Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12/02/2024, 23:54
General
-
Target
97f1a585a7b4c15df61fa892fb3fc76d.exe
-
Size
7.1MB
-
MD5
97f1a585a7b4c15df61fa892fb3fc76d
-
SHA1
9d1564a02e8cd72e9cb188da42e05ae3511762c8
-
SHA256
9a6e4a0945252684df6638c58bcc3f0eeb38923ab8b56972585692d43ecc532b
-
SHA512
a2b74994062f45df13552d80ef6f21c2228fedde24b5913e528721389bcf3cc22c5a8f6ac741d309322ec6340648248d1bb6b4794f83f93a42e90f03c2776e38
-
SSDEEP
196608:9fXscaDbsQoXznnH/UAhB9ZOjy+puQqw/LMBkJzIDluZpK1:9fsOnfpDmKmTaMCloK
Malware Config
Extracted
bitrat
1.38
vbd3hiruwgcquiwrhpvaxann2ieo3tw3iznqlrp2z6mqyaonh4rswjqd.onion:80
-
communication_password
a5b168cfbe7cfa4410a62b9965318077
-
tor_process
svchost
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
ACProtect 1.3x - 1.4x DLL software 11 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 15 IoCs
-
UPX packed file 47 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97f1a585a7b4c15df61fa892fb3fc76d.exe"C:\Users\Admin\AppData\Local\Temp\97f1a585a7b4c15df61fa892fb3fc76d.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rkZqKaShx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA498.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\97f1a585a7b4c15df61fa892fb3fc76d.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\97f1a585a7b4c15df61fa892fb3fc76d.exe"{path}"2⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\d32839c8\tor\svchost.exe"C:\Users\Admin\AppData\Local\d32839c8\tor\svchost.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d32839c8\tor\svchost.exe"C:\Users\Admin\AppData\Local\d32839c8\tor\svchost.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD556c01c630c5b8d5496eb6640c984f1d9
SHA138d5f04092c3ce6bafe8ed683b353123fba35bb7
SHA2565f1823f659d2ece842d450fc034ec9cceea5130d3111f933639c90d1da0efb72
SHA51286c52a8836261387b87544227b793debfbd2f5ca414aa0d0faab7a7963109ea7f7fe14d9f3670680337660db8cf0a868c5ce18b84399ff77fde47a7870e69abe
-
Filesize
20KB
MD52e1b54c65531d5557839611fd8e9aa8d
SHA19fc1e4cd7fd36f262f057207d028e59c527e85b0
SHA256580c94bd87e9293751a039c1eb0f7775cd586197879079fff55a1e653c5be93f
SHA5122d8e704c27cb6e538f1232949684d2e49a53bae2c5183a0124dfec8fa991817c31efcef793f76a13159209882a2ba7575a71f663d41b84236255594dbe208e20
-
Filesize
56KB
MD5fed03e26f0cbf313931b57febae866a3
SHA1c5410314b240621173102574102f11206534b61f
SHA256dd1636daeb64102cd0d549d8598f35f21a45ec8808b5d06a9523407ac870cabb
SHA512f23560d8c22477329c3f67622ec68a08892ac72558de0173c1c361609b5d0f5fa71da65f573087825639aec9090bdc90780a3210228e432e4cd02fe29c7e96a3
-
Filesize
1.5MB
MD5e0c692c0c6fa059dae15e837a29c9ad4
SHA1f3bd9b035cdc78a90ea49ee650481fd58e6a08ba
SHA256bca45f3d44d92d69c5e7c87f0f4c90b9e5350e53ffef68a484ce680508a514b5
SHA5121c287d04a4bdddb27a935ed5b1fa3bc59c946c4c8b39416cca7c99315ab0f1d0bfa1d075a9afed08a984c9f1a37d88cf625da13728d8fb678179cc16c6b4016b
-
Filesize
2.7MB
MD52268cce7a5cbd9d7165380389bfc71e9
SHA15a7ca0007c2ca6e2d7f2da6e11f01067bce7d95a
SHA2563a7121fffac6c429398f5a860309ef2e5fb87ec1b1fce3934b8032012a84338d
