Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

0162043ff0...08.exe

windows7-x64

10

0162043ff0...08.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2023, 19:13 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0162043ff06fc0b7df59995580637c08.exe

  • Size

    10.1MB

  • MD5

    0162043ff06fc0b7df59995580637c08

  • SHA1

    dbc586ca0e60b45b96824f4daa8d0ec4d3d41bdd

  • SHA256

    68144fe9a725e15493eb9156fc66f401701aff5daec246cb7489eca9993fa751

  • SHA512

    76bdd28851dd82ff301f77e98a1cd03cc6950dfdd04396293fb4d1181c74febdead5574b2a5d20148908a9a13850be83b279c1a5248be633bf30b62aa953c121

  • SSDEEP

    196608:YV8YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY4:

Score
10/10
tofseeevasionpersistencetrojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.6

lazystax.ru

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Creates new service(s) 1 TTPs
    persistence
  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0162043ff06fc0b7df59995580637c08.exe
    "C:\Users\Admin\AppData\Local\Temp\0162043ff06fc0b7df59995580637c08.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nszekpmk\
      2⤵
        PID:4868
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xrtwpoo.exe" C:\Windows\SysWOW64\nszekpmk\
        2⤵
          PID:4716
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create nszekpmk binPath= "C:\Windows\SysWOW64\nszekpmk\xrtwpoo.exe /d\"C:\Users\Admin\AppData\Local\Temp\0162043ff06fc0b7df59995580637c08.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:3620
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description nszekpmk "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:1916
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start nszekpmk
          2⤵
          • Launches sc.exe
          PID:3884
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:4416
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 1164
          2⤵
          • Program crash
          PID:748
      • C:\Windows\SysWOW64\nszekpmk\xrtwpoo.exe
        C:\Windows\SysWOW64\nszekpmk\xrtwpoo.exe /d"C:\Users\Admin\AppData\Local\Temp\0162043ff06fc0b7df59995580637c08.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4540
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Deletes itself
          PID:2688
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 556
          2⤵
          • Program crash
          PID:2612
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2164 -ip 2164
        1⤵
          PID:4644
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4540 -ip 4540
          1⤵
            PID:4772

