Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14/10/2024, 02:00
Behavioral task
behavioral1
Sample
horion executor.exe
Resource
win7-20241010-en
General
-
Target
horion executor.exe
-
Size
468KB
-
MD5
2eb0ea8d72d333361e25d0098cf9e3f9
-
SHA1
ca83c1003b89271df09d3930a21693916d9bdf00
-
SHA256
c9b145d19869e40e615086a5b158fca378b0098dc3621991eff2c43b67435863
-
SHA512
6ad5bc8cf4ef20d5965b20b2f2fa7e4ba23f397d150f9ea4803d64ee1f58ae0eadce4eddd3ea44eee7f05a7541759897e4891a168d4b2b371935be40a1e9baab
-
SSDEEP
3072:Gw+jqS91UbTiEy5dUBoqcPvSqqw1QHgtUOJ/yDPjPVc2WLiK4XVfI2a:zWb91Ub2dXrSYiEnJ8b22Wo
Malware Config
Extracted
xenorat
10.0.2.15
horiom executor
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
horion
Signatures
-
Detect XenoRat Payload 3 IoCs
resource yara_rule behavioral1/memory/2860-1-0x0000000000820000-0x000000000089C000-memory.dmp family_xenorat behavioral1/files/0x0008000000016d70-4.dat family_xenorat behavioral1/memory/2060-9-0x00000000002C0000-0x000000000033C000-memory.dmp family_xenorat -
Executes dropped EXE 1 IoCs
pid Process 2060 horion executor.exe -
Loads dropped DLL 1 IoCs
pid Process 2860 horion executor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language horion executor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language horion executor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2660 schtasks.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2060 2860 horion executor.exe 30 PID 2860 wrote to memory of 2060 2860 horion executor.exe 30 PID 2860 wrote to memory of 2060 2860 horion executor.exe 30 PID 2860 wrote to memory of 2060 2860 horion executor.exe 30 PID 2060 wrote to memory of 2660 2060 horion executor.exe 31 PID 2060 wrote to memory of 2660 2060 horion executor.exe 31 PID 2060 wrote to memory of 2660 2060 horion executor.exe 31 PID 2060 wrote to memory of 2660 2060 horion executor.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\horion executor.exe"C:\Users\Admin\AppData\Local\Temp\horion executor.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Roaming\XenoManager\horion executor.exe"C:\Users\Admin\AppData\Roaming\XenoManager\horion executor.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "horion" /XML "C:\Users\Admin\AppData\Local\Temp\tmp448F.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2660
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a5d34e4f70c0f81519354ab56c05b496
SHA13f51ca99e94765128ac747a31c48160586fdcfe1
SHA2567b65fe498c991e293aac865a9f3363758632aef005bcb286daf3728f8ef7a19c
SHA512d512f10ab0349a0eb2fc2870f45589cce64860d7a444a4f064a050a8560c9711f8dbcfd186b3631942b2d2ac11f39e8eb56ceef63df09d026174f1b7c588016b
-
Filesize
468KB
MD52eb0ea8d72d333361e25d0098cf9e3f9
SHA1ca83c1003b89271df09d3930a21693916d9bdf00
SHA256c9b145d19869e40e615086a5b158fca378b0098dc3621991eff2c43b67435863
SHA5126ad5bc8cf4ef20d5965b20b2f2fa7e4ba23f397d150f9ea4803d64ee1f58ae0eadce4eddd3ea44eee7f05a7541759897e4891a168d4b2b371935be40a1e9baab