Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2023, 04:36 UTC

General

  • Target

    a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4.exe

  • Size

    7.3MB

  • MD5

    f80dadc61dd4a914ce96139252df0aba

  • SHA1

    ad8785e358f14f80083ca386b9505fbfa066c4b4

  • SHA256

    a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4

  • SHA512

    084a10db94dedf772f6ac6b964f13c0279b7fddcaadd69187ca50d994a7a83b143d02d3b5d0cd9c9102b34b5ef7f48a5db355cd97eddfb6e28ae22e3433f963e

  • SSDEEP

    196608:H+23b3ntL9L2M8VKXGqIeP3ljBBFNzi3RPKLxhnZKW:H1Xd9L2M8VcIe1jARPKLxhnQW

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 6 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Themida packer 10 IoCs

    Detects Themida, an advanced Windows software protection system.

  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4.exe
    "C:\Users\Admin\AppData\Local\Temp\a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Users\Admin\Documents\BinGo\mgiibjcj.exe
      "C:\Users\Admin\Documents\BinGo\mgiibjcj.exe" rest
      2⤵
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Users\Admin\Documents\BinGo\runes\7z.exe
        C:\Users\Admin\Documents\BinGo\runes\7z.exe x "C:\Users\Admin\Documents\BinGo\runes\\13.16.1-v1692500306000.tgz" -y -p -o"C:\Users\Admin\Documents\BinGo\runes\"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2696
      • C:\Users\Admin\Documents\BinGo\runes\7z.exe
        C:\Users\Admin\Documents\BinGo\runes\7z.exe x "C:\Users\Admin\Documents\BinGo\runes\\13.16.1-v1692500306000.tar" -y -p -o"C:\Users\Admin\Documents\BinGo\runes\"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2040
      • C:\Users\Admin\Documents\BinGo\runes\7z.exe
        C:\Users\Admin\Documents\BinGo\runes\7z.exe x "C:\Users\Admin\Documents\BinGo\runes\\13.16.1-v1692500306000.tar" -y -p -o"C:\Users\Admin\Documents\BinGo\runes\"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2972
      • C:\Users\Admin\Documents\BinGo\runes\7z.exe
        C:\Users\Admin\Documents\BinGo\runes\7z.exe x "C:\Users\Admin\Documents\BinGo\runes\\13.16.1-v1692500306000.tgz" -y -p -o"C:\Users\Admin\Documents\BinGo\runes\"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2648

