Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    36s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2024, 14:15

General

  • Target

    HaxterHub/HaxterHub V3/HaxterHub.exe

  • Size

    8.4MB

  • MD5

    ec9a8dee8bb46c61c68dabb022851e95

  • SHA1

    fae5e0b718daaca5b74b69faad71817cdcd80e49

  • SHA256

    1b9694f94b3568a914506718d11d1af5431bbe45b7034fd4e257dddad56394c2

  • SHA512

    ee0be2c09d4a391eab9e45a4bc65a54c539452d9eeeab1adcf6c938143accbc4c8a65e14658fe3ef2e1e5ba7168314315c3f68cc02cfe663452587825c6fdadf

  • SSDEEP

    196608:qmf88888888888888888888Cmsq8888888888888V8888888g:rf88888888888888888888Tsq888888y

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HaxterHub\HaxterHub V3\HaxterHub.exe
    "C:\Users\Admin\AppData\Local\Temp\HaxterHub\HaxterHub V3\HaxterHub.exe"
    1⤵
    • Enumerates system info in registry
    PID:5092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5092-0-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

    Filesize

    4KB

  • memory/5092-1-0x0000000000990000-0x00000000011FA000-memory.dmp

    Filesize

    8.4MB

  • memory/5092-2-0x0000000006110000-0x00000000066B4000-memory.dmp

    Filesize

    5.6MB

  • memory/5092-3-0x0000000005B60000-0x0000000005BF2000-memory.dmp

    Filesize

    584KB

  • memory/5092-5-0x00000000066C0000-0x00000000068D4000-memory.dmp

    Filesize

    2.1MB

  • memory/5092-4-0x0000000005AB0000-0x0000000005ABA000-memory.dmp

    Filesize

    40KB

  • memory/5092-6-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB

  • memory/5092-7-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB

  • memory/5092-8-0x000000000B250000-0x000000000B302000-memory.dmp

    Filesize

    712KB

  • memory/5092-9-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB

  • memory/5092-10-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

    Filesize

    4KB

  • memory/5092-11-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB

  • memory/5092-12-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB