Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

bGsw.exe

windows7-x64

10

bGsw.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    125s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    27/10/2022, 18:25 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bGsw.exe

  • Size

    47KB

  • MD5

    7f7eae31fd88251f48d55641fe8a9279

  • SHA1

    7d763dff2a1085e16b13d9f3f1badd95cb987b9d

  • SHA256

    49f5ab1d1ac3fc37bc87caebe6566465b04207c015a77070dafa9b2b3d5e7c2a

  • SHA512

    8afdb8a4801cf3609f36fc74096480cd683d351bce85b5155384a1d8d5e417126034df9a645e0d3a361ec64bac8a1228ff4a97c108dd8c46e077978df2183caa

  • SSDEEP

    768:p96mxUTILWCaS+DiMtelDSN+iV08YbygeB29sASYtsvEgK/JnZVc6KN:p96AKWMtKDs4zb1G29rSYOnkJnZVclN

Score
10/10
asyncratrat

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Async RAT payload 1 IoCs
    rat
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bGsw.exe
    "C:\Users\Admin\AppData\Local\Temp\bGsw.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1600

Network

  • flag-us
    DNS
    pastebin.com
    bGsw.exe
    Remote address:
    8.8.8.8:53
    Request
    pastebin.com
    IN A
    Response
    pastebin.com
    IN A
    104.20.67.143
    pastebin.com
    IN A
    104.20.68.143
    pastebin.com
    IN A
    172.67.34.170
  • flag-us
    GET
    https://pastebin.com/raw/rkU6tFXq
    bGsw.exe
    Remote address:
    104.20.67.143:443
    Request
    GET /raw/rkU6tFXq HTTP/1.1
    Host: pastebin.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Thu, 27 Oct 2022 18:25:22 GMT
    Content-Type: text/plain; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    x-frame-options: DENY
    x-content-type-options: nosniff
    x-xss-protection: 1;mode=block
    cache-control: public, max-age=1801
    CF-Cache-Status: HIT
    Age: 6
    Last-Modified: Thu, 27 Oct 2022 18:25:16 GMT
    Server: cloudflare
    CF-RAY: 760d79514c20d4a0-BRU
  • flag-us
    GET
    https://pastebin.com/raw/rkU6tFXq
    bGsw.exe
    Remote address:
    104.20.67.143:443
    Request
    GET /raw/rkU6tFXq HTTP/1.1
    Host: pastebin.com
    Response
    HTTP/1.1 200 OK
    Date: Thu, 27 Oct 2022 18:25:51 GMT
    Content-Type: text/plain; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    x-frame-options: DENY
    x-content-type-options: nosniff
    x-xss-protection: 1;mode=block
    cache-control: public, max-age=1801
    CF-Cache-Status: HIT
    Age: 35
    Last-Modified: Thu, 27 Oct 2022 18:25:16 GMT
    Server: cloudflare
    CF-RAY: 760d7a05b9b6d4a0-BRU
  • flag-us
    GET
    https://pastebin.com/raw/rkU6tFXq
    bGsw.exe
    Remote address:
    104.20.67.143:443
    Request
    GET /raw/rkU6tFXq HTTP/1.1
    Host: pastebin.com
    Response
    HTTP/1.1 200 OK
    Date: Thu, 27 Oct 2022 18:26:19 GMT
    Content-Type: text/plain; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    x-frame-options: DENY
    x-content-type-options: nosniff
    x-xss-protection: 1;mode=block
    cache-control: public, max-age=1801
    CF-Cache-Status: HIT
    Age: 63
    Last-Modified: Thu, 27 Oct 2022 18:25:16 GMT
    Server: cloudflare
    CF-RAY: 760d7ab6df51d4a0-BRU
  • flag-us
    GET
    https://pastebin.com/raw/rkU6tFXq
    bGsw.exe
    Remote address:
    104.20.67.143:443
    Request
    GET /raw/rkU6tFXq HTTP/1.1
    Host: pastebin.com
    Response
    HTTP/1.1 200 OK
    Date: Thu, 27 Oct 2022 18:26:47 GMT
    Content-Type: text/plain; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    x-frame-options: DENY
    x-content-type-options: nosniff
    x-xss-protection: 1;mode=block
    cache-control: public, max-age=1801
    CF-Cache-Status: HIT
    Age: 91
    Last-Modified: Thu, 27 Oct 2022 18:25:16 GMT
    Server: cloudflare
    CF-RAY: 760d7b68cf3bd4a0-BRU
  • flag-us
    GET
    https://pastebin.com/raw/rkU6tFXq
    bGsw.exe
    Remote address:
    104.20.67.143:443
    Request
    GET /raw/rkU6tFXq HTTP/1.1
    Host: pastebin.com
    Response
    HTTP/1.1 200 OK
    Date: Thu, 27 Oct 2022 18:27:16 GMT
    Content-Type: text/plain; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    x-frame-options: DENY
    x-content-type-options: nosniff
    x-xss-protection: 1;mode=block
    cache-control: public, max-age=1801
    CF-Cache-Status: HIT
    Age: 120
    Last-Modified: Thu, 27 Oct 2022 18:25:16 GMT
    Server: cloudflare
    CF-RAY: 760d7c1e9910d4a0-BRU
  • 104.20.67.143:443
    https://pastebin.com/raw/rkU6tFXq
    tls, http
    bGsw.exe
    1.3kB
     6.7kB
     15
    20

    HTTP Request

    GET https://pastebin.com/raw/rkU6tFXq

    HTTP Response

    200

    HTTP Request

    GET https://pastebin.com/raw/rkU6tFXq

    HTTP Response

    200

    HTTP Request

    GET https://pastebin.com/raw/rkU6tFXq

    HTTP Response

    200

    HTTP Request

    GET https://pastebin.com/raw/rkU6tFXq

    HTTP Response

    200

    HTTP Request

    GET https://pastebin.com/raw/rkU6tFXq

    HTTP Response

    200
  • 192.168.100.5:8973
    bGsw.exe
    152 B
     3
  • 192.168.100.5:8973
    bGsw.exe
    152 B
     3
  • 192.168.100.5:8973
    bGsw.exe
    152 B
     3
  • 192.168.100.5:8973
    bGsw.exe
    152 B
     3
  • 192.168.100.5:8973
    bGsw.exe
    152 B
     3
  • 8.8.8.8:53
    pastebin.com
    dns
    bGsw.exe
    58 B
     106 B
     1
    1

    DNS Request

    pastebin.com

    DNS Response

    104.20.67.143
    104.20.68.143
    172.67.34.170

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1600-54-0x0000000001080000-0x0000000001092000-memory.dmp

    Filesize

    72KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.