Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250207-en
  • resource tags

    arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/02/2025, 07:57

General

  • Target

    Dangerous RAT.exe

  • Size

    7.2MB

  • MD5

    302cb7218c3275c139ac070dae4f4daa

  • SHA1

    bcf24a42ae53f36863caa8b9c49a67d6a2bbc223

  • SHA256

    0079ba87b80bba1dbeb2fb1ea7361f7a44d0c4e9d55995c28b3329e9265a8c14

  • SHA512

    118819ac3011e0cb6222e883c95d179a970b8166dccdff7ed3bdeb34d1f67a5eee1ef2b251d708fd67b07835eb67cdbfcf877bb722f35a4dd086e38bf98c8adb

  • SSDEEP

    196608:/btBPRnfvon6IZYhydLLCdsflb8MKHTdas:7ZQ60LyS8MSas

Malware Config

Extracted

Family

xworm

Version

3.0

C2

3skr.uncofig.com:9999

Mutex

wRjQMjeNtaZnUCMU

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot7942324376:AAFz5Z-GdKIj1CePZyqIUmvNWOymMRw8Lmk/sendMessage?chat_id=2078478344

aes.plain

Signatures

  • Detect Neshta payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Neshta family
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Dangerous RAT.exe
    "C:\Users\Admin\AppData\Local\Temp\Dangerous RAT.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Users\Admin\AppData\Local\Temp\set.exe
      "C:\Users\Admin\AppData\Local\Temp\set.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2096
    • C:\Users\Admin\AppData\Local\Temp\Dangerous RAT 2020 Cracked by Unknown Venom.exe
      "C:\Users\Admin\AppData\Local\Temp\Dangerous RAT 2020 Cracked by Unknown Venom.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3084
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 864
        3⤵
        • Program crash
        PID:4072
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3084 -ip 3084
    1⤵
      PID:1284
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
      1⤵
        PID:2656
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0NBNTVGNjQtNkQ0MC00MkUxLUJDMkEtMTZFNzRDRkQ4OEYxfSIgdXNlcmlkPSJ7MUQ4RjY4QzAtOTNERC00MzJDLTlGQzktOEQ3OTk1MTNGNzU3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OTQ4MkRDNUEtOUM4NS00QUI2LTk5RTYtRDAyNzcwOTE5RkQ1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTczODk1NzQxMiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDMwMDQxNTY3MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyODQ4NjgyNTUiLz48L2FwcD48L3JlcXVlc3Q-
        1⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:5056

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Dangerous RAT 2020 Cracked by Unknown Venom.exe

        Filesize

        11.2MB

        MD5

        fb40ba1b494af4057ab259bba5f33fe6

        SHA1

        b872393a07d3949947a41871132b736c00c771bb

        SHA256

        40a82c50b9875698551a2f6dd4f71fc23b4a04eeec655a4746111279ef57d2ac

        SHA512

        f2feec8be6578aa273efd363ae1eba0862fc240a441fd8d1f14942fda241e34896e7b76179d7132af97f18acdf13afd4032f1874a9b20cc04120706beff9e804

      • C:\Users\Admin\AppData\Local\Temp\set.exe

        Filesize

        38KB

        MD5

        e1929d0781ff08abf8be3051479043b6

        SHA1

        0605a5657e022bd1cadf80f13446c678728dcde9

        SHA256

        b4ae6a462c5f24bec5870f6e92d94a00b1e1a4abd95e5433d6ac99a0f9d92042

        SHA512

        fb47c341b636293d500f1892f02e2be2b16bd0301eedc0c30025c00ae22ce3fe6d42abc0a4837cc5551eeed6cd5bbe815a0301db86bac6a84177a6c103d54d27

      • memory/1100-1-0x0000000000870000-0x0000000000FB2000-memory.dmp

        Filesize

        7.3MB

      • memory/1100-0-0x00007FFAF2533000-0x00007FFAF2535000-memory.dmp

        Filesize

        8KB

      • memory/1100-31-0x00007FFAF2530000-0x00007FFAF2FF2000-memory.dmp

        Filesize

        10.8MB

      • memory/1100-4-0x00007FFAF2530000-0x00007FFAF2FF2000-memory.dmp

        Filesize

        10.8MB

      • memory/2096-15-0x0000000000390000-0x00000000003A0000-memory.dmp

        Filesize

        64KB

      • memory/2096-16-0x00007FFAF2530000-0x00007FFAF2FF2000-memory.dmp

        Filesize

        10.8MB

      • memory/2096-36-0x000000001B030000-0x000000001B040000-memory.dmp

        Filesize

        64KB

      • memory/2096-37-0x00007FFAF2530000-0x00007FFAF2FF2000-memory.dmp

        Filesize

        10.8MB

      • memory/3084-30-0x0000000073B0E000-0x0000000073B0F000-memory.dmp

        Filesize

        4KB

      • memory/3084-32-0x0000000000A50000-0x000000000158E000-memory.dmp

        Filesize

        11.2MB

      • memory/3084-33-0x0000000006600000-0x0000000006BA6000-memory.dmp

        Filesize

        5.6MB

      • memory/3084-34-0x00000000060F0000-0x0000000006182000-memory.dmp

        Filesize

        584KB

      • memory/3084-35-0x0000000006190000-0x000000000622C000-memory.dmp

        Filesize

        624KB