Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2024, 10:55

General

  • Target

    3c17536c9824395560e1c82edf9fd329018a30443408220bd8f69e03c4d23bbd.exe

  • Size

    45KB

  • MD5

    f1328e251cf2393078be810afacde1f9

  • SHA1

    e0638a74e19cb95057442460daec0dec14379063

  • SHA256

    3c17536c9824395560e1c82edf9fd329018a30443408220bd8f69e03c4d23bbd

  • SHA512

    5744ddafaa8b3913382ca9bd3fc1650109bd4368a8870517e59057881e1a5a9eb91689bdc545edd4b22a8f0652d7c93fde29a0e67866c06f0f3f3f984a587ab1

  • SSDEEP

    768:LbdhO/poiiUcjlJInZXSeH9Xqk5nWEZ5SbTDa8WI7CPW5Kj:LJw+jjgnNH9XqcnW85SbT9WICj

Malware Config

Extracted

Family

xenorat

C2

cinasa.duckdns.org

Mutex

pastj

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    2424

  • startup_name

    nothingset

Signatures

  • Detect XenoRat Payload 1 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Xenorat family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c17536c9824395560e1c82edf9fd329018a30443408220bd8f69e03c4d23bbd.exe
    "C:\Users\Admin\AppData\Local\Temp\3c17536c9824395560e1c82edf9fd329018a30443408220bd8f69e03c4d23bbd.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/108-0-0x00000000749AE000-0x00000000749AF000-memory.dmp

    Filesize

    4KB

  • memory/108-1-0x0000000000270000-0x0000000000282000-memory.dmp

    Filesize

    72KB

  • memory/108-2-0x00000000749A0000-0x000000007508E000-memory.dmp

    Filesize

    6.9MB

  • memory/108-3-0x00000000749AE000-0x00000000749AF000-memory.dmp

    Filesize

    4KB

  • memory/108-4-0x00000000749A0000-0x000000007508E000-memory.dmp

    Filesize

    6.9MB