Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2025, 14:09
Static task
static1
Behavioral task
behavioral1
Sample
DurableLauncher.exe
Resource
win7-20240903-en
General
-
Target
DurableLauncher.exe
-
Size
10.5MB
-
MD5
3980d879e8cdab01a8c85a98863c2064
-
SHA1
65196c9bb57059f3b8f1f23e2a8f9204051a6473
-
SHA256
1877f5f99c834df6605e2fd22460fa93ce03b87d50e47ba7cb274d856257a159
-
SHA512
ebf991a2e495804c3414e6b70a0720253edd7a8c717a2d57ebcf099814b66b6717a03f4b207cb27701cd5d1415ccac3bd7c6bf0313c733713adae23dead4719f
-
SSDEEP
196608:H0jNSwsCQcSDUhj7237EAMJoOA394I1hKJgYkMAhfpww5vlb2wBsY:yowsCKohf2LEAZO5I1GgYkZ19b/iY
Malware Config
Extracted
xenorat
127.0.0.1
Durable_club_623326
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
Microsoft Executable Handler
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral2/files/0x000c000000023c93-135.dat family_xenorat behavioral2/memory/1948-140-0x0000000000FE0000-0x0000000000FF2000-memory.dmp family_xenorat -
Xenorat family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2108 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000\Control Panel\International\Geo\Nation durable.exe Key value queried \REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000\Control Panel\International\Geo\Nation last.exe -
Executes dropped EXE 3 IoCs
pid Process 3568 last.exe 1948 durable.exe 3612 durable.exe -
Loads dropped DLL 35 IoCs
pid Process 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe 3568 last.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language durable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language durable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 772 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2108 powershell.exe 2108 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2108 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 536 wrote to memory of 3568 536 DurableLauncher.exe 86 PID 536 wrote to memory of 3568 536 DurableLauncher.exe 86 PID 3568 wrote to memory of 4800 3568 last.exe 88 PID 3568 wrote to memory of 4800 3568 last.exe 88 PID 4800 wrote to memory of 2108 4800 cmd.exe 89 PID 4800 wrote to memory of 2108 4800 cmd.exe 89 PID 3568 wrote to memory of 1948 3568 last.exe 90 PID 3568 wrote to memory of 1948 3568 last.exe 90 PID 3568 wrote to memory of 1948 3568 last.exe 90 PID 1948 wrote to memory of 3612 1948 durable.exe 91 PID 1948 wrote to memory of 3612 1948 durable.exe 91 PID 1948 wrote to memory of 3612 1948 durable.exe 91 PID 3612 wrote to memory of 772 3612 durable.exe 93 PID 3612 wrote to memory of 772 3612 durable.exe 93 PID 3612 wrote to memory of 772 3612 durable.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\DurableLauncher.exe"C:\Users\Admin\AppData\Local\Temp\DurableLauncher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\onefile_536_133830653684560481\last.exeC:\Users\Admin\AppData\Local\Temp\DurableLauncher.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\durable'"3⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\durable'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2108
-
-
-
