Overview

overview

7

Static

static

7

174f3c937a...79.exe

windows7-x64

7

174f3c937a...79.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    170s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 10:30 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    174f3c937aa26c41e8c5fa6865a99179.exe

  • Size

    328KB

  • MD5

    174f3c937aa26c41e8c5fa6865a99179

  • SHA1

    dd5083da2acde1ea12bb36a485a6983304a6708e

  • SHA256

    2110ab9145eb713326e795f37cfd853d4434756738db301881c81dd94e325dbb

  • SHA512

    6c5d5645f80b84e5e46c721db336bff46d4ece80942512a0c3fb7a0f4786569ae147e36d3dca0b5b0bb9d4a99e4fdf75064b5da378bc7cb16382eff02dc2e6af

  • SSDEEP

    6144:nePJYhcvhLxotp++sCTHUIKz3JWGYBjWo80I/G13YtcOmq81yOgfkJzq12:nePJYIh9of++skOYBjD5wG13YtcOncyQ

Score
7/10
bootkitpersistenceupx

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan

Processes

  • C:\Users\Admin\AppData\Local\Temp\174f3c937aa26c41e8c5fa6865a99179.exe
    "C:\Users\Admin\AppData\Local\Temp\174f3c937aa26c41e8c5fa6865a99179.exe"
    1⤵
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Modifies system certificate store
    PID:1884

