Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1791s -
max time network
1793s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2024, 17:21
Static task
static1
Behavioral task
behavioral1
Sample
xrp.exe
Resource
win7-20241010-en
General
-
Target
xrp.exe
-
Size
136KB
-
MD5
0d08e05884330a38020985c58e14e3af
-
SHA1
40703991414f435a13d1da2879edeba05e2a6f4a
-
SHA256
afe70b3c28c52a2f90f0bfca93e335008cf06eb1c14d1b161ebf25754c6c81ac
-
SHA512
b7ac3707a6e7a6152c0694f1b5e44ac45522ebf94720664e91b4a66f4bcafa918d88f2ba3d233acfdd2466652dc6a3d85f980621a254165760705ea4b7d42c14
-
SSDEEP
1536:tGAUgKrkSIWXgB7DIHYSf6GpcEApEXJjh0Nq9tAIGpdnJWZjN52QR0+GoxhoMyn6:tGAUBgSdG7e305mxrSk
Malware Config
Extracted
asyncrat
v1.2.0
Default
192.252.186.220:56003
192.252.186.220:3534
192.252.186.220:43985
igsnloedblkziu
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023cbd-3.dat family_asyncrat -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 2980 cGoMHeTI.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2980 cGoMHeTI.exe 2980 cGoMHeTI.exe 2980 cGoMHeTI.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2980 cGoMHeTI.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2980 cGoMHeTI.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2980 cGoMHeTI.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2604 1856 xrp.exe 85 PID 1856 wrote to memory of 2604 1856 xrp.exe 85 PID 2604 wrote to memory of 2980 2604 cmd.exe 86 PID 2604 wrote to memory of 2980 2604 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\xrp.exe"C:\Users\Admin\AppData\Local\Temp\xrp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SYSTEM32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\cGoMHeTI.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\cGoMHeTI.exeC:\Users\Admin\AppData\Local\Temp\cGoMHeTI.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2980
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5b1593c6c6ca1b44185e3df4e1acfb935
SHA17ab9312fe1ba1e5f57440ed87b6961906b1decb7
SHA256fce952de72f22770ddddc0e6a0726125fddc433819a993fb9f1166c1bfeeafc7
SHA51233e52bd49e208dda248ff91af3363a0778fb2546437f2fc9f213d16f38c1d4f448bd14911e030c1833c24581f11b1f700c6150929dedf5cf2ca1645ec5d8c024