Local\Temp\37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exeC:\Users\Admin\AppData\Local\Temp\37e478cf172754aab975baacdbee95c5499679f8d96d2a2d009d2de24222364f.exe2⤵PID:3060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 123⤵
- Program crash
PID:4836
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3060 -ip 30601⤵PID:3128