Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

dridex

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/12/2023, 22:38 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cab64e32c71c085be226df9cd6628d779c78d256ea30a4fefc73de585e95bbd3.exe

  • Size

    6.9MB

  • MD5

    83f52d29a05ee020f4647aa02eda3c89

  • SHA1

    0d296a7b2b83d90473a57a746290212d61ed22ff

  • SHA256

    cab64e32c71c085be226df9cd6628d779c78d256ea30a4fefc73de585e95bbd3

  • SHA512

    dbdbd161b2c01bd5bbd4b7ae08e8c297c4734964dcba1290f523431c5f6b5c3ad4dd1a04e9cd511e6ed32b016ff5357937487da79877f432920eb85955ca48a7

  • SSDEEP

    196608:TA89BmaeXRdyXFnlUrU7o7Bz3HzNNn1jnNnTfMImG0zj:XBmakyVnlUQ7Wz3Tv1jNTh0zj

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cab64e32c71c085be226df9cd6628d779c78d256ea30a4fefc73de585e95bbd3.exe
    "C:\Users\Admin\AppData\Local\Temp\cab64e32c71c085be226df9cd6628d779c78d256ea30a4fefc73de585e95bbd3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3816
    • C:\Users\Admin\AppData\Local\Temp\is-QA069.tmp\cab64e32c71c085be226df9cd6628d779c78d256ea30a4fefc73de585e95bbd3.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-QA069.tmp\cab64e32c71c085be226df9cd6628d779c78d256ea30a4fefc73de585e95bbd3.tmp" /SL5="$70056,6977575,54272,C:\Users\Admin\AppData\Local\Temp\cab64e32c71c085be226df9cd6628d779c78d256ea30a4fefc73de585e95bbd3.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:208
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:540
        • C:\Program Files (x86)\CRTGame\crtgame.exe
          "C:\Program Files (x86)\CRTGame\crtgame.exe" -i
          3⤵
          • Executes dropped EXE
          PID:4488
        • C:\Program Files (x86)\CRTGame\crtgame.exe
          "C:\Program Files (x86)\CRTGame\crtgame.exe" -s
          3⤵
          • Executes dropped EXE
          PID:3864
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 10
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1284
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 10
            4⤵
              PID:928

      Network

      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        17.160.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        17.160.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        208.194.73.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        208.194.73.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        180.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        180.178.17.96.in-addr.arpa
        IN PTR
        Response
        180.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-180deploystaticakamaitechnologiescom
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        241.154.82.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.154.82.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.a-0001.a-msedge.net
        g-bing-com.a-0001.a-msedge.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a95feef0ebdc4d269db2274b8de04e8e&localId=w:1B195E82-8ACE-960B-5E55-FECC85247699&deviceId=6966553648399595&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a95feef0ebdc4d269db2274b8de04e8e&localId=w:1B195E82-8ACE-960B-5E55-FECC85247699&deviceId=6966553648399595&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=24D614557A83632A173807B67BA46207; domain=.bing.com; expires=Fri, 03-Jan-2025 22:39:11 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: BBA7A2F633174B20A46F4900C6F988E2 Ref B: LON04EDGE0616 Ref C: 2023-12-10T22:39:11Z
        date: Sun, 10 Dec 2023 22:39:11 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=a95feef0ebdc4d269db2274b8de04e8e&localId=w:1B195E82-8ACE-960B-5E55-FECC85247699&deviceId=6966553648399595&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=a95feef0ebdc4d269db2274b8de04e8e&localId=w:1B195E82-8ACE-960B-5E55-FECC85247699&deviceId=6966553648399595&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=24D614557A83632A173807B67BA46207
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 5FB3993AC7AA42069A44EE18C79E5B95 Ref B: LON04EDGE0616 Ref C: 2023-12-10T22:39:12Z
        date: Sun, 10 Dec 2023 22:39:11 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a95feef0ebdc4d269db2274b8de04e8e&localId=w:1B195E82-8ACE-960B-5E55-FECC85247699&deviceId=6966553648399595&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a95feef0ebdc4d269db2274b8de04e8e&localId=w:1B195E82-8ACE-960B-5E55-FECC85247699&deviceId=6966553648399595&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=24D614557A83632A173807B67BA46207
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: ACEF6F4EFE9C48B3ABEDCE47E6E5B387 Ref B: LON04EDGE0616 Ref C: 2023-12-10T22:39:12Z
        date: Sun, 10 Dec 2023 22:39:11 GMT
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301036_1G9CB801VBJIYBSI0&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301036_1G9CB801VBJIYBSI0&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 231701
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 71E5CE97663E4DAA9EFDB03F38B3AD3E Ref B: LON04EDGE1215 Ref C: 2023-12-10T22:39:12Z
        date: Sun, 10 Dec 2023 22:39:11 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301469_1CI9E0AG3RDYG5DMG&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301469_1CI9E0AG3RDYG5DMG&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 172727
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 5C0BDBE8CF894AD59BE1AB77562F8DD7 Ref B: LON04EDGE1215 Ref C: 2023-12-10T22:39:12Z
        date: Sun, 10 Dec 2023 22:39:11 GMT
      • flag-us
        DNS
        41.110.16.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        41.110.16.96.in-addr.arpa
        IN PTR
        Response
        41.110.16.96.in-addr.arpa
        IN PTR
        a96-16-110-41deploystaticakamaitechnologiescom
      • flag-us
        DNS
        200.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        200.197.79.204.in-addr.arpa
        IN PTR
        Response
        200.197.79.204.in-addr.arpa
        IN PTR
        a-0001a-msedgenet
      • flag-us
        DNS
        158.240.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        158.240.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        15.164.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        15.164.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        86.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        86.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.134.221.88.in-addr.arpa
        IN PTR
        Response
        18.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-18deploystaticakamaitechnologiescom
      • flag-us
        DNS
        43.229.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        43.229.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-de
        DNS
        bhdpxhb.com
        crtgame.exe
        Remote address:
        45.155.250.90:53
        Request
        bhdpxhb.com
        IN A
        Response
        bhdpxhb.com
        IN A
        185.196.8.22
      • flag-us
        GET
        http://bhdpxhb.com/click/?counter=de7ef49b2c006853fb383b753555f34036fd1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f518166429e289d5b86953e226c55f676647fc2813369d184da325a508ddf0ef910ce
        Remote address:
        185.196.8.22:80
        Request
        GET /click/?counter=de7ef49b2c006853fb383b753555f34036fd1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f518166429e289d5b86953e226c55f676647fc2813369d184da325a508ddf0ef910ce HTTP/1.1
        Host: bhdpxhb.com
        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.20.1
        Date: Sun, 10 Dec 2023 22:41:12 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        X-Powered-By: PHP/7.4.33
      • flag-us
        DNS
        22.8.196.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        22.8.196.185.in-addr.arpa
        IN PTR
        Response
        22.8.196.185.in-addr.arpa
        IN PTR
        g3fmytasteoftodaycom
      • flag-us
        DNS
        90.250.155.45.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        90.250.155.45.in-addr.arpa
        IN PTR
        Response
      • 204.79.197.200:443
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a95feef0ebdc4d269db2274b8de04e8e&localId=w:1B195E82-8ACE-960B-5E55-FECC85247699&deviceId=6966553648399595&anid=
        tls, http2
        1.9kB
         9.3kB
         21
        19

