Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2025, 02:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
xm.ocx.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
xm.ocx.exe
-
Size
3.3MB
-
MD5
45ccb4f3c18ee9a044abd6117e32868d
-
SHA1
e34b03cb092ea7d139eaffe9bc84e9e83120db80
-
SHA256
b9b628725d830cb53c6854bd5bc5f6d6607cce3ec06821ec323fdb876f883d08
-
SHA512
566f157bf9f508ad6fae249f05fad74ea0ce4573e7cd67e4a68c6edf6d064783c14719a913b50d3bb1df5b719a1ee750aeb51cd91a238b71d4b7a24d9ebfca53
-
SSDEEP
98304:VlUOwdXxngJRzhTMU2dZvxO4V84DdDoolft0:V2hxngJRzhQZxx0
Malware Config
Signatures
-
Fatalrat family
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/4228-2-0x0000000010000000-0x000000001002D000-memory.dmp fatalrat -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xm.ocx.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 xm.ocx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz xm.ocx.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe 4228 xm.ocx.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4228 xm.ocx.exe