Network

  • flag-us
    DNS
    registry.npmmirror.com
    mgiibjcj.exe
    Remote address:
    8.8.8.8:53
    Request
    registry.npmmirror.com
    IN A
    Response
    registry.npmmirror.com
    IN CNAME
    registry.npmmirror.com.w.cdngslb.com
    registry.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.226
    registry.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.227
    registry.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.224
    registry.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.230
    registry.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.231
    registry.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.229
    registry.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.225
    registry.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.228
  • flag-us
    DNS
    ia.51.la
    mgiibjcj.exe
    Remote address:
    8.8.8.8:53
    Request
    ia.51.la
    IN A
    Response
    ia.51.la
    IN A
    42.236.73.39
    ia.51.la
    IN A
    42.236.73.38
  • flag-us
    DNS
    note.youdao.com
    mgiibjcj.exe
    Remote address:
    8.8.8.8:53
    Request
    note.youdao.com
    IN A
    Response
    note.youdao.com
    IN CNAME
    note.ntes53.netease.com
    note.ntes53.netease.com
    IN CNAME
    note.youdao.com.163jiasu.com
    note.youdao.com.163jiasu.com
    IN CNAME
    note.youdao.com.w.kunluncan.com
    note.youdao.com.w.kunluncan.com
    IN A
    47.246.48.231
    note.youdao.com.w.kunluncan.com
    IN A
    47.246.48.225
    note.youdao.com.w.kunluncan.com
    IN A
    47.246.48.229
    note.youdao.com.w.kunluncan.com
    IN A
    47.246.48.226
    note.youdao.com.w.kunluncan.com
    IN A
    47.246.48.227
    note.youdao.com.w.kunluncan.com
    IN A
    47.246.48.230
    note.youdao.com.w.kunluncan.com
    IN A
    47.246.48.228
    note.youdao.com.w.kunluncan.com
    IN A
    47.246.48.224
  • flag-us
    DNS
    cdn.npmmirror.com
    mgiibjcj.exe
    Remote address:
    8.8.8.8:53
    Request
    cdn.npmmirror.com
    IN A
    Response
    cdn.npmmirror.com
    IN CNAME
    cdn.npmmirror.com.w.cdngslb.com
    cdn.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.229
    cdn.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.225
    cdn.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.227
    cdn.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.231
    cdn.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.228
    cdn.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.226
    cdn.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.230
    cdn.npmmirror.com.w.cdngslb.com
    IN A
    47.246.48.224
  • flag-us
    DNS
    web.51.la
    mgiibjcj.exe
    Remote address:
    8.8.8.8:53
    Request
    web.51.la
    IN A
    Response
    web.51.la
    IN A
    42.236.73.54
  • flag-cn
    GET
    https://web.51.la/report/main?comId=21738151
    mgiibjcj.exe
    Remote address:
    42.236.73.54:443
    Request
    GET /report/main?comId=21738151 HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Accept: text/html, application/xhtml+xml, */*
    Accept-Encoding: identity
    Accept-Language: zh-cn
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
    Host: web.51.la
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 20 Aug 2023 04:36:56 GMT
    Content-Type: text/html; charset=utf-8
    Content-Length: 35980
    Connection: keep-alive
    set-cookie: csrfToken=FqroEJlZ6SEcsQAt_r_lsp3u; path=/
    set-cookie: 51la_ss_web=a386e8e0-ac70-4649-a13a-b59634bf9789; path=/; max-age=86400; expires=Mon, 21 Aug 2023 04:36:56 GMT; domain=.51.la; httponly
    set-cookie: 51la_ss_web.sig=9ipeeJddvOGB5-hAhRb6jGnSDBj00IW5Af5z2bj5sCo; path=/; max-age=86400; expires=Mon, 21 Aug 2023 04:36:56 GMT; domain=.51.la; httponly
    x-frame-options: SAMEORIGIN
    x-xss-protection: 1; mode=block
    x-content-type-options: nosniff
    x-download-options: noopen
    x-readtime: 18
  • flag-us
    DNS
    game.gtimg.cn
    mgiibjcj.exe
    Remote address:
    8.8.8.8:53
    Request
    game.gtimg.cn
    IN A
    Response
    game.gtimg.cn
    IN CNAME
    game.gtimg.cn.cloud.tc.qq.com
    game.gtimg.cn.cloud.tc.qq.com
    IN CNAME
    game.gtimg.cn.sched.legopic2.tdnsv6.com
    game.gtimg.cn.sched.legopic2.tdnsv6.com
    IN A
    203.205.136.82
    game.gtimg.cn.sched.legopic2.tdnsv6.com
    IN A
    203.205.136.80
  • 42.236.73.39:443
    ia.51.la
    tls
    mgiibjcj.exe
    1.3kB
    5.0kB
    9
    10
  • 47.246.48.226:443
    registry.npmmirror.com
    tls
    mgiibjcj.exe
    1.3kB
    6.7kB
    10
    14
  • 47.246.48.226:443
    registry.npmmirror.com
    tls
    mgiibjcj.exe
    1.3kB
    6.7kB
    11
    13
  • 47.246.48.226:443
    registry.npmmirror.com
    tls
    mgiibjcj.exe
    1.4kB
    5.7kB
    12
    15
  • 47.246.48.231:443
    note.youdao.com
    tls
    mgiibjcj.exe
    1.4kB
    6.5kB
    10
    13
  • 47.246.48.229:443
    cdn.npmmirror.com
    tls
    mgiibjcj.exe
    2.4kB
    63.0kB
    32
    53
  • 42.236.73.54:443
    https://web.51.la/report/main?comId=21738151
    tls, http
    mgiibjcj.exe
    1.7kB
    42.6kB
    24
    35

