Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1790s -
max time network
1796s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2024, 17:21
Static task
static1
Behavioral task
behavioral1
Sample
xrp.exe
Resource
win7-20240903-en
General
-
Target
xrp.exe
-
Size
136KB
-
MD5
0d08e05884330a38020985c58e14e3af
-
SHA1
40703991414f435a13d1da2879edeba05e2a6f4a
-
SHA256
afe70b3c28c52a2f90f0bfca93e335008cf06eb1c14d1b161ebf25754c6c81ac
-
SHA512
b7ac3707a6e7a6152c0694f1b5e44ac45522ebf94720664e91b4a66f4bcafa918d88f2ba3d233acfdd2466652dc6a3d85f980621a254165760705ea4b7d42c14
-
SSDEEP
1536:tGAUgKrkSIWXgB7DIHYSf6GpcEApEXJjh0Nq9tAIGpdnJWZjN52QR0+GoxhoMyn6:tGAUBgSdG7e305mxrSk
Malware Config
Extracted
asyncrat
v1.2.0
Default
192.252.186.220:56003
192.252.186.220:3534
192.252.186.220:43985
igsnloedblkziu
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b88-3.dat family_asyncrat -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4660 vmKQo7Le.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4660 vmKQo7Le.exe 4660 vmKQo7Le.exe 4660 vmKQo7Le.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4660 vmKQo7Le.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4660 vmKQo7Le.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4660 vmKQo7Le.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1940 wrote to memory of 5032 1940 xrp.exe 84 PID 1940 wrote to memory of 5032 1940 xrp.exe 84 PID 5032 wrote to memory of 4660 5032 cmd.exe 85 PID 5032 wrote to memory of 4660 5032 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\xrp.exe"C:\Users\Admin\AppData\Local\Temp\xrp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SYSTEM32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\vmKQo7Le.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\vmKQo7Le.exeC:\Users\Admin\AppData\Local\Temp\vmKQo7Le.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4660
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5322ecb9be3f75448810cfd4728de57c4
SHA1f67d9253877f66079bb1239f3d54c9b6edb4276b
SHA256221df89d89fc3d8f058264f219b520025ed99103e2f8ede6a5b0fa104ba544a8
SHA51205b6835cfe3ffe10423188e47927f3a8682b818d5eef1fca5f3dc0515c7c2960dae9902b850e0c4047a9b6839d2b667887424bff4a28e85a637ab71530b89ea9