Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    15s
  • max time network
    17s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/05/2024, 14:15

General

  • Target

    HaxterHub/HaxterHub V3/HaxterHub.exe

  • Size

    8.4MB

  • MD5

    ec9a8dee8bb46c61c68dabb022851e95

  • SHA1

    fae5e0b718daaca5b74b69faad71817cdcd80e49

  • SHA256

    1b9694f94b3568a914506718d11d1af5431bbe45b7034fd4e257dddad56394c2

  • SHA512

    ee0be2c09d4a391eab9e45a4bc65a54c539452d9eeeab1adcf6c938143accbc4c8a65e14658fe3ef2e1e5ba7168314315c3f68cc02cfe663452587825c6fdadf

  • SSDEEP

    196608:qmf88888888888888888888Cmsq8888888888888V8888888g:rf88888888888888888888Tsq888888y

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HaxterHub\HaxterHub V3\HaxterHub.exe
    "C:\Users\Admin\AppData\Local\Temp\HaxterHub\HaxterHub V3\HaxterHub.exe"
    1⤵
    • Enumerates system info in registry
    PID:4612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4612-0-0x00007FF8289C0000-0x00007FF828B9B000-memory.dmp

    Filesize

    1.9MB

  • memory/4612-1-0x0000000000C40000-0x00000000014AA000-memory.dmp

    Filesize

    8.4MB

  • memory/4612-2-0x00000000062A0000-0x000000000679E000-memory.dmp

    Filesize

    5.0MB

  • memory/4612-3-0x0000000005DA0000-0x0000000005E32000-memory.dmp

    Filesize

    584KB

  • memory/4612-4-0x0000000005D00000-0x0000000005D0A000-memory.dmp

    Filesize

    40KB

  • memory/4612-5-0x00000000067A0000-0x00000000069B4000-memory.dmp

    Filesize

    2.1MB