Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3B3RAP Leec...er.exe
windows7-x64
8B3RAP Leec...er.exe
windows10-2004-x64
7B3RAP Leec...et.dll
windows7-x64
1B3RAP Leec...et.dll
windows10-2004-x64
1NETFLIX Ch...ER.exe
windows7-x64
7NETFLIX Ch...ER.exe
windows10-2004-x64
7NETFLIX Ch...ER.exe
windows7-x64
7NETFLIX Ch...ER.exe
windows10-2004-x64
7NETFLIX Ch...er.dll
windows7-x64
1NETFLIX Ch...er.dll
windows10-2004-x64
1NETFLIX Ch...et.dll
windows7-x64
1NETFLIX Ch...et.dll
windows10-2004-x64
1Proxy Chec...ER.exe
windows7-x64
7Proxy Chec...ER.exe
windows10-2004-x64
7Proxy Chec...ER.exe
windows7-x64
8Proxy Chec...ER.exe
windows10-2004-x64
7Proxy Chec...ck.exe
windows7-x64
10Proxy Chec...ck.exe
windows10-2004-x64
10Proxy Chec...er.dll
windows7-x64
1Proxy Chec...er.dll
windows10-2004-x64
1Proxy Chec...et.dll
windows7-x64
1Proxy Chec...et.dll
windows10-2004-x64
1Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 02:27
Static task
static1
Behavioral task
behavioral1
Sample
B3RAP Leecher v0.5/B3RAP Leecher.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
B3RAP Leecher v0.5/B3RAP Leecher.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
B3RAP Leecher v0.5/Leaf.xNet.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
B3RAP Leecher v0.5/Leaf.xNet.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
NETFLIX Checker Account By X-KILLER/._cache_NETFLIX Checker Account By X-KILLER.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
NETFLIX Checker Account By X-KILLER/._cache_NETFLIX Checker Account By X-KILLER.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
NETFLIX Checker Account By X-KILLER/NETFLIX Checker Account By X-KILLER.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
NETFLIX Checker Account By X-KILLER/NETFLIX Checker Account By X-KILLER.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
NETFLIX Checker Account By X-KILLER/SkinSoft.VisualStyler.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
NETFLIX Checker Account By X-KILLER/SkinSoft.VisualStyler.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
NETFLIX Checker Account By X-KILLER/xNet.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
NETFLIX Checker Account By X-KILLER/xNet.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Proxy Checker v0.2/._cache_Proxy Checker v0.2 By X-SLAYER.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Proxy Checker v0.2/._cache_Proxy Checker v0.2 By X-SLAYER.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Proxy Checker v0.2/Proxy Checker v0.2 By X-SLAYER.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Proxy Checker v0.2/Proxy Checker v0.2 By X-SLAYER.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Proxy Checker v0.2/Proxy Checker v0.2 Crack.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Proxy Checker v0.2/Proxy Checker v0.2 Crack.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Proxy Checker v0.2/SkinSoft.VisualStyler.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Proxy Checker v0.2/SkinSoft.VisualStyler.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Proxy Checker v0.2/xNet.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Proxy Checker v0.2/xNet.dll
Resource
win10v2004-20240802-en
General
-
Target
NETFLIX Checker Account By X-KILLER/NETFLIX Checker Account By X-KILLER.exe
-
Size
1.3MB
-
MD5
89f4a57b13570e7493112ef54ad3196e
-
SHA1
22f39b91fc4172194877927dfbfa31a10057ce8f
-
SHA256
d8bfdcac9ac53a9d4fdcb9b04fa5a33e06db1df062888317302afaf21f17eaa2
-
SHA512
73e5931cd03bff77a9b4b77b943a4ac4fcc26dc49707c349e1a4bd03e317ea99ef0171e8f9906275cc25e803449cd14549363c7a6b74c76c6f3a1166caf3ed77
-
SSDEEP
24576:CnsJ39LyjbJkQFMhmC+6GD9Lyq4CeZTdp4ZJSK2i+n9B5t0Agv:CnsHyjtk2MYC5GDpF4ldezSPFn1OAG
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 1492 Synaptics.exe 2976 ._cache_Synaptics.exe -
Loads dropped DLL 7 IoCs
pid Process 2068 NETFLIX Checker Account By X-KILLER.exe 2068 NETFLIX Checker Account By X-KILLER.exe 2068 NETFLIX Checker Account By X-KILLER.exe 1492 Synaptics.exe 1492 Synaptics.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2976 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" NETFLIX Checker Account By X-KILLER.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETFLIX Checker Account By X-KILLER.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1428 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2976 ._cache_Synaptics.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2976 ._cache_Synaptics.exe 2976 ._cache_Synaptics.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2976 ._cache_Synaptics.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2976 ._cache_Synaptics.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2976 ._cache_Synaptics.