Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

SecuriteIn...36.exe

windows7-x64

10

SecuriteIn...36.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2023, 13:35 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe

  • Size

    34KB

  • MD5

    f11f4091d6316cc4cc359c411d014df5

  • SHA1

    0586fcf24376475f42ebcbb4cd9ea017a0450ac4

  • SHA256

    aa3d6760a1c5dbfcf7407c4e69f853b33f882cfc17daee6f18e037ed3a763e11

  • SHA512

    770ace08649a7f9862fb57e241dceae4ddafb8f501e0e732b3de7f1392371d49faf987437f649e45839d6425085c7e4224beb103679d84009b5403ba793d1704

  • SSDEEP

    384:5Z4c1yx/Et5nYPLpFzDGiFzDGe8JN77hh+b:LyxMt5EBDGiBDGZ3h0b

Score
10/10
agentteslazgratkeyloggerpersistenceratspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    server1.sqsendy.shop
  • Port:
    587
  • Username:
    sendycool@fleetdept.shop
  • Password:
    {f];qthoiBBW

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    server1.sqsendy.shop
  • Port:
    587
  • Username:
    sendycool@fleetdept.shop
  • Password:
    {f];qthoiBBW
  • Email To:
    ceocool@fleetdept.shop

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
      C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4336

Network

  • flag-cz
    GET
    http://62.233.57.103/hih/Niahrtfy.vdf
    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    Remote address:
    62.233.57.103:80
    Request
    GET /hih/Niahrtfy.vdf HTTP/1.1
    Host: 62.233.57.103
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Mon, 11 Dec 2023 13:35:55 GMT
    Server: Apache/2.4.6 (CentOS)
    Last-Modified: Mon, 11 Dec 2023 09:14:07 GMT
    ETag: "a2400-60c385b2335c0"
    Accept-Ranges: bytes
    Content-Length: 664576
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    208.194.73.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    208.194.73.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.205.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.205.248.87.in-addr.arpa
    IN PTR
    Response
    0.205.248.87.in-addr.arpa
    IN PTR
    https-87-248-205-0lgwllnwnet
  • flag-us
    DNS
    103.57.233.62.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.57.233.62.in-addr.arpa
    IN PTR
    Response
    103.57.233.62.in-addr.arpa
    IN PTR
    slot0nqvtwoshop
  • flag-us
    DNS
    1.181.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.181.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301614_1PEIP2AXZTPQ08R0S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301614_1PEIP2AXZTPQ08R0S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 415794
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 9DE25F8DF5914AABBF46DDD18AD8B6FB Ref B: LON04EDGE0713 Ref C: 2023-12-11T13:35:46Z
    date: Mon, 11 Dec 2023 13:35:46 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301724_1GGOULONZ6XJKTHM3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301724_1GGOULONZ6XJKTHM3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 563726
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 08E4A1BF139C46DF9A527BFBE697DB11 Ref B: LON04EDGE0713 Ref C: 2023-12-11T13:35:46Z
    date: Mon, 11 Dec 2023 13:35:46 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301205_1OM9XZCKYFXI34HLQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301205_1OM9XZCKYFXI34HLQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 646893
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: C6999E2EDC72466AAD7522F6CB714984 Ref B: LON04EDGE0713 Ref C: 2023-12-11T13:35:46Z
    date: Mon, 11 Dec 2023 13:35:46 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301315_1JM5631GU1VNGZFL5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301315_1JM5631GU1VNGZFL5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 452131
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 108BFFC2B5F54690977BF497E3F9F887 Ref B: LON04EDGE0713 Ref C: 2023-12-11T13:35:46Z
    date: Mon, 11 Dec 2023 13:35:46 GMT
  • flag-us
    DNS
    43.58.199.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.58.199.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    api.ipify.org
    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN CNAME
    api4.ipify.org
    api4.ipify.org
    IN A
    104.237.62.212
    api4.ipify.org
    IN A
    173.231.16.77
    api4.ipify.org
    IN A
    64.185.227.156
  • flag-us
    GET
    https://api.ipify.org/
    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    Remote address:
    104.237.62.212:443
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
    Host: api.ipify.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.25.2
    Date: Mon, 11 Dec 2023 13:36:07 GMT
    Content-Type: text/plain
    Content-Length: 12
    Connection: keep-alive
    Vary: Origin
  • flag-us
    DNS
    212.62.237.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.62.237.104.in-addr.arpa
    IN PTR
    Response
    212.62.237.104.in-addr.arpa
    IN PTR
    apiipifyorg
  • flag-us
    DNS
    ip-api.com
    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    Remote address:
    8.8.8.8:53
    Request
    ip-api.com
    IN A
    Response
    ip-api.com
    IN A
    208.95.112.1
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.135.221.88.in-addr.arpa
    IN PTR
    Response
    232.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-232deploystaticakamaitechnologiescom
  • flag-us
    DNS
    232.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.135.221.88.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    server1.sqsendy.shop
    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    Remote address:
    8.8.8.8:53
    Request
    server1.sqsendy.shop
    IN A
    Response
    server1.sqsendy.shop
    IN A
    63.250.35.178
  • flag-us
    DNS
    178.35.250.63.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    178.35.250.63.in-addr.arpa
    IN PTR
    Response
    178.35.250.63.in-addr.arpa
    IN PTR
    server1sqsendyshop
  • flag-us
    DNS
    173.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    173.178.17.96.in-addr.arpa
    IN PTR
    Response
    173.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-173deploystaticakamaitechnologiescom
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
    Response
  • 62.233.57.103:80
    http://62.233.57.103/hih/Niahrtfy.vdf
    http
    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    14.9kB
     690.8kB
     323
    519

