Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/10/2024, 08:01

General

  • Target

    Xeno_manager.exe

  • Size

    45KB

  • MD5

    32cb2f4e99ecc0113554aad30643b92f

  • SHA1

    9e10547be5ee02d6a8e2be72f92a8747c708c897

  • SHA256

    9037601de282b706cf457116b42b3d36e3ccd7842b13b08efced4337230ced80

  • SHA512

    390e7d66580ffd4e3e807ddc0e95664e945664880034d494713c7d2fa6bdacdc08baace40e36361261ea3a24323e89a15fc529a3696b5c5b9bc9e989530eca35

  • SSDEEP

    768:6SisJmceOo5De+APsZjGsdHbtm+KW7qTN+8Nw:MsJmfOiD+kZ/HbteW2EUw

Malware Config

Extracted

Family

xenorat

C2

87.120.116.115

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    50000

  • install_path

    appdata

  • port

    1390

  • startup_name

    nothingset

Signatures

  • Detect XenoRat Payload 3 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Xeno_manager.exe
    "C:\Users\Admin\AppData\Local\Temp\Xeno_manager.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Roaming\UpdateManager\Xeno_manager.exe
      "C:\Users\Admin\AppData\Roaming\UpdateManager\Xeno_manager.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "UpdateManager" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1BBB.tmp" /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp1BBB.tmp

    Filesize

    1KB

    MD5

    4605c526b2fb5221014861df1b02805e

    SHA1

    52a20384950759123efdef6dee59c3b1853dcba8

    SHA256

    9d48dedb381f9459439231a6546f3e7fe55afa82c3a9120afb367420e0b8e4c0

    SHA512

    27a5d80ee9d92d64d0ea04537ac364e58ce882a48ec83550c9446cdaad858bc00210acb3f03c4efe3069e68483d9825e3c0ac9294ec1fb824df6925328a61690

  • \Users\Admin\AppData\Roaming\UpdateManager\Xeno_manager.exe

    Filesize

    45KB

    MD5

    32cb2f4e99ecc0113554aad30643b92f

    SHA1

    9e10547be5ee02d6a8e2be72f92a8747c708c897

    SHA256

    9037601de282b706cf457116b42b3d36e3ccd7842b13b08efced4337230ced80

    SHA512

    390e7d66580ffd4e3e807ddc0e95664e945664880034d494713c7d2fa6bdacdc08baace40e36361261ea3a24323e89a15fc529a3696b5c5b9bc9e989530eca35

  • memory/2800-9-0x0000000000FF0000-0x0000000001002000-memory.dmp

    Filesize

    72KB

  • memory/2800-10-0x00000000746E0000-0x0000000074DCE000-memory.dmp

    Filesize

    6.9MB

  • memory/2800-11-0x00000000746E0000-0x0000000074DCE000-memory.dmp

    Filesize

    6.9MB

  • memory/2800-14-0x00000000746E0000-0x0000000074DCE000-memory.dmp

    Filesize

    6.9MB

  • memory/2800-15-0x00000000746E0000-0x0000000074DCE000-memory.dmp

    Filesize

    6.9MB

  • memory/3064-0-0x00000000746EE000-0x00000000746EF000-memory.dmp

    Filesize

    4KB

  • memory/3064-1-0x0000000000F80000-0x0000000000F92000-memory.dmp

    Filesize

    72KB