Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2024, 17:19
Static task
static1
Behavioral task
behavioral1
Sample
xrp.exe
Resource
win7-20240903-en
General
-
Target
xrp.exe
-
Size
136KB
-
MD5
0d08e05884330a38020985c58e14e3af
-
SHA1
40703991414f435a13d1da2879edeba05e2a6f4a
-
SHA256
afe70b3c28c52a2f90f0bfca93e335008cf06eb1c14d1b161ebf25754c6c81ac
-
SHA512
b7ac3707a6e7a6152c0694f1b5e44ac45522ebf94720664e91b4a66f4bcafa918d88f2ba3d233acfdd2466652dc6a3d85f980621a254165760705ea4b7d42c14
-
SSDEEP
1536:tGAUgKrkSIWXgB7DIHYSf6GpcEApEXJjh0Nq9tAIGpdnJWZjN52QR0+GoxhoMyn6:tGAUBgSdG7e305mxrSk
Malware Config
Extracted
asyncrat
v1.2.0
Default
192.252.186.220:56003
192.252.186.220:3534
192.252.186.220:43985
igsnloedblkziu
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023cb0-3.dat family_asyncrat -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 3528 BtRp61k7.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3528 BtRp61k7.exe 3528 BtRp61k7.exe 3528 BtRp61k7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3528 BtRp61k7.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3528 BtRp61k7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2320 wrote to memory of 3104 2320 xrp.exe 83 PID 2320 wrote to memory of 3104 2320 xrp.exe 83 PID 3104 wrote to memory of 3528 3104 cmd.exe 84 PID 3104 wrote to memory of 3528 3104 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\xrp.exe"C:\Users\Admin\AppData\Local\Temp\xrp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SYSTEM32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\BtRp61k7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\BtRp61k7.exeC:\Users\Admin\AppData\Local\Temp\BtRp61k7.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3528
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5b3f5422006291ef27db335983a29acf4
SHA186e2cf8a9db62435f68caca32030265a22f3152a
SHA2566f7eb9f2c040ca90b0b5c4410d6ef19a447c858147031628cfaca56ac18bed75
SHA5122dc00a116c555c44206e08f02c914ee03fed1b0ad5c984368891134cba07a07aa377161e9380b7ab8857829b4110456c6961573596bb6c453c5b1402a9ad1359