Overview

overview

7

Static

static

1

dridex

windows10-2004-x64

7

Analysis

  • max time kernel
    135s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/04/2023, 11:09 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe

  • Size

    715KB

  • MD5

    b573942c396811112008b8b594be39e0

  • SHA1

    f862b5e3c4727cd9bf0606db85b38b9ffd27c13e

  • SHA256

    3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646

  • SHA512

    f1b445b4646bb2727296d33e5cfc2bf1e3a5d3436abade5a06793bc7ba0dfdfc582143fbb7959189fc03651d12e58f1622eecf5eca7abbed0bd370fee41ab857

  • SSDEEP

    12288:CwtKLXYdOWi1IqB+leXEZCcD8pellpco/zENOeQiV1u:X+CW+lFrApeCoAYeXV

Score
7/10
spywarestealer

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
    "C:\Users\Admin\AppData\Local\Temp\3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe"
    1⤵
      PID:3700

    Network

    • flag-us
      DNS
      bz.bbbeioaag.com
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      Remote address:
      8.8.8.8:53
      Request
      bz.bbbeioaag.com
      IN A
      Response
      bz.bbbeioaag.com
      IN A
      103.100.211.218
    • flag-hk
      GET
      http://bz.bbbeioaag.com/sts/cimage.jpg
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      Remote address:
      103.100.211.218:80
      Request
      GET /sts/cimage.jpg HTTP/1.1
      User-Agent: HTTPREAD
      Host: bz.bbbeioaag.com
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx/1.18.0 (Ubuntu)
      Date: Mon, 24 Apr 2023 11:09:40 GMT
      Content-Type: image/jpeg
      Content-Length: 1495756
      Last-Modified: Sun, 23 Apr 2023 15:29:53 GMT
      Connection: keep-alive
      ETag: "64454ef1-16d2cc"
      Accept-Ranges: bytes
    • flag-us
      DNS
      196.249.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      196.249.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      218.211.100.103.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      218.211.100.103.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      72.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      72.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      adsmanager.facebook.com
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      Remote address:
      8.8.8.8:53
      Request
      adsmanager.facebook.com
      IN A
      Response
      adsmanager.facebook.com
      IN CNAME
      star.facebook.com
      star.facebook.com
      IN CNAME
      star.c10r.facebook.com
      star.c10r.facebook.com
      IN A
      157.240.196.17
    • flag-fr
      GET
      https://adsmanager.facebook.com/ads/manager/account_settings/account_billing/
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      Remote address:
      157.240.196.17:443
      Request
      GET /ads/manager/account_settings/account_billing/ HTTP/1.1
      Connection: Keep-Alive
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
      Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
      Host: adsmanager.facebook.com
      User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.62
      sec-ch-ua: "Microsoft Edge";v="111", "Not(A:Brand";v="8", "Chromium";v="111"
      sec-ch-ua-mobile: ?0
      sec-ch-ua-platform: "Windows"
      sec-ch-prefers-color-scheme: light
      Upgrade-Insecure-Requests: 1
      Sec-Fetch-Site: none
      Sec-Fetch-Mode: navigate
      Sec-Fetch-User: ?1
      Sec-Fetch-Dest: document
      Response
      HTTP/1.1 302 Found
      Vary: Accept-Encoding
      Set-Cookie: sb=fWNGZKAW0VefLy7y7lxJ9eNL; expires=Wed, 23-Apr-2025 11:09:49 GMT; Max-Age=63072000; path=/; domain=.facebook.com; secure; httponly; SameSite=None
      Location: https://www.facebook.com/login.php?next=https%3A%2F%2Fadsmanager.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing%2F
