Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

X7EIN_loader_prod.exe

windows7-x64

7

X7EIN_loader_prod.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    X7EIN_loader_prod.exe

  • Size

    22.1MB

  • Sample

    250303-zelasaykv8

  • MD5

    b305aa477ab7a5f2304aa747b0f52111

  • SHA1

    e5f5987f1ee86bca5ef6e316c51b6a6c20c03788

  • SHA256

    c5e40b00c093c4f1e3f34ea04ac9bc8cd233670447ef54f6c59362a9927a358c

  • SHA512

    5bb7fa6edd3e66fb6b7b0ecf58819c1e0f53512a998f612bce864c32cb63cfca1c16e7208b8fa6c4ed0b5d79de65116db4ab07690f8ae73ec14345b2c97cb5b8

  • SSDEEP

    393216:oCs9AonSMquOyVEffa4SNCs6V54ZGNlhxRDe2QGlHeJtIwt:F0AonSMIHn3SQs6v1NpRDeUUp

Score
10/10
asyncratvenomrateulendefense_evasiondiscoveryevasionexecutionratspywarestealertrojan

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Eulen

Mutex

Microsoft_Sync_Manager

Attributes
  • delay

    1

  • install

    true

  • install_file

    DiscordHelper.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/KnhCGRrn

aes.plain

Targets

    • Target

      X7EIN_loader_prod.exe

    • Size

      22.1MB

    • MD5

      b305aa477ab7a5f2304aa747b0f52111

    • SHA1

      e5f5987f1ee86bca5ef6e316c51b6a6c20c03788

    • SHA256

      c5e40b00c093c4f1e3f34ea04ac9bc8cd233670447ef54f6c59362a9927a358c

    • SHA512

      5bb7fa6edd3e66fb6b7b0ecf58819c1e0f53512a998f612bce864c32cb63cfca1c16e7208b8fa6c4ed0b5d79de65116db4ab07690f8ae73ec14345b2c97cb5b8

    • SSDEEP

      393216:oCs9AonSMquOyVEffa4SNCs6V54ZGNlhxRDe2QGlHeJtIwt:F0AonSMIHn3SQs6v1NpRDeUUp

    Score
    10/10
    asyncratvenomrateulendefense_evasiondiscoveryevasionexecutionratspywarestealertrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Disables service(s)

      defense_evasionexecution

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • VenomRAT

      Detects VenomRAT.

      rat

    • Venomrat family

      venomrat

    • Async RAT payload

      rat

    • Stops running service(s)

      defense_evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Privilege Escalation

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Defense Evasion

Impair Defenses

3
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Service Stop

2
T1489

Tasks