Network

  • flag-us
    DNS
    9.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.134.221.88.in-addr.arpa
    IN PTR
    Response
    9.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-9deploystaticakamaitechnologiescom
  • flag-us
    DNS
    2.136.104.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.136.104.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    17.53.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.53.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    79.121.231.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    79.121.231.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    74.19.199.152.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    74.19.199.152.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    csc3-2010-crl.verisign.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    csc3-2010-crl.verisign.com
    IN A
    Response
    csc3-2010-crl.verisign.com
    IN CNAME
    crl-symcprod.digicert.com
    crl-symcprod.digicert.com
    IN CNAME
    crl.edge.digicert.com
    crl.edge.digicert.com
    IN CNAME
    fp2e7a.wpc.2be4.phicdn.net
    fp2e7a.wpc.2be4.phicdn.net
    IN CNAME
    fp2e7a.wpc.phicdn.net
    fp2e7a.wpc.phicdn.net
    IN A
    192.229.221.95
  • flag-us
    GET
    http://csc3-2010-crl.verisign.com/CSC3-2010.crl
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    192.229.221.95:80
    Request
    GET /CSC3-2010.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: csc3-2010-crl.verisign.com
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Age: 5678
    Cache-Control: public, max-age=3600
    Content-Type: application/pkix-crl
    Date: Tue, 26 Dec 2023 00:45:47 GMT
    Last-Modified: Mon, 25 Dec 2023 23:11:09 GMT
    Server: ECAcc (lhd/35E5)
    X-Cache: HIT
    X-Content-Type-Options: nosniff
    X-EC-BBR-Enable: 1
    X-Frame-Options: SAMEORIGIN
    X-XSS-Protection: 1; mode=block
    Content-Length: 107803
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    GET
    http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
    Remote address:
    192.229.221.95:80
    Request
    GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: ocsp.digicert.com
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Age: 202
    Cache-Control: max-age=7200
    Content-Type: application/ocsp-response
    Date: Tue, 26 Dec 2023 00:45:48 GMT
    Last-Modified: Tue, 26 Dec 2023 00:42:26 GMT
    Server: ECAcc (lhd/35F8)
    X-Cache: HIT
    Content-Length: 471
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    157.123.68.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.123.68.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    GET
    http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEA6Nvl6mEObLtWnHNvbXAEs%3D
    Remote address:
    192.229.221.95:80
    Request
    GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEA6Nvl6mEObLtWnHNvbXAEs%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: ocsp.digicert.com
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Age: 164
    Cache-Control: max-age=7200
    Content-Type: application/ocsp-response
    Date: Tue, 26 Dec 2023 00:45:53 GMT
    Last-Modified: Tue, 26 Dec 2023 00:43:09 GMT
    Server: ECAcc (lhd/35BD)
    X-Cache: HIT
    Content-Length: 313
  • flag-us
    DNS
    41.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.110.16.96.in-addr.arpa
    IN PTR
    Response
    41.110.16.96.in-addr.arpa
    IN PTR
    a96-16-110-41deploystaticakamaitechnologiescom
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    208.194.73.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    208.194.73.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
  • flag-us
    DNS
    183.1.37.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.1.37.23.in-addr.arpa
    IN PTR
    Response
    183.1.37.23.in-addr.arpa
    IN PTR
    a23-37-1-183deploystaticakamaitechnologiescom
  • flag-us
    DNS
    183.1.37.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.1.37.23.in-addr.arpa
    IN PTR
    Response
    183.1.37.23.in-addr.arpa
    IN PTR
    a23-37-1-183deploystaticakamaitechnologiescom
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301663_1QHQXW81RF8E6NQ10&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301663_1QHQXW81RF8E6NQ10&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 384106
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: F072C434F42E4EF7973B007DF255557F Ref B: LON04EDGE1006 Ref C: 2023-12-26T00:46:26Z
    date: Tue, 26 Dec 2023 00:46:25 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301662_176VB0P3XGJB59KS3&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301662_176VB0P3XGJB59KS3&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 319171
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 21693B933C994EEA891102C5742A1B7B Ref B: LON04EDGE1006 Ref C: 2023-12-26T00:46:26Z
    date: Tue, 26 Dec 2023 00:46:25 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301254_1Y97V3K1Y4OI79J21&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301254_1Y97V3K1Y4OI79J21&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 344185
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 7A2CA8FF1EF941A2B896848032E1F5AE Ref B: LON04EDGE1006 Ref C: 2023-12-26T00:46:26Z
    date: Tue, 26 Dec 2023 00:46:25 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301253_1ITZSO8YS9ZANR3WZ&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301253_1ITZSO8YS9ZANR3WZ&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 388086
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: D56C57CA3AB541A19D680DBDFAEBEFCB Ref B: LON04EDGE1006 Ref C: 2023-12-26T00:46:27Z
    date: Tue, 26 Dec 2023 00:46:26 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317300924_1N7S5A2UISE5XQ4TY&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317300924_1N7S5A2UISE5XQ4TY&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301357_1M7VV0SOSJXWEGMMP&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301357_1M7VV0SOSJXWEGMMP&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
  • flag-us
    GET
    http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
    Remote address:
    192.229.221.95:80
    Request
    GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: ocsp.digicert.com
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Age: 5533
    Cache-Control: max-age=7200
    Content-Type: application/ocsp-response
    Date: Tue, 26 Dec 2023 00:46:26 GMT
    Last-Modified: Mon, 25 Dec 2023 23:14:13 GMT
    Server: ECAcc (lhd/35A2)
    X-Cache: HIT
    Content-Length: 471
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
  • flag-us
    DNS
    119.110.54.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    119.110.54.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    119.110.54.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    119.110.54.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    178.223.142.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    178.223.142.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    178.223.142.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    178.223.142.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    b.liteflames.com
    174f3c937aa26c41e8c5fa6865a99179.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
  • flag-us
    DNS
    59.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    59.134.221.88.in-addr.arpa
    IN PTR
    Response
    59.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-59deploystaticakamaitechnologiescom
  • flag-us
    DNS
    59.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    59.134.221.88.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    59.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    59.134.221.88.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    59.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    59.134.221.88.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    59.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    59.134.221.88.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    43.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.134.221.88.in-addr.arpa
    IN PTR
    Response
    43.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-43deploystaticakamaitechnologiescom
  • flag-us
    DNS
    43.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.134.221.88.in-addr.arpa
    IN PTR
    Response
    43.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-43deploystaticakamaitechnologiescom
  • flag-us
    DNS
    232.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.135.221.88.in-addr.arpa
    IN PTR
    Response
    232.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-232deploystaticakamaitechnologiescom
  • flag-us
    DNS
    232.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.135.221.88.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    33.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    33.134.221.88.in-addr.arpa
    IN PTR
    Response
    33.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-33deploystaticakamaitechnologiescom
  • flag-us
    DNS
    33.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    33.134.221.88.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    210.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    210.135.221.88.in-addr.arpa
    IN PTR
    Response
    210.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-210deploystaticakamaitechnologiescom
  • flag-us
    DNS
    210.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    210.135.221.88.in-addr.arpa
    IN PTR
    Response
    210.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-210deploystaticakamaitechnologiescom
  • flag-us
    DNS
    17.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.134.221.88.in-addr.arpa
    IN PTR
    Response
    17.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-17deploystaticakamaitechnologiescom
  • flag-us
    DNS
    17.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.134.221.88.in-addr.arpa
    IN PTR
  • flag-us
    GET
    http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
    Remote address:
    192.229.221.95:80
    Request
    GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: ocsp.digicert.com
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Age: 5274
    Cache-Control: max-age=7200
    Content-Type: application/ocsp-response
    Date: Tue, 26 Dec 2023 00:47:40 GMT
    Last-Modified: Mon, 25 Dec 2023 23:19:46 GMT
    Server: ECAcc (lhd/35FB)
    X-Cache: HIT
    Content-Length: 471
  • flag-us
    DNS
    8.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.173.189.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    8.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.173.189.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    8.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.173.189.20.in-addr.arpa
    IN PTR
  • 192.229.221.95:80
    http://csc3-2010-crl.verisign.com/CSC3-2010.crl
    http
    174f3c937aa26c41e8c5fa6865a99179.exe
    2.4kB
     112.0kB
     49
    87