C:\Users\Admin\AppData\Roaming\durable\durable.exe"C:\Users\Admin\AppData\Roaming\durable\durable.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Roaming\XenoManager\durable.exe"C:\Users\Admin\AppData\Roaming\XenoManager\durable.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Executable Handler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAAB7.tmp" /F5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:772
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5f3cfd044825e9c08ce37a8034e2ed786
SHA151637c5678aedf528adef8036c53513495fcbb44
SHA256bcbe37f565b91a127e40634db8e7e1b8b1ce3e1344f3fa082496b93d75435b80
SHA512fd9f8ae46a438138c31408ebf9129dd507a8fd6dc24f24eae2b2dd8bd90e8b78afb0aef82a314ca5566d4d1bb7d166642dd2e7d7ea8e484c0261f623b2c1c15b
-
Filesize
10KB
MD54db0ac98329ae64cec9c28570af52968
SHA18f7d327c1049c27b0df6bc6c2017cc302ba99a10
SHA2565a43e3809403668ed6c6f17a71828eb8cd0dcb64afc09b815a4b9f05c3661714
SHA512515e0b972a644620c27b3c074aee62b8ba5aa679b0e1c936f616c5537a83c7ca762b7a6c7acc3279ab235d1d344db9423cdc1abf7c72775d4bbfb2cb24cbf6b9
-
Filesize
21KB
MD515e2c2434668d1648d9147156b0a44c6
SHA1bea635adfd889381cc324d2612606e409518261d
SHA256ebee833d40ed09abccff1f415b4a4cb1ec6f8d84431067980b09a36450edb9f8
SHA512197818202b07f97dc370f456a1f59a5210c8af7e8221d6e0bbf8a96e8190668dd29d353bffb0f833fc622b8f797558708446cdde7a062ecd8c66d67b87262445
-
Filesize
13KB
MD5bea27cb11a8529d6ad11373531e5222f
SHA174b61da8fd39f03136b4fad7faa7e5a1ea7c1116
SHA2561eb72bd49457080ce1432eb28e85134d7bd4344bccd9357839acbbfa9236b868
SHA51249fec85d5853ddb352abc93be6cab3c42f2a3dbcdf32a90fe7fff6e5bf378514c594328c7845f892508c8301f8224f7a6a26f44458a6a9ebc59d99b7ccef8f4b
-
Filesize
81KB
MD54101128e19134a4733028cfaafc2f3bb
SHA166c18b0406201c3cfbba6e239ab9ee3dbb3be07d
SHA2565843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
SHA5124f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca
-
Filesize
120KB
MD56a9ca97c039d9bbb7abf40b53c851198
SHA101bcbd134a76ccd4f3badb5f4056abedcff60734
SHA256e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
SHA512dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d
-
Filesize
62KB
MD5de4d104ea13b70c093b07219d2eff6cb
SHA183daf591c049f977879e5114c5fea9bbbfa0ad7b
SHA25639bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
SHA512567f703c2e45f13c6107d767597dba762dc5caa86024c87e7b28df2d6c77cd06d3f1f97eed45e6ef127d5346679fea89ac4dc2c453ce366b6233c0fa68d82692
-
Filesize
154KB
MD5337b0e65a856568778e25660f77bc80a
SHA14d9e921feaee5fa70181eba99054ffa7b6c9bb3f
SHA256613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
SHA51219e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e
-
Filesize
30KB
MD5ff8300999335c939fcce94f2e7f039c0
SHA14ff3a7a9d9ca005b5659b55d8cd064d2eb708b1a
SHA2562f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
SHA512f29b1fd6f52130d69c8bd21a72a71841bf67d54b216febcd4e526e81b499b9b48831bb7cdff0bff6878aab542ca05d6326b8a293f2fb4dd95058461c0fd14017
-
Filesize
76KB
MD58140bdc5803a4893509f0e39b67158ce
SHA1653cc1c82ba6240b0186623724aec3287e9bc232
SHA25639715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
SHA512d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826
-
Filesize
155KB
MD5069bccc9f31f57616e88c92650589bdd
SHA1050fc5ccd92af4fbb3047be40202d062f9958e57
SHA256cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
