Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
04/06/2023, 15:38
Static task
static1
Behavioral task
behavioral1
Sample
YYY.exe
Resource
win7-20230220-en
General
-
Target
YYY.exe
-
Size
294KB
-
MD5
62e48038a1105d8445b0f539b250a2ad
-
SHA1
f592671e524814bb585b61ecf3c6fea16c724ae8
-
SHA256
0b34d688a6c36cf55e1c18d22523f62a7fba025cc2035e0c163abd50288ae539
-
SHA512
3a8874013fa64019b80788d0f32054e59ee56ef8e25188a51026d562212473c6961b7be46eddda11d3babeeb463656ea7c43f48298cde8184a59373ef38a9393
-
SSDEEP
6144:XA2Q6m116ut7IBtDulkUcSEY0EWZOdnPtx2Tk5Kvj5:X5ObIBtxLSpXWYJPb2o5q
Malware Config
Extracted
asyncrat
0.5.6A
richard4545.loseyourip.com:6606
richard4545.loseyourip.com:7707
richard4545.loseyourip.com:8808
richard4545.loseyourip.com:3850
richard4545.loseyourip.com:3845
103.212.81.152:6606
103.212.81.152:7707
103.212.81.152:8808
103.212.81.152:3850
103.212.81.152:3845
cccphnbynt
-
delay
5
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
resource yara_rule behavioral1/memory/1496-58-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1496-59-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1496-61-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1496-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1496-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1160 set thread context of 1496 1160 YYY.exe 27 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1496 Caspol.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1496 Caspol.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1160 wrote to memory of 1496 1160 YYY.exe 27 PID 1160 wrote to memory of 1496 1160 YYY.exe 27 PID 1160 wrote to memory of 1496 1160 YYY.exe 27 PID 1160 wrote to memory of 1496 1160 YYY.exe 27 PID 1160 wrote to memory of 1496 1160 YYY.exe 27 PID 1160 wrote to memory of 1496 1160 YYY.exe 27 PID 1160 wrote to memory of 1496 1160 YYY.exe 27 PID 1160 wrote to memory of 1496 1160 YYY.exe 27 PID 1160 wrote to memory of 1496 1160 YYY.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\YYY.exe"C:\Users\Admin\AppData\Local\Temp\YYY.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1496
-