Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

41b804087a...cb.exe

windows7-x64

10

41b804087a...cb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/01/2024, 10:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    41b804087a2da74fa613efd66fa8edcb.exe

  • Size

    40KB

  • MD5

    41b804087a2da74fa613efd66fa8edcb

  • SHA1

    0701226e6636d7317afb8889594d1e877627e592

  • SHA256

    eca97d7269a904a9671c828c7264407fa91d54aef414e07287aa148171104f9c

  • SHA512

    8dceef9644807103809362955e84d7ff95b1d1d08c0f14f066477c872c0b900570db57b2eab8bf2207c5d1459d0a1b248f29f649f5a80010e608475bf1091f61

  • SSDEEP

    768:NE9hYh7Nq2Ozhiow2Gkm6Bc3/9fzNBwIldgbzosd:Nu2hzOlw2GkmX3BBldg/ok

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Signatures

  • Detect XtremeRAT payload 1 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

Processes

  • C:\Users\Admin\AppData\Local\Temp\41b804087a2da74fa613efd66fa8edcb.exe
    "C:\Users\Admin\AppData\Local\Temp\41b804087a2da74fa613efd66fa8edcb.exe"
    1⤵
      PID:1824
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1824 -ip 1824
      1⤵
        PID:2444

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1824-0-0x0000000000C80000-0x0000000000C92000-memory.dmp

        Filesize

        72KB

        Download