    HTTP Request

    GET https://web.51.la/report/main?comId=21738151

    HTTP Response

    200
  • 47.246.48.226:443
    registry.npmmirror.com
    tls
    mgiibjcj.exe
    1.4kB
    5.7kB
    11
    13
  • 47.246.48.229:443
    cdn.npmmirror.com
    tls
    mgiibjcj.exe
    2.2kB
    49.0kB
    28
    43
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    3.1kB
    112.2kB
    50
    91
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    6.9kB
    14
    18
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    7.0kB
    14
    19
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    7.3kB
    13
    17
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    7.1kB
    14
    19
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    7.1kB
    13
    17
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    7.0kB
    14
    19
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    9.9kB
    14
    20
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    3.1kB
    110.5kB
    49
    90
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.3kB
    63.5kB
    32
    56
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.1kB
    14
    19
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.3kB
    58.9kB
    31
    53
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.2kB
    15
    21
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.3kB
    15
    21
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.9kB
    97.7kB
    45
    81
  • 127.0.0.1:49237
    mgiibjcj.exe
  • 127.0.0.1:49239
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:49247
    mgiibjcj.exe
  • 127.0.0.1:49252
    mgiibjcj.exe
  • 127.0.0.1:49254
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:49259
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:49620
    mgiibjcj.exe
  • 127.0.0.1:49623
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:49974
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:49979
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:49983
    mgiibjcj.exe
  • 127.0.0.1:49988
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:49992
    mgiibjcj.exe
  • 127.0.0.1:49997
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50002
    mgiibjcj.exe
  • 127.0.0.1:50006
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50011
    mgiibjcj.exe
  • 127.0.0.1:50017
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50022
    mgiibjcj.exe
  • 127.0.0.1:50026
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50032
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50036
    mgiibjcj.exe
  • 127.0.0.1:50040
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50046
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.4kB
    9.9kB
    13
    18
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.7kB
    15
    22
  • 127.0.0.1:50050
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50055
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.8kB
    21.5kB
    21
    29
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.4kB
    65.9kB
    33
    58
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.4kB
    14
    19
  • 127.0.0.1:50059
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50063
    mgiibjcj.exe
  • 127.0.0.1:50068
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.8kB
    91.5kB
    42
    76
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50073
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    12.4kB
    15
    21
  • 127.0.0.1:50077
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.3kB
    59.9kB
    32
    56
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50082
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.6kB
    10.6kB
    16
    23
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.6kB
    14.7kB
    16
    24
  • 127.0.0.1:50086
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50090
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    12.0kB
    14
    20
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.1kB
    14
    19
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.3kB
    14
    19
  • 127.0.0.1:50096
    mgiibjcj.exe
  • 127.0.0.1:50100
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50105
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.2kB
    15
    22
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    9.7kB
    15
    21
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    12.3kB
    15
    21
  • 127.0.0.1:50109
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50114
    mgiibjcj.exe
  • 127.0.0.1:50118
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.2kB
    57.3kB
    30
    52
  • 127.0.0.1:443
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.8kB
    14
    19
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    12.1kB
    14
    20
  • 127.0.0.1:50123
    mgiibjcj.exe
  • 127.0.0.1:50127
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50132
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.2kB
    52.9kB
    29
    49
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.5kB
    69.3kB
    35
    61
  • 127.0.0.1:50136
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50141
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.0kB
    15
    21
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.1kB
    15
    21
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.6kB
    12.6kB
    16
    23
  • 127.0.0.1:50145
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50150
    mgiibjcj.exe
  • 127.0.0.1:50155
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.3kB
    15
    21
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50160
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.4kB
    14
    19
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    10.9kB
    14
    19
  • 127.0.0.1:50164
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50169
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.6kB
    20.7kB
    17
    26
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.2kB
    14
    19
  • 127.0.0.1:50173
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.1kB
    14
    20
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50178
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.4kB
    14
    19
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.5kB
    14
    19
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.6kB
    15
    22
  • 127.0.0.1:50182
    mgiibjcj.exe
  • 127.0.0.1:50186
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50191
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.3kB
    14
    19
  • 127.0.0.1:50195
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.0kB
    15
    22
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.3kB
    14
    20
  • 127.0.0.1:50200
    mgiibjcj.exe
  • 127.0.0.1:50204
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.1kB
    14
    19
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.6kB
    82.0kB
    39
    70
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.6kB
    20.9kB
    17
    26
  • 127.0.0.1:50209
    mgiibjcj.exe
  • 127.0.0.1:50213
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50218
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.6kB
    80.9kB
    39
    69
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.3kB
    59.0kB
    31
    53
  • 127.0.0.1:50223
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50228
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.4kB
    9.4kB
    13
    18
  • 127.0.0.1:50232
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50237
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    12.0kB
    15
    21
  • 127.0.0.1:50241
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.5kB
    15
    21
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50246
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.6kB
    14
    19
  • 127.0.0.1:50250
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.7kB
    87.6kB
    41
    74
  • 127.0.0.1:443
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.5kB
    71.6kB
    35
    62
  • 127.0.0.1:50255
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.4kB
    10.4kB
    13
    18
  • 127.0.0.1:50259
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50264
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.4kB
    14
    19
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    12.1kB
    14
    20
  • 127.0.0.1:50268
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50273
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.2kB
    14
    19
  • 127.0.0.1:50277
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    10.8kB
    15
    21
  • 127.0.0.1:443
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.6kB
    82.0kB
    39
    70
  • 127.0.0.1:50283
    mgiibjcj.exe
  • 127.0.0.1:50287
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.6kB
    21.5kB
    17
    26
  • 127.0.0.1:443
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.4kB
    15
    21
  • 127.0.0.1:50292
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    10.9kB
    14
    19
  • 127.0.0.1:50296
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50300
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.5kB
    14
    19
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.5kB
    11.8kB
    14
    20
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    1.6kB
    10.7kB
    16
    24
  • 127.0.0.1:50305
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:50310
    mgiibjcj.exe
  • 127.0.0.1:50313
    mgiibjcj.exe
  • 203.205.136.82:443
    game.gtimg.cn
    tls
    mgiibjcj.exe
    2.4kB
    69.1kB
    34
    60
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 127.0.0.1:443
    mgiibjcj.exe
  • 8.8.8.8:53
    registry.npmmirror.com
    dns
    mgiibjcj.exe
    68 B
    243 B
    1
    1

