Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/12/2024, 07:32
Static task
static1
Behavioral task
behavioral1
Sample
57fcc042b0f7783567878d217ae69e25.exe
Resource
win7-20240903-en
General
-
Target
57fcc042b0f7783567878d217ae69e25.exe
-
Size
166KB
-
MD5
57fcc042b0f7783567878d217ae69e25
-
SHA1
83032ec361ea8b15ef956536999b754db6a12423
-
SHA256
13bd3ee226114db8e18f2fe414a7e2c4e0937eda7d8a02b2efebaa2af8238564
-
SHA512
4fe2ce713333d9a16d65ca5ccdc3a2e687b84a58b6b1e43b43c3f508edb2cc04478a5595efc43202decf7f86b50fd43382246fbc12553117a9177fb13d987b67
-
SSDEEP
3072:sx0yjrZkg1DP9onHyAhZKoQd0z269TAfL7/Rwf+hO3IyYPC+X4og6Rd:iRjfAi7ymn/LhO3IyYPzX4oVd
Malware Config
Extracted
xenorat
dns.stipamana.com
Xeno_rat_nd8912d
-
delay
12000
-
install_path
appdata
-
port
4567
-
startup_name
mrec
Signatures
-
Detect XenoRat Payload 3 IoCs
resource yara_rule behavioral1/memory/2492-11-0x0000000000400000-0x0000000000412000-memory.dmp family_xenorat behavioral1/memory/2492-7-0x0000000000400000-0x0000000000412000-memory.dmp family_xenorat behavioral1/memory/2492-5-0x0000000000400000-0x0000000000412000-memory.dmp family_xenorat -
Xenorat family
-
Executes dropped EXE 4 IoCs
pid Process 2860 57fcc042b0f7783567878d217ae69e25.exe 2880 57fcc042b0f7783567878d217ae69e25.exe 2904 57fcc042b0f7783567878d217ae69e25.exe 1716 57fcc042b0f7783567878d217ae69e25.exe -
Loads dropped DLL 4 IoCs
pid Process 2492 57fcc042b0f7783567878d217ae69e25.exe 2860 57fcc042b0f7783567878d217ae69e25.exe 2860 57fcc042b0f7783567878d217ae69e25.exe 2860 57fcc042b0f7783567878d217ae69e25.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1944 set thread context of 2492 1944 57fcc042b0f7783567878d217ae69e25.exe 31 PID 1944 set thread context of 1428 1944 57fcc042b0f7783567878d217ae69e25.exe 32 PID 1944 set thread context of 2248 1944 57fcc042b0f7783567878d217ae69e25.exe 33 PID 2860 set thread context of 2880 2860 57fcc042b0f7783567878d217ae69e25.exe 35 PID 2860 set thread context of 2904 2860 57fcc042b0f7783567878d217ae69e25.exe 36 PID 2860 set thread context of 1716 2860 57fcc042b0f7783567878d217ae69e25.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57fcc042b0f7783567878d217ae69e25.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57fcc042b0f7783567878d217ae69e25.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57fcc042b0f7783567878d217ae69e25.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57fcc042b0f7783567878d217ae69e25.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57fcc042b0f7783567878d217ae69e25.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57fcc042b0f7783567878d217ae69e25.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57fcc042b0f7783567878d217ae69e25.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57fcc042b0f7783567878d217ae69e25.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1488 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe 1428 57fcc042b0f7783567878d217ae69e25.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1944 57fcc042b0f7783567878d217ae69e25.exe Token: SeDebugPrivilege 2860 57fcc042b0f7783567878d217ae69e25.exe Token: SeDebugPrivilege 1428 57fcc042b0f7783567878d217ae69e25.