Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1798s -
max time network
1565s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/11/2024, 22:53
Behavioral task
behavioral1
Sample
doxxing tools.exe
Resource
win7-20240903-en
General
-
Target
doxxing tools.exe
-
Size
45KB
-
MD5
2c793b3221f10acac5abf94c66cdffad
-
SHA1
fc87d203a90c393a4a8077cd56e2d0440cf44eb2
-
SHA256
8cb13d52c6106edd9c40b5144b1f6c23f223fc06e65b62c096e9da9ec86cbd29
-
SHA512
f69ce3c562621663afccdd2eb53caae363efe0b53a01dac668a093ba7d0e2aa07a3c2bb7dc4eb7832e93e6491989d28940c3bf015a4cee40858775be0416b06e
-
SSDEEP
768:1dhO/poiiUcjlJIn2VH9Xqk5nWEZ5SbTDaJuI7CPW5Y:Lw+jjgn+H9XqcnW85SbTMuIg
Malware Config
Extracted
xenorat
127.0.0.1
Xeno_rat_nd8912d
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
Photos
Signatures
-
Detect XenoRat Payload 3 IoCs
resource yara_rule behavioral1/memory/2280-1-0x00000000009B0000-0x00000000009C2000-memory.dmp family_xenorat behavioral1/files/0x000800000001739c-4.dat family_xenorat behavioral1/memory/1940-9-0x0000000000F60000-0x0000000000F72000-memory.dmp family_xenorat -
Xenorat family
-
Executes dropped EXE 1 IoCs
pid Process 1940 doxxing tools.exe -
Loads dropped DLL 1 IoCs
pid Process 2280 doxxing tools.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language doxxing tools.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language doxxing tools.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2768 schtasks.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2280 wrote to memory of 1940 2280 doxxing tools.exe 31 PID 2280 wrote to memory of 1940 2280 doxxing tools.exe 31 PID 2280 wrote to memory of 1940 2280 doxxing tools.exe 31 PID 2280 wrote to memory of 1940 2280 doxxing tools.exe 31 PID 1940 wrote to memory of 2768 1940 doxxing tools.exe 32 PID 1940 wrote to memory of 2768 1940 doxxing tools.exe 32 PID 1940 wrote to memory of 2768 1940 doxxing tools.exe 32 PID 1940 wrote to memory of 2768 1940 doxxing tools.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\doxxing tools.exe"C:\Users\Admin\AppData\Local\Temp\doxxing tools.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Roaming\XenoManager\doxxing tools.exe"C:\Users\Admin\AppData\Roaming\XenoManager\doxxing tools.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Photos" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF612.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2768
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b6f02b8314bd1b23bbd31f0ae07160d8
SHA1166461e0568ec70a49b95f23fb335700ff3b15ca
SHA256dacb90bc1c1bab4ed6a535a0d9e9634d00154acc5d22ad733bf504ff7812ea33
SHA512a4b3c1bf5b977f1f35016d33ecb997f969affa50738d23da6d0c4f6e181ba8aff9dbee01cfececd7abbfc9290375c60452d4922fb1a251af17f514fb71076e2a
-
Filesize
45KB
MD52c793b3221f10acac5abf94c66cdffad
SHA1fc87d203a90c393a4a8077cd56e2d0440cf44eb2
SHA2568cb13d52c6106edd9c40b5144b1f6c23f223fc06e65b62c096e9da9ec86cbd29
SHA512f69ce3c562621663afccdd2eb53caae363efe0b53a01dac668a093ba7d0e2aa07a3c2bb7dc4eb7832e93e6491989d28940c3bf015a4cee40858775be0416b06e