Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-en -
resource tags
-
submitted
30/01/2025, 04:35
General
-
Target
Drunkdeer (3).exe
-
Size
667KB
-
MD5
dd7527eb0b3ed22e909068cbb53ddbb2
-
SHA1
2a1c2e9f0a0840d6e438e2fc277232d12556c9dd
-
SHA256
56e9238e93542c952ac6688e6b0da86ef001bffb11666eec3d128538b0113c34
-
SHA512
ea6d928554c357042161520e2ed494ba6127f91019e2dcb9d725c5fd7b0920d222d8ea283c963ee422f401c581deb58f4fff6294e568a5191003cb2cd82d558e
-
SSDEEP
12288:paoZmL+EP8YPEVHdmOhlU9va6vspHdOisdeT6DsHgD:prI8iEVHdmOhlU9va6vsZdOiIeWsi
Score
10/10
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
-
Detect Xworm Payload 1 IoCs
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
Umbral family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Drunkdeer (3).exe"C:\Users\Admin\AppData\Local\Temp\Drunkdeer (3).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
680KB
-
Filesize
408KB