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 1944 wrote to memory of 2492 1944 57fcc042b0f7783567878d217ae69e25.exe 31 PID 1944 wrote to memory of 2492 1944 57fcc042b0f7783567878d217ae69e25.exe 31 PID 1944 wrote to memory of 2492 1944 57fcc042b0f7783567878d217ae69e25.exe 31 PID 1944 wrote to memory of 2492 1944 57fcc042b0f7783567878d217ae69e25.exe 31 PID 1944 wrote to memory of 2492 1944 57fcc042b0f7783567878d217ae69e25.exe 31 PID 1944 wrote to memory of 2492 1944 57fcc042b0f7783567878d217ae69e25.exe 31 PID 1944 wrote to memory of 2492 1944 57fcc042b0f7783567878d217ae69e25.exe 31 PID 1944 wrote to memory of 2492 1944 57fcc042b0f7783567878d217ae69e25.exe 31 PID 1944 wrote to memory of 2492 1944 57fcc042b0f7783567878d217ae69e25.exe 31 PID 1944 wrote to memory of 1428 1944 57fcc042b0f7783567878d217ae69e25.exe 32 PID 1944 wrote to memory of 1428 1944 57fcc042b0f7783567878d217ae69e25.exe 32 PID 1944 wrote to memory of 1428 1944 57fcc042b0f7783567878d217ae69e25.exe 32 PID 1944 wrote to memory of 1428 1944 57fcc042b0f7783567878d217ae69e25.exe 32 PID 1944 wrote to memory of 1428 1944 57fcc042b0f7783567878d217ae69e25.exe 32 PID 1944 wrote to memory of 1428 1944 57fcc042b0f7783567878d217ae69e25.exe 32 PID 1944 wrote to memory of 1428 1944 57fcc042b0f7783567878d217ae69e25.exe 32 PID 1944 wrote to memory of 1428 1944 57fcc042b0f7783567878d217ae69e25.exe 32 PID 1944 wrote to memory of 1428 1944 57fcc042b0f7783567878d217ae69e25.exe 32 PID 1944 wrote to memory of 2248 1944 57fcc042b0f7783567878d217ae69e25.exe 33 PID 1944 wrote to memory of 2248 1944 57fcc042b0f7783567878d217ae69e25.exe 33 PID 1944 wrote to memory of 2248 1944 57fcc042b0f7783567878d217ae69e25.exe 33 PID 1944 wrote to memory of 2248 1944 57fcc042b0f7783567878d217ae69e25.exe 33 PID 1944 wrote to memory of 2248 1944 57fcc042b0f7783567878d217ae69e25.exe 33 PID 1944 wrote to memory of 2248 1944 57fcc042b0f7783567878d217ae69e25.exe 33 PID 1944 wrote to memory of 2248 1944 57fcc042b0f7783567878d217ae69e25.exe 33 PID 1944 wrote to memory of 2248 1944 57fcc042b0f7783567878d217ae69e25.exe 33 PID 1944 wrote to memory of 2248 1944 57fcc042b0f7783567878d217ae69e25.exe 33 PID 2492 wrote to memory of 2860 2492 57fcc042b0f7783567878d217ae69e25.exe 34 PID 2492 wrote to memory of 2860 2492 57fcc042b0f7783567878d217ae69e25.exe 34 PID 2492 wrote to memory of 2860 2492 57fcc042b0f7783567878d217ae69e25.exe 34 PID 2492 wrote to memory of 2860 2492 57fcc042b0f7783567878d217ae69e25.exe 34 PID 2860 wrote to memory of 2880 2860 57fcc042b0f7783567878d217ae69e25.exe 35 PID 2860 wrote to memory of 2880 2860 57fcc042b0f7783567878d217ae69e25.exe 35 PID 2860 wrote to memory of 2880 2860 57fcc042b0f7783567878d217ae69e25.exe 35 PID 2860 wrote to memory of 2880 2860 57fcc042b0f7783567878d217ae69e25.exe 35 PID 2860 wrote to memory of 2880 2860 57fcc042b0f7783567878d217ae69e25.exe 35 PID 2860 wrote to memory of 2880 2860 57fcc042b0f7783567878d217ae69e25.exe 35 PID 2860 wrote to memory of 2880 2860 57fcc042b0f7783567878d217ae69e25.exe 35 PID 2860 wrote to memory of 2880 2860 57fcc042b0f7783567878d217ae69e25.exe 35 PID 2860 wrote to memory of 2880 2860 57fcc042b0f7783567878d217ae69e25.exe 35 PID 2860 wrote to memory of 2904 2860 57fcc042b0f7783567878d217ae69e25.exe 36 PID 2860 wrote to memory of 2904 2860 57fcc042b0f7783567878d217ae69e25.exe 36 PID 2860 wrote to memory of 2904 2860 57fcc042b0f7783567878d217ae69e25.exe 36 PID 2860 wrote to memory of 2904 2860 57fcc042b0f7783567878d217ae69e25.exe 36 PID 2860 wrote to memory of 2904 2860 57fcc042b0f7783567878d217ae69e25.exe 36 PID 2860 wrote to memory of 2904 2860 57fcc042b0f7783567878d217ae69e25.exe 36 PID 2860 wrote to memory of 2904 2860 57fcc042b0f7783567878d217ae69e25.exe 36 PID 2860 wrote to memory of 2904 