Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2025, 14:22

General

  • Target

    Release.zip

  • Size

    6.4MB

  • MD5

    0ac7270ebbf7914fa19f0a20b7725338

  • SHA1

    04b140f70fa4f6e8c4003fd993a2260073242d53

  • SHA256

    4cd52a1328ac7b1e2856007eb6eb721441f275f5c5b0049f6e8ba0a1f1c98be0

  • SHA512

    71b340eb439cd192f2fb490d6e7b12377d7755e912d6e045796f1ebe565f497840f8d4d3cd550225818728034bed687e078a6e73975b07741785bc20df9dbdae

  • SSDEEP

    196608:vMSPrNiQ7KRy+EPqbTwVLW83FUSA7WQZzwM3/C2c6:DDNdORywWB1USA7WS/vc6

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    4444

  • startup_name

    nothingset

Signatures

  • Detect XenoRat Payload 2 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Xenorat family
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Release.zip
    1⤵
      PID:3324
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2632
      • C:\Users\Admin\AppData\Local\Temp\Temp1_Release.zip\xeno rat server.exe
        "C:\Users\Admin\AppData\Local\Temp\Temp1_Release.zip\xeno rat server.exe"
        1⤵
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1832
      • C:\Users\Admin\Documents\Release\xeno rat server.exe
        "C:\Users\Admin\Documents\Release\xeno rat server.exe"
        1⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:4440
      • C:\Users\Admin\Downloads\duick.exe
        "C:\Users\Admin\Downloads\duick.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4788

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Downloads\duick.exe

        Filesize

        43KB

        MD5

        2c36d82398c502d8cc533154bc1b99d9

        SHA1

        8c326ab5446d61987ca7674dd4af8b462a551509

        SHA256

        c61036cbc6460746b2d7c80a9ae355c7f95af6c22f2826d1e6ef8f9695e4410a

        SHA512

        65eb32fb7bdb2c08adc02a63c34b40e554c681972b218844385e871e5d65419e3f20e678ac850a98b74fbf38af16f1bfccb1cde8a20e0800bccbf249f5aeaf90

      • memory/1832-12-0x0000000008850000-0x0000000008902000-memory.dmp

        Filesize

        712KB

      • memory/1832-9-0x0000000075240000-0x00000000759F0000-memory.dmp

        Filesize

        7.7MB

      • memory/1832-3-0x0000000004EF0000-0x0000000004F82000-memory.dmp

        Filesize

        584KB

      • memory/1832-4-0x0000000075240000-0x00000000759F0000-memory.dmp

        Filesize

        7.7MB

      • memory/1832-5-0x0000000004EA0000-0x0000000004EAA000-memory.dmp

        Filesize

        40KB

      • memory/1832-6-0x0000000005170000-0x0000000005184000-memory.dmp

        Filesize

        80KB

      • memory/1832-8-0x00000000053F0000-0x0000000005402000-memory.dmp

        Filesize

        72KB

      • memory/1832-13-0x0000000008930000-0x0000000008952000-memory.dmp

        Filesize

        136KB

      • memory/1832-0-0x000000007524E000-0x000000007524F000-memory.dmp

        Filesize

        4KB

      • memory/1832-10-0x000000007524E000-0x000000007524F000-memory.dmp

        Filesize

        4KB

      • memory/1832-2-0x0000000005400000-0x00000000059A4000-memory.dmp

        Filesize

        5.6MB

      • memory/1832-11-0x0000000075240000-0x00000000759F0000-memory.dmp

        Filesize

        7.7MB

      • memory/1832-7-0x00000000053D0000-0x00000000053EA000-memory.dmp

        Filesize

        104KB

      • memory/1832-14-0x0000000008960000-0x0000000008CB4000-memory.dmp

        Filesize

        3.3MB

      • memory/1832-16-0x0000000075240000-0x00000000759F0000-memory.dmp

        Filesize

        7.7MB

      • memory/1832-18-0x00000000086A0000-0x00000000087C4000-memory.dmp

        Filesize

        1.1MB

      • memory/1832-19-0x00000000087F0000-0x000000000880A000-memory.dmp

        Filesize

        104KB

      • memory/1832-21-0x0000000075240000-0x00000000759F0000-memory.dmp

        Filesize

        7.7MB

      • memory/1832-1-0x0000000000280000-0x0000000000482000-memory.dmp

        Filesize

        2.0MB

      • memory/4440-23-0x0000000005E60000-0x0000000005E72000-memory.dmp

        Filesize

        72KB

      • memory/4440-24-0x000000000D360000-0x000000000D6B4000-memory.dmp

        Filesize

        3.3MB

      • memory/4440-22-0x0000000005990000-0x00000000059A4000-memory.dmp

        Filesize

        80KB

      • memory/4788-35-0x0000000000D90000-0x0000000000DA2000-memory.dmp

        Filesize

        72KB