Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1CITACION D...04.zip
windows7-x64
1CITACION D...04.zip
windows10-2004-x64
1CITACION D...DA.exe
windows7-x64
10CITACION D...DA.exe
windows10-2004-x64
10CITACION D...MI.dll
windows7-x64
1CITACION D...MI.dll
windows10-2004-x64
1CITACION D...EX.dll
windows7-x64
1CITACION D...EX.dll
windows10-2004-x64
1CITACION D...IO.dll
windows7-x64
1CITACION D...IO.dll
windows10-2004-x64
3CITACION D...in.eps
windows7-x64
3CITACION D...in.eps
windows10-2004-x64
3CITACION D...and.ai
windows7-x64
3CITACION D...and.ai
windows10-2004-x64
3Analysis
-
max time kernel
449s -
max time network
451s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-es -
resource tags
arch:x64arch:x86image:win10v2004-20240426-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
26/04/2024, 22:54
Static task
static1
Behavioral task
behavioral1
Sample
CITACION DEMANDA 04.zip
Resource
win7-20240215-es
Behavioral task
behavioral2
Sample
CITACION DEMANDA 04.zip
Resource
win10v2004-20240426-es
Behavioral task
behavioral3
Sample
CITACION DEMANDA/04 CITACION DEMANDA.exe
Resource
win7-20231129-es
Behavioral task
behavioral4
Sample
CITACION DEMANDA/04 CITACION DEMANDA.exe
Resource
win10v2004-20240426-es
Behavioral task
behavioral5
Sample
CITACION DEMANDA/ASUS_WMI.dll
Resource
win7-20240221-es
Behavioral task
behavioral6
Sample
CITACION DEMANDA/ASUS_WMI.dll
Resource
win10v2004-20240419-es
Behavioral task
behavioral7
Sample
CITACION DEMANDA/ATKEX.dll
Resource
win7-20240221-es
Behavioral task
behavioral8
Sample
CITACION DEMANDA/ATKEX.dll
Resource
win10v2004-20240419-es
Behavioral task
behavioral9
Sample
CITACION DEMANDA/AsIO.dll
Resource
win7-20240221-es
Behavioral task
behavioral10
Sample
CITACION DEMANDA/AsIO.dll
Resource
win10v2004-20240419-es
Behavioral task
behavioral11
Sample
CITACION DEMANDA/parkin.eps
Resource
win7-20231129-es
Behavioral task
behavioral12
Sample
CITACION DEMANDA/parkin.eps
Resource
win10v2004-20240419-es
Behavioral task
behavioral13
Sample
CITACION DEMANDA/riband.ai
Resource
win7-20240221-es
Behavioral task
behavioral14
Sample
CITACION DEMANDA/riband.ai
Resource
win10v2004-20240419-es
General
-
Target
CITACION DEMANDA/04 CITACION DEMANDA.exe
-
Size
446KB
-
MD5
485008b43f0edceba0e0d3ca04bc1c1a
-
SHA1
55ae8f105af415bb763d1b87f6572f078052877c
-
SHA256
12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10
-
SHA512
402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1
-
SSDEEP
12288:vK5+DMJA3TAz4plk9iZOOti81N5y1qMIg+GV5Zul3M:y5+DMJA3TAz4plk9ijK1qlGV7ulM
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
Default
melo2024.kozow.com:8000
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
AnsyFelix
-
install_folder
%AppData%
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral4/memory/4532-37-0x0000000006D80000-0x0000000006DA6000-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 632 set thread context of 3968 632 04 CITACION DEMANDA.exe 83 PID 3968 set thread context of 4532 3968 cmd.exe 86 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Firefoxnode_xz.job cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 464 timeout.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 632 04 CITACION DEMANDA.exe 632 04 CITACION DEMANDA.exe 3968 cmd.exe 3968 cmd.exe 4532 MSBuild.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 632 04 CITACION DEMANDA.exe 3968 cmd.exe 3968 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4532 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4532 MSBuild.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 632 wrote to memory of 3968 632 04 CITACION DEMANDA.exe 83 PID 632 wrote to memory of 3968 632 04 CITACION DEMANDA.exe 83 PID 632 wrote to memory of 3968 632 04 CITACION DEMANDA.exe 83 PID 632 wrote to memory of 3968 632 04 CITACION DEMANDA.exe 83 PID 3968 wrote to memory of 4532 3968 cmd.exe 86 PID 3968 wrote to memory of 4532 3968 cmd.exe 86 PID 3968 wrote to memory of 4532 3968 cmd.exe 86 PID 3968 wrote to memory of 4532 3968 cmd.exe 86 PID 3968 wrote to memory of 4532 3968 cmd.exe 86 PID 4532 wrote to memory of 980 4532 MSBuild.exe 89 PID 4532 wrote to memory of 980 4532 MSBuild.exe 89 PID 4532 wrote to memory of 980 4532 MSBuild.exe 89 PID 980 wrote to memory of 464 980 cmd.exe 91 PID 980 wrote to memory of 464 980 cmd.exe 91 PID 980 wrote to memory of 464 980 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\04 CITACION DEMANDA.exe"C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\04 CITACION DEMANDA.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF20C.tmp.bat""4⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
PID:464
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
776KB
MD59dc62be569ee54e27be46662d2b39722
SHA15b46f561d2f2e815d67a0d1daf3819cee86f24cd
SHA2561128dc9a0faba9b666ce5fd945bcb5aa74aad122ad22e10ebc2899ef58bf75c5
SHA51262150747d6a778508af83340f8209cfe2972beca7ddef636c8b7b4547ff2f830420942e3a9397f1aeea56d82f3f0c93d933c486388069fa262470c56b245bde7
-
Filesize
171B
MD5e574e6b66c7deb64f07362e7ecdb6b35
SHA1702ffa1b346071142792f5ab121fa81a354471bd
SHA256868df83104a7ca3679e7e70cd76fb4a12ca8a0de64ff438e1f8c710a7cce7500
SHA51226dbdabd99a8a5d79d1b5c90ba467897caf154712fb4ba69e6d1c4e2a3988ec263612150680314f5dcfbeaa171f4a54554475edc53f4bd4bafcd61e0eb1e22f5