2860 57fcc042b0f7783567878d217ae69e25.exe 36 PID 2860 wrote to memory of 2904 2860 57fcc042b0f7783567878d217ae69e25.exe 36 PID 2860 wrote to memory of 1716 2860 57fcc042b0f7783567878d217ae69e25.exe 37 PID 2860 wrote to memory of 1716 2860 57fcc042b0f7783567878d217ae69e25.exe 37 PID 2860 wrote to memory of 1716 2860 57fcc042b0f7783567878d217ae69e25.exe 37 PID 2860 wrote to memory of 1716 2860 57fcc042b0f7783567878d217ae69e25.exe 37 PID 2860 wrote to memory of 1716 2860 57fcc042b0f7783567878d217ae69e25.exe 37 PID 2860 wrote to memory of 1716 2860 57fcc042b0f7783567878d217ae69e25.exe 37 PID 2860 wrote to memory of 1716 2860 57fcc042b0f7783567878d217ae69e25.exe 37 PID 2860 wrote to memory of 1716 2860 57fcc042b0f7783567878d217ae69e25.exe 37 PID 2860 wrote to memory of 1716 2860 57fcc042b0f7783567878d217ae69e25.exe 37 PID 1428 wrote to memory of 1488 1428 57fcc042b0f7783567878d217ae69e25.exe 38 PID 1428 wrote to memory of 1488 1428 57fcc042b0f7783567878d217ae69e25.exe 38 PID 1428 wrote to memory of 1488 1428 57fcc042b0f7783567878d217ae69e25.exe 38 PID 1428 wrote to memory of 1488 1428 57fcc042b0f7783567878d217ae69e25.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\57fcc042b0f7783567878d217ae69e25.exe"C:\Users\Admin\AppData\Local\Temp\57fcc042b0f7783567878d217ae69e25.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\57fcc042b0f7783567878d217ae69e25.exeC:\Users\Admin\AppData\Local\Temp\57fcc042b0f7783567878d217ae69e25.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Roaming\UpdateManager\57fcc042b0f7783567878d217ae69e25.exe"C:\Users\Admin\AppData\Roaming\UpdateManager\57fcc042b0f7783567878d217ae69e25.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Roaming\UpdateManager\57fcc042b0f7783567878d217ae69e25.exeC:\Users\Admin\AppData\Roaming\UpdateManager\57fcc042b0f7783567878d217ae69e25.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880
-
-
C:\Users\Admin\AppData\Roaming\UpdateManager\57fcc042b0f7783567878d217ae69e25.exeC:\Users\Admin\AppData\Roaming\UpdateManager\57fcc042b0f7783567878d217ae69e25.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2904
-
-
C:\Users\Admin\AppData\Roaming\UpdateManager\57fcc042b0f7783567878d217ae69e25.exeC:\Users\Admin\AppData\Roaming\UpdateManager\57fcc042b0f7783567878d217ae69e25.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1716
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\57fcc042b0f7783567878d217ae69e25.exeC:\Users\Admin\AppData\Local\Temp\57fcc042b0f7783567878d217ae69e25.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmp11AD.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1488
-
-
-
C:\Users\Admin\AppData\Local\Temp\57fcc042b0f7783567878d217ae69e25.exeC:\Users\Admin\AppData\Local\Temp\57fcc042b0f7783567878d217ae69e25.exe2⤵
- System Location Discovery: System Language Discovery
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53b3f28197a31a2b741ee0d08a4d305f2
SHA197297440e62341e3073db2b03a47236287009995
SHA256d5efca262ba443b7213615f293b7d72110c85c1a2756f0923bd84772fdc6bafb
SHA51271db6156f9eac7d3ff04b2d72af62300375c9ba8c3c7b0903a848218f55db6eb6441444e34122504c18bc2a7c007e84e620f6c996bec0211828867ef5b1e22c1
-
Filesize
166KB
MD557fcc042b0f7783567878d217ae69e25
SHA183032ec361ea8b15ef956536999b754db6a12423
SHA25613bd3ee226114db8e18f2fe414a7e2c4e0937eda7d8a02b2efebaa2af8238564
SHA5124fe2ce713333d9a16d65ca5ccdc3a2e687b84a58b6b1e43b43c3f508edb2cc04478a5595efc43202decf7f86b50fd43382246fbc12553117a9177fb13d987b67