Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
242s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
14/12/2023, 15:24
General
-
Target
Release/stub/xeno rat client.exe
-
Size
41KB
-
MD5
2fe8fac79ece15f356bc5822837c67fe
-
SHA1
ea55c7a7bc93ea43bc948541a84166d4034ef6a2
-
SHA256
d802c46c42c3af1e202d21532ab44c0159e6ca3832afedf2420d9ed1d35cb088
-
SHA512
5af0c243117e5d8f74f66205b79a53f7d268019fde9c5ef53b1cd50f5f33836466d422c93c96f484207540cb51ed85695ad7ed969945f89c9ef47f3107e4b495
-
SSDEEP
768:Bwk1EJoH10LJWwWPX6X0QX8LukxDY3q7R8xAbLm+9Phu/BE:H3sJ/WPKlMVK3qV6AbLxPhuK
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Release\stub\xeno rat client.exe"C:\Users\Admin\AppData\Local\Temp\Release\stub\xeno rat client.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD518a268f5b1815c597fbd3b5856d1413f
SHA1683dcd4f9ade6766c45bfa96e28331475ec7f0a6
SHA256e0e69682d331f3071da897cc8558eef3bf2bb3bc0d144f10aef8e62ad3193172
SHA51284420150bbdc7d5b211175ff2fec310251fa59d1fda447831954b5e8e69c157442ff2cac994c5ad7d137d98ea5ba6ce4fc5df9d834c019c08b9696df95072e6f
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB