Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    26/07/2024, 14:32

General

  • Target

    28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe

  • Size

    250KB

  • MD5

    0b15ac611ffb409d42f1718635482256

  • SHA1

    7f039e46b0a1ae613b64c45769405f197dba0ca3

  • SHA256

    28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd

  • SHA512

    7076f48ba765d5cd4550757e9a6697075ae7bb5419f8a614223a3fdb827f8e6b5b26267f22cea19ce0c9239b7b3b624021dbec0e7d30ee1c433f739dfd1eeab4

  • SSDEEP

    6144:bLcou8zw6r/39IDG+tW6Ltc/gkHYYrguTEzI:/55TeDG+tla/g+YYrguTE0

Malware Config

Extracted

Family

xenorat

C2

45.66.231.63

Mutex

Holid_rat_nd8859g

Attributes
  • delay

    60400

  • install_path

    appdata

  • port

    1243

  • startup_name

    HDdisplay

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 8 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
    "C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
      C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
      2⤵
        PID:2120
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 92
          3⤵
          • Program crash
          PID:1592
      • C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
        C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
        2⤵
          PID:1132
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 92
            3⤵
            • Program crash
            PID:1556
        • C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
          C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1520
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /Create /TN "HDdisplay" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA052.tmp" /F
            3⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:3320
        • C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
          C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:976
          • C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
            "C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4368
            • C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
              C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2040
            • C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
              C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
              4⤵
              • Executes dropped EXE
              PID:2800
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 92
                5⤵
                • Program crash
                PID:1640
            • C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
              C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
              4⤵
              • Executes dropped EXE
              PID:4308
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 92
                5⤵
                • Program crash
                PID:4984
            • C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
              C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:852
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1132 -ip 1132
        1⤵
          PID:4352
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2120 -ip 2120
          1⤵
            PID:1540
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2800 -ip 2800
            1⤵
              PID:4780
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4308 -ip 4308
              1⤵
                PID:4232

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe.log

                Filesize

                706B

                MD5

                80305b9a250a27091f46fa147674ffb3

                SHA1

                81b485761494618e4c8bba9af56c29b2ea8e8a07

                SHA256

                d9febc24cdfe2a616fff0e891fb055951aad00be6d57b0bc3cf8f4f643c5f6ae

                SHA512

                52544d526e83ae2a71d63768457435dbe79843a76146f60b7e41ec7b53ddb620323592325e19d6776b92b7e1fbb8dc79db85e94a30d970f0983563456ccd7a19

              • C:\Users\Admin\AppData\Local\Temp\tmpA052.tmp

                Filesize

                1KB

                MD5

                97eb16acf891872f91fc8443ea268319

                SHA1

                986240717ab115f689fa101fef5e10bb154c9326

                SHA256

                1a08a4968aca691c62656cbae75111bdc53d331d261988543d70cd3fbeb3f79a

                SHA512

                5f7b541007c0be54413815927698f4d76b713bc1eeacc706f5b1f6ad22ab84865670d4d7a51575a3a0854e9a04ab124e85d6c0246c7bb2d4b22d292bf35330dc

              • C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe

                Filesize

                250KB

                MD5

                0b15ac611ffb409d42f1718635482256

                SHA1

                7f039e46b0a1ae613b64c45769405f197dba0ca3

                SHA256

                28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd

                SHA512

                7076f48ba765d5cd4550757e9a6697075ae7bb5419f8a614223a3fdb827f8e6b5b26267f22cea19ce0c9239b7b3b624021dbec0e7d30ee1c433f739dfd1eeab4

              • memory/976-17-0x0000000074A10000-0x00000000751C1000-memory.dmp

                Filesize

                7.7MB

              • memory/976-30-0x0000000074A10000-0x00000000751C1000-memory.dmp

                Filesize

                7.7MB

              • memory/1520-42-0x0000000005E70000-0x0000000005ED6000-memory.dmp

                Filesize

                408KB

              • memory/1520-43-0x00000000060E0000-0x00000000061DA000-memory.dmp

                Filesize

                1000KB

              • memory/1520-48-0x00000000065C0000-0x00000000065DE000-memory.dmp

                Filesize

                120KB

              • memory/1520-47-0x0000000006AB0000-0x0000000006FDC000-memory.dmp

                Filesize

                5.2MB

              • memory/1520-11-0x0000000000400000-0x0000000000412000-memory.dmp

                Filesize

                72KB

              • memory/1520-14-0x0000000074A10000-0x00000000751C1000-memory.dmp

                Filesize

                7.7MB

              • memory/1520-39-0x0000000074A10000-0x00000000751C1000-memory.dmp

                Filesize

                7.7MB

              • memory/1520-46-0x00000000062E0000-0x0000000006330000-memory.dmp

                Filesize

                320KB

              • memory/1520-18-0x0000000074A10000-0x00000000751C1000-memory.dmp

                Filesize

                7.7MB

              • memory/1520-45-0x0000000006260000-0x00000000062D6000-memory.dmp

                Filesize

                472KB

              • memory/1520-44-0x00000000063B0000-0x0000000006572000-memory.dmp

                Filesize

                1.8MB

              • memory/4796-16-0x0000000074A10000-0x00000000751C1000-memory.dmp

                Filesize

                7.7MB

              • memory/4796-2-0x0000000003340000-0x0000000003346000-memory.dmp

                Filesize

                24KB

              • memory/4796-1-0x0000000000EA0000-0x0000000000EE6000-memory.dmp

                Filesize

                280KB

              • memory/4796-4-0x0000000005B20000-0x0000000005B60000-memory.dmp

                Filesize

                256KB

              • memory/4796-5-0x0000000005C00000-0x0000000005C9C000-memory.dmp

                Filesize

                624KB

              • memory/4796-6-0x0000000006250000-0x00000000067F6000-memory.dmp

                Filesize

                5.6MB

              • memory/4796-3-0x0000000074A10000-0x00000000751C1000-memory.dmp

                Filesize

                7.7MB

              • memory/4796-0-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

                Filesize

                4KB

              • memory/4796-8-0x0000000005BC0000-0x0000000005BC6000-memory.dmp

                Filesize

                24KB

              • memory/4796-7-0x0000000005D40000-0x0000000005DD2000-memory.dmp

                Filesize

                584KB