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2976 ._cache_Synaptics.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2976 ._cache_Synaptics.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2976 ._cache_Synaptics.exe 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2976 ._cache_Synaptics.exe 2976 ._cache_Synaptics.exe 2976 ._cache_Synaptics.exe 2976 ._cache_Synaptics.exe 2976 ._cache_Synaptics.exe 2976 ._cache_Synaptics.exe 2976 ._cache_Synaptics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2540 ._cache_NETFLIX Checker Account By X-KILLER.exe 2976 ._cache_Synaptics.exe 1428 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2540 2068 NETFLIX Checker Account By X-KILLER.exe 31 PID 2068 wrote to memory of 2540 2068 NETFLIX Checker Account By X-KILLER.exe 31 PID 2068 wrote to memory of 2540 2068 NETFLIX Checker Account By X-KILLER.exe 31 PID 2068 wrote to memory of 2540 2068 NETFLIX Checker Account By X-KILLER.exe 31 PID 2068 wrote to memory of 1492 2068 NETFLIX Checker Account By X-KILLER.exe 32 PID 2068 wrote to memory of 1492 2068 NETFLIX Checker Account By X-KILLER.exe 32 PID 2068 wrote to memory of 1492 2068 NETFLIX Checker Account By X-KILLER.exe 32 PID 2068 wrote to memory of 1492 2068 NETFLIX Checker Account By X-KILLER.exe 32 PID 1492 wrote to memory of 2976 1492 Synaptics.exe 33 PID 1492 wrote to memory of 2976 1492 Synaptics.exe 33 PID 1492 wrote to memory of 2976 1492 Synaptics.exe 33 PID 1492 wrote to memory of 2976 1492 Synaptics.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\NETFLIX Checker Account By X-KILLER\NETFLIX Checker Account By X-KILLER.exe"C:\Users\Admin\AppData\Local\Temp\NETFLIX Checker Account By X-KILLER\NETFLIX Checker Account By X-KILLER.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\NETFLIX Checker Account By X-KILLER\._cache_NETFLIX Checker Account By X-KILLER.exe"C:\Users\Admin\AppData\Local\Temp\NETFLIX Checker Account By X-KILLER\._cache_NETFLIX Checker Account By X-KILLER.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2540
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\NETFLIX Checker Account By X-KILLER\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\NETFLIX Checker Account By X-KILLER\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2976
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD589f4a57b13570e7493112ef54ad3196e
SHA122f39b91fc4172194877927dfbfa31a10057ce8f
SHA256d8bfdcac9ac53a9d4fdcb9b04fa5a33e06db1df062888317302afaf21f17eaa2
SHA51273e5931cd03bff77a9b4b77b943a4ac4fcc26dc49707c349e1a4bd03e317ea99ef0171e8f9906275cc25e803449cd14549363c7a6b74c76c6f3a1166caf3ed77
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
24KB
MD57fb8706f1e6ece60fe1e83fa99360de7
SHA1c6f70413a8da42e90b9794876e34abf9b0ef42da
SHA256e8e8199f98366e6ce0754cb2e25205604b4b1f8952721778e1c2a9dc0ec7c365
SHA51203656140048fc3277d31e1fc57c1e040aa71f826317f217366d1f885038561d50b10291a8efa0adf56a3bbcf44d3b1291a285ec9e05b375a42c12635787683bc
-
Filesize
31KB
MD5d3054ae1569d809eac61d2b42c011f46
SHA1fcc8e5f1bc409ca33e5279e24055c97df7026d4a
SHA256c1a37289061d68b9cc002d5a430e52b945173cf29dafccb6d33e0fc1522b2f9a
SHA5122de113665d8272685ab40ec41914a193a96659080aa6c30b71446ef60f9aa320edaa3cb07b409fcfa16c4434e7fc22ef97b1ced2dad75eb1b7b8addcafead811
-
Filesize
26KB
MD5372f3d0db76a331f5f213d10f2286afb
SHA186500972b5e641c4268adbe6fd5e7969fb636f1d
SHA2561da6976d4aa6204c2c2ca45343f588666cea98573d4705c03df6207612047b8b
SHA5124ac44d067d53a7177ac007296469fb033f87a1d667abec7ed8fd94f506f1a93fef0a8849c460c56384270ef04f8949eeba6315ebd9195bd31cec2ea6edfa1df0
-
Filesize
26KB
MD5ab2a16c4e427f4350abf937348593f65
SHA11f7a88017549efeef1c34bcd4b1567f8d1efe880
SHA2566fa01a2d60ec3b073c32e4bb1e2b692a8812ec2096d99b68360eeb737e66ea90
SHA51291b795f4debf5150aa72d454871423f9e2cb49f25e61165b71551e90938d51d98df554202389a96007b223acdb61d3af1e6c71a962898d645525d51ee64a6cf1
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
Filesize
66KB
MD5c74d260d388f5ac3d95d8c1c3a27c989
SHA15da009086036004a7c670d608d5e1e923aead568
SHA256dc1bebb8ce88d59e4b3130c1ff2c4b7f5df2701c7a71b476b8a6f2ed541db628
SHA5126460db8f73806017d267c0e4e112902956a3bc53853c6a893cff66fe44772305b2c158ef8b58e993806d713aceaddcf2efa7ccf625063678444d3fd20b10546a
-
\Users\Admin\AppData\Local\Temp\NETFLIX Checker Account By X-KILLER\._cache_NETFLIX Checker Account By X-KILLER.exe
Filesize538KB
MD5867f1fbc0a5d89a100d4fe867fa4b34f
SHA1a41eb575ac101f0954d074932eebcd916ce0023b
SHA256e22c7f85f00cc4a5219d23ead9ae28897ebea30d09b39387456c1f4fd4541ce5
SHA5126e71eae56d521d0f62abf605f7181bee429e878aa96853e8e95e0512bb2f5a1c93191ab9afbaf3409d61f78ee4decb6581c7764daaa53bc35ad4c1c77b9ecbfa