Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/10/2024, 12:58
Behavioral task
behavioral1
Sample
client.exe
Resource
win7-20240903-en
General
-
Target
client.exe
-
Size
45KB
-
MD5
1acd506e251f840ff4aebd32401a68ab
-
SHA1
38ce2a41d59a1bf0f3332fb867f43794c39577af
-
SHA256
b55e1e8555367114aff90727da651e37d8662a2678041b8f50f19fd8a397f984
-
SHA512
26c74ecb9a20848f0b6bf9a1b9b0ccbc67d1b281337d50bafdf93382f1bf4f89f19669e5a278df8ff032092ede9597d0142b8e2718b0e7bbb034c3e78b84c5c4
-
SSDEEP
768:wdhO/poiiUcjlJInKTH9Xqk5nWEZ5SbTDaSuI7CPW5k:iw+jjgn8H9XqcnW85SbTvuIM
Malware Config
Extracted
xenorat
people-weekend.gl.at.ply.gg
somerandomvalue
-
install_path
appdata
-
port
5719
-
startup_name
Console
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral2/memory/1700-1-0x0000000000910000-0x0000000000922000-memory.dmp family_xenorat behavioral2/files/0x000a000000023b7b-6.dat family_xenorat -
Xenorat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation client.exe -
Executes dropped EXE 1 IoCs
pid Process 4504 client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4892 schtasks.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1700 wrote to memory of 4504 1700 client.exe 86 PID 1700 wrote to memory of 4504 1700 client.exe 86 PID 1700 wrote to memory of 4504 1700 client.exe 86 PID 4504 wrote to memory of 4892 4504 client.exe 87 PID 4504 wrote to memory of 4892 4504 client.exe 87 PID 4504 wrote to memory of 4892 4504 client.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Roaming\XenoManager\client.exe"C:\Users\Admin\AppData\Roaming\XenoManager\client.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Console" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6467.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4892
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
1KB
MD5fdd36139980f5cbfef3360123665b96c
SHA1faf5353ca339065426642578c3913906e892becf
SHA256ff95b1308fc4294f5d6dcb0c171633387d81b4f2efda617292eb784615b17bed
SHA5122ab91e7733c16300feda4efa61cc11baf21245f85c4cccd08e92c5fd61cfa03d206ba04939362733ce26385dfd66ab4524cd1a0da2c779a7e0ce9d00b4e5e31b
-
Filesize
45KB
MD51acd506e251f840ff4aebd32401a68ab
SHA138ce2a41d59a1bf0f3332fb867f43794c39577af
SHA256b55e1e8555367114aff90727da651e37d8662a2678041b8f50f19fd8a397f984
SHA51226c74ecb9a20848f0b6bf9a1b9b0ccbc67d1b281337d50bafdf93382f1bf4f89f19669e5a278df8ff032092ede9597d0142b8e2718b0e7bbb034c3e78b84c5c4