Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2024, 05:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bdcdb05af6a2ac95bb13857ab6b6debc.exe
Resource
win7-20240221-en
7 signatures
150 seconds
General
-
Target
bdcdb05af6a2ac95bb13857ab6b6debc.exe
-
Size
1.7MB
-
MD5
bdcdb05af6a2ac95bb13857ab6b6debc
-
SHA1
93999f28d1c8391d60830be5202233b63db93301
-
SHA256
09df08b715bf11a0bc6cb5cdc5cd724927ba6c6a18ca2896f153d9b424196767
-
SHA512
7a25c9768a0181bf3000c56d8f739a1835aa9114761a20e7d8ed21318467556acc26e183e832b907122fe2f2c32ab1750ccb3d016a2abead43955ad7050f73e5
-
SSDEEP
49152:7jr8QuQLqpb0/udMUNPlam4t1Uyru4YNsbN:7nhuQWb0/uWUNPlL4t1dNYUN
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
eewe.ddns.net:2880
Attributes
-
communication_password
b18aba2f7c3bf981f4caba4a41e6b205
-
tor_process
tor
Signatures
-
resource yara_rule behavioral2/memory/4344-3-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-5-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-6-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-8-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-9-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-12-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-13-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-11-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-14-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-15-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-16-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-17-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-19-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-20-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-22-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-24-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-25-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-27-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-28-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-29-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-31-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-33-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-34-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-36-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-37-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-38-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-40-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-42-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-43-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-45-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-46-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-47-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-49-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-51-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-52-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-54-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-55-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-56-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-58-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-60-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4344-61-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 4344 bdcdb05af6a2ac95bb13857ab6b6debc.exe 4344 bdcdb05af6a2ac95bb13857ab6b6debc.exe 4344 bdcdb05af6a2ac95bb13857ab6b6debc.exe 4344 bdcdb05af6a2ac95bb13857ab6b6debc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2292 set thread context of 4344 2292 bdcdb05af6a2ac95bb13857ab6b6debc.exe 92 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 4344 bdcdb05af6a2ac95bb13857ab6b6debc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4344 bdcdb05af6a2ac95bb13857ab6b6debc.exe 4344 bdcdb05af6a2ac95bb13857ab6b6debc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2292 wrote to memory of 4344 2292 bdcdb05af6a2ac95bb13857ab6b6debc.exe 92 PID 2292 wrote to memory of 4344 2292 bdcdb05af6a2ac95bb13857ab6b6debc.exe 92 PID 2292 wrote to memory of 4344 2292 bdcdb05af6a2ac95bb13857ab6b6debc.exe 92 PID 2292 wrote to memory of 4344 2292 bdcdb05af6a2ac95bb13857ab6b6debc.exe 92 PID 2292 wrote to memory of 4344 2292 bdcdb05af6a2ac95bb13857ab6b6debc.exe 92 PID 2292 wrote to memory of 4344 2292 bdcdb05af6a2ac95bb13857ab6b6debc.exe 92 PID 2292 wrote to memory of 4344 2292 bdcdb05af6a2ac95bb13857ab6b6debc.exe 92 PID 2292 wrote to memory of 4344 2292 bdcdb05af6a2ac95bb13857ab6b6debc.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\bdcdb05af6a2ac95bb13857ab6b6debc.exe"C:\Users\Admin\AppData\Local\Temp\bdcdb05af6a2ac95bb13857ab6b6debc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\bdcdb05af6a2ac95bb13857ab6b6debc.exe"C:\Users\Admin\AppData\Local\Temp\bdcdb05af6a2ac95bb13857ab6b6debc.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4344
-