Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
57s -
max time network
36s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
14/12/2024, 22:15
Behavioral task
behavioral1
Sample
asteroid-256-main/Asteroid.dll
Resource
win10ltsc2021-20241211-en
General
-
Target
asteroid-256-main/selfess.exe
-
Size
112KB
-
MD5
a10cb3a53b64b20da6d511622a4ffeb4
-
SHA1
3568550a55d5facff2ee6dc8da0900aa9b19dee6
-
SHA256
43879a1a65c815dcd4a7d9bb25981f6603ba952800d3d3c103717bf0b41c4d6e
-
SHA512
ad72a609e00dd3dc2360c466085eeb6dfc8abe4bdc1163d01c99cc6a682a2dfd93c08ccb33d314a9a6e713bc904ae2aa38b9a6f8c953b0a5bbd0ea2550cb01ea
-
SSDEEP
1536:Lw+jjgnGElmH9XqcnW85SbT/uIin+EQzl3:Lw+jqJo91UbT/Un+Eg
Malware Config
Extracted
xenorat
127.0.0.1
Xeno_rat_nd8912d
-
delay
5000
-
install_path
nothingset
-
port
4444
-
startup_name
gg
Signatures
-
Detect XenoRat Payload 1 IoCs
resource yara_rule behavioral2/memory/2100-1-0x00000000009E0000-0x0000000000A02000-memory.dmp family_xenorat -
Xenorat family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language selfess.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1580 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3980 taskmgr.exe Token: SeSystemProfilePrivilege 3980 taskmgr.exe Token: SeCreateGlobalPrivilege 3980 taskmgr.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe -
Suspicious use of SendNotifyMessage 37 IoCs
pid Process 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2100 wrote to memory of 1580 2100 selfess.exe 82 PID 2100 wrote to memory of 1580 2100 selfess.exe 82 PID 2100 wrote to memory of 1580 2100 selfess.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\asteroid-256-main\selfess.exe"C:\Users\Admin\AppData\Local\Temp\asteroid-256-main\selfess.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "gg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp414A.tmp" /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1580
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt1⤵PID:2836
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3980
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD586b2f3ae19fdce01008399915a04f896
SHA1469574481dc0fa07c399deebd624ce0326bbbf6d
SHA256a4fe43c98f0eaee6b45f4677bf2b70fcd947e01ca79e99e34eb8fba8be27d4ae
SHA5125fa01bf34542aee0bac28392287344fd54f49fc57167f608cd85e8d2c47750f2768bde12eb6564adc7f26a3bcacfb7df8cbb505fea79b44df1c1f426636a9bef