Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
52s -
max time network
54s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 15:03
Behavioral task
behavioral1
Sample
stub2.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
stub2.exe
Resource
win7-20240508-en
General
-
Target
stub2.exe
-
Size
45KB
-
MD5
375395b1fb6017ba3c4af4f1317ef7c3
-
SHA1
109e31925a757348ca517eb69cb129d1b471d16e
-
SHA256
8de191bee3f6ca50411f20a46b2bd1170d4a7a012bdbed151f2854dd7f1afdc8
-
SHA512
bbfcf92f9570660e16d1d93f714368822ee5823eb8314ac102568b7f10fcbaa4033aa786a4bc329cbfd64b7e9b8a91f56cb472eff78882eade0306c8b65d3bf0
-
SSDEEP
768:9dhO/poiiUcjlJInfYH9Xqk5nWEZ5SbTDa1uI7CPW5s:zw+jjgnwH9XqcnW85SbTIuI0
Malware Config
Extracted
xenorat
himekosworld-37849.portmap.host
Xeno_rat_nd8912d
-
delay
5000
-
install_path
temp
-
port
37849
-
startup_name
nothingset
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2356 stub2.exe -
Loads dropped DLL 1 IoCs
pid Process 1772 stub2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe 2356 stub2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2356 stub2.exe Token: SeShutdownPrivilege 2356 stub2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1772 wrote to memory of 2356 1772 stub2.exe 28 PID 1772 wrote to memory of 2356 1772 stub2.exe 28 PID 1772 wrote to memory of 2356 1772 stub2.exe 28 PID 1772 wrote to memory of 2356 1772 stub2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\stub2.exe"C:\Users\Admin\AppData\Local\Temp\stub2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\XenoManager\stub2.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\stub2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5375395b1fb6017ba3c4af4f1317ef7c3
SHA1109e31925a757348ca517eb69cb129d1b471d16e
SHA2568de191bee3f6ca50411f20a46b2bd1170d4a7a012bdbed151f2854dd7f1afdc8
SHA512bbfcf92f9570660e16d1d93f714368822ee5823eb8314ac102568b7f10fcbaa4033aa786a4bc329cbfd64b7e9b8a91f56cb472eff78882eade0306c8b65d3bf0