Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

cd348d8f8a...32.exe

windows7-x64

10

cd348d8f8a...32.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2023, 19:46 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cd348d8f8a74c9ceba525ccbf26a7e70_exe32.exe

  • Size

    1.1MB

  • MD5

    cd348d8f8a74c9ceba525ccbf26a7e70

  • SHA1

    55a371874bf3b68925a9c98fe91aba703aec0bc6

  • SHA256

    a491a0d38b7f90a19b5fea4beb3dd65468517cd424024ea9bbc18524835fc6f7

  • SHA512

    0ce3ba5abd2a4dd3a6d523fffbdc83fc634ffaccf338b3a2ad7677f0d2cfe17da7c94bce8715ce2ceff75b0283ff339fff61ac8ca6a4953bbcf7cb6fa67b96a7

  • SSDEEP

    24576:4AHnh+eWsN3skA4RV1Hom2KXMmHa97aWtjzjFtuM250:/h+ZkldoPK8Ya971XjFtA0

Score
10/10
limeratrat

Malware Config

Extracted

Family

limerat

Wallets

1JBKLGyE6AnRGvk92A8x3m8qmXfh3fcEty

Attributes
  • aes_key

    nulled

  • antivm

    true

  • c2_url

    https://pastebin.com/raw/cXuQ0V20

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    Winservices.exe

  • main_folder

    AppData

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    true

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/cXuQ0V20

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat
  • Executes dropped EXE 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd348d8f8a74c9ceba525ccbf26a7e70_exe32.exe
    "C:\Users\Admin\AppData\Local\Temp\cd348d8f8a74c9ceba525ccbf26a7e70_exe32.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • Maps connected drives based on registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2668
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F
      2⤵
      • Creates scheduled task(s)
      PID:2616
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {E72994B2-E666-48E1-8875-FFFB2DECCE1B} S-1-5-21-3849525425-30183055-657688904-1000:KGPMNUDG\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\secinit\sdchange.exe
      C:\Users\Admin\secinit\sdchange.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2884
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
        3⤵
          PID:2856
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F
          3⤵
          • Creates scheduled task(s)
          PID:2372
      • C:\Users\Admin\secinit\sdchange.exe
        C:\Users\Admin\secinit\sdchange.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2192
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
          3⤵
            PID:1744
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F
            3⤵
            • Creates scheduled task(s)
            PID:2932
        • C:\Users\Admin\secinit\sdchange.exe
          C:\Users\Admin\secinit\sdchange.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1520
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
            3⤵
              PID:844
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F
              3⤵
              • Creates scheduled task(s)
              PID:1556

        Network

        • flag-us
          DNS
          pastebin.com
          RegAsm.exe
          Remote address:
          8.8.8.8:53
          Request
          pastebin.com
          IN A
          Response
          pastebin.com
          IN A
          104.20.67.143
          pastebin.com
          IN A
          104.20.68.143
          pastebin.com
          IN A
          172.67.34.170
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Connection: Keep-Alive
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:29:05 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: EXPIRED
          Server: cloudflare
          CF-RAY: 816c2f7af8870e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:29:06 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 1
          Server: cloudflare
          CF-RAY: 816c2f857da80e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:29:09 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 4
          Server: cloudflare
          CF-RAY: 816c2f960dc30e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:29:13 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 8
          Server: cloudflare
          CF-RAY: 816c2fb1ec370e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:29:14 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 9
          Server: cloudflare
          CF-RAY: 816c2fb6be8c0e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:29:22 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 17
          Server: cloudflare
          CF-RAY: 816c2fe5fef70e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:29:26 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 21
          Server: cloudflare
          CF-RAY: 816c30022e900e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:29:32 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 27
          Server: cloudflare
          CF-RAY: 816c3025dabe0e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:29:38 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 33
          Server: cloudflare
          CF-RAY: 816c30488aa40e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:29:47 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 42
          Server: cloudflare
          CF-RAY: 816c3082c9840e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:29:56 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 51
          Server: cloudflare
          CF-RAY: 816c30bc1cc30e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:30:00 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 55
          Server: cloudflare
          CF-RAY: 816c30d31c6b0e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:30:08 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 63
          Server: cloudflare
          CF-RAY: 816c3107fcf90e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:30:11 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 66
          Server: cloudflare
          CF-RAY: 816c3116cd9d0e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:30:15 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 70
          Server: cloudflare
          CF-RAY: 816c3130fd6d0e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:30:21 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 76
          Server: cloudflare
          CF-RAY: 816c315589390e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:30:25 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 80
          Server: cloudflare
          CF-RAY: 816c316f4f000e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:30:32 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 87
          Server: cloudflare
          CF-RAY: 816c319baf670e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:30:41 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 96
          Server: cloudflare
          CF-RAY: 816c31d25d4c0e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:30:43 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 98
          Server: cloudflare
          CF-RAY: 816c31e0bd350e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:30:51 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 106
          Server: cloudflare
          CF-RAY: 816c321288cb0e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:30:53 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 108
          Server: cloudflare
          CF-RAY: 816c3220f8ac0e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:31:01 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 116
          Server: cloudflare
          CF-RAY: 816c3254bc5c0e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:31:04 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 119
          Server: cloudflare
          CF-RAY: 816c32649d8d0e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:31:09 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 124
          Server: cloudflare
          CF-RAY: 816c32814cd00e80-AMS
        • flag-us
          GET
          https://pastebin.com/raw/cXuQ0V20
          RegAsm.exe
          Remote address:
          104.20.67.143:443
          Request
          GET /raw/cXuQ0V20 HTTP/1.1
          Host: pastebin.com
          Response
          HTTP/1.1 404 Not Found
          Date: Mon, 16 Oct 2023 00:31:13 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          x-frame-options: DENY
          x-frame-options: DENY
          x-content-type-options: nosniff
          x-content-type-options: nosniff
          x-xss-protection: 1;mode=block
          x-xss-protection: 1;mode=block
          cache-control: public, max-age=1801
          CF-Cache-Status: HIT
          Age: 128
          Server: cloudflare
          CF-RAY: 816c329e5c100e80-AMS
        • 104.20.67.143:443
          https://pastebin.com/raw/cXuQ0V20
          tls, http
          RegAsm.exe
          5.0kB
           32.0kB
           59
          61

