Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 16:24

General

  • Target

    Pago652024.exe

  • Size

    222KB

  • MD5

    8a522f9786f61b5bd677d7a8ed6bd1aa

  • SHA1

    06fdb9d40c9b6448fd8c1a47595eb3e8b3e9ed29

  • SHA256

    e4d55c94e2904333166dc800a24bb13f97f8ceaf8815bbc133f3ac40dd4211f2

  • SHA512

    e79c2be732536b4db756280d889b2021b31396ec669368796d507d7238be27984239d367bf22d9d1dea615b85b5b5b96677a08a383e28272a432988e537deabd

  • SSDEEP

    6144:0kE+cZHhNRHvo14E92D08KHKIpRfvv0upeG2wxywW0pS/i1SbUI:0kpcZB/PoODOEuYG2wxywW0pS/i1SbB

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Rolid_rat_nd8889g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1278

  • startup_name

    mns

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Pago652024.exe
    "C:\Users\Admin\AppData\Local\Temp\Pago652024.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Users\Admin\AppData\Local\Temp\Pago652024.exe
      C:\Users\Admin\AppData\Local\Temp\Pago652024.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2236
      • C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe
        "C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe
          4⤵
          • Executes dropped EXE
          PID:3488
        • C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe
          4⤵
          • Executes dropped EXE
          PID:4488
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 80
            5⤵
            • Program crash
            PID:3428
        • C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe
          4⤵
          • Executes dropped EXE
          PID:5080
    • C:\Users\Admin\AppData\Local\Temp\Pago652024.exe
      C:\Users\Admin\AppData\Local\Temp\Pago652024.exe
      2⤵
        PID:1020
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 80
          3⤵
          • Program crash
          PID:436
      • C:\Users\Admin\AppData\Local\Temp\Pago652024.exe
        C:\Users\Admin\AppData\Local\Temp\Pago652024.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3688
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "mns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp35F0.tmp" /F
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5076
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1020 -ip 1020
      1⤵
        PID:4044
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4488 -ip 4488
        1⤵
          PID:1988

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Pago652024.exe.log

          Filesize

          706B

          MD5

          d95c58e609838928f0f49837cab7dfd2

          SHA1

          55e7139a1e3899195b92ed8771d1ca2c7d53c916

          SHA256

          0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

          SHA512

          405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

        • C:\Users\Admin\AppData\Local\Temp\tmp35F0.tmp

          Filesize

          1KB

          MD5

          831f29adcdc8c602266b3fb65f01b1c5

          SHA1

          092247b5233f6c748f9bf715939134b0f1836655

          SHA256

          6b533eb2c748b5994edcece75c7d339bc4fcbc2a3a0f8bb797017b6380d5c6d0

          SHA512

          00fd058322514a9c846d57ed59d3cdc497f2a16b061c72cb20e65f51529225be406640f6620121131fddfb3bbe21e5592e0b74b0f6e47126933e4e4cb42a90c2

        • C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe

          Filesize

          222KB

          MD5

          8a522f9786f61b5bd677d7a8ed6bd1aa

          SHA1

          06fdb9d40c9b6448fd8c1a47595eb3e8b3e9ed29

          SHA256

          e4d55c94e2904333166dc800a24bb13f97f8ceaf8815bbc133f3ac40dd4211f2

          SHA512

          e79c2be732536b4db756280d889b2021b31396ec669368796d507d7238be27984239d367bf22d9d1dea615b85b5b5b96677a08a383e28272a432988e537deabd

        • memory/1692-5-0x000000000DB20000-0x000000000DBBC000-memory.dmp

          Filesize

          624KB

        • memory/1692-4-0x000000000DA40000-0x000000000DA7A000-memory.dmp

          Filesize

          232KB

        • memory/1692-0-0x00000000746DE000-0x00000000746DF000-memory.dmp

          Filesize

          4KB

        • memory/1692-6-0x000000000E170000-0x000000000E714000-memory.dmp

          Filesize

          5.6MB

        • memory/1692-7-0x000000000DC60000-0x000000000DCF2000-memory.dmp

          Filesize

          584KB

        • memory/1692-8-0x0000000002920000-0x0000000002926000-memory.dmp

          Filesize

          24KB

        • memory/1692-1-0x0000000000500000-0x000000000053C000-memory.dmp

          Filesize

          240KB

        • memory/1692-3-0x00000000746D0000-0x0000000074E80000-memory.dmp

          Filesize

          7.7MB

        • memory/1692-15-0x00000000746D0000-0x0000000074E80000-memory.dmp

          Filesize

          7.7MB

        • memory/1692-2-0x0000000002990000-0x0000000002996000-memory.dmp

          Filesize

          24KB

        • memory/2236-29-0x00000000746D0000-0x0000000074E80000-memory.dmp

          Filesize

          7.7MB

        • memory/2236-14-0x00000000746D0000-0x0000000074E80000-memory.dmp

          Filesize

          7.7MB

        • memory/2236-9-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/3016-30-0x00000000746D0000-0x0000000074E80000-memory.dmp

          Filesize

          7.7MB

        • memory/3016-37-0x00000000746D0000-0x0000000074E80000-memory.dmp

          Filesize

          7.7MB

        • memory/3688-17-0x00000000746D0000-0x0000000074E80000-memory.dmp

          Filesize

          7.7MB

        • memory/3688-16-0x00000000746D0000-0x0000000074E80000-memory.dmp

          Filesize

          7.7MB

        • memory/3688-38-0x00000000746D0000-0x0000000074E80000-memory.dmp

          Filesize

          7.7MB