    HTTP Request

    GET http://csc3-2010-crl.verisign.com/CSC3-2010.crl

    HTTP Response

    200
  • 192.229.221.95:80
    http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
    http
    470 B
     868 B
     5
    3

    HTTP Request

    GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D

    HTTP Response

    200
  • 192.229.221.95:80
    http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEA6Nvl6mEObLtWnHNvbXAEs%3D
    http
    510 B
     750 B
     6
    4

    HTTP Request

    GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEA6Nvl6mEObLtWnHNvbXAEs%3D

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.3kB
     15
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.6kB
     929 B
     14
    9
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301357_1M7VV0SOSJXWEGMMP&pid=21.2&w=1080&h=1920&c=4
    tls, http2
    49.2kB
     1.3MB
     984
    977

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301663_1QHQXW81RF8E6NQ10&pid=21.2&w=1080&h=1920&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301662_176VB0P3XGJB59KS3&pid=21.2&w=1080&h=1920&c=4

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301254_1Y97V3K1Y4OI79J21&pid=21.2&w=1920&h=1080&c=4

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301253_1ITZSO8YS9ZANR3WZ&pid=21.2&w=1920&h=1080&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317300924_1N7S5A2UISE5XQ4TY&pid=21.2&w=1920&h=1080&c=4

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301357_1M7VV0SOSJXWEGMMP&pid=21.2&w=1080&h=1920&c=4

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.8kB
     8.2kB
     18
    12
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.5kB
     8.3kB
     16
    14
  • 192.229.221.95:80
    http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
    http
    424 B
     869 B
     4
    3

    HTTP Request

    GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D

    HTTP Response

    200
  • 192.229.221.95:80
    http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
    http
    424 B
     869 B
     4
    3

    HTTP Request

    GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D

    HTTP Response

    200
  • 8.8.8.8:53
    9.134.221.88.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    9.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    2.136.104.51.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.136.104.51.in-addr.arpa

  • 8.8.8.8:53
    b.liteflames.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    62 B
     121 B
     1
    1

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    17.53.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    17.53.126.40.in-addr.arpa

  • 8.8.8.8:53
    79.121.231.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    79.121.231.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    74.19.199.152.in-addr.arpa
    dns
    72 B
     143 B
     1
    1

    DNS Request

    74.19.199.152.in-addr.arpa

  • 8.8.8.8:53
    csc3-2010-crl.verisign.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    72 B
     212 B
     1
    1

    DNS Request

    csc3-2010-crl.verisign.com

    DNS Response

    192.229.221.95

  • 8.8.8.8:53
    26.35.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    26.35.223.20.in-addr.arpa

  • 8.8.8.8:53
    241.154.82.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.154.82.20.in-addr.arpa

  • 8.8.8.8:53
    b.liteflames.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    62 B
     121 B
     1
    1