    DNS Request

    registry.npmmirror.com

    DNS Response

    47.246.48.226
    47.246.48.227
    47.246.48.224
    47.246.48.230
    47.246.48.231
    47.246.48.229
    47.246.48.225
    47.246.48.228

  • 8.8.8.8:53
    ia.51.la
    dns
    mgiibjcj.exe
    54 B
    86 B
    1
    1

    DNS Request

    ia.51.la

    DNS Response

    42.236.73.39
    42.236.73.38

  • 8.8.8.8:53
    note.youdao.com
    dns
    mgiibjcj.exe
    61 B
    304 B
    1
    1

    DNS Request

    note.youdao.com

    DNS Response

    47.246.48.231
    47.246.48.225
    47.246.48.229
    47.246.48.226
    47.246.48.227
    47.246.48.230
    47.246.48.228
    47.246.48.224

  • 8.8.8.8:53
    cdn.npmmirror.com
    dns
    mgiibjcj.exe
    63 B
    233 B
    1
    1

    DNS Request

    cdn.npmmirror.com

    DNS Response

    47.246.48.229
    47.246.48.225
    47.246.48.227
    47.246.48.231
    47.246.48.228
    47.246.48.226
    47.246.48.230
    47.246.48.224

  • 8.8.8.8:53
    web.51.la
    dns
    mgiibjcj.exe
    55 B
    71 B
    1
    1

    DNS Request

    web.51.la

    DNS Response

    42.236.73.54

  • 8.8.8.8:53
    game.gtimg.cn
    dns
    mgiibjcj.exe
    59 B
    184 B
    1
    1

    DNS Request

    game.gtimg.cn

    DNS Response

    203.205.136.82
    203.205.136.80

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Desktop\BinGoÍâ·þ°æ13.16.2.lnk

    Filesize

    1KB

    MD5

    3c44682a2b88c7fb58cffcc3d2111ed7

    SHA1

    ef33304da3047c0110c304373058749c96921094

    SHA256

    6e2bbdfcb1e2c97cc1e56d310b0e018565ab898da57dd6ac5d40be507ca719c3

    SHA512

    1a66b7b66f0525c7fe5c11891152e26d3ffbc3465292831741d5a624e299208e9e540248ee522c2be39284fa520c70ffa55a9581969a44e59e83f0e629f81cb7