SHA5120e5513fbe42987c658dba13da737c547ff0b8006aecf538c2f5cf731c54de83e26889be62e5c8a10d2c91d5ada4d64015b640dab13130039a5a8a5ab33a723dc
-
Filesize
290KB
MD5234d271ecb91165aaec148ad6326dd39
SHA1d7fccec47f7a5fbc549222a064f3053601400b6f
SHA256c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
SHA51269289a9b1b923d89ba6e914ab601c9aee4d03ff98f4ed8400780d4b88df5f4d92a8ca1a458abcfde00c8455d3676aca9ec03f7d0593c64b7a05ed0895701d7ed
-
Filesize
10KB
MD5e3d495cf14d857349554a3606a8e7210
SHA1db0843b89a84fb37efd3c76168bcb303174aac29
SHA256e21f4c40c29be0b115463e7bb8a365946a4afc152b9fff602abd41c6e0ce68a2
SHA5128f69a16042e88bc51d30ad4c78d8240e2619104324e79e5f382975486bfb39b4e0a3c35976d08399300d7823d6a358104658374daf36a513ce0774f3611d4d6e
-
Filesize
686KB
MD58769adafca3a6fc6ef26f01fd31afa84
SHA138baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA2562aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
SHA512fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
-
Filesize
1.1MB
MD5bc58eb17a9c2e48e97a12174818d969d
SHA111949ebc05d24ab39d86193b6b6fcff3e4733cfd
SHA256ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
SHA5124aa2b2ce3eb47503b48f6a888162a527834a6c04d3b49c562983b4d5aad9b7363d57aef2e17fe6412b89a9a3b37fb62a4ade4afc90016e2759638a17b1deae6c
-
Filesize
507KB
MD556db4a861aec914a860461dedcdca0a0
SHA18535a8c9eac371a54308795a8bbe89414933e035
SHA2566ab611c4a24406d9d97f09d49d50142ab2734b69a2b0d9ea6489e4af90c4a2a4
SHA512600a21666e9ed334de5b4b17f60136434ee485c80f9740e6085e24ef95ca5376e6223a54c6b1c8f12987edab5d89af9676cc12e2a335f4c4e9ab79dfef8e4b90
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
13KB
MD52ce3043d6fbd62bcbe6948a1e6a789f0
SHA17a5e9bc5a96bd2ec677927fb014073e7cdb70f3b
SHA256c5a4ac8202a0211163938b6306e3a678cc461ed8e283f4c4601748d2e50783a3
SHA5128fca5216d65c66640541b31e21a7eb18f510c5c0d3420bff5581337875a6f68dd808f35d61a759a26aad9ae4f50aa1580e8d90e016d9acdc5aa2d04cfaad4377
-
Filesize
12KB
MD58d17946e6b1936061203afe20cddb5b0
SHA1589dac4d2864fdc0219b0de3973b2ee0023cd5ea
SHA256bb9898057572f17131bb63d513c19901e29d2e29215f7a93d6d84fa537475f0b
SHA5123354942781e4d36b84d83ab6959707d29f6e25d3614b15a228d63d084f6f2a280bfc9153f24ea0fef489fa7043e21eb67e4b6d3ad7d073fde37f6206462f5931
-
Filesize
12KB
MD5606e85b094ae6752e1099a176aa20f09
SHA135e9355ce75b57111d3793502636d5fcd78d34a4
SHA256917fa3438b61cc207d73bd72cda6c42cd08656a2187fd9ca2860c67c12677238
SHA51219de7b6c567e997825f2f08773c45a3562bc3980248de31738395cafa0306707a82f912a8b9b1dba440162443e1554e87ef5586776189b763576d9a7aca9e587
-
Filesize
11KB
MD5dae7f4dd6792fb84c91bd45d44ed6c96
SHA1a88eb81d4d72adc4c7f7402338f9d5760957efc3
SHA25601eb2117f0223f0447cd16b5ec79baf3430871da8ef461404ba13592d2e8a89c
SHA51266e98ae82073abb24e9053203f41cebb4ac30a461fe2a62baa1190970e1be7567f495914e017ec94b6b911bab721e63a7ff2d1d85e29d5824ab3d9bc9fb9fce4
-
Filesize
13KB
MD51dee6707a941e02202a47c58408ed538
SHA1511387a5a611119ba81377931da5a8da5c429b78
SHA2564e76a0be3e295571172cf1d06dbcc48f715357bb496d8567d9376667326fa5ef
SHA512f29063d04151c9df75ca2c138fba5f9e4da551f0fdfa7a8a83390df0dcde064038ba87eec4c852a87d80cef0dc38306aed1121d06a6b337e4cc722e4057c432a
-
Filesize
17KB
MD52efa942a436ca17562fb49bb66acdcc4
SHA150b2841914e9a1237ac29c7a681f0951c03d59a4
SHA2564810a6392848b3ff20d67a531a26daaf2e1f2fe37cf61c0245d24cb0fa00177d