SHA512c6aca46e1f333f431e9b32f491292a6639659998a35be1ae28117f8ceb60465d9f789727e2024dd141b2c8148bb2be5257ffb3e2b37c8bb7ffe23281b1a9c9f1
-
Filesize
6.0MB
MD5654ba55710822f4f137f9a5bf2d964fc
SHA121a3fc7a02997faf4a087bb3d348cb1337993ae4
SHA25650c67766af175a66d79925780349e317c1017c41f4da4b56c5a91ec143a5eefe
SHA512d7af6ce7cc9548617470b89337f8c26274b486cac0d13fd3e8b63e29b061618508edc2d0da92564dcc51e1946a34fb7525995cfe1eaddd372d131af84c7f85e2
-
Filesize
232B
MD52648fcd91f054ccddd3a1b6ba5a29939
SHA1e72c335e8226bd1e1e89e79d2f45f1167b58f8f6
SHA2566cce4935e32c9d47ba756966a287810434219b1faff2a71911ff11d7969dbbfa
SHA512ddc2dc1ea6a2270ae805b34a0f2279685630f2bebd7bda36a657bf4a30067bd411d320c2ffdcf3cb05ad7c2df6dd6c57efccfdb12de95985ee6f49dce9895ae1
-
Filesize
2.6MB
MD5e7abc6934cb714f2728cd37ab9a5f543
SHA14142e6c2e538f0fc1d90776f254bcb116fe474ae
SHA2564496bcbc97fb32777dfb90e1e50b7a00584c43bc3ac653120e1fcb04e642ec52
SHA51264ec20f9105bead5244326b093078a927c2edc56792b4202dc1468aecbe78565a9d3cf73bc4b98776d92de76abcf1c306dc5f6ca60d44521b96d2ac11d6f5e2e
-
Filesize
747KB
MD5181f386541f55bbd2e067402debc3533
SHA197fb513693da546e585c16704a4c048e30505760
SHA256c81c397daa2d5821814d5efdfc944233ba72d49115167ac86a93f153a8844f0c
SHA51233a09ef3a2e264cc1096813e5af2350a6a3d0d40924d8dac78b1e950d4f7bce30cd52a00dd524af32187991705d84cbdcc949bc614ea6a21337eaae784ef5108
-
Filesize
57KB
MD5813367216cb7ef856249d81839a3da9b
SHA18daeee7817a1fe878b0a7945d1b57663dc32513c
SHA256fae5f8fa1a2af6b62c2d61dfc24fb37a6084faab71b5b392257c0214a4baed8c
SHA512d2e100c79a4a2935d9badbd2fb2f5be73171a16c33c4001e958a1c2e29a4b1d54dd73354be41ee54a739e19522850a29ac9c48aa3e6f87e91ae86c7a5bf45c2e
-
Filesize
594KB
MD5b7d0a3e0d5da14b9d7be3386526dd5fc
SHA135ce6a0047f354c2e4f66fc0f0ca44dd43d7918d
SHA25616983201df066c70bd82e4b1c59f63fa339abbb1650c7b37646679192115d2e4
SHA51233739b1529dad26468f5e439cc61fe5ef6299d6caebbd1478138f853cf0b9ff9b3f20f03ef2c73a79c87ffe755ce079462381eb11716e9d40d6df004e8fe9b53
-
Filesize
475KB
MD5779bcb81683f4a04859f74e5d8d7a8d8
SHA11463f0fba366c71f562e3ba53a9fa35c240228e6
SHA25696dba2d4f958d581d4f4acc52c09ebcd76835e5396c1a305b2333a39b3323564
SHA512dc0029bd3dd0eff72a04f5a34d6783336bffee2c2afb32164418175f8d7a22e46d5320815a17d523a9fe1db35664e2fc58170c86c9ca18bac3f1f25f36876c57
-
Filesize
366KB
MD5099983c13bade9554a3c17484e5481f1
SHA1a84e69ad9722f999252d59d0ed9a99901a60e564
SHA256b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
SHA51289f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2
-
Filesize
286KB
MD5b0d98f7157d972190fe0759d4368d320
SHA15715a533621a2b642aad9616e603c6907d80efc4
SHA2562922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
SHA51241ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496
-
Filesize
439KB
MD5c88826ac4bb879622e43ead5bdb95aeb
SHA187d29853649a86f0463bfd9ad887b85eedc21723
SHA256c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
SHA512f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3
-
Filesize
88KB
MD52c916456f503075f746c6ea649cf9539