  • C:\Users\Admin\Documents\BinGo\runes\13.16.1-v1692500306000.tar

    Filesize

    673KB

    MD5

    c56b9e4c865fe1d28adec521600a0003

    SHA1

    21f71a5f95827a406223dce2a0226b03b7768d76

    SHA256

    23774bd5dcd902b57572da10fd1eef676ee578dbcc543e063def3daae415b592

    SHA512

    ce2fde4012f04d6146110957e6df761027728e3f066c0ee99f1a333ebe1960764116f48b89e3f8fcc9ed01117cb9947f23d69c73d4ff6e5b496ffc2cbfddfe85

  • C:\Users\Admin\Documents\BinGo\runes\13.16.1-v1692500306000.tar

    Filesize

    550KB

    MD5

    46d8b7d28fe3316385c6e16b2cbb5327

    SHA1

    0602d8a5abf32a12c3085570fb6ecab9cf4062bc

    SHA256

    5d8f9e336740488ad27b06c9eff4051cc2a5f62458b75b423a4383b7995d9412

    SHA512

    5f5f842470737a331231ec705cb0dbf1360448f36e6572d0e8177fa2cc9e894e3e2020c4399a57498ae82208f31a2ba4b58d2e394deffbf35f1e17ebe8d2a4ea

  • C:\Users\Admin\Documents\BinGo\runes\13.16.1-v1692500306000.tgz

    Filesize

    54KB

    MD5

    411423301601a7f63641a0879c25137d

    SHA1

    293cf0dc82bc67bc9d963773ba634737fbc64da8

    SHA256

    c3624b81d0889821978fe0e01544a2f56cae892187facda4b181735948cb383a

    SHA512

    d75477976b16d59737f66629bfcefc26e4fdf4a041be50bd6d8501ee89fb2255c84a47b559a8cfc78cd0b775ecc355a128a9a3fae792eb99ed233af75955bc36

  • C:\Users\Admin\Documents\BinGo\runes\13.16.1-v1692500306000.tgz

    Filesize

    41KB

    MD5

    49a1818298089983ddd60429a9973244

    SHA1

    fb607cb81f1c68dfd00629a5ec593ae1f8c690cc

    SHA256

    25cdd76451c2d0b1964a121fef788a32f9f375aea9c812bdf16a859ada616e47

    SHA512

    604614210e57755be1845537e95d36f1cc1fbbdc3041d52bd86e8c85422888221f2c63d4e8b0d82207cd2c297fafc03b8f2804ba201b166554a43733eeda14b0

  • C:\Users\Admin\Documents\BinGo\runes\7z.exe

    Filesize

    354KB

    MD5

    1f0f641a53fe1535da96c6830ce20688

    SHA1

    247fd5f4ea18f3dbada32784d89c58f9ecb287db

    SHA256

    2151c021ec07eb8d2c1c08c884038e6606d8254d47e436f77fdf8be008891744

    SHA512

    3734dff5c4af534afc634daf2df14207c6d6b0280ab7e731aaff7e9722aed226682c531934e85fa8bca35b5a8aa24640418ffcaa52124f7bbd26f01d168305f3

  • C:\Users\Admin\Documents\BinGo\runes\7z.exe

    Filesize

    354KB

    MD5

    1f0f641a53fe1535da96c6830ce20688

    SHA1

    247fd5f4ea18f3dbada32784d89c58f9ecb287db

    SHA256

    2151c021ec07eb8d2c1c08c884038e6606d8254d47e436f77fdf8be008891744

    SHA512

    3734dff5c4af534afc634daf2df14207c6d6b0280ab7e731aaff7e9722aed226682c531934e85fa8bca35b5a8aa24640418ffcaa52124f7bbd26f01d168305f3

  • C:\Users\Admin\Documents\BinGo\runes\7z.exe

    Filesize

    354KB

    MD5

    1f0f641a53fe1535da96c6830ce20688

    SHA1

    247fd5f4ea18f3dbada32784d89c58f9ecb287db

    SHA256

    2151c021ec07eb8d2c1c08c884038e6606d8254d47e436f77fdf8be008891744

    SHA512

    3734dff5c4af534afc634daf2df14207c6d6b0280ab7e731aaff7e9722aed226682c531934e85fa8bca35b5a8aa24640418ffcaa52124f7bbd26f01d168305f3