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a95feef0ebdc4d269db2274b8de04e8e&localId=w:1B195E82-8ACE-960B-5E55-FECC85247699&deviceId=6966553648399595&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=a95feef0ebdc4d269db2274b8de04e8e&localId=w:1B195E82-8ACE-960B-5E55-FECC85247699&deviceId=6966553648399595&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a95feef0ebdc4d269db2274b8de04e8e&localId=w:1B195E82-8ACE-960B-5E55-FECC85247699&deviceId=6966553648399595&anid=

        HTTP Response

        204
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.3kB
         16
        14
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239317301469_1CI9E0AG3RDYG5DMG&pid=21.2&w=1080&h=1920&c=4
        tls, http2
        15.5kB
         427.0kB
         319
        316

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301036_1G9CB801VBJIYBSI0&pid=21.2&w=1920&h=1080&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301469_1CI9E0AG3RDYG5DMG&pid=21.2&w=1080&h=1920&c=4

        HTTP Response

        200

        HTTP Response

        200
      • 185.196.8.22:80
        http://bhdpxhb.com/click/?counter=de7ef49b2c006853fb383b753555f34036fd1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f518166429e289d5b86953e226c55f676647fc2813369d184da325a508ddf0ef910ce
        http
        479 B
         352 B
         4
        3

        HTTP Request

        GET http://bhdpxhb.com/click/?counter=de7ef49b2c006853fb383b753555f34036fd1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f518166429e289d5b86953e226c55f676647fc2813369d184da325a508ddf0ef910ce

        HTTP Response

        200
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
         90 B
         1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        17.160.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        17.160.190.20.in-addr.arpa

      • 8.8.8.8:53
        208.194.73.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        208.194.73.20.in-addr.arpa

      • 8.8.8.8:53
        180.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        180.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        241.154.82.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        241.154.82.20.in-addr.arpa

      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         158 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         173 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        41.110.16.96.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        41.110.16.96.in-addr.arpa

      • 8.8.8.8:53
        200.197.79.204.in-addr.arpa
        dns
        73 B
         106 B
         1
        1

        DNS Request

        200.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        158.240.127.40.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        158.240.127.40.in-addr.arpa

      • 8.8.8.8:53
        15.164.165.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        15.164.165.52.in-addr.arpa

      • 8.8.8.8:53
        86.23.85.13.in-addr.arpa
        dns
        70 B
         144 B
         1
        1

        DNS Request

        86.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        18.134.221.88.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        18.134.221.88.in-addr.arpa

      • 8.8.8.8:53
        43.229.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        43.229.111.52.in-addr.arpa