      content-security-policy-report-only: default-src data: blob: 'self' *.fbcdn.net *.facebook.com;script-src blob: data: 'self' 'unsafe-inline' 'unsafe-eval' *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com;style-src data: blob: 'self' 'unsafe-inline' 'unsafe-eval' *.facebook.com *.fbcdn.net;connect-src adsmanager.facebook.com adsmanager-graph.facebook.com adsmanager.secure.facebook.com blob: 'self' *.fbcdn.net rupload.facebook.com wss://gateway.facebook.com wss://edge-chat.facebook.com wss://edge-chat-latest.facebook.com https://edge-chat.facebook.com/mqtt/pull https://edge-chat-latest.facebook.com/mqtt/pull *.facebook.com/rsrc.php/;font-src 'self' *.facebook.com *.fbcdn.net fonts.gstatic.com;img-src data: blob: 'self' *.facebook.com *.fbcdn.net *.fbsbx.com *.cdninstagram.com;media-src 'self' *.facebook.com *.fbcdn.net *.fbsbx.com *.cdninstagram.com;frame-src * ms-excel:;manifest-src data: blob: 'self';report-uri https://www.facebook.com/csp/reporting/?minimize=0;
      content-security-policy: default-src data: blob: 'self' *.fbcdn.net *.facebook.com;script-src blob: data: 'self' 'unsafe-inline' 'unsafe-eval' *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com;style-src data: blob: 'self' 'unsafe-inline' 'unsafe-eval' *.facebook.com *.fbcdn.net;connect-src adsmanager.facebook.com adsmanager-graph.facebook.com adsmanager.secure.facebook.com blob: 'self' 'unsafe-inline' 'unsafe-eval' *.fbcdn.net rupload.facebook.com wss://gateway.facebook.com wss://edge-chat.facebook.com wss://edge-chat-latest.facebook.com https://edge-chat.facebook.com/mqtt/pull https://edge-chat-latest.facebook.com/mqtt/pull *.facebook.com/rsrc.php/ *.facebook.com;font-src 'self' *.facebook.com *.fbcdn.net fonts.gstatic.com;img-src data: blob: 'self' *.facebook.com *.fbcdn.net *.fbsbx.com *.cdninstagram.com;media-src 'self' *.facebook.com *.fbcdn.net *.fbsbx.com *.cdninstagram.com;frame-src * ms-excel:;manifest-src data: blob: 'self';block-all-mixed-content;upgrade-insecure-requests;
      x-fb-rlafr: 0
      document-policy: force-load-at-top
      cross-origin-resource-policy: same-origin
      cross-origin-opener-policy: same-origin-allow-popups
      Pragma: no-cache
      Cache-Control: private, no-cache, no-store, must-revalidate
      Expires: Sat, 01 Jan 2000 00:00:00 GMT
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 0
      X-Frame-Options: DENY
      origin-agent-cluster: ?0
      Strict-Transport-Security: max-age=15552000; preload
      Content-Type: text/html; charset="utf-8"
      X-FB-Debug: 8PvXxrhIRYmzg50u/V9c24ySGuIsKnEDE+yImaa4pc8TNncRHS19ck0snKFjI9w2rKy6EMrYjHgLvIq3P2rxEg==
      Date: Mon, 24 Apr 2023 11:09:49 GMT
      Connection: keep-alive
      Content-Length: 0
    • flag-fr
      GET
      https://adsmanager.facebook.com/ads/manager/account_settings/account_billing/
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      Remote address:
      157.240.196.17:443
      Request
      GET /ads/manager/account_settings/account_billing/ HTTP/1.1
      Connection: Keep-Alive
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
      Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
      Host: adsmanager.facebook.com
      User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.62
      sec-ch-ua: "Microsoft Edge";v="111", "Not(A:Brand";v="8", "Chromium";v="111"
      sec-ch-ua-mobile: ?0
      sec-ch-ua-platform: "Windows"
      sec-ch-prefers-color-scheme: light
      Upgrade-Insecure-Requests: 1
      Sec-Fetch-Site: none
      Sec-Fetch-Mode: navigate
      Sec-Fetch-User: ?1
      Sec-Fetch-Dest: document
      Response
      HTTP/1.1 302 Found
      Vary: Accept-Encoding
      Set-Cookie: sb=hWNGZLO92bmH1bdvFJ8XUXUx; expires=Wed, 23-Apr-2025 11:09:57 GMT; Max-Age=63072000; path=/; domain=.facebook.com; secure; httponly; SameSite=None
      Location: https://www.facebook.com/login.php?next=https%3A%2F%2Fadsmanager.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing%2F
      x-fb-rlafr: 0
      document-policy: force-load-at-top
      cross-origin-resource-policy: same-origin
      cross-origin-opener-policy: same-origin-allow-popups
      Pragma: no-cache
      Cache-Control: private, no-cache, no-store, must-revalidate
      Expires: Sat, 01 Jan 2000 00:00:00 GMT
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 0
      X-Frame-Options: DENY
      origin-agent-cluster: ?0
      Strict-Transport-Security: max-age=15552000; preload
      Content-Type: text/html; charset="utf-8"
      X-FB-Debug: uL/QoW0Ii8Mmy9FSrpUZxgOH6XfcVxQUxkfiK1j6fpD1yQWnKcA0Z80ryhC6ccIlvpvUb6mVLrqSFM/uFvBqgA==
