Overview

overview

10

Static

static

3

SHIPPING D...df.exe

windows7-x64

10

SHIPPING D...df.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2023, 07:20 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SHIPPING DOCUMENT_9871610T00077003_pdf.exe

  • Size

    639KB

  • MD5

    c60068fde058f588a2b7fe236cfbc0e9

  • SHA1

    d5b3d029b3645a1f2cbf14ec1d134276e47d60e2

  • SHA256

    a75840200db6ba9313053ab15551f6c758d78ac9ffbe75ede0f36e744eaed24b

  • SHA512

    146f766575aa3f81a4d90247871e17cd99bb572720f1a5b72a0ace9140476556d321e82526176bc831eefd029253c5fa627eb7ba78bbd73e2c080447fa2249c0

  • SSDEEP

    12288:CE5QaueH5qjR82KUIdsNQ3GZDlOPk9JiPB7a4pZ5fBJfOUmtakjg7s:CE3qjWsI6wKo44PBu8Z5L2Umtaks

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.dcc-asia.com
  • Port:
    587
  • Username:
    g@dcc-asia.com
  • Password:
    soso@#1235

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.dcc-asia.com
  • Port:
    587
  • Username:
    g@dcc-asia.com
  • Password:
    soso@#1235
  • Email To:
    g@dcc-asia.com

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_9871610T00077003_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_9871610T00077003_pdf.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3548
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_9871610T00077003_pdf.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:448
    • C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_9871610T00077003_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_9871610T00077003_pdf.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2736

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    82.177.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    82.177.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    180.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    180.178.17.96.in-addr.arpa
    IN PTR
    Response
    180.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-180deploystaticakamaitechnologiescom
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.a-0001.a-msedge.net
    g-bing-com.a-0001.a-msedge.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f0e90f6b5de3439fa96536cece064438&localId=w:853D0CBF-5E72-08DA-CFDC-0876B9DB17B8&deviceId=6896189555047291&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f0e90f6b5de3439fa96536cece064438&localId=w:853D0CBF-5E72-08DA-CFDC-0876B9DB17B8&deviceId=6896189555047291&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=1E389988CF1169C519A78A68CEF168C5; domain=.bing.com; expires=Tue, 31-Dec-2024 07:20:08 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: CED3201088214114B4A1EE491C259214 Ref B: LON04EDGE1118 Ref C: 2023-12-07T07:20:08Z
    date: Thu, 07 Dec 2023 07:20:08 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=f0e90f6b5de3439fa96536cece064438&localId=w:853D0CBF-5E72-08DA-CFDC-0876B9DB17B8&deviceId=6896189555047291&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=f0e90f6b5de3439fa96536cece064438&localId=w:853D0CBF-5E72-08DA-CFDC-0876B9DB17B8&deviceId=6896189555047291&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=1E389988CF1169C519A78A68CEF168C5
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 4936BE3174114B84BDD2459E60172AA1 Ref B: LON04EDGE1118 Ref C: 2023-12-07T07:20:08Z
    date: Thu, 07 Dec 2023 07:20:08 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f0e90f6b5de3439fa96536cece064438&localId=w:853D0CBF-5E72-08DA-CFDC-0876B9DB17B8&deviceId=6896189555047291&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f0e90f6b5de3439fa96536cece064438&localId=w:853D0CBF-5E72-08DA-CFDC-0876B9DB17B8&deviceId=6896189555047291&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=1E389988CF1169C519A78A68CEF168C5
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 771CB63FD84E40918D8FF642350D529D Ref B: LON04EDGE1118 Ref C: 2023-12-07T07:20:08Z
    date: Thu, 07 Dec 2023 07:20:08 GMT
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301455_1N9S2NVLYIW6WUPJX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301455_1N9S2NVLYIW6WUPJX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 746478
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: C7DA88DC0916429FA4373AA3C4946A2C Ref B: LON04EDGE1208 Ref C: 2023-12-07T07:20:09Z
    date: Thu, 07 Dec 2023 07:20:08 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301022_10AJDZH059R4K9Z5T&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301022_10AJDZH059R4K9Z5T&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 804657
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: DDB90F4AB0A84608B731F338DD7F2A39 Ref B: LON04EDGE1208 Ref C: 2023-12-07T07:20:09Z
    date: Thu, 07 Dec 2023 07:20:08 GMT
  • flag-us
    DNS
    41.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.110.16.96.in-addr.arpa
    IN PTR
    Response
    41.110.16.96.in-addr.arpa
    IN PTR
    a96-16-110-41deploystaticakamaitechnologiescom
  • flag-us
    DNS
    api.ipify.org
    SHIPPING DOCUMENT_9871610T00077003_pdf.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN CNAME
    api4.ipify.org
    api4.ipify.org
    IN A
    64.185.227.156
    api4.ipify.org
    IN A
    104.237.62.212
    api4.ipify.org
    IN A
    173.231.16.77
  • flag-us
    GET
    https://api.ipify.org/
    SHIPPING DOCUMENT_9871610T00077003_pdf.exe
    Remote address:
    64.185.227.156:443
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
    Host: api.ipify.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.25.1
    Date: Thu, 07 Dec 2023 07:20:27 GMT
    Content-Type: text/plain
    Content-Length: 12
    Connection: keep-alive
    Vary: Origin
  • flag-us
    DNS
    156.227.185.64.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    156.227.185.64.in-addr.arpa
    IN PTR
    Response
    156.227.185.64.in-addr.arpa
    IN PTR
    apiipifyorg
  • flag-us
    DNS
    smtp.dcc-asia.com
    SHIPPING DOCUMENT_9871610T00077003_pdf.exe
    Remote address:
    8.8.8.8:53
    Request
    smtp.dcc-asia.com
    IN A
    Response
    smtp.dcc-asia.com
    IN CNAME
    us2.smtp.mailhostbox.com
    us2.smtp.mailhostbox.com
    IN A
    208.91.199.224
    us2.smtp.mailhostbox.com
    IN A
    208.91.199.225
    us2.smtp.mailhostbox.com
    IN A
    208.91.198.143
    us2.smtp.mailhostbox.com
    IN A
    208.91.199.223
  • flag-us
    DNS
    224.199.91.208.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    224.199.91.208.in-addr.arpa
    IN PTR
    Response
    224.199.91.208.in-addr.arpa
    IN PTR
    208-91-199-224 unifiedlayercom
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.134.221.88.in-addr.arpa
    IN PTR
    Response
    18.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-18deploystaticakamaitechnologiescom
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    168.117.168.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    168.117.168.52.in-addr.arpa
    IN PTR
    Response
  • 204.79.197.200:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f0e90f6b5de3439fa96536cece064438&localId=w:853D0CBF-5E72-08DA-CFDC-0876B9DB17B8&deviceId=6896189555047291&anid=
    tls, http2
    1.9kB
     9.3kB
     22
    19