          Network

          • flag-us
            DNS
            1.181.190.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            1.181.190.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            158.240.127.40.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            158.240.127.40.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            158.240.127.40.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            158.240.127.40.in-addr.arpa
            IN PTR
          • flag-us
            DNS
            175.178.17.96.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            175.178.17.96.in-addr.arpa
            IN PTR
            Response
            175.178.17.96.in-addr.arpa
            IN PTR
            a96-17-178-175deploystaticakamaitechnologiescom
          • flag-us
            DNS
            95.221.229.192.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            95.221.229.192.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            95.221.229.192.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            95.221.229.192.in-addr.arpa
            IN PTR
          • flag-us
            DNS
            26.35.223.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            26.35.223.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            9.228.82.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            9.228.82.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            208.194.73.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            208.194.73.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            208.194.73.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            208.194.73.20.in-addr.arpa
            IN PTR
          • flag-us
            DNS
            microsoft.com
            svchost.exe
            Remote address:
            8.8.8.8:53
            Request
            microsoft.com
            IN A
            Response
            microsoft.com
            IN A
            20.112.250.133
            microsoft.com
            IN A
            20.231.239.246
            microsoft.com
            IN A
            20.76.201.171
            microsoft.com
            IN A
            20.70.246.20
            microsoft.com
            IN A
            20.236.44.162
          • flag-us
            DNS
            microsoft.com
            svchost.exe
            Remote address:
            8.8.8.8:53
            Request
            microsoft.com
            IN MX
            Response
            microsoft.com
            IN MX
            microsoft-commail protectionoutlook�
          • flag-us
            DNS
            microsoft-com.mail.protection.outlook.com
            svchost.exe
            Remote address:
            8.8.8.8:53
            Request
            microsoft-com.mail.protection.outlook.com
            IN A
            Response
            microsoft-com.mail.protection.outlook.com
            IN A
            52.101.11.0
            microsoft-com.mail.protection.outlook.com
            IN A
            104.47.53.36
            microsoft-com.mail.protection.outlook.com
            IN A
            52.101.42.0
            microsoft-com.mail.protection.outlook.com
            IN A
            52.101.8.49
            microsoft-com.mail.protection.outlook.com
            IN A
            104.47.54.36
          • flag-us
            DNS
            133.250.112.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            133.250.112.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            157.123.68.40.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            157.123.68.40.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            171.39.242.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            171.39.242.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            171.39.242.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            171.39.242.20.in-addr.arpa
            IN PTR
          • flag-us
            DNS
            171.39.242.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            171.39.242.20.in-addr.arpa
            IN PTR
          • flag-us
            DNS
            yahoo.com
            svchost.exe
            Remote address:
            8.8.8.8:53
            Request
            yahoo.com
            IN MX
            Response
            yahoo.com
            IN MX
            mta5am0yahoodnsnet
            yahoo.com
            IN MX
            mta7�.
            yahoo.com
            IN MX
            mta6�.
          • flag-us
            DNS
            mta5.am0.yahoodns.net
            svchost.exe
            Remote address:
            8.8.8.8:53
            Request
            mta5.am0.yahoodns.net
            IN A
            Response
            mta5.am0.yahoodns.net
            IN A
            67.195.228.94
            mta5.am0.yahoodns.net
            IN A
            98.136.96.91
            mta5.am0.yahoodns.net
            IN A
            98.136.96.77
            mta5.am0.yahoodns.net
            IN A
            67.195.204.72
            mta5.am0.yahoodns.net
            IN A
            67.195.228.111
            mta5.am0.yahoodns.net
            IN A
            98.136.96.75
            mta5.am0.yahoodns.net
            IN A
            67.195.228.106
            mta5.am0.yahoodns.net
            IN A
            67.195.204.77
          • flag-us
            DNS
            41.110.16.96.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            41.110.16.96.in-addr.arpa
            IN PTR
            Response
            41.110.16.96.in-addr.arpa
            IN PTR
            a96-16-110-41deploystaticakamaitechnologiescom
          • flag-us
            DNS
            41.110.16.96.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            41.110.16.96.in-addr.arpa
            IN PTR
          • flag-us
            DNS
            59.128.231.4.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            59.128.231.4.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            59.128.231.4.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            59.128.231.4.in-addr.arpa
            IN PTR
          • flag-us
            DNS
            18.134.221.88.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            18.134.221.88.in-addr.arpa
            IN PTR
            Response
            18.134.221.88.in-addr.arpa
            IN PTR
            a88-221-134-18deploystaticakamaitechnologiescom
          • flag-us
            DNS
            tse1.mm.bing.net
            Remote address:
            8.8.8.8:53
            Request
            tse1.mm.bing.net
            IN A
            Response
            tse1.mm.bing.net
            IN CNAME
            mm-mm.bing.net.trafficmanager.net
            mm-mm.bing.net.trafficmanager.net