      • 45.155.250.90:53
        bhdpxhb.com
        dns
        crtgame.exe
        57 B
         84 B
         1
        1

        DNS Request

        bhdpxhb.com

        DNS Response

        185.196.8.22

      • 8.8.8.8:53
        22.8.196.185.in-addr.arpa
        dns
        71 B
         107 B
         1
        1

        DNS Request

        22.8.196.185.in-addr.arpa

      • 8.8.8.8:53
        90.250.155.45.in-addr.arpa
        dns
        72 B
         135 B
         1
        1

        DNS Request

        90.250.155.45.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\CRTGame\crtgame.exe
        Filesize

        57KB

        MD5

        ae2fa5c69b4da1ea8fdd0ac55fce693b

        SHA1

        071822d82d476bcf887d645d4256cda15ba1ccfb

        SHA256

        67532650c6392b2326d7c14cdd2bc9f7111fdc0d09c37393121d4117c8d63792

        SHA512

        7a0ba52619cfbffabff0f1215e81fed493171f8f4cc2f97b95bdfdc95e04e8a488bc7ed2f69b1c401698b5b3283e3f454bd2280794851399b6418a02e9a49d03

        Download Submit

      • C:\Program Files (x86)\CRTGame\crtgame.exe
        Filesize

        54KB

        MD5

        e02b28dcadba878b5dfb4308d2f0c81c

        SHA1

        eca9f0b7e3c42c4abbba23aa48f77c10667b8332

        SHA256

        dbc6373e224c881ef9da32b123735069aaed1c5cd79647a4cea47e8e7216f457

        SHA512

        9b982971b49f457f7fbf167fe7a2bd20976869c17ec392f0671b916b660caa2a7f62ba3dc9fe15c2bea8308a7c1e366f08f1117d430771366dea3a019cab1510

        Download Submit

      • C:\Program Files (x86)\CRTGame\crtgame.exe
        Filesize

        428KB

        MD5

        ca0cbde1dd9d525eb4c371a6687c756a

        SHA1

        79d8a2247975b61416f9c4388615c7a7910f4925

        SHA256

        131fd3701243a423087be48a690da2dd51cc1035c4d3b58f78b538ac5cc87d94

        SHA512

        6e4f76af0ad0857cec69265dfbe43965d95da3de4a10b5886e98a2ffce071f058e98443db489bd81d7f24361dd8acc22331bf9bc64da38d0d06799af22b17f09

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-NQKDL.tmp\_isetup\_iscrypt.dll
        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-NQKDL.tmp\_isetup\_isdecmp.dll
        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-QA069.tmp\cab64e32c71c085be226df9cd6628d779c78d256ea30a4fefc73de585e95bbd3.tmp
        Filesize

        556KB

        MD5

        d1179e965de52918bc9bce28ffc569bb

        SHA1

        ffaca64ed37ef51d2f124a7214466b5d49aa1ff5

        SHA256

        c8e1ac84d68dfa19e9629a255f0148c8ae78a28cd0be1a1e5c24d2bb4b3b51a7

        SHA512

        7975784eaae330622adeba4e96930f1f7e791dc2fc0d12bd099316b2b65f1a6faca6badd5586f20614d8e5201a68033a9bc8e6ba9554782855e9adef1a1499d6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-QA069.tmp\cab64e32c71c085be226df9cd6628d779c78d256ea30a4fefc73de585e95bbd3.tmp
        Filesize

        356KB

        MD5

        6e8939dbab66b2004a60eb03b72b0a80

        SHA1

        39676df329624116e84dee5f31688248e44b9f13

        SHA256

        b4059fc4e91092c94c56456ea8b1a2d837adbe8170dbe50d3ca06c59c3da5436

        SHA512

        790e46459f11f2751d1bda710bfa916620894d961560912aaafcb8aa40812f20e2ef68ec115496f7cc2e4f8e63bf39412c155e8383ee0465d9e65306104b15db

        Download Submit

      • memory/208-10-0x0000000000750000-0x0000000000751000-memory.dmp

        Filesize

        4KB

        Download

      • memory/208-163-0x0000000000750000-0x0000000000751000-memory.dmp

        Filesize

        4KB

        Download

      • memory/208-161-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB

        Download

      • memory/3816-2-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3816-0-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3816-160-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3864-181-0x00000000008A0000-0x0000000000942000-memory.dmp

        Filesize

        648KB

        Download

      • memory/3864-189-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-159-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-209-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-206-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-162-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-203-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-166-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-167-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-170-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-173-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-176-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-180-0x00000000008A0000-0x0000000000942000-memory.dmp

        Filesize

        648KB

        Download

      • memory/3864-179-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-199-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-186-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-157-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-190-0x00000000008A0000-0x0000000000942000-memory.dmp

        Filesize

        648KB

        Download

      • memory/3864-193-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3864-196-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/4488-152-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/4488-151-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/4488-155-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/4488-154-0x0000000000400000-0x000000000061E000-memory.dmp

        Filesize

        2.1MB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.