Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
180s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25/11/2022, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe
Resource
win10v2004-20221111-en
General
-
Target
a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe
-
Size
898KB
-
MD5
c6063f1ebf76cb261d34cc179842a3d1
-
SHA1
0cd817f26d148deb12148254b7814e83ba90cd56
-
SHA256
a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5
-
SHA512
ca13fb6dc08d94cc8a7be2a0b88a449495447eb3fdf2efd0b26811304effeae876df8481aa653e4f8a9addf8afc6748ead50d596d23d6bfebfb10957624175e3
-
SSDEEP
12288:Itb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaBTYWex6A:Itb20pkaCqT5TBWgNQ7aVSx6A
Malware Config
Extracted
xtremerat
ellol.publicvm.com
Signatures
-
Detect XtremeRAT payload 5 IoCs
resource yara_rule behavioral1/memory/1248-62-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/1248-63-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/1492-66-0x0000000000000000-mapping.dmp family_xtremerat behavioral1/memory/1248-68-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/1492-69-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
resource yara_rule behavioral1/memory/1248-57-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/1248-61-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/1248-62-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/1248-63-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/1248-68-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/1492-69-0x0000000010000000-0x000000001004D000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1776 set thread context of 1248 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1776 wrote to memory of 1248 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 28 PID 1776 wrote to memory of 1248 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 28 PID 1776 wrote to memory of 1248 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 28 PID 1776 wrote to memory of 1248 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 28 PID 1776 wrote to memory of 1248 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 28 PID 1776 wrote to memory of 1248 1776 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 28 PID 1248 wrote to memory of 1492 1248 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 29 PID 1248 wrote to memory of 1492 1248 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 29 PID 1248 wrote to memory of 1492 1248 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 29 PID 1248 wrote to memory of 1492 1248 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 29 PID 1248 wrote to memory of 1492 1248 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 29 PID 1248 wrote to memory of 580 1248 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 30 PID 1248 wrote to memory of 580 1248 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 30 PID 1248 wrote to memory of 580 1248 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 30 PID 1248 wrote to memory of 580 1248 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 30 PID 1248 wrote to memory of 580 1248 a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe"C:\Users\Admin\AppData\Local\Temp\a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe"C:\Users\Admin\AppData\Local\Temp\a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:1492
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:580
-
-