SHA1fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA5121c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
-
Filesize
1KB
MD512a15eedc5e5a0708232e011d43938cd
SHA1fefaa51d64346d491a51ed2eaa2d15afe12291fe
SHA256a55cd522ff74883371c3af8fb3093b3522faeed973a315d753a60d467bc9c444
SHA5123f8cc53bd32f639589c1950c802a25841a5da53d19a0825a01860a60aa018b49c224814c8971facf2f56cf3f1242976c36f2d55776b81f0c0314176ef45cdcb1
-
Filesize
188KB
MD5d407cc6d79a08039a6f4b50539e560b8
SHA121171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA25692cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c
-
Filesize
973KB
MD55cfe61ff895c7daa889708665ef05d7b
SHA15e58efe30406243fbd58d4968b0492ddeef145f2
SHA256f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
SHA51243b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da
-
Filesize
135KB
MD5af6c41a3eea6fba9e889d6050757b9fb
SHA14a635a0a96434780616726914ce26084c94f6b8a
SHA2565ce64480ac77266ee4edc12fc5c0994c7fcf7559ba727ba9ce99ab4ad5013392
SHA5128eb77e7df07e950f65cc348dc96b8f86a2d58527e657025ae7a84968e35aee71f6f4d4a0a00b79a0826ad803001ffc270211f48c03956592288ba8c1fa832a04
-
Filesize
127KB
MD50d63bc5edc89dc241d157b96e069c95f
SHA1124019722de4b434753744ed60219327556fd825
SHA256623dcf29cc66340dcf6f4d97108f25cb4fc685439c9c88f6b9dae0eefed30b0e
SHA5122fa05ded7c79cdd74a56db3d7fee9745cbc998484959021618d9426ab64c56c624168c66cbdb51da38bf0a750cf1fd6c7109d63e5e68e0cdf023d42ab641adb7
-
Filesize
116KB
MD56889ac829b41adea4406114c7c0b56ae
SHA1c4b5bc2707ad6efe4d497bb160b7147022809633
SHA25664efa83426d96623a08c47f6ddabf21a7fe851d364419aecbfe59390d0d27ded
SHA512b3c4e7b563db401b68bab5963c4415201fad00f68f05cf62c41cec69f2b0b97e52ce60dc5438393443422f45af034de1357ad4da305481b327d1704fa2604557
-
Filesize
157B
MD5eb6a94bb542c5eccbf6a69cb41eee37d
SHA117fa40a8ae0870316298d061563b79bd6681a439
SHA25625350b0e59c5d4e1992f5f62f86db4885988481d98674c026321fe3704f6fb00
SHA512cd940a918b09da62f4bb736329ddc37afeb15783ac047d1b6b56284c0daf298042cf396da95e660996466f7e48e5ac4f80861951da601e80667805aefd737502
-
Filesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa
-
Filesize
4.0MB
-
Filesize
800KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
1.0MB
-
Filesize
144KB
-
Filesize
800KB
-
Filesize
2.8MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
544KB
-
Filesize
824KB
-
Filesize
4.0MB
-
Filesize
292KB
-
Filesize
4.0MB
-
Filesize
2.8MB
-
Filesize
1.0MB
-
Filesize
2.8MB
-
Filesize
544KB
-
Filesize
4.0MB
-
Filesize
144KB
-
Filesize
824KB
-
Filesize
4.0MB
-
Filesize
292KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.1MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
6.3MB
-
Filesize
7.8MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
7.8MB
-
Filesize
228KB
-
Filesize
7.8MB
-
Filesize
228KB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
228KB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
1.0MB
-
Filesize
824KB
-
Filesize
800KB
-
Filesize
144KB
-
Filesize
2.8MB
-
Filesize
544KB
-
Filesize
292KB
-
Filesize
4.0MB