      Date: Mon, 24 Apr 2023 11:09:57 GMT
      Connection: keep-alive
      Content-Length: 0
    • flag-us
      DNS
      www.facebook.com
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      Remote address:
      8.8.8.8:53
      Request
      www.facebook.com
      IN A
      Response
      www.facebook.com
      IN CNAME
      star-mini.c10r.facebook.com
      star-mini.c10r.facebook.com
      IN A
      157.240.201.35
    • flag-nl
      GET
      https://www.facebook.com/login.php?next=https%3A%2F%2Fadsmanager.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing%2F
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      Remote address:
      157.240.201.35:443
      Request
      GET /login.php?next=https%3A%2F%2Fadsmanager.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing%2F HTTP/1.1
      Connection: Keep-Alive
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
      Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
      User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.62
      sec-ch-ua: "Microsoft Edge";v="111", "Not(A:Brand";v="8", "Chromium";v="111"
      sec-ch-ua-mobile: ?0
      sec-ch-ua-platform: "Windows"
      sec-ch-prefers-color-scheme: light
      Upgrade-Insecure-Requests: 1
      Sec-Fetch-Site: none
      Sec-Fetch-Mode: navigate
      Sec-Fetch-User: ?1
      Sec-Fetch-Dest: document
      Host: www.facebook.com
      Cookie: sb=fWNGZKAW0VefLy7y7lxJ9eNL
      Response
      HTTP/1.1 200 OK
      Vary: Accept-Encoding
      Set-Cookie: fr=0SGeDYaZXgKlAVxgG..BkRmN9.1i.AAA.0.0.BkRmN9.AWVyTnLdg6M; expires=Sun, 23-Jul-2023 11:09:48 GMT; Max-Age=7775999; path=/; domain=.facebook.com; secure; httponly; SameSite=None
      report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}],"group":"network-errors"}
      cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
      content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
      nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
      x-fb-rlafr: 0
      document-policy: force-load-at-top
      cross-origin-opener-policy: same-origin-allow-popups
      Pragma: no-cache
      Cache-Control: private, no-cache, no-store, must-revalidate
      Expires: Sat, 01 Jan 2000 00:00:00 GMT
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 0
      X-Frame-Options: DENY
      origin-agent-cluster: ?0
      Strict-Transport-Security: max-age=15552000; preload
      Content-Type: text/html; charset="utf-8"
      X-FB-Debug: sDKjauN+n9c5LEw7nG/piR0C/oTz7GYYFXpAT40Ns6UWyvfpbu1vRWGKWg0etnMfQXG/BsyVKtVZPlvBsGmPdw==
      Date: Mon, 24 Apr 2023 11:09:49 GMT
      Transfer-Encoding: chunked
      Alt-Svc: h3=":443"; ma=86400
      Connection: keep-alive
    • flag-nl
      GET
      https://www.facebook.com/login.php?next=https%3A%2F%2Fadsmanager.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing%2F
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      Remote address:
      157.240.201.35:443
      Request
      GET /login.php?next=https%3A%2F%2Fadsmanager.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing%2F HTTP/1.1
      Connection: Keep-Alive
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
      Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
      User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.62
      sec-ch-ua: "Microsoft Edge";v="111", "Not(A:Brand";v="8", "Chromium";v="111"
      sec-ch-ua-mobile: ?0
      sec-ch-ua-platform: "Windows"
      sec-ch-prefers-color-scheme: light
      Upgrade-Insecure-Requests: 1
      Sec-Fetch-Site: none
      Sec-Fetch-Mode: navigate
      Sec-Fetch-User: ?1
      Sec-Fetch-Dest: document
      Host: www.facebook.com
      Cookie: sb=hWNGZLO92bmH1bdvFJ8XUXUx
      Response
      HTTP/1.1 200 OK
      Vary: Accept-Encoding
      Set-Cookie: fr=0FdX7cIsr0uIKsEU9..BkRmOF.Xf.AAA.0.0.BkRmOF.AWWILtHt6ds; expires=Sun, 23-Jul-2023 11:09:56 GMT; Max-Age=7775999; path=/; domain=.facebook.com; secure; httponly; SameSite=None
      report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}],"group":"network-errors"}
      cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
      content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
      nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
      x-fb-rlafr: 0
      document-policy: force-load-at-top
      cross-origin-opener-policy: same-origin-allow-popups
      Pragma: no-cache
      Cache-Control: private, no-cache, no-store, must-revalidate
      Expires: Sat, 01 Jan 2000 00:00:00 GMT
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 0
      X-Frame-Options: DENY
      origin-agent-cluster: ?0
      Strict-Transport-Security: max-age=15552000; preload
      Content-Type: text/html; charset="utf-8"
      X-FB-Debug: oBpXrtw/0mx261t2l7vm3FogUqlEnzO6nJHh9XyvlplkhrKyGewye4dRIq711hTXPGOHugQHTL1XdDw3D9EcQA==
      Date: Mon, 24 Apr 2023 11:09:57 GMT
      Transfer-Encoding: chunked
      Alt-Svc: h3=":443"; ma=86400
      Connection: keep-alive
    • flag-us
      DNS
      count.iiagjaggg.com
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      Remote address:
      8.8.8.8:53
      Request
      count.iiagjaggg.com
      IN A
      Response
      count.iiagjaggg.com
      IN A
      154.221.31.191
    • flag-hk
      GET
      http://count.iiagjaggg.com/check/safe
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      Remote address:
      154.221.31.191:80
      Request
      GET /check/safe HTTP/1.1
      Connection: Keep-Alive
      User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.62
      Host: count.iiagjaggg.com
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Mon, 24 Apr 2023 11:09:50 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      X-Powered-By: PHP/7.4.30
    • flag-hk
      POST
      http://count.iiagjaggg.com/check/?sid=493828&key=daf4169ca1ee6cfb8ccc96b357d1c9cd
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      Remote address:
      154.221.31.191:80
      Request
      POST /check/?sid=493828&key=daf4169ca1ee6cfb8ccc96b357d1c9cd HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.62
      Content-Length: 256
      Host: count.iiagjaggg.com
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Mon, 24 Apr 2023 11:09:50 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      X-Powered-By: PHP/7.4.30
    • flag-hk
      GET
      http://count.iiagjaggg.com/check/safe
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      Remote address:
      154.221.31.191:80
      Request
      GET /check/safe HTTP/1.1
      Connection: Keep-Alive
      User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.62
      Host: count.iiagjaggg.com
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Mon, 24 Apr 2023 11:09:57 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      X-Powered-By: PHP/7.4.30
    • flag-hk
      POST
      http://count.iiagjaggg.com/check/?sid=493904&key=c79ee38727ef35ebfe61b3fee5e52b68
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      Remote address:
      154.221.31.191:80
      Request
      POST /check/?sid=493904&key=c79ee38727ef35ebfe61b3fee5e52b68 HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.62
      Content-Length: 256
      Host: count.iiagjaggg.com
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Mon, 24 Apr 2023 11:09:57 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      X-Powered-By: PHP/7.4.30
    • flag-us
      DNS
      17.196.240.157.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      17.196.240.157.in-addr.arpa
      IN PTR
      Response
      17.196.240.157.in-addr.arpa
      IN PTR
      edge-star-shv-02-mrs2facebookcom
    • flag-us
      DNS
      35.201.240.157.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      35.201.240.157.in-addr.arpa
      IN PTR
      Response
      35.201.240.157.in-addr.arpa
      IN PTR
      edge-star-mini-shv-01-ams4facebookcom
    • flag-us
      DNS
      191.31.221.154.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      191.31.221.154.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      104.219.191.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      104.219.191.52.in-addr.arpa
      IN PTR
      Response
    • 103.100.211.218:80
      http://bz.bbbeioaag.com/sts/cimage.jpg
      http
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      51.5kB
       1.5MB
       1116
      1115

