Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Client - C...0).exe

windows10-ltsc 2021-x64

10

Client - C...1).exe

windows10-ltsc 2021-x64

10

Client - C...2).exe

windows10-ltsc 2021-x64

10

Client - C...3).exe

windows10-ltsc 2021-x64

10

Client - C...4).exe

windows10-ltsc 2021-x64

10

Client - C...5).exe

windows10-ltsc 2021-x64

10

Client - C...6).exe

windows10-ltsc 2021-x64

10

Client - C...7).exe

windows10-ltsc 2021-x64

10

Client - C...8).exe

windows10-ltsc 2021-x64

10

Client - C...9).exe

windows10-ltsc 2021-x64

10

Client - Copy (2).exe

windows10-ltsc 2021-x64

10

Client - C...0).exe

windows10-ltsc 2021-x64

10

Client - C...1).exe

windows10-ltsc 2021-x64

10

Client - C...2).exe

windows10-ltsc 2021-x64

10

Client - C...3).exe

windows10-ltsc 2021-x64

10

Client - C...4).exe

windows10-ltsc 2021-x64

10

Client - C...5).exe

windows10-ltsc 2021-x64

10

Client - C...6).exe

windows10-ltsc 2021-x64

10

Client - C...7).exe

windows10-ltsc 2021-x64

10

Client - C...8).exe

windows10-ltsc 2021-x64

10

Client - C...9).exe

windows10-ltsc 2021-x64

10

Client - Copy (3).exe

windows10-ltsc 2021-x64

10

Client - C...0).exe

windows10-ltsc 2021-x64

10

Client - C...1).exe

windows10-ltsc 2021-x64

10

Client - Copy (4).exe

windows10-ltsc 2021-x64

10

Client - Copy (5).exe

windows10-ltsc 2021-x64

10

Client - Copy (6).exe

windows10-ltsc 2021-x64

10

Client - Copy (7).exe

windows10-ltsc 2021-x64

10

Client - Copy (8).exe

windows10-ltsc 2021-x64

10

Client - Copy (9).exe

windows10-ltsc 2021-x64

10

Client - Copy.exe

windows10-ltsc 2021-x64

10

Client.exe

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    898s
  • max time network
    900s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    08/01/2025, 00:40 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client - Copy (2).exe

  • Size

    74KB

  • MD5

    518cefe78569449a64ba9fcc57722fc3

  • SHA1

    f5a37814247e38571eea79a509b81599b95868fd

  • SHA256

    2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab

  • SHA512

    88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958

  • SSDEEP

    1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY

Score
10/10
asyncratdefaultdiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

159.203.126.35:22279

Mutex

hnfkoikowllyvsdhi

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain
1
5bKih5YqjnZbGvsDA1pd2DJeMR8faRap

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client - Copy (2).exe
    "C:\Users\Admin\AppData\Local\Temp\Client - Copy (2).exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:5040

Network

  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    35.126.203.159.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    35.126.203.159.in-addr.arpa
    IN PTR
    Response
    35.126.203.159.in-addr.arpa
    IN PTR
    us-east-65319 packetriotnet
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    8.153.16.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.153.16.2.in-addr.arpa
    IN PTR
    Response
    8.153.16.2.in-addr.arpa
    IN PTR
    a2-16-153-8deploystaticakamaitechnologiescom
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    91.16.208.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    91.16.208.104.in-addr.arpa
    IN PTR
    Response
  • 159.203.126.35:22279
    tls
    Client - Copy (2).exe
    31.0kB
     20.9kB
     236
    273
  • 159.203.126.35:22279
    tls
    Client - Copy (2).exe
    357 B
     172 B
     5
    4
  • 159.203.126.35:22279
    tls
    Client - Copy (2).exe
    509 B
     332 B
     9
    8
  • 159.203.126.35:22279
    tls
    Client - Copy (2).exe
    509 B
     332 B
     9
    8
  • 159.203.126.35:22279
    tls
    Client - Copy (2).exe
    509 B
     332 B
     9
    8
  • 159.203.126.35:22279
    tls
    Client - Copy (2).exe
    233 B
     92 B
     3
    2
  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    14.160.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    14.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    35.126.203.159.in-addr.arpa
    dns
    73 B
     115 B
     1
    1

    DNS Request

    35.126.203.159.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    8.153.16.2.in-addr.arpa
    dns
    69 B
     131 B
     1
    1

    DNS Request

    8.153.16.2.in-addr.arpa

  • 8.8.8.8:53
    22.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    22.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    91.16.208.104.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    91.16.208.104.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5040-0-0x00007FFDB7AC3000-0x00007FFDB7AC5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/5040-1-0x00000000003C0000-0x00000000003D8000-memory.dmp

    Filesize

    96KB

    Download

  • memory/5040-3-0x00007FFDB7AC0000-0x00007FFDB8582000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5040-4-0x00007FFDB7AC0000-0x00007FFDB8582000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5040-7-0x00007FFDB7AC0000-0x00007FFDB8582000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5040-8-0x00007FFDB7AC0000-0x00007FFDB8582000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5040-10-0x00007FFDB7AC3000-0x00007FFDB7AC5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/5040-11-0x00007FFDB7AC0000-0x00007FFDB8582000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5040-12-0x00007FFDB7AC0000-0x00007FFDB8582000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5040-13-0x00007FFDB7AC0000-0x00007FFDB8582000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5040-14-0x00007FFDB7AC0000-0x00007FFDB8582000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.