Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Client - C...0).exe

windows10-ltsc 2021-x64

10

Client - C...1).exe

windows10-ltsc 2021-x64

10

Client - C...2).exe

windows10-ltsc 2021-x64

10

Client - C...3).exe

windows10-ltsc 2021-x64

10

Client - C...4).exe

windows10-ltsc 2021-x64

10

Client - C...5).exe

windows10-ltsc 2021-x64

10

Client - C...6).exe

windows10-ltsc 2021-x64

10

Client - C...7).exe

windows10-ltsc 2021-x64

10

Client - C...8).exe

windows10-ltsc 2021-x64

10

Client - C...9).exe

windows10-ltsc 2021-x64

10

Client - Copy (2).exe

windows10-ltsc 2021-x64

10

Client - C...0).exe

windows10-ltsc 2021-x64

10

Client - C...1).exe

windows10-ltsc 2021-x64

10

Client - C...2).exe

windows10-ltsc 2021-x64

10

Client - C...3).exe

windows10-ltsc 2021-x64

10

Client - C...4).exe

windows10-ltsc 2021-x64

10

Client - C...5).exe

windows10-ltsc 2021-x64

10

Client - C...6).exe

windows10-ltsc 2021-x64

10

Client - C...7).exe

windows10-ltsc 2021-x64

10

Client - C...8).exe

windows10-ltsc 2021-x64

10

Client - C...9).exe

windows10-ltsc 2021-x64

10

Client - Copy (3).exe

windows10-ltsc 2021-x64

10

Client - C...0).exe

windows10-ltsc 2021-x64

10

Client - C...1).exe

windows10-ltsc 2021-x64

10

Client - Copy (4).exe

windows10-ltsc 2021-x64

10

Client - Copy (5).exe

windows10-ltsc 2021-x64

10

Client - Copy (6).exe

windows10-ltsc 2021-x64

10

Client - Copy (7).exe

windows10-ltsc 2021-x64

10

Client - Copy (8).exe

windows10-ltsc 2021-x64

10

Client - Copy (9).exe

windows10-ltsc 2021-x64

10

Client - Copy.exe

windows10-ltsc 2021-x64

10

Client.exe

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    880s
  • max time network
    899s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    08/01/2025, 00:40 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client - Copy (29).exe

  • Size

    74KB

  • MD5

    518cefe78569449a64ba9fcc57722fc3

  • SHA1

    f5a37814247e38571eea79a509b81599b95868fd

  • SHA256

    2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab

  • SHA512

    88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958

  • SSDEEP

    1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY

Score
10/10
asyncratdefaultdiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

159.203.126.35:22279

Mutex

hnfkoikowllyvsdhi

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain
1
5bKih5YqjnZbGvsDA1pd2DJeMR8faRap

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client - Copy (29).exe
    "C:\Users\Admin\AppData\Local\Temp\Client - Copy (29).exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3452

Network

  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    35.126.203.159.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    35.126.203.159.in-addr.arpa
    IN PTR
    Response
    35.126.203.159.in-addr.arpa
    IN PTR
    us-east-65319 packetriotnet
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    8.153.16.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.153.16.2.in-addr.arpa
    IN PTR
    Response
    8.153.16.2.in-addr.arpa
    IN PTR
    a2-16-153-8deploystaticakamaitechnologiescom
  • flag-us
    DNS
    23.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.117.168.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.117.168.52.in-addr.arpa
    IN PTR
    Response
  • 159.203.126.35:22279
    tls
    Client - Copy (29).exe
    38.9kB
     25.7kB
     297
    341
  • 159.203.126.35:22279
    tls
    Client - Copy (29).exe
    495 B
     292 B
     8
    7
  • 159.203.126.35:22279
    tls
    Client - Copy (29).exe
    509 B
     332 B
     9
    8
  • 159.203.126.35:22279
    tls
    Client - Copy (29).exe
    509 B
     332 B
     9
    8
  • 159.203.126.35:22279
    tls
    Client - Copy (29).exe
    279 B
     132 B
     4
    3
  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    35.126.203.159.in-addr.arpa
    dns
    73 B
     115 B
     1
    1

    DNS Request

    35.126.203.159.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    8.153.16.2.in-addr.arpa
    dns
    69 B
     131 B
     1
    1

    DNS Request

    8.153.16.2.in-addr.arpa

  • 8.8.8.8:53
    23.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    171.117.168.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    171.117.168.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3452-0-0x00007FF9389C3000-0x00007FF9389C5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3452-1-0x00000000008C0000-0x00000000008D8000-memory.dmp

    Filesize

    96KB

    Download

  • memory/3452-3-0x00007FF9389C0000-0x00007FF939482000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3452-4-0x00007FF9389C0000-0x00007FF939482000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3452-7-0x00007FF9389C0000-0x00007FF939482000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3452-9-0x00007FF9389C0000-0x00007FF939482000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3452-10-0x00007FF9389C3000-0x00007FF9389C5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3452-11-0x00007FF9389C0000-0x00007FF939482000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3452-12-0x00007FF9389C0000-0x00007FF939482000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3452-13-0x00007FF9389C0000-0x00007FF939482000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3452-14-0x00007FF9389C0000-0x00007FF939482000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.