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404

          HTTP Request

          GET https://pastebin.com/raw/cXuQ0V20

          HTTP Response

          404
        • 8.8.8.8:53
          pastebin.com
          dns
          RegAsm.exe
          58 B
           106 B
           1
          1

          DNS Request

          pastebin.com

          DNS Response

          104.20.67.143
          104.20.68.143
          172.67.34.170

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Cab959E.tmp
          Filesize

          61KB

          MD5

          f3441b8572aae8801c04f3060b550443

          SHA1

          4ef0a35436125d6821831ef36c28ffaf196cda15

          SHA256

          6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

          SHA512

          5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Tar95DF.tmp
          Filesize

          163KB

          MD5

          9441737383d21192400eca82fda910ec

          SHA1

          725e0d606a4fc9ba44aa8ffde65bed15e65367e4

          SHA256

          bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

          SHA512

          7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

          Download Submit

        • C:\Users\Admin\secinit\sdchange.exe
          Filesize

          1.1MB

          MD5

          c8f07cb7fa1c83889d4371b1336f44e3

          SHA1

          29be028194364313274169b439b9fce3819bcfdd

          SHA256

          7c323a91e4c38f1bb5b657b887893acee245841b7cdd213051ea349a0db30973

          SHA512

          edfb14a97618140f50738c943bfd73f43ce47a8afb41486b2d14d1d10ac7bd16c606f9a70c358071592b7c31bb9c2a9b2ee9e87f85cca40d33ed87bd2860117a

          Download Submit

        • C:\Users\Admin\secinit\sdchange.exe
          Filesize

          1.1MB

          MD5

          c8f07cb7fa1c83889d4371b1336f44e3

          SHA1

          29be028194364313274169b439b9fce3819bcfdd

          SHA256

          7c323a91e4c38f1bb5b657b887893acee245841b7cdd213051ea349a0db30973

          SHA512

          edfb14a97618140f50738c943bfd73f43ce47a8afb41486b2d14d1d10ac7bd16c606f9a70c358071592b7c31bb9c2a9b2ee9e87f85cca40d33ed87bd2860117a

          Download Submit

        • C:\Users\Admin\secinit\sdchange.exe
          Filesize

          1.1MB

          MD5

          c8f07cb7fa1c83889d4371b1336f44e3

          SHA1

          29be028194364313274169b439b9fce3819bcfdd

          SHA256

          7c323a91e4c38f1bb5b657b887893acee245841b7cdd213051ea349a0db30973

          SHA512

          edfb14a97618140f50738c943bfd73f43ce47a8afb41486b2d14d1d10ac7bd16c606f9a70c358071592b7c31bb9c2a9b2ee9e87f85cca40d33ed87bd2860117a

          Download Submit

        • C:\Users\Admin\secinit\sdchange.exe
          Filesize

          1.1MB

          MD5

          c8f07cb7fa1c83889d4371b1336f44e3

          SHA1

          29be028194364313274169b439b9fce3819bcfdd

          SHA256

          7c323a91e4c38f1bb5b657b887893acee245841b7cdd213051ea349a0db30973

          SHA512

          edfb14a97618140f50738c943bfd73f43ce47a8afb41486b2d14d1d10ac7bd16c606f9a70c358071592b7c31bb9c2a9b2ee9e87f85cca40d33ed87bd2860117a

          Download Submit

        • memory/844-80-0x0000000074370000-0x000000007491B000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/844-79-0x0000000074370000-0x000000007491B000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/1272-0-0x0000000000150000-0x0000000000151000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1744-69-0x0000000074370000-0x000000007491B000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/1744-68-0x0000000074370000-0x000000007491B000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/2668-8-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2668-12-0x0000000074370000-0x000000007491B000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/2668-11-0x0000000074370000-0x000000007491B000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/2668-7-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2668-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2668-1-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2668-2-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2856-23-0x0000000074370000-0x000000007491B000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/2856-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2856-58-0x0000000074370000-0x000000007491B000-memory.dmp

          Filesize

          5.7MB

          Download

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.