invitaton[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
invitaton.exe
Size 23.3MB
Sample260729-hapc7san7v
SHA256 761c11701d6668c52b5e55020a475fde8cd428a5bcb70aeb4c7d10c58249cb09
MD5 04eb31cc639d6539bf55e13ed3bdd05f
SHA1 6bb022c49082ea6c07657ad5f6689be0f7b22640
SHA512 828cd888afa107c2b542c5779563af043d9126166a906a1d2a758a68f7d59b9d410705af58d3e102548e996f68a3235cb13d2fffd7d2c0531be1f7aff6e6e81f
SSDEEP 393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpq:q9WtLzgOTbjZvk/ekS/mcpq
TLSH
T14A37333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor rat

Malware Config

Signatures

GoToResolve remote administration tool 1 IoCs

GoToResolve is a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
sample	rat_gotoresolve

File Explorer

invitaton.exe

.exe 23.3MB

invitaton.exe

IMPHASH f8e4a22bcb1b836585534b93f63c1414
SHA256 761c11701d6668c52b5e55020a475fde8cd428a5bcb70aeb4c7d10c58249cb09
MD5 04eb31cc639d6539bf55e13ed3bdd05f
SHA1 6bb022c49082ea6c07657ad5f6689be0f7b22640
SHA512 828cd888afa107c2b542c5779563af043d9126166a906a1d2a758a68f7d59b9d410705af58d3e102548e996f68a3235cb13d2fffd7d2c0531be1f7aff6e6e81f
SSDEEP 393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpq:q9WtLzgOTbjZvk/ekS/mcpq
TLSH
T14A37333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

GoToResolve remote administration tool

GoToResolve is a remote administration tool that can be used as a backdoor

backdoor rat

Digest

4c:b4:ee:86:2a:b2:a0:53:d9:f0:fa:82:c7:86:c4:d0:89:e1:69:ba

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=5984112,CN=GoTo Technologies USA\, LLC,O=GoTo Technologies USA\, LLC,L=Boston,ST=Massachusetts,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 10, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

0f:2e:eb:fc:2c:fe:89:8b:6a:fd:8c:b1:6a:81:97:c8:46:81:73:dd:93:ea:3e:df:db:78:c2:3e:eb:f4:be:d3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

Chains

Oct 10, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:0c:87:67:bb:2d:4f:ef:c2:d6:17:df:11:ce:1b:89

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 13, 2024 - May 12, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

903728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\a\rescue-native-rescueassist\rescue-native-rescueassist\build\RelWithDebInfo\GoToResolveUnattendedUpdater.pdb

ole32

StgOpenStorage

rstrtmgr

RmGetList RmEndSession RmStartSession RmRegisterResources

ntdll

RtlNtStatusToDosError NtQuerySystemInformation RtlUnwind VerSetConditionMask

shlwapi

PathIsDirectoryW PathIsDirectoryEmptyW

kernel32

FormatMessageA CreateFileW UnmapViewOfFile GetFileSize CreateFileMappingW MapViewOfFile LocalAlloc GetModuleHandleW SetUnhandledExceptionFilter SetLastError lstrlenW WriteFile GetVersionExW FindNextFileW GetCurrentProcess RemoveDirectoryW FindClose Sleep DeleteFileW LoadLibraryW GetProcAddress MoveFileExW FreeLibrary GetCurrentProcessId ReadFile CompareFileTime SetHandleInformation HeapFree TerminateProcess K32GetModuleFileNameExW InitializeCriticalSectionEx WaitForSingleObject GetCurrentThreadId OpenProcess SetFileInformationByHandle HeapAlloc GetCurrentDirectoryW DecodePointer DeleteCriticalSection GetProcessHeap QueryFullProcessImageNameW IsWow64Process GetProcessTimes LoadLibraryExW GetExitCodeProcess GetFileSizeEx LCMapStringA GetStringTypeExA GetUserDefaultLCID LoadLibraryA WaitForMultipleObjects GetThreadLocale LCIDToLocaleName GetStdHandle ProcessIdToSessionId FlushFileBuffers GetFileAttributesW GetDynamicTimeZoneInformation MultiByteToWideChar GetConsoleMode lstrcpyW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetFileType RaiseException AddVectoredExceptionHandler SetEvent SleepEx CreateEventW CreateThread ExitThread GetVersion LockFileEx SetEndOfFile UnlockFileEx RemoveVectoredExceptionHandler InitializeCriticalSection SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW SetFilePointerEx FindFirstFileExW GetFileTime GetSystemTimeAsFileTime OutputDebugStringW GetLocalTime EnterCriticalSection LeaveCriticalSection CreateProcessW WriteConsoleW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileAttributesW DeviceIoControl CreateDirectoryExW CopyFileExW AreFileApisANSI QueryPerformanceFrequency TlsAlloc GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter ResetEvent GetCPInfo CompareStringEx EncodePointer QueryPerformanceCounter GetLocaleInfoEx VerifyVersionInfoW WriteConsoleA WideCharToMultiByte InitOnceBeginInitialize InitOnceComplete LCMapStringEx FreeLibraryAndExitThread GetModuleHandleExW SetConsoleCtrlHandler SetStdHandle GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetConsoleOutputCP HeapReAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation HeapSize IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CreateEventA OpenEventA GetStringTypeW WaitForSingleObjectEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable LocalFree SetCurrentDirectoryW FindResourceW LoadResource CloseHandle LockResource lstrcatW GetLastError FormatMessageW GetModuleFileNameW GetCommandLineW SizeofResource CreateDirectoryW TlsGetValue TlsSetValue TlsFree InitializeCriticalSectionAndSpinCount GetCommandLineA WakeAllConditionVariable GetExitCodeThread SleepConditionVariableSRW

user32

FindWindowW LoadStringA wsprintfW GetWindowThreadProcessId ShowWindow AttachThreadInput BringWindowToTop

shell32

ShellExecuteExW CommandLineToArgvW ShellExecuteW

oleaut32

VariantClear

advapi32

RegSetValueExA RegCreateKeyExA RegCloseKey SystemFunction036 ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegDeleteTreeA SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW ConvertStringSidToSidW RegDeleteKeyExA QueryServiceStatus CloseServiceHandle OpenSCManagerW RegDeleteKeyW ChangeServiceConfig2W RegCreateKeyExW DeleteService ControlService StartServiceW QueryServiceConfigW QueryServiceConfig2W OpenServiceW EnumServicesStatusW RegQueryInfoKeyW RegEnumValueW RegQueryValueExW RegQueryValueExA RegOpenKeyExA RegSetValueExW

ws2_32

WSACleanup WSAStartup gethostname WSAGetLastError

crypt32

CryptProtectData CertOpenStore CertGetNameStringW CertFindCertificateInStore CertCloseStore CertFreeCertificateContext CertDeleteCertificateFromStore

comctl32

ord345

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

270KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21.9MB

Virtual Size

21.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

invitaton.exe

ole32

rstrtmgr

ntdll

shlwapi

kernel32

user32

shell32

oleaut32

advapi32

ws2_32

crypt32

comctl32

generic