Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Insidious.exe

windows7-x64

10

Insidious.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2024, 15:46 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Insidious.exe

  • Size

    303KB

  • MD5

    fbf3ddca500a4965c99447ea7e79cf6d

  • SHA1

    582ad8da1b4b136e1ccef53200f1920b9baa24b9

  • SHA256

    2809f0c07efc9d7937f9a4c3c5b9ee7e950f859717f1223d61463c1064d91fbd

  • SHA512

    e0bab8e7bcdb2b7ddda0738bc352082ed2bb522fba0c9346d0a52550b1b7f80d41d9764d5603ab9a778e4e92c07d6fd0abada87abe45e8befa04ef939ad13300

  • SSDEEP

    6144:g5hxT6MDdbICydeBvQ26i2dVTZ86jmA1D0mCT:g5dY26i2vTGY1D4T

Score
10/10
44caliberspywarestealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1321482296741859409/X1bn2jlvTd0y9AD60L8KRwYU6M1PtlXbovFDDG4UGVxu_AKL8j8gxu-Us5mRHlfUCPOy

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\Insidious.exe
    "C:\Users\Admin\AppData\Local\Temp\Insidious.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3508
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1156

    Network

    • flag-us
      DNS
      freegeoip.app
      Insidious.exe
      Remote address:
      8.8.8.8:53
      Request
      freegeoip.app
      IN A
      Response
      freegeoip.app
      IN A
      104.21.73.97
      freegeoip.app
      IN A
      172.67.160.84
    • flag-us
      GET
      https://freegeoip.app/xml/
      Insidious.exe
      Remote address:
      104.21.73.97:443
      Request
      GET /xml/ HTTP/1.1
      Host: freegeoip.app
      Connection: Keep-Alive
      Response
      HTTP/1.1 301 Moved Permanently
      Date: Wed, 25 Dec 2024 15:47:09 GMT
      Content-Type: text/html
      Content-Length: 167
      Connection: keep-alive
      Cache-Control: max-age=3600
      Expires: Wed, 25 Dec 2024 16:47:09 GMT
      Location: https://ipbase.com/xml/
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kRYUHbl2Uay9tG4%2FIFGQIjY8OKiwo4S9fRpRXCUbQ7IqDF61IRGrmf7XRTHgr5y6QF6lLoFWtKiWCCMT6zRJiOrASBkx5qRsjm4FVcH6UeY4zxuhNKVPmTqekcuOrs0Y"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8f79f7cecbfcef11-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=28774&min_rtt=27097&rtt_var=8715&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2991&recv_bytes=364&delivery_rate=128922&cwnd=248&unsent_bytes=0&cid=f5c107e91c3b69f7&ts=79&x=0"
    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      ipbase.com
      Insidious.exe
      Remote address:
      8.8.8.8:53
      Request
      ipbase.com
      IN A
      Response
      ipbase.com
      IN A
      172.67.209.71
      ipbase.com
      IN A
      104.21.85.189
    • flag-us
      GET
      https://ipbase.com/xml/
      Insidious.exe
      Remote address:
      172.67.209.71:443
      Request
      GET /xml/ HTTP/1.1
      Host: ipbase.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 404 Not Found
      Date: Wed, 25 Dec 2024 15:47:09 GMT
      Content-Type: text/html; charset=utf-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Age: 8953
      Cache-Control: public,max-age=0,must-revalidate
      Cache-Status: "Netlify Edge"; hit
      Vary: Accept-Encoding
      X-Nf-Request-Id: 01JFZ807G9ZED3Y25427257QFN
      cf-cache-status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=asLGqu14SM9wyG72a7UPznConcOjYwqwwD2OTsvDILR8KuUrhoofxTKaxndlNEWXoELbE6hE3%2Bw0enOWPC7Qs5pjqVrQAQAGeuBdE4%2BSQgNawvkN%2BZOmC7M93Qv6"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8f79f7cfd977ef01-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=28672&min_rtt=27975&rtt_var=6913&sent=6&recv=6&lost=0&retrans=0&sent_bytes=2981&recv_bytes=358&delivery_rate=123188&cwnd=248&unsent_bytes=0&cid=c4457e1e86618690&ts=111&x=0"
    • flag-us
      DNS
      97.73.21.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.73.21.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      28.118.140.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      28.118.140.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      71.209.67.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      71.209.67.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      4.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      4.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.163.245.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.163.245.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      107.12.20.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      107.12.20.2.in-addr.arpa
      IN PTR
      Response
      107.12.20.2.in-addr.arpa
      IN PTR
      a2-20-12-107deploystaticakamaitechnologiescom
    • flag-us
      DNS
      73.144.22.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.144.22.2.in-addr.arpa
      IN PTR
      Response
      73.144.22.2.in-addr.arpa
      IN PTR
      a2-22-144-73deploystaticakamaitechnologiescom
    • flag-us
      DNS
      81.144.22.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      81.144.22.2.in-addr.arpa
      IN PTR
      Response
      81.144.22.2.in-addr.arpa
      IN PTR
      a2-22-144-81deploystaticakamaitechnologiescom
    • flag-us
      DNS
      48.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      48.229.111.52.in-addr.arpa
      IN PTR
      Response
    • 104.21.73.97:443
      https://freegeoip.app/xml/
      tls, http
      Insidious.exe
      720 B
       4.3kB
       8
      7