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f0e90f6b5de3439fa96536cece064438&localId=w:853D0CBF-5E72-08DA-CFDC-0876B9DB17B8&deviceId=6896189555047291&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=f0e90f6b5de3439fa96536cece064438&localId=w:853D0CBF-5E72-08DA-CFDC-0876B9DB17B8&deviceId=6896189555047291&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f0e90f6b5de3439fa96536cece064438&localId=w:853D0CBF-5E72-08DA-CFDC-0876B9DB17B8&deviceId=6896189555047291&anid=

    HTTP Response

    204
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.3kB
     16
    14
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301022_10AJDZH059R4K9Z5T&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    tls, http2
    57.9kB
     1.6MB
     1176
    1174

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301455_1N9S2NVLYIW6WUPJX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301022_10AJDZH059R4K9Z5T&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200
  • 64.185.227.156:443
    https://api.ipify.org/
    tls, http
    SHIPPING DOCUMENT_9871610T00077003_pdf.exe
    946 B
     7.0kB
     11
    12

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 208.91.199.224:587
    smtp.dcc-asia.com
    smtp
    SHIPPING DOCUMENT_9871610T00077003_pdf.exe
    1.9kB
     1.1kB
     16
    17
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    82.177.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    82.177.190.20.in-addr.arpa

  • 8.8.8.8:53
    180.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    180.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     158 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    241.154.82.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.154.82.20.in-addr.arpa

  • 8.8.8.8:53
    26.35.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    26.35.223.20.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    41.110.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    41.110.16.96.in-addr.arpa

  • 8.8.8.8:53
    api.ipify.org
    dns
    SHIPPING DOCUMENT_9871610T00077003_pdf.exe
    59 B
     126 B
     1
    1

