Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2025, 18:33
Static task
static1
Behavioral task
behavioral1
Sample
DemonSpoofCall.exe
Resource
win7-20240903-en
General
-
Target
DemonSpoofCall.exe
-
Size
9.7MB
-
MD5
1dfe6d227d66658b9ab790ce66160551
-
SHA1
62087a4f6c0b47635f068262b3d9df15aab746d9
-
SHA256
c2d4aff226178355b8ef7b9e28e4d2869def12eacdfe91e9ed1135b6cd20deab
-
SHA512
c10e34658ea727c52f96051fd9fe6d3c1b6f3dbeed9b9ced6bbfd2819db3a8aaeea693f890581190d3d10749e3000f8088c543d8cd006301c0b3032c4457d454
-
SSDEEP
196608:lrkCDFxgtiWe4/RSgOqTn9nBIzuZrSW+xHGoFlaoDKWzQo1OIg5sa7t:5eiYRNXnDZrSF8oF9uB5B
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
127.0.0.1:6606
89.84.63.139:6606
caqxyzoxvrzhnrxwoc
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
resource yara_rule behavioral2/memory/2896-8-0x00000000070E0000-0x00000000070F8000-memory.dmp VenomRAT -
Venomrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2896-8-0x00000000070E0000-0x00000000070F8000-memory.dmp family_asyncrat -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 2896 PDFreader.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 6 raw.githubusercontent.com 7 raw.githubusercontent.com 8 raw.githubusercontent.com -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DemonSpoofCall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDFreader.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3164 DemonSpoofCall.exe 2896 PDFreader.exe 2896 PDFreader.exe 2896 PDFreader.exe 2896 PDFreader.exe 2896 PDFreader.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3164 DemonSpoofCall.exe Token: SeDebugPrivilege 2896 PDFreader.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2896 PDFreader.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3164 wrote to memory of 2896 3164 DemonSpoofCall.exe 84 PID 3164 wrote to memory of 2896 3164 DemonSpoofCall.exe 84 PID 3164 wrote to memory of 2896 3164 DemonSpoofCall.exe 84 PID 3164 wrote to memory of 2896 3164 DemonSpoofCall.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\DemonSpoofCall.exe"C:\Users\Admin\AppData\Local\Temp\DemonSpoofCall.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Roaming\PDFreader.exe"C:\Users\Admin\AppData\Roaming\PDFreader.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.8MB
MD5f7dfe66072d3a91e2cd71436d4f3fb33
SHA17a76472a762c7cf68748c3b6b213ada71c5bba5a
SHA25622e912427beff52645f1e2a19e361ecb03258a009a0d45e52fe20deefb224234
SHA51222f49b6bcf5db183a0ac23e4b51631f8487d30f2508be9ac0408760f04224397d2851eaa3027b9f75607337a0395898ec2eed006ae4ac38dcdcc3f17ef5316a7