      HTTP Request

      GET http://bz.bbbeioaag.com/sts/cimage.jpg

      HTTP Response

      200
    • 157.240.196.17:443
      https://adsmanager.facebook.com/ads/manager/account_settings/account_billing/
      tls, http
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      2.7kB
       8.0kB
       14
      14

      HTTP Request

      GET https://adsmanager.facebook.com/ads/manager/account_settings/account_billing/

      HTTP Response

      302

      HTTP Request

      GET https://adsmanager.facebook.com/ads/manager/account_settings/account_billing/

      HTTP Response

      302
    • 157.240.201.35:443
      https://www.facebook.com/login.php?next=https%3A%2F%2Fadsmanager.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing%2F
      tls, http
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      5.2kB
       149.8kB
       65
      118

      HTTP Request

      GET https://www.facebook.com/login.php?next=https%3A%2F%2Fadsmanager.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing%2F

      HTTP Response

      200

      HTTP Request

      GET https://www.facebook.com/login.php?next=https%3A%2F%2Fadsmanager.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing%2F

      HTTP Response

      200
    • 154.221.31.191:80
      http://count.iiagjaggg.com/check/?sid=493904&key=c79ee38727ef35ebfe61b3fee5e52b68
      http
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      2.5kB
       1.9kB
       18
      18

      HTTP Request

      GET http://count.iiagjaggg.com/check/safe

      HTTP Response

      200

      HTTP Request

      POST http://count.iiagjaggg.com/check/?sid=493828&key=daf4169ca1ee6cfb8ccc96b357d1c9cd

      HTTP Response

      200

      HTTP Request

      GET http://count.iiagjaggg.com/check/safe

      HTTP Response

      200

      HTTP Request

      POST http://count.iiagjaggg.com/check/?sid=493904&key=c79ee38727ef35ebfe61b3fee5e52b68

      HTTP Response

      200
    • 52.152.110.14:443
      260 B
       5
    • 20.189.173.13:443
      322 B
       7
    • 8.247.211.254:80
      322 B
       7
    • 8.247.211.254:80
      322 B
       7
    • 8.247.211.254:80
      322 B
       7
    • 173.223.113.164:443
      322 B
       7
    • 173.223.113.131:80
      322 B
       7
    • 131.253.33.203:80
      322 B
       7
    • 52.152.110.14:443
      260 B
       5
    • 8.247.211.254:80
      322 B
       7
    • 52.152.110.14:443
      260 B
       5
    • 52.152.110.14:443
      260 B
       5
    • 52.152.110.14:443
      260 B
       5
    • 52.152.110.14:443
      208 B
       4
    • 8.8.8.8:53
      bz.bbbeioaag.com
      dns
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      62 B
       78 B
       1
      1

      DNS Request

      bz.bbbeioaag.com

      DNS Response

      103.100.211.218

    • 8.8.8.8:53
      196.249.167.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      196.249.167.52.in-addr.arpa

    • 8.8.8.8:53
      218.211.100.103.in-addr.arpa
      dns
      74 B
       162 B
       1
      1

      DNS Request

      218.211.100.103.in-addr.arpa

    • 8.8.8.8:53
      72.32.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      72.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      adsmanager.facebook.com
      dns
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      69 B
       128 B
       1
      1

      DNS Request

      adsmanager.facebook.com

      DNS Response

      157.240.196.17

    • 8.8.8.8:53
      www.facebook.com
      dns
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      62 B
       107 B
       1
      1

      DNS Request

      www.facebook.com

      DNS Response

      157.240.201.35

    • 8.8.8.8:53
      count.iiagjaggg.com
      dns
      3e8d6af0fce9981e4d6902fdb27de548ecefb46ed7d4546e69a2dbfea1779646.exe
      65 B
       81 B
       1
      1

      DNS Request

      count.iiagjaggg.com

      DNS Response

      154.221.31.191

    • 8.8.8.8:53
      17.196.240.157.in-addr.arpa
      dns
      73 B
       121 B
       1
      1

      DNS Request

      17.196.240.157.in-addr.arpa

    • 8.8.8.8:53
      35.201.240.157.in-addr.arpa
      dns
      73 B
       126 B
       1
      1

      DNS Request

      35.201.240.157.in-addr.arpa

    • 8.8.8.8:53
      191.31.221.154.in-addr.arpa
      dns
      73 B
       134 B
       1
      1

      DNS Request

      191.31.221.154.in-addr.arpa

    • 8.8.8.8:53
      104.219.191.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      104.219.191.52.in-addr.arpa

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3700-135-0x0000000005560000-0x00000000056CE000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/3700-136-0x00000000056D0000-0x00000000057FF000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/3700-137-0x00000000056D0000-0x00000000057FF000-memory.dmp

      Filesize

      1.2MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.