      HTTP Request

      GET https://freegeoip.app/xml/

      HTTP Response

      301
    • 172.67.209.71:443
      https://ipbase.com/xml/
      tls, http
      Insidious.exe
      852 B
       8.1kB
       11
      14

      HTTP Request

      GET https://ipbase.com/xml/

      HTTP Response

      404
    • 8.8.8.8:53
      freegeoip.app
      dns
      Insidious.exe
      59 B
       91 B
       1
      1

      DNS Request

      freegeoip.app

      DNS Response

      104.21.73.97
      172.67.160.84

    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
       90 B
       1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      ipbase.com
      dns
      Insidious.exe
      56 B
       88 B
       1
      1

      DNS Request

      ipbase.com

      DNS Response

      172.67.209.71
      104.21.85.189

    • 8.8.8.8:53
      97.73.21.104.in-addr.arpa
      dns
      71 B
       133 B
       1
      1

      DNS Request

      97.73.21.104.in-addr.arpa

    • 8.8.8.8:53
      28.118.140.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      28.118.140.52.in-addr.arpa

    • 8.8.8.8:53
      71.209.67.172.in-addr.arpa
      dns
      72 B
       134 B
       1
      1

      DNS Request

      71.209.67.172.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      4.159.190.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      4.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
       159 B
       1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      56.163.245.4.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      56.163.245.4.in-addr.arpa

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      107.12.20.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      107.12.20.2.in-addr.arpa

    • 8.8.8.8:53
      73.144.22.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      73.144.22.2.in-addr.arpa

    • 8.8.8.8:53
      81.144.22.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      81.144.22.2.in-addr.arpa

    • 8.8.8.8:53
      48.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      48.229.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\44\Process.txt
      Filesize

      1KB

      MD5

      bd0b0d0467d325b7aacbaeeee52dd1dc

      SHA1

      76fcbffdb3fe4ca01d3dc8c818df3a0f4a9750b7

      SHA256

      2b63d6b0763d8b2a8a5535f389d0561340d3099dfeedbc313e0faead7456ab6e

      SHA512

      1b7f8d50e5a7b254d172a8537aeae811b0f3f46b745c2446d35a736e7bdc74a481bcdc23ee92ef197a6e5d8d6b56249e6a3ad8a4bab181257f79fd4e909cd5e3

      Download Submit

    • memory/3508-0-0x00007FFA0AAB3000-0x00007FFA0AAB5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3508-1-0x000002694BFA0000-0x000002694BFF2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/3508-33-0x00007FFA0AAB0000-0x00007FFA0B571000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3508-118-0x00007FFA0AAB0000-0x00007FFA0B571000-memory.dmp

      Filesize

      10.8MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.