Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 19:22
Behavioral task
behavioral1
Sample
NixwareLoader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NixwareLoader.exe
Resource
win10v2004-20241007-en
General
-
Target
NixwareLoader.exe
-
Size
78KB
-
MD5
0c3707365415a5dde7293f2109fe0b4e
-
SHA1
10e64f1087f142bb2e3301d41f5b600933291099
-
SHA256
0adc04c287413eac1f39fe5abeaed5655c3b74f3ee346646ee2d71fec944f1ac
-
SHA512
e9b914a6f9b8e434f240ae96072f4bca963bb64e63abcab76a1ecb626bac6cbe6ca79c6eb06872f83a740f7a1ce3eeb6fe44c56e07ba9e7393a1b97581698e90
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+cPIC:5Zv5PDwbjNrmAE+QIC
Malware Config
Extracted
discordrat
-
discord_token
MTAyMTQzMjA3ODQzMDExMzc5Mw.GRS-So.q-fGy4OeZA7_se-xUdFVkaPiNxQJFRukyw9Ofw
-
server_id
1321113521538203738
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2248 wrote to memory of 3068 2248 NixwareLoader.exe 30 PID 2248 wrote to memory of 3068 2248 NixwareLoader.exe 30 PID 2248 wrote to memory of 3068 2248 NixwareLoader.exe 30