Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 02:01

General

  • Target

    d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe

  • Size

    235KB

  • MD5

    0dba4bed5bf4e4c327b712f723e714c5

  • SHA1

    b8609db0404983d9a7f2bc4639d93a539bb883a6

  • SHA256

    d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267

  • SHA512

    3e2d21c7f0f4a97cc491d70bef203e75c91d716706256938d6cb0171cbd8499e902b9d51be4a0afc47c602d5aebf5db22802c38aae29d0ebcd9fb29611824653

  • SSDEEP

    6144:BhTnFgUgcego6uIXCHq2MYOITuVYmE9oO8N21Tx6I:/byUTelnK2fZSVYmE9oO8N21TxP

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Wolid_rat_nd8859g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1280

  • startup_name

    cms

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
    "C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
      C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
        "C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2548
        • C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
          4⤵
          • Executes dropped EXE
          PID:2676
        • C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
          4⤵
          • Executes dropped EXE
          PID:2604
        • C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
          4⤵
          • Executes dropped EXE
          PID:2448
    • C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
      C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5FA.tmp" /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1668
    • C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
      C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
      2⤵
        PID:1972

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp5FA.tmp

      Filesize

      1KB

      MD5

      afef954e03bba0a4799c2eb89877df4c

      SHA1

      829fecc6e072769ae3d720580456eb6153a4e2a2

      SHA256

      07501340bd4fc395d08b29637a74fb2aeec1f4c3e6082488e6582f6dd3526a99

      SHA512

      96ea517ac387f3b5f1a898436e197adf736a9078aedcb9b6bbe8e94ba862bfbf2085dd9df856ffd3d20ccf1a87810565d379e9f872bbff9415807426675268d0

    • C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe

      Filesize

      235KB

      MD5

      0dba4bed5bf4e4c327b712f723e714c5

      SHA1

      b8609db0404983d9a7f2bc4639d93a539bb883a6

      SHA256

      d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267

      SHA512

      3e2d21c7f0f4a97cc491d70bef203e75c91d716706256938d6cb0171cbd8499e902b9d51be4a0afc47c602d5aebf5db22802c38aae29d0ebcd9fb29611824653

    • memory/2168-12-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/2168-23-0x0000000074D90000-0x000000007547E000-memory.dmp

      Filesize

      6.9MB

    • memory/2168-32-0x0000000074D90000-0x000000007547E000-memory.dmp

      Filesize

      6.9MB

    • memory/2168-6-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/2168-8-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/2548-33-0x0000000000F40000-0x0000000000F80000-memory.dmp

      Filesize

      256KB

    • memory/2868-46-0x0000000074D90000-0x000000007547E000-memory.dmp

      Filesize

      6.9MB

    • memory/2868-24-0x0000000074D90000-0x000000007547E000-memory.dmp

      Filesize

      6.9MB

    • memory/2868-49-0x0000000074D90000-0x000000007547E000-memory.dmp

      Filesize

      6.9MB

    • memory/2868-50-0x0000000074D90000-0x000000007547E000-memory.dmp

      Filesize

      6.9MB

    • memory/2936-0-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

      Filesize

      4KB

    • memory/2936-26-0x0000000074D90000-0x000000007547E000-memory.dmp

      Filesize

      6.9MB

    • memory/2936-2-0x00000000001C0000-0x00000000001C6000-memory.dmp

      Filesize

      24KB

    • memory/2936-5-0x00000000001D0000-0x00000000001D6000-memory.dmp

      Filesize

      24KB

    • memory/2936-4-0x00000000002D0000-0x000000000030E000-memory.dmp

      Filesize

      248KB

    • memory/2936-3-0x0000000074D90000-0x000000007547E000-memory.dmp

      Filesize

      6.9MB

    • memory/2936-1-0x00000000010E0000-0x0000000001120000-memory.dmp

      Filesize

      256KB