  • C:\Users\Admin\Documents\BinGo\runes\7z.exe

    Filesize

    354KB

    MD5

    1f0f641a53fe1535da96c6830ce20688

    SHA1

    247fd5f4ea18f3dbada32784d89c58f9ecb287db

    SHA256

    2151c021ec07eb8d2c1c08c884038e6606d8254d47e436f77fdf8be008891744

    SHA512

    3734dff5c4af534afc634daf2df14207c6d6b0280ab7e731aaff7e9722aed226682c531934e85fa8bca35b5a8aa24640418ffcaa52124f7bbd26f01d168305f3

  • C:\Users\Admin\Documents\BinGo\runes\7z.exe

    Filesize

    354KB

    MD5

    1f0f641a53fe1535da96c6830ce20688

    SHA1

    247fd5f4ea18f3dbada32784d89c58f9ecb287db

    SHA256

    2151c021ec07eb8d2c1c08c884038e6606d8254d47e436f77fdf8be008891744

    SHA512

    3734dff5c4af534afc634daf2df14207c6d6b0280ab7e731aaff7e9722aed226682c531934e85fa8bca35b5a8aa24640418ffcaa52124f7bbd26f01d168305f3

  • \Users\Admin\Documents\BinGo\libcurl.dll

    Filesize

    1.8MB

    MD5

    6fa08b52d88e7a4967764e099d33663b

    SHA1

    06d10ed3766bbaf56c7b6cb23821706dbadc025c

    SHA256

    e295b243ae3e45289b8bfaff537d99ca7039d08a48c4359294dacd753936a0c0

    SHA512

    14f21a29b1c69d82a4f00b9709549c996ab21a9f00e3bd553482110b93418a3c47fccee4cb2ad99f7213906c746a578c051e88b08f6cc3c2ac5ee8fe0a1b1bb0

  • \Users\Admin\Documents\BinGo\runes\7z.exe

    Filesize

    354KB

    MD5

    1f0f641a53fe1535da96c6830ce20688

    SHA1

    247fd5f4ea18f3dbada32784d89c58f9ecb287db

    SHA256

    2151c021ec07eb8d2c1c08c884038e6606d8254d47e436f77fdf8be008891744

    SHA512

    3734dff5c4af534afc634daf2df14207c6d6b0280ab7e731aaff7e9722aed226682c531934e85fa8bca35b5a8aa24640418ffcaa52124f7bbd26f01d168305f3