    DNS Request

    api.ipify.org

    DNS Response

    64.185.227.156
    104.237.62.212
    173.231.16.77

  • 8.8.8.8:53
    156.227.185.64.in-addr.arpa
    dns
    73 B
     100 B
     1
    1

    DNS Request

    156.227.185.64.in-addr.arpa

  • 8.8.8.8:53
    smtp.dcc-asia.com
    dns
    SHIPPING DOCUMENT_9871610T00077003_pdf.exe
    63 B
     162 B
     1
    1

    DNS Request

    smtp.dcc-asia.com

    DNS Response

    208.91.199.224
    208.91.199.225
    208.91.198.143
    208.91.199.223

  • 8.8.8.8:53
    224.199.91.208.in-addr.arpa
    dns
    73 B
     118 B
     1
    1

    DNS Request

    224.199.91.208.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    18.134.221.88.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    18.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    13.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    13.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    168.117.168.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    168.117.168.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wazy351w.gce.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/448-50-0x0000000007BB0000-0x000000000822A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/448-38-0x0000000070530000-0x000000007057C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/448-61-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/448-57-0x00000000078B0000-0x00000000078CA000-memory.dmp

    Filesize

    104KB

    Download

  • memory/448-58-0x0000000007890000-0x0000000007898000-memory.dmp

    Filesize

    32KB

    Download

  • memory/448-56-0x00000000077B0000-0x00000000077C4000-memory.dmp

    Filesize

    80KB

    Download

  • memory/448-55-0x00000000077A0000-0x00000000077AE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/448-54-0x0000000007770000-0x0000000007781000-memory.dmp

    Filesize

    68KB

    Download

  • memory/448-53-0x00000000077F0000-0x0000000007886000-memory.dmp

    Filesize

    600KB

    Download

  • memory/448-52-0x00000000075E0000-0x00000000075EA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/448-51-0x0000000007570000-0x000000000758A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/448-23-0x0000000005A30000-0x0000000005A96000-memory.dmp

    Filesize

    408KB

    Download

  • memory/448-49-0x0000000007460000-0x0000000007503000-memory.dmp

    Filesize

    652KB

    Download

  • memory/448-35-0x0000000006290000-0x00000000062DC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/448-48-0x0000000006850000-0x000000000686E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/448-18-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/448-17-0x00000000028B0000-0x00000000028E6000-memory.dmp

    Filesize

    216KB

    Download

  • memory/448-19-0x0000000002850000-0x0000000002860000-memory.dmp

    Filesize

    64KB

    Download

  • memory/448-20-0x0000000002850000-0x0000000002860000-memory.dmp

    Filesize

    64KB

    Download

  • memory/448-21-0x0000000005300000-0x0000000005928000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/448-37-0x0000000006810000-0x0000000006842000-memory.dmp

    Filesize

    200KB

    Download

  • memory/448-36-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/448-22-0x0000000005200000-0x0000000005222000-memory.dmp

    Filesize

    136KB

    Download

  • memory/448-33-0x0000000005BC0000-0x0000000005F14000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/448-34-0x0000000006240000-0x000000000625E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2736-14-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2736-62-0x00000000071A0000-0x00000000071F0000-memory.dmp

    Filesize

    320KB

    Download

  • memory/2736-64-0x0000000005A60000-0x0000000005A70000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2736-16-0x0000000005A60000-0x0000000005A70000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2736-63-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2736-15-0x0000000003450000-0x00000000034B6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2736-11-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/3548-9-0x0000000006A70000-0x0000000006AEA000-memory.dmp

    Filesize

    488KB

    Download

  • memory/3548-10-0x00000000090D0000-0x000000000916C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/3548-2-0x0000000005860000-0x0000000005E04000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/3548-8-0x0000000006720000-0x000000000672A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3548-7-0x0000000006710000-0x0000000006718000-memory.dmp

    Filesize

    32KB

    Download

  • memory/3548-6-0x0000000005700000-0x000000000571A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/3548-5-0x0000000005320000-0x000000000532A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3548-4-0x0000000005590000-0x00000000055A0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3548-3-0x0000000005350000-0x00000000053E2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/3548-0-0x00000000009D0000-0x0000000000A74000-memory.dmp

    Filesize

    656KB

    Download

  • memory/3548-13-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3548-1-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.