SHA512bad96c34d318b975330f720b422c758ddc91ae6ab34b873f9a68f060f52552939654ac7a78d49ea787d7f182e293c604f772bea9e027d0159a43c9f06957d392
-
Filesize
12KB
MD5308c6e862a3554f1b5587d003f4b1bbf
SHA1800955d3a24065766e5825c8324b7f48cd02f073
SHA256671aad8b7fae31e076df50c947cd198369eea6379e6fa1b058596e528f5da561
SHA51235b27a6320a8046f7e7bc42b9af8414b076f5334467576a0e83c6d7992ec3675f73cf0fc72ae6da402ff70dd16fcc0c29287ab27ad04bb346d5229d62deb54a5
-
Filesize
10KB
MD5690fc8d8423ee69c662f11cd6406cef1
SHA1a0b78af3bc976c8aafa1fe80ef71f22d4bf7080b
SHA256bd597e5853a3f2cad1d4e5743170a66383be18d215f8f83be2a473736ee28718
SHA512b08dd641aef8c663174c4ad436915ffc4c4afb70b8a9719f535f1f99b7b29240a0c8951e19f3348c010dad3000b6b5173b1def077ec6d96bb8a3d3e9be339a40
-
Filesize
10KB
MD5174b652c8e6c40c36c8ab06a20a34c01
SHA1f3cb9321100dce3a8d79b0fc517cc58e05d26e41
SHA25642af8d99fc975720585d25d767fc825d4922c088b6c2b13ee2de23e439523610
SHA5129f0c444069e477a043c85f606bf1a3fb695773dbc16d1124a4b2d771ea0385b797552031433cb625d7dc9c8d490eb0ef8fa2c13aa628ebba58df6a0530913f32
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
174KB
MD5739d352bd982ed3957d376a9237c9248
SHA1961cf42f0c1bb9d29d2f1985f68250de9d83894d
SHA2569aee90cf7980c8ff694bb3ffe06c71f87eb6a613033f73e3174a732648d39980
SHA512585a5143519ed9b38bb53f912cea60c87f7ce8ba159a1011cf666f390c2e3cc149e0ac601b008e039a0a78eaf876d7a3f64fff612f5de04c822c6e214bc2efde
-
Filesize
118KB
MD5bd18f35f8a56415ec604d97bd3dd44c4
SHA163f51eb5dafeb24327e3bcb63828336c920b4fcd
SHA256f3501ebce24205f3dc54192cd917eab9a899fe936570650253d4c1466383eff1
SHA5123c1c268005f494413cd2f9409b64ed3a2c9af558c0f317447af2c27776406c61dcb28ae6720af156145078ec565a14a3e12d409e57389bb3d4d10f8d7a92a7d1
-
Filesize
15.8MB
MD56adfcfaed8015427390f85628f51a304
SHA1a07005c48969d761d8f686a669fea1550b7b02e9
SHA25612672f0f8b64f4016ee9a95d0bed2907356ff8657aac7a2a1e2fdaeade411a5d
SHA5122314b4ec6881412bf9efcac73c800d5b826432883636a4554504a1326108c41510ef7fe140a4378be55cbb75efc133a434d3dc17545597fa52e3c489bf634a00
-
Filesize
3.3MB
MD56f4b8eb45a965372156086201207c81f
SHA18278f9539463f0a45009287f0516098cb7a15406
SHA256976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
SHA5122c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
-
Filesize
34KB
MD532d36d2b0719db2b739af803c5e1c2f5
SHA1023c4f1159a2a05420f68daf939b9ac2b04ab082
SHA256128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
SHA512a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1
-
Filesize
5.5MB
MD59a24c8c35e4ac4b1597124c1dcbebe0f
SHA1f59782a4923a30118b97e01a7f8db69b92d8382a
SHA256a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
SHA5129d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b
-
Filesize
28KB
MD597ee623f1217a7b4b7de5769b7b665d6
SHA195b918f3f4c057fb9c878c8cc5e502c0bd9e54c0
SHA2560046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
SHA51220edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f
-
Filesize
50KB
MD59cc5f00bb134f4cc591d3e39e138dbf9
SHA1f9f5c35404783ff19f0261d6fb613b5fc519d2e2
SHA256e7aef6cb67a6a22c38eff3ffeab7ae9b8bdb9baab0c3c39c70bc4e8734a33c2b
SHA5122d06e5d6e74991a1a1fd030312be554c4db311b154664d669940c105efbb7ddd7ace452e3a58b2ef1e4a84a9f8e57e552c43d6d3a7968fb37d55aefdb3bcf11e