Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 15:03
Behavioral task
behavioral1
Sample
stub2.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
stub2.exe
Resource
win7-20240508-en
Errors
General
-
Target
stub2.exe
-
Size
45KB
-
MD5
375395b1fb6017ba3c4af4f1317ef7c3
-
SHA1
109e31925a757348ca517eb69cb129d1b471d16e
-
SHA256
8de191bee3f6ca50411f20a46b2bd1170d4a7a012bdbed151f2854dd7f1afdc8
-
SHA512
bbfcf92f9570660e16d1d93f714368822ee5823eb8314ac102568b7f10fcbaa4033aa786a4bc329cbfd64b7e9b8a91f56cb472eff78882eade0306c8b65d3bf0
-
SSDEEP
768:9dhO/poiiUcjlJInfYH9Xqk5nWEZ5SbTDa1uI7CPW5s:zw+jjgnwH9XqcnW85SbTIuI0
Malware Config
Extracted
xenorat
himekosworld-37849.portmap.host
Xeno_rat_nd8912d
-
delay
5000
-
install_path
temp
-
port
37849
-
startup_name
nothingset
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation stub2.exe -
Executes dropped EXE 1 IoCs
pid Process 4844 stub2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4844 stub2.exe Token: SeShutdownPrivilege 4844 stub2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2652 wrote to memory of 4844 2652 stub2.exe 84 PID 2652 wrote to memory of 4844 2652 stub2.exe 84 PID 2652 wrote to memory of 4844 2652 stub2.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\stub2.exe"C:\Users\Admin\AppData\Local\Temp\stub2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\XenoManager\stub2.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\stub2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
45KB
MD5375395b1fb6017ba3c4af4f1317ef7c3
SHA1109e31925a757348ca517eb69cb129d1b471d16e
SHA2568de191bee3f6ca50411f20a46b2bd1170d4a7a012bdbed151f2854dd7f1afdc8
SHA512bbfcf92f9570660e16d1d93f714368822ee5823eb8314ac102568b7f10fcbaa4033aa786a4bc329cbfd64b7e9b8a91f56cb472eff78882eade0306c8b65d3bf0