Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2025, 21:51
Behavioral task
behavioral1
Sample
Client-build.exe
Resource
win7-20240708-en
General
-
Target
Client-build.exe
-
Size
45KB
-
MD5
304d0e77da53af75ea9b70012a78348d
-
SHA1
2abfcf36150e5b19e90a2df133d5d5ccdc986b7b
-
SHA256
e1b5a90f068ee75d794e62acb4386e49a2e48b37d58de79801b437218dc78765
-
SHA512
0782a2840a73ae9459ba20e7ac9bd516efa55e65c2453b6d7bc7f68b39a63012d762c678e48c2fcaeb6418b31b6d2652fa7c4f33bd6ca0e53dbc018040fff054
-
SSDEEP
768:WdhO/poiiUcjlJInU9SH9Xqk5nWEZ5SbTDaauI7CPW5p:Aw+jjgnUoH9XqcnW85SbTfuIR
Malware Config
Extracted
xenorat
127.0.0.1
Xeno_rat_nd8912d
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
WindowsSys64
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral2/memory/4644-1-0x0000000000510000-0x0000000000522000-memory.dmp family_xenorat behavioral2/files/0x000b000000023b93-6.dat family_xenorat -
Xenorat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Client-build.exe -
Executes dropped EXE 1 IoCs
pid Process 1904 Client-build.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client-build.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client-build.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4448 schtasks.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4644 wrote to memory of 1904 4644 Client-build.exe 84 PID 4644 wrote to memory of 1904 4644 Client-build.exe 84 PID 4644 wrote to memory of 1904 4644 Client-build.exe 84 PID 1904 wrote to memory of 4448 1904 Client-build.exe 86 PID 1904 wrote to memory of 4448 1904 Client-build.exe 86 PID 1904 wrote to memory of 4448 1904 Client-build.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-build.exe"C:\Users\Admin\AppData\Local\Temp\Client-build.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Roaming\XenoManager\Client-build.exe"C:\Users\Admin\AppData\Roaming\XenoManager\Client-build.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "WindowsSys64" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC6CA.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4448
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
1KB
MD54e84065ba9714547e9524fc0cc9ea0bc
SHA15d559eda01716ae6b16406d6b29e6482d998d06d
SHA2566da0fcb0257f15e2ed3947ceddb801a0622c40ce59cc47624d0e5ff2a5fc7d70
SHA512e3397c846831bb66f847f0199d442413d9fb9a4146d34f5a11d04ebd19665c0ce00183d326bbbd24de4044c6124d5f48ae9fce524ff232d607299e0ca902aee6
-
Filesize
45KB
MD5304d0e77da53af75ea9b70012a78348d
SHA12abfcf36150e5b19e90a2df133d5d5ccdc986b7b
SHA256e1b5a90f068ee75d794e62acb4386e49a2e48b37d58de79801b437218dc78765
SHA5120782a2840a73ae9459ba20e7ac9bd516efa55e65c2453b6d7bc7f68b39a63012d762c678e48c2fcaeb6418b31b6d2652fa7c4f33bd6ca0e53dbc018040fff054