Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07/01/2025, 20:38
General
-
Target
rig.exe
-
Size
2.4MB
-
MD5
570a9cc9fd20159e92707abe69676299
-
SHA1
864cb610c0c80cf8ff00fd4aaae9b05fa63fd990
-
SHA256
ba52bd426e17cf8902ae05eb8caea7e0510d668db97dedd2cabcd1dc5a06063f
-
SHA512
ba11d2e1888f736d1934e78db6397ae04ea49422beb7392575422ea51cd459ac9b0c8a274397ab828792728364d145c16fc2390242a17a56a8ad02fa4c580f92
-
SSDEEP
49152:BfOqHErn3OFIJDOmxFVIdtKfBDhqGDZdB4hYk/0AK0uOkJA79OB8OITieIr:fcne+9Omb+dtKfBD3rZOkJA79OBkbI
Malware Config
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 4 IoCs
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rig.exe"C:\Users\Admin\AppData\Local\Temp\rig.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
-
Filesize
5.3MB
-
Filesize
4KB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB