Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2024, 17:22
Static task
static1
Behavioral task
behavioral1
Sample
xrp.exe
Resource
win7-20240708-en
General
-
Target
xrp.exe
-
Size
136KB
-
MD5
0d08e05884330a38020985c58e14e3af
-
SHA1
40703991414f435a13d1da2879edeba05e2a6f4a
-
SHA256
afe70b3c28c52a2f90f0bfca93e335008cf06eb1c14d1b161ebf25754c6c81ac
-
SHA512
b7ac3707a6e7a6152c0694f1b5e44ac45522ebf94720664e91b4a66f4bcafa918d88f2ba3d233acfdd2466652dc6a3d85f980621a254165760705ea4b7d42c14
-
SSDEEP
1536:tGAUgKrkSIWXgB7DIHYSf6GpcEApEXJjh0Nq9tAIGpdnJWZjN52QR0+GoxhoMyn6:tGAUBgSdG7e305mxrSk
Malware Config
Extracted
asyncrat
v1.2.0
Default
192.252.186.220:56003
192.252.186.220:3534
192.252.186.220:43985
igsnloedblkziu
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023c9e-3.dat family_asyncrat -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4968 morADhmt.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4968 morADhmt.exe 4968 morADhmt.exe 4968 morADhmt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4968 morADhmt.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4968 morADhmt.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2328 wrote to memory of 608 2328 xrp.exe 84 PID 2328 wrote to memory of 608 2328 xrp.exe 84 PID 608 wrote to memory of 4968 608 cmd.exe 85 PID 608 wrote to memory of 4968 608 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\xrp.exe"C:\Users\Admin\AppData\Local\Temp\xrp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SYSTEM32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\morADhmt.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Users\Admin\AppData\Local\Temp\morADhmt.exeC:\Users\Admin\AppData\Local\Temp\morADhmt.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4968
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD530c2b801f87dbe4813160234e1626d57
SHA16f1f3d02ae37b98d915f69ad1f6489b8940f237d
SHA256b534ee43d6301b7920a3fba8a981c56750dc7a240cfc378a13357a03a7f60f69
SHA512fee5f8586abd5105ac6e5a6944a414b81f14d1a2af8bc6da5899565fe7768f2016e27ef9b5cca3c7faa30dc461f7567b912a308a7769fe61281134cae054719b