  • memory/1512-63-0x0000000010000000-0x000000001011B000-memory.dmp

    Filesize

    1.1MB

  • memory/1512-62-0x0000000010000000-0x000000001011B000-memory.dmp

    Filesize

    1.1MB

  • memory/1512-70-0x0000000010000000-0x000000001011B000-memory.dmp

    Filesize

    1.1MB

  • memory/1512-69-0x0000000005FE0000-0x0000000006CA6000-memory.dmp

    Filesize

    12.8MB

  • memory/1512-67-0x0000000000400000-0x00000000010C6000-memory.dmp

    Filesize

    12.8MB

  • memory/1512-66-0x0000000002F40000-0x0000000002F50000-memory.dmp

    Filesize

    64KB

  • memory/1512-64-0x0000000010000000-0x000000001011B000-memory.dmp

    Filesize

    1.1MB

  • memory/1512-68-0x0000000002F40000-0x0000000002F50000-memory.dmp

    Filesize

    64KB

  • memory/1512-53-0x0000000000400000-0x00000000010C6000-memory.dmp

    Filesize

    12.8MB

  • memory/1512-58-0x0000000010000000-0x000000001011B000-memory.dmp

    Filesize

    1.1MB

  • memory/1512-57-0x0000000000400000-0x00000000010C6000-memory.dmp

    Filesize

    12.8MB

  • memory/1512-56-0x0000000000400000-0x00000000010C6000-memory.dmp

    Filesize

    12.8MB

  • memory/1512-55-0x0000000000400000-0x00000000010C6000-memory.dmp

    Filesize

    12.8MB

  • memory/1512-54-0x0000000076EF0000-0x0000000076EF2000-memory.dmp

    Filesize

    8KB

  • memory/2040-458-0x0000000000210000-0x0000000000213000-memory.dmp

    Filesize

    12KB

  • memory/2040-119-0x0000000000CC0000-0x0000000000D97000-memory.dmp

    Filesize

    860KB

  • memory/2040-457-0x0000000000CC0000-0x0000000000D97000-memory.dmp

    Filesize

    860KB

  • memory/2040-120-0x0000000000210000-0x0000000000213000-memory.dmp

    Filesize

    12KB

  • memory/2568-97-0x0000000007BB0000-0x0000000007BB1000-memory.dmp

    Filesize

    4KB

  • memory/2568-88-0x0000000005B70000-0x0000000005B71000-memory.dmp

    Filesize

    4KB

  • memory/2568-108-0x0000000007A70000-0x0000000007B47000-memory.dmp

    Filesize

    860KB

  • memory/2568-73-0x0000000000400000-0x00000000010C6000-memory.dmp

    Filesize

    12.8MB

  • memory/2568-896-0x0000000007A70000-0x0000000007B47000-memory.dmp

    Filesize

    860KB

  • memory/2568-96-0x0000000073980000-0x0000000073DDF000-memory.dmp

    Filesize

    4.4MB

  • memory/2568-815-0x0000000010000000-0x000000001011B000-memory.dmp

    Filesize

    1.1MB

  • memory/2568-118-0x0000000006DC0000-0x0000000006DC1000-memory.dmp

    Filesize

    4KB

  • memory/2568-102-0x0000000073980000-0x0000000073DDF000-memory.dmp

    Filesize

    4.4MB

  • memory/2568-100-0x0000000006D50000-0x0000000006D51000-memory.dmp

    Filesize

    4KB

  • memory/2568-95-0x0000000005B80000-0x0000000005B81000-memory.dmp

    Filesize

    4KB

  • memory/2568-98-0x0000000000400000-0x00000000010C6000-memory.dmp

    Filesize

    12.8MB

  • memory/2568-71-0x0000000000400000-0x00000000010C6000-memory.dmp

    Filesize

    12.8MB

  • memory/2568-158-0x0000000010000000-0x000000001011B000-memory.dmp

    Filesize

    1.1MB

  • memory/2568-218-0x0000000010000000-0x000000001011B000-memory.dmp

    Filesize

    1.1MB

  • memory/2568-233-0x0000000010000000-0x000000001011B000-memory.dmp

    Filesize

    1.1MB

  • memory/2568-238-0x0000000010000000-0x000000001011B000-memory.dmp

    Filesize

    1.1MB

  • memory/2568-101-0x0000000006D40000-0x0000000006D41000-memory.dmp

    Filesize

    4KB

  • memory/2568-87-0x0000000003950000-0x0000000003960000-memory.dmp

    Filesize

    64KB

  • memory/2568-72-0x0000000000400000-0x00000000010C6000-memory.dmp

    Filesize

    12.8MB

  • memory/2568-81-0x0000000010000000-0x000000001011B000-memory.dmp

    Filesize

    1.1MB

  • memory/2568-74-0x0000000000400000-0x00000000010C6000-memory.dmp

    Filesize

    12.8MB

  • memory/2568-99-0x0000000010000000-0x000000001011B000-memory.dmp

    Filesize

    1.1MB

  • memory/2648-468-0x0000000000100000-0x0000000000103000-memory.dmp

    Filesize

    12KB

  • memory/2648-464-0x0000000000100000-0x0000000000103000-memory.dmp

    Filesize

    12KB

  • memory/2648-463-0x0000000000160000-0x0000000000237000-memory.dmp

    Filesize

    860KB

  • memory/2648-467-0x0000000000160000-0x0000000000237000-memory.dmp

    Filesize

    860KB

  • memory/2696-115-0x0000000000090000-0x0000000000093000-memory.dmp

    Filesize

    12KB

  • memory/2696-114-0x0000000000C30000-0x0000000000D07000-memory.dmp

    Filesize

    860KB

  • memory/2696-111-0x0000000000090000-0x0000000000093000-memory.dmp

    Filesize

    12KB

  • memory/2972-471-0x0000000000CB0000-0x0000000000D87000-memory.dmp

    Filesize

    860KB

  • memory/2972-472-0x0000000000100000-0x0000000000103000-memory.dmp

    Filesize

    12KB

  • memory/2972-804-0x0000000000CB0000-0x0000000000D87000-memory.dmp

    Filesize

    860KB

  • memory/2972-805-0x0000000000100000-0x0000000000103000-memory.dmp

    Filesize

    12KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.