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    157.123.68.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    157.123.68.40.in-addr.arpa

  • 8.8.8.8:53
    41.110.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    41.110.16.96.in-addr.arpa

  • 8.8.8.8:53
    b.liteflames.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    62 B
     121 B
     1
    1

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    b.liteflames.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    62 B
     121 B
     1
    1

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    b.liteflames.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    124 B
     121 B
     2
    1

    DNS Request

    b.liteflames.com

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    b.liteflames.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    62 B
     121 B
     1
    1

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    b.liteflames.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    62 B
     121 B
     1
    1

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    208.194.73.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    208.194.73.20.in-addr.arpa

  • 8.8.8.8:53
    b.liteflames.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    124 B
     121 B
     2
    1

    DNS Request

    b.liteflames.com

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    183.1.37.23.in-addr.arpa
    dns
    140 B
     266 B
     2
    2

    DNS Request

    183.1.37.23.in-addr.arpa

    DNS Request

    183.1.37.23.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    124 B
     346 B
     2
    2

    DNS Request

    tse1.mm.bing.net

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    b.liteflames.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    124 B
     242 B
     2
    2

    DNS Request

    b.liteflames.com

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    b.liteflames.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    124 B
     121 B
     2
    1

    DNS Request

    b.liteflames.com

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    b.liteflames.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    124 B
     121 B
     2
    1

    DNS Request

    b.liteflames.com

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    119.110.54.20.in-addr.arpa
    dns
    144 B
     316 B
     2
    2

    DNS Request

    119.110.54.20.in-addr.arpa

    DNS Request

    119.110.54.20.in-addr.arpa

  • 8.8.8.8:53
    b.liteflames.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    124 B
     242 B
     2
    2

    DNS Request

    b.liteflames.com

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    178.223.142.52.in-addr.arpa
    dns
    146 B
     147 B
     2
    1

    DNS Request

    178.223.142.52.in-addr.arpa

    DNS Request

    178.223.142.52.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    360 B
     5

    DNS Request

    30.243.111.52.in-addr.arpa

    DNS Request

    30.243.111.52.in-addr.arpa

    DNS Request

    30.243.111.52.in-addr.arpa

    DNS Request

    30.243.111.52.in-addr.arpa

    DNS Request

    30.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    b.liteflames.com
    dns
    174f3c937aa26c41e8c5fa6865a99179.exe
    124 B
     121 B
     2
    1

    DNS Request

    b.liteflames.com

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    59.134.221.88.in-addr.arpa
    dns
    360 B
     137 B
     5
    1

    DNS Request

    59.134.221.88.in-addr.arpa

    DNS Request

    59.134.221.88.in-addr.arpa

    DNS Request

    59.134.221.88.in-addr.arpa

    DNS Request

    59.134.221.88.in-addr.arpa

    DNS Request

    59.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    43.134.221.88.in-addr.arpa
    dns
    144 B
     274 B
     2
    2

    DNS Request

    43.134.221.88.in-addr.arpa

    DNS Request

    43.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    232.135.221.88.in-addr.arpa
    dns
    146 B
     139 B
     2
    1

    DNS Request

    232.135.221.88.in-addr.arpa

    DNS Request

    232.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    33.134.221.88.in-addr.arpa
    dns
    144 B
     137 B
     2
    1

    DNS Request

    33.134.221.88.in-addr.arpa

    DNS Request

    33.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    210.135.221.88.in-addr.arpa
    dns
    146 B
     278 B
     2
    2

    DNS Request

    210.135.221.88.in-addr.arpa

    DNS Request

    210.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    17.134.221.88.in-addr.arpa
    dns
    144 B
     137 B
     2
    1

    DNS Request

    17.134.221.88.in-addr.arpa

    DNS Request

    17.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    8.173.189.20.in-addr.arpa
    dns
    213 B
     157 B
     3
    1

    DNS Request

    8.173.189.20.in-addr.arpa

    DNS Request

    8.173.189.20.in-addr.arpa

    DNS Request

    8.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1884-0-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

    Download

  • memory/1884-9-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

    Download

  • memory/1884-10-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

    Download

  • memory/1884-15-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.