Analysis
-
max time kernel
121s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/12/2023, 22:02 UTC
Static task
static1
Behavioral task
behavioral1
Sample
fb575b81ad1e487b50b566ff5cbf3233.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fb575b81ad1e487b50b566ff5cbf3233.exe
Resource
win10v2004-20231222-en
General
-
Target
fb575b81ad1e487b50b566ff5cbf3233.exe
-
Size
124KB
-
MD5
fb575b81ad1e487b50b566ff5cbf3233
-
SHA1
cd47476ee360e2daa78425ec08fd21aaf42db6ad
-
SHA256
7d2411ec44f9d62c21606110c4552cf27e7f96201ff9540bd4e3d333ac9fdf95
-
SHA512
69a9a553b6eb6612cd0a56079a5e97068bdb409aad28a89a3be5838689da2b74a3ca2def2ae91c1188ebc6f0493d3ea9dad03a3899f8e309fce7bb2fff6e556d
-
SSDEEP
3072:/Lk395hYXJC45616+PtnOYRoKlYHjy4dR3uINyLjY/Xz:/QqQJ1TLiKCHjtdReIgs/z
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 2804 fb575b81ad1e487b50b566ff5cbf3233.exe 2804 fb575b81ad1e487b50b566ff5cbf3233.exe 2804 fb575b81ad1e487b50b566ff5cbf3233.exe 2804 fb575b81ad1e487b50b566ff5cbf3233.exe 2804 fb575b81ad1e487b50b566ff5cbf3233.exe 2804 fb575b81ad1e487b50b566ff5cbf3233.exe 2804 fb575b81ad1e487b50b566ff5cbf3233.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\1ClickDownload\Real Steel 2011 BRRiP XViD AbSurdiTy.torrent fb575b81ad1e487b50b566ff5cbf3233.exe File created C:\Program Files (x86)\1ClickDownload\1ClickDownload.exe fb575b81ad1e487b50b566ff5cbf3233.exe File created C:\Program Files (x86)\1ClickDownload\OneClickLib.dll fb575b81ad1e487b50b566ff5cbf3233.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2804 fb575b81ad1e487b50b566ff5cbf3233.exe
Processes
Network
-
Remote address:8.8.8.8:53Requestextratorrent.comIN AResponseextratorrent.comIN A104.21.234.163extratorrent.comIN A104.21.234.162
-
Remote address:8.8.8.8:53Requestextratorrent.comIN A
-
GEThttp://extratorrent.com/download/2586826/Real%20Steel%202011%20BRRiP%20XViD%20AbSurdiTy.torrentfb575b81ad1e487b50b566ff5cbf3233.exeRemote address:104.21.234.163:80RequestGET /download/2586826/Real%20Steel%202011%20BRRiP%20XViD%20AbSurdiTy.torrent HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: NSIS_Inetc (Mozilla)
Host: extratorrent.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 301 Moved Permanently
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Tue, 09 Jan 2024 22:27:04 GMT
Location: http://extra.to/download/2586826/Real%20Steel%202011%20BRRiP%20XViD%20AbSurdiTy.torrent
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xDNSAmKIhIigwYp04amnzwvLXU0VQCmNPEuq1UUukb%2FXklGB2xliFnSM4%2FNwTN6%2B%2FIVsRtCb37deduDuKHxJ0u2TUM7cPhejHM6pnSIbr8KGtEPRbs7Gekuz5vwbG9IVrNeA"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 842fc31a08f648af-LHR
alt-svc: h3=":443"; ma=86400
-
Remote address:8.8.8.8:53Requestextra.toIN AResponseextra.toIN A104.21.32.180extra.toIN A172.67.153.51
-
GEThttp://extra.to/download/2586826/Real%20Steel%202011%20BRRiP%20XViD%20AbSurdiTy.torrentfb575b81ad1e487b50b566ff5cbf3233.exeRemote address:104.21.32.180:80RequestGET /download/2586826/Real%20Steel%202011%20BRRiP%20XViD%20AbSurdiTy.torrent HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Connection: Keep-Alive
Cache-Control: no-cache
Host: extra.to
ResponseHTTP/1.1 522
Content-Type: text/plain; charset=UTF-8
Content-Length: 15
Connection: keep-alive
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RpBgvxc9%2BPHYShxarbQC1l1K8Rl2t20O88RiEOb%2Ft3WGm9%2FicRhhQbUAkYEL%2FzKdi6DQqDuzSitMlqNGjG%2Fi5KS8mbotYxYXF3cRJkcvTNW%2FsBIJZULo1Es9Og%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Server: cloudflare
CF-RAY: 842fc31ac9c63867-LHR
alt-svc: h3=":443"; ma=86400
-
Remote address:8.8.8.8:53Requestcmp.torrentsmanager.comIN AResponse
-
Remote address:8.8.8.8:53Requestinstaller.zugo.comIN AResponse
-
Remote address:8.8.8.8:53Requestinstaller.zugo.comIN A
-
Remote address:8.8.8.8:53Requestinstaller.zugo.comIN A
-
Remote address:8.8.8.8:53Requestdata.oa-software.comIN AResponse
-
104.21.234.163:80http://extratorrent.com/download/2586826/Real%20Steel%202011%20BRRiP%20XViD%20AbSurdiTy.torrenthttpfb575b81ad1e487b50b566ff5cbf3233.exe573 B 1.6kB 7 5
HTTP Request
GET http://extratorrent.com/download/2586826/Real%20Steel%202011%20BRRiP%20XViD%20AbSurdiTy.torrentHTTP Response
301 -
104.21.32.180:80http://extra.to/download/2586826/Real%20Steel%202011%20BRRiP%20XViD%20AbSurdiTy.torrenthttpfb575b81ad1e487b50b566ff5cbf3233.exe470 B 1.7kB 6 5
HTTP Request
GET http://extra.to/download/2586826/Real%20Steel%202011%20BRRiP%20XViD%20AbSurdiTy.torrentHTTP Response
522
-
124 B 94 B 2 1
DNS Request
extratorrent.com
DNS Request
extratorrent.com
DNS Response
104.21.234.163104.21.234.162
-
54 B 86 B 1 1
DNS Request
extra.to
DNS Response
104.21.32.180172.67.153.51
-
69 B 142 B 1 1
DNS Request
cmp.torrentsmanager.com
-
192 B 135 B 3 1
DNS Request
installer.zugo.com
DNS Request
installer.zugo.com
DNS Request
installer.zugo.com
-
66 B 139 B 1 1
DNS Request
data.oa-software.com
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
24KB
MD5a44440ef6425e359677fb0689f2187d9
SHA13c81aaa99afd6f12edaf4994d52391dff1200553
SHA256a8225e4f81de78d3d372c18695a5723406c4292fdd8c2b9cb03aadbc0b127d60
SHA512b3c0b80d8fa08e90aaaa8a32e659d7b71dc0bd4871a18d7dc03886061a5f224c48b1e204e6cd2b2403336659683b2c874b0eed47740e449623644c077e1103a9
-
Filesize
9KB
MD5c10e04dd4ad4277d5adc951bb331c777
SHA1b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e