Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

47c1a3c712...1b.exe

windows7-x64

10

47c1a3c712...1b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2024, 02:13 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe

  • Size

    45KB

  • MD5

    fac7f1e31fc892329844a1b0d6b5ade5

  • SHA1

    ab95a85791703d5a82341ea594aca2780bb3cb20

  • SHA256

    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b

  • SHA512

    53f783e7cf143a957385572cab76c6a27891cd96e7d4f7064ddbc0ed84c090f7b0849977276db8a142572a9f730c17bed907118c8931017f149593f4c7ff43eb

  • SSDEEP

    768:LbdhO/poiiUcjlJInZXSeH9Xqk5nWEZ5SbTDa8WI7CPW5K:LJw+jjgnNH9XqcnW85SbT9WIC

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

cinasa.duckdns.org

Mutex

pastj

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    2424

  • startup_name

    nothingset

Signatures

  • Detect XenoRat Payload 1 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Xenorat family
    xenorat
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    "C:\Users\Admin\AppData\Local\Temp\47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1628

Network

  • flag-us
    DNS
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    Remote address:
    8.8.8.8:53
    Request
    cinasa.duckdns.org
    IN A
    Response
    cinasa.duckdns.org
    IN A
    154.216.17.204
  • flag-us
    DNS
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    Remote address:
    8.8.8.8:53
    Request
    cinasa.duckdns.org
    IN A
    Response
    cinasa.duckdns.org
    IN A
    154.216.17.204
  • flag-us
    DNS
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    Remote address:
    8.8.8.8:53
    Request
    cinasa.duckdns.org
    IN A
    Response
    cinasa.duckdns.org
    IN A
    154.216.17.204
  • 154.216.17.204:2424
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    152 B
     120 B
     3
    3
  • 154.216.17.204:2424
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    152 B
     120 B
     3
    3
  • 154.216.17.204:2424
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    152 B
     120 B
     3
    3
  • 154.216.17.204:2424
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    152 B
     120 B
     3
    3
  • 154.216.17.204:2424
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    152 B
     120 B
     3
    3
  • 154.216.17.204:2424
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    152 B
     120 B
     3
    3
  • 154.216.17.204:2424
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    152 B
     120 B
     3
    3
  • 154.216.17.204:2424
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    152 B
     120 B
     3
    3
  • 154.216.17.204:2424
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    152 B
     120 B
     3
    3
  • 154.216.17.204:2424
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    152 B
     120 B
     3
    3
  • 154.216.17.204:2424
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    152 B
     120 B
     3
    3
  • 154.216.17.204:2424
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    152 B
     120 B
     3
    3
  • 154.216.17.204:2424
    cinasa.duckdns.org
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    152 B
     120 B
     3
    3
  • 8.8.8.8:53
    cinasa.duckdns.org
    dns
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    64 B
     80 B
     1
    1

    DNS Request

    cinasa.duckdns.org

    DNS Response

    154.216.17.204

  • 8.8.8.8:53
    cinasa.duckdns.org
    dns
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    64 B
     80 B
     1
    1

    DNS Request

    cinasa.duckdns.org

    DNS Response

    154.216.17.204

  • 8.8.8.8:53
    cinasa.duckdns.org
    dns
    47c1a3c712327198d08b6dcdbbf589b1b590d73971533cba1deefc95ed2fd11b.exe
    64 B
     80 B
     1
    1

    DNS Request

    cinasa.duckdns.org

    DNS Response

    154.216.17.204

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1628-0-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1628-1-0x00000000000D0000-0x00000000000E2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1628-2-0x0000000074B00000-0x00000000751EE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1628-3-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1628-4-0x0000000074B00000-0x00000000751EE000-memory.dmp

    Filesize

    6.9MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.