Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2024, 23:00 UTC

General

  • Target

    KWAo.exe

  • Size

    1.3MB

  • MD5

    7f951c4f31319daee4a1f1ece60e5e6b

  • SHA1

    044d20440b4931fd9d357ea8a43f8ff047ebab5d

  • SHA256

    c7a46fb4e1691e3b8712cb595bc25672dfb77570166cc2d2cba02cf2f9e7b728

  • SHA512

    a87acb49cd46ae47ee1bfa6a2dc554240cdc3e55ec625f3b37df3569740565573f433dd8bdd63c578ddfe6563ee44b4f0b71c8524ac628313e733c147e86c5e0

  • SSDEEP

    24576:Yj5zD+Z0RKwDkheamIcjLwRqFazNBJvGKb6NUzP3olmc/nthbgRKlO:Yj5PrRZRsRqMPJvGKb6NUzvsfbjA

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

segundo

C2

formationslistcomplet2.sexidude.com:3056

Mutex

ibsdlcboijedubuheubueyd

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain
1
USYwrgc9sryQdNlflMPy5OMI1W2z0f5H

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KWAo.exe
    "C:\Users\Admin\AppData\Local\Temp\KWAo.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2812

Network

  • flag-us
    DNS
    formationslistcomplet2.sexidude.com
    csc.exe
    Remote address:
    8.8.8.8:53
    Request
    formationslistcomplet2.sexidude.com
    IN A
    Response
    formationslistcomplet2.sexidude.com
    IN A
    181.131.217.244
  • flag-us
    DNS
    formationslistcomplet2.sexidude.com
    csc.exe
    Remote address:
    8.8.8.8:53
    Request
    formationslistcomplet2.sexidude.com
    IN A
    Response
    formationslistcomplet2.sexidude.com
    IN A
    181.131.217.244
  • flag-us
    DNS
    formationslistcomplet2.sexidude.com
    csc.exe
    Remote address:
    8.8.8.8:53
    Request
    formationslistcomplet2.sexidude.com
    IN A
    Response
    formationslistcomplet2.sexidude.com
    IN A
    181.131.217.244
  • 181.131.217.244:3056
    formationslistcomplet2.sexidude.com
    csc.exe
    152 B
    3
  • 181.131.217.244:3056
    formationslistcomplet2.sexidude.com
    csc.exe
    152 B
    3
  • 181.131.217.244:3056
    formationslistcomplet2.sexidude.com
    csc.exe
    152 B
    3
  • 181.131.217.244:3056
    formationslistcomplet2.sexidude.com
    csc.exe
    152 B
    3
  • 181.131.217.244:3056
    formationslistcomplet2.sexidude.com
    csc.exe
    152 B
    3
  • 181.131.217.244:3056
    formationslistcomplet2.sexidude.com
    csc.exe
    104 B
    2
  • 8.8.8.8:53
    formationslistcomplet2.sexidude.com
    dns
    csc.exe
    81 B
    97 B
    1
    1

    DNS Request

    formationslistcomplet2.sexidude.com

    DNS Response

    181.131.217.244

  • 8.8.8.8:53
    formationslistcomplet2.sexidude.com
    dns
    csc.exe
    81 B
    97 B
    1
    1

    DNS Request

    formationslistcomplet2.sexidude.com

    DNS Response

    181.131.217.244

  • 8.8.8.8:53
    formationslistcomplet2.sexidude.com
    dns
    csc.exe
    81 B
    97 B
    1
    1

    DNS Request

    formationslistcomplet2.sexidude.com

    DNS Response

    181.131.217.244

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2700-14-0x0000000000534000-0x0000000000556000-memory.dmp

    Filesize

    136KB

  • memory/2700-0-0x0000000000400000-0x0000000000557000-memory.dmp

    Filesize

    1.3MB

  • memory/2700-2-0x0000000000400000-0x0000000000557000-memory.dmp

    Filesize

    1.3MB

  • memory/2700-5-0x0000000000400000-0x0000000000557000-memory.dmp

    Filesize

    1.3MB

  • memory/2700-6-0x0000000000400000-0x0000000000557000-memory.dmp

    Filesize

    1.3MB

  • memory/2700-4-0x0000000000400000-0x0000000000557000-memory.dmp

    Filesize

    1.3MB

  • memory/2700-10-0x0000000000400000-0x0000000000557000-memory.dmp

    Filesize

    1.3MB

  • memory/2700-12-0x000000000045D000-0x0000000000476000-memory.dmp

    Filesize

    100KB

  • memory/2700-15-0x000000000053C000-0x0000000000556000-memory.dmp

    Filesize

    104KB

  • memory/2700-13-0x0000000000400000-0x0000000000557000-memory.dmp

    Filesize

    1.3MB

  • memory/2700-1-0x000000000045D000-0x0000000000476000-memory.dmp

    Filesize

    100KB

  • memory/2812-17-0x0000000000080000-0x0000000000092000-memory.dmp

    Filesize

    72KB

  • memory/2812-19-0x0000000000080000-0x0000000000092000-memory.dmp

    Filesize

    72KB

  • memory/2812-9-0x0000000000080000-0x0000000000092000-memory.dmp

    Filesize

    72KB

  • memory/2812-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2812-7-0x0000000000080000-0x0000000000092000-memory.dmp

    Filesize

    72KB

  • memory/2812-20-0x000000007441E000-0x000000007441F000-memory.dmp

    Filesize

    4KB

  • memory/2812-21-0x0000000074410000-0x0000000074AFE000-memory.dmp

    Filesize

    6.9MB

  • memory/2812-22-0x000000007441E000-0x000000007441F000-memory.dmp

    Filesize

    4KB

  • memory/2812-23-0x0000000074410000-0x0000000074AFE000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.