            IN CNAME
            dual-a-0001.a-msedge.net
            dual-a-0001.a-msedge.net
            IN A
            204.79.197.200
            dual-a-0001.a-msedge.net
            IN A
            13.107.21.200
          • flag-us
            GET
            https://tse1.mm.bing.net/th?id=OADD2.10239317301195_10TKS815IX0MOD3NX&pid=21.2&w=1920&h=1080&c=4
            Remote address:
            204.79.197.200:443
            Request
            GET /th?id=OADD2.10239317301195_10TKS815IX0MOD3NX&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
            host: tse1.mm.bing.net
            accept: */*
            accept-encoding: gzip, deflate, br
            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
            Response
            HTTP/2.0 200
            cache-control: public, max-age=2592000
            content-length: 309212
            content-type: image/jpeg
            x-cache: TCP_HIT
            access-control-allow-origin: *
            access-control-allow-headers: *
            access-control-allow-methods: GET, POST, OPTIONS
            timing-allow-origin: *
            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
            x-msedge-ref: Ref A: 8E14F34492E5443CB7B0C1C88189B5E4 Ref B: LON04EDGE0614 Ref C: 2023-12-31T16:27:21Z
            date: Sun, 31 Dec 2023 16:27:21 GMT
          • flag-us
            GET
            https://tse1.mm.bing.net/th?id=OADD2.10239317301603_1BR89K0OLV9RXH5TJ&pid=21.2&w=1080&h=1920&c=4
            Remote address:
            204.79.197.200:443
            Request
            GET /th?id=OADD2.10239317301603_1BR89K0OLV9RXH5TJ&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
            host: tse1.mm.bing.net
            accept: */*
            accept-encoding: gzip, deflate, br
            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
            Response
            HTTP/2.0 200
            cache-control: public, max-age=2592000
            content-length: 162579
            content-type: image/jpeg
            x-cache: TCP_HIT
            access-control-allow-origin: *
            access-control-allow-headers: *
            access-control-allow-methods: GET, POST, OPTIONS
            timing-allow-origin: *
            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
            x-msedge-ref: Ref A: C1C0A36CB4FA4784861E33E8593B6A6D Ref B: LON04EDGE0614 Ref C: 2023-12-31T16:27:21Z
            date: Sun, 31 Dec 2023 16:27:21 GMT
          • flag-us
            GET
            https://tse1.mm.bing.net/th?id=OADD2.10239317301604_1H6WK0590WT095LZX&pid=21.2&w=1080&h=1920&c=4
            Remote address:
            204.79.197.200:443
            Request
            GET /th?id=OADD2.10239317301604_1H6WK0590WT095LZX&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
            host: tse1.mm.bing.net
            accept: */*
            accept-encoding: gzip, deflate, br
            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
            Response
            HTTP/2.0 200
            cache-control: public, max-age=2592000
            content-length: 150156
            content-type: image/jpeg
            x-cache: TCP_HIT
            access-control-allow-origin: *
            access-control-allow-headers: *
            access-control-allow-methods: GET, POST, OPTIONS
            timing-allow-origin: *
            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
            x-msedge-ref: Ref A: 5FFB016E45894F6691E79A50CB27A821 Ref B: LON04EDGE0614 Ref C: 2023-12-31T16:27:22Z
            date: Sun, 31 Dec 2023 16:27:22 GMT
          • flag-us
            GET
            https://tse1.mm.bing.net/th?id=OADD2.10239317301194_1BB7MER7NWV3AQK9M&pid=21.2&w=1920&h=1080&c=4
            Remote address:
            204.79.197.200:443
            Request
            GET /th?id=OADD2.10239317301194_1BB7MER7NWV3AQK9M&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
            host: tse1.mm.bing.net
            accept: */*
            accept-encoding: gzip, deflate, br
            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
            Response
            HTTP/2.0 200
            cache-control: public, max-age=2592000
            content-length: 389552
            content-type: image/jpeg
            x-cache: TCP_HIT
            access-control-allow-origin: *
            access-control-allow-headers: *
            access-control-allow-methods: GET, POST, OPTIONS
            timing-allow-origin: *
            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
            x-msedge-ref: Ref A: 1D7F1AACFD764697BE5754A7635EF09B Ref B: LON04EDGE0614 Ref C: 2023-12-31T16:27:22Z
            date: Sun, 31 Dec 2023 16:27:22 GMT
          • flag-us
            GET
            https://tse1.mm.bing.net/th?id=OADD2.10239317301478_1ATXLTSLM5UX4ZJYP&pid=21.2&w=1080&h=1920&c=4
            Remote address:
            204.79.197.200:443
            Request
            GET /th?id=OADD2.10239317301478_1ATXLTSLM5UX4ZJYP&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
            host: tse1.mm.bing.net
            accept: */*
            accept-encoding: gzip, deflate, br
            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
            Response
            HTTP/2.0 200
            cache-control: public, max-age=2592000
            content-length: 308926
            content-type: image/jpeg
            x-cache: TCP_HIT
            access-control-allow-origin: *
            access-control-allow-headers: *
            access-control-allow-methods: GET, POST, OPTIONS
            timing-allow-origin: *
            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
            x-msedge-ref: Ref A: 9662309761E24425A029620E224DA0AF Ref B: LON04EDGE0614 Ref C: 2023-12-31T16:27:22Z
            date: Sun, 31 Dec 2023 16:27:22 GMT
          • flag-us
            GET
            https://tse1.mm.bing.net/th?id=OADD2.10239317301045_1V3F59LO4JDHHM1AD&pid=21.2&w=1920&h=1080&c=4
            Remote address:
            204.79.197.200:443
            Request
            GET /th?id=OADD2.10239317301045_1V3F59LO4JDHHM1AD&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
            host: tse1.mm.bing.net
            accept: */*
            accept-encoding: gzip, deflate, br
            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
            Response
            HTTP/2.0 200
            cache-control: public, max-age=2592000
            content-length: 498337
            content-type: image/jpeg
            x-cache: TCP_HIT
            access-control-allow-origin: *
            access-control-allow-headers: *
            access-control-allow-methods: GET, POST, OPTIONS
            timing-allow-origin: *
            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
            x-msedge-ref: Ref A: 885749AC79344D0E8D72C4D0B90D17EB Ref B: LON04EDGE0614 Ref C: 2023-12-31T16:27:22Z
            date: Sun, 31 Dec 2023 16:27:22 