Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    06/09/2024, 01:30

General

  • Target

    90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe

  • Size

    349KB

  • MD5

    9202eafd948a7c76d895cf64a4c29266

  • SHA1

    01cf5b9553d08d8255f2e125e9a6272e8b40b7a7

  • SHA256

    90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256

  • SHA512

    47e7bb6b613c8f1c358108c7e1447b950109fb6fb0dbf5cadc457f628ad5bdce5874da1ca9fc8a51432c79798c03d869189145725d688500ff009f826a839512

  • SSDEEP

    6144:QocMkAI/pFPeX8yP2jYddBTnETaxzO7KIU4ctjccYnaXYI:JkAEFeXZP2jgTwTFa4ctjccYnaXF

Malware Config

Extracted

Family

xenorat

C2

154.216.17.155

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    50000

  • install_path

    appdata

  • port

    1356

  • startup_name

    csvr

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe
    "C:\Users\Admin\AppData\Local\Temp\90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Users\Admin\AppData\Local\Temp\90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe
      C:\Users\Admin\AppData\Local\Temp\90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe
      2⤵
        PID:2404
      • C:\Users\Admin\AppData\Local\Temp\90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe
        C:\Users\Admin\AppData\Local\Temp\90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1716
        • C:\Users\Admin\AppData\Roaming\XenoManager\90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe
          "C:\Users\Admin\AppData\Roaming\XenoManager\90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2244
          • C:\Users\Admin\AppData\Roaming\XenoManager\90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3020
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks.exe" /Create /TN "csvr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp558F.tmp" /F
              5⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2984
          • C:\Users\Admin\AppData\Roaming\XenoManager\90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2908

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp558F.tmp

      Filesize

      1KB

      MD5

      160385510e6df55d6dcf0161d1dc17ce

      SHA1

      14ae524cbf1cb92619f5fb73390a9482aa892362

      SHA256

      7e2b90db3215a0698ee1e99e1d12a54b08c79d0bd3e84cfb540c1cd2de8c016a

      SHA512

      d055fce8f8a11a81d3f851ce69d80195259b977f0a83c7b2cdc7a60736340389ed90c0581a896ba4dffff6d2d132c9a3f5bb4098fd0edeb9130d897f838d7f4c

    • \Users\Admin\AppData\Roaming\XenoManager\90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256.exe

      Filesize

      349KB

      MD5

      9202eafd948a7c76d895cf64a4c29266

      SHA1

      01cf5b9553d08d8255f2e125e9a6272e8b40b7a7

      SHA256

      90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256

      SHA512

      47e7bb6b613c8f1c358108c7e1447b950109fb6fb0dbf5cadc457f628ad5bdce5874da1ca9fc8a51432c79798c03d869189145725d688500ff009f826a839512

    • memory/1716-12-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1716-7-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1716-14-0x0000000074500000-0x0000000074BEE000-memory.dmp

      Filesize

      6.9MB

    • memory/1716-9-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1716-22-0x0000000074500000-0x0000000074BEE000-memory.dmp

      Filesize

      6.9MB

    • memory/2184-3-0x0000000074500000-0x0000000074BEE000-memory.dmp

      Filesize

      6.9MB

    • memory/2184-4-0x00000000046C0000-0x0000000004716000-memory.dmp

      Filesize

      344KB

    • memory/2184-5-0x00000000003D0000-0x00000000003D6000-memory.dmp

      Filesize

      24KB

    • memory/2184-15-0x0000000074500000-0x0000000074BEE000-memory.dmp

      Filesize

      6.9MB

    • memory/2184-0-0x000000007450E000-0x000000007450F000-memory.dmp

      Filesize

      4KB

    • memory/2184-2-0x00000000001F0000-0x00000000001F6000-memory.dmp

      Filesize

      24KB

    • memory/2184-1-0x0000000000A00000-0x0000000000A62000-memory.dmp

      Filesize

      392KB

    • memory/2244-23-0x00000000002E0000-0x0000000000342000-memory.dmp

      Filesize

      392KB