    HTTP Request

    GET http://62.233.57.103/hih/Niahrtfy.vdf

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.3kB
     16
    14
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301315_1JM5631GU1VNGZFL5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    tls, http2
    70.6kB
     2.1MB
     1470
    1513

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301614_1PEIP2AXZTPQ08R0S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301724_1GGOULONZ6XJKTHM3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301205_1OM9XZCKYFXI34HLQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301315_1JM5631GU1VNGZFL5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.3kB
     16
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.3kB
     16
    14
  • 104.237.62.212:443
    https://api.ipify.org/
    tls, http
    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    1.2kB
     9.1kB
     17
    15

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 208.95.112.1:80
    ip-api.com
    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    260 B
     5
  • 63.250.35.178:587
    server1.sqsendy.shop
    smtp-submission
    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    4.0kB
     6.8kB
     23
    20
  • 63.250.35.178:587
    server1.sqsendy.shop
    smtp-submission
    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    3.1kB
     7.1kB
     29
    27
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    208.194.73.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    208.194.73.20.in-addr.arpa

  • 8.8.8.8:53
    0.205.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    0.205.248.87.in-addr.arpa

  • 8.8.8.8:53
    103.57.233.62.in-addr.arpa
    dns
    72 B
     103 B
     1
    1

    DNS Request

    103.57.233.62.in-addr.arpa

  • 8.8.8.8:53
    1.181.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    1.181.190.20.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    43.58.199.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    43.58.199.20.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    api.ipify.org
    dns
    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    59 B
     126 B
     1
    1

    DNS Request

    api.ipify.org

    DNS Response

    104.237.62.212
    173.231.16.77
    64.185.227.156

  • 8.8.8.8:53
    212.62.237.104.in-addr.arpa
    dns
    73 B
     100 B
     1
    1

    DNS Request

    212.62.237.104.in-addr.arpa

  • 8.8.8.8:53
    ip-api.com
    dns
    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    56 B
     72 B
     1
    1

    DNS Request

    ip-api.com

    DNS Response

    208.95.112.1

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    232.135.221.88.in-addr.arpa
    dns
    146 B
     139 B
     2
    1

    DNS Request

    232.135.221.88.in-addr.arpa

    DNS Request

    232.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    server1.sqsendy.shop
    dns
    SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe
    66 B
     82 B
     1
    1

    DNS Request

    server1.sqsendy.shop

    DNS Response

    63.250.35.178

  • 8.8.8.8:53
    178.35.250.63.in-addr.arpa
    dns
    72 B
     106 B
     1
    1

    DNS Request

    178.35.250.63.in-addr.arpa

  • 8.8.8.8:53
    173.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    173.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    22.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    22.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.DownLoaderNET.887.13436.exe.log
    Filesize

    1KB

    MD5

    489c7565f9b029ba9fadff774073cc98

    SHA1

    56c05089b33ee7e7dfa9e6a2d098164efd8e1150

    SHA256

    10bf6242da02dad8b2e1208b9dab9a7303cf986320e05e5ef20b99c9b71326d4

    SHA512

    ddea09c011a8d4f85905842c2f34c98add0110a0b6b3b2709718c3614a2c42dec5f4f5d5b9442cfd3c6c23e9a90c8c0b25c14c3dbd42faea9cc8dd232cace1ac

    Download Submit

  • memory/4336-936-0x0000000074400000-0x0000000074BB0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4336-938-0x00000000056D0000-0x00000000056E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4336-937-0x00000000056E0000-0x0000000005746000-memory.dmp

    Filesize

    408KB

    Download

  • memory/4336-935-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/4336-944-0x0000000006D70000-0x0000000006D7A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4336-943-0x0000000006F20000-0x0000000006FB2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/4336-942-0x0000000006D80000-0x0000000006E1C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/4336-941-0x0000000006C90000-0x0000000006CE0000-memory.dmp

    Filesize

    320KB

    Download

  • memory/4336-940-0x00000000056D0000-0x00000000056E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4336-939-0x0000000074400000-0x0000000074BB0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4568-51-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-59-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-19-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-17-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-21-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-9-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-29-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-27-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-25-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-23-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-7-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-33-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-31-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-37-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-49-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-15-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-53-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-47-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-45-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-43-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-41-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-11-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-67-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-65-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-63-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-61-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-57-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-55-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-39-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-35-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-5-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-926-0x00000000053F0000-0x00000000053F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4568-928-0x0000000005E60000-0x0000000005EAC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4568-927-0x0000000005E20000-0x0000000005E62000-memory.dmp

    Filesize

    264KB

    Download

  • memory/4568-929-0x00000000066D0000-0x0000000006C74000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/4568-934-0x0000000074400000-0x0000000074BB0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4568-13-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-4-0x0000000005BD0000-0x0000000005C73000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4568-3-0x0000000005BD0000-0x0000000005C78000-memory.dmp

    Filesize

    672KB

    Download

  • memory/4568-2-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4568-1-0x0000000074400000-0x0000000074BB0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4568-0-0x0000000000130000-0x000000000013C000-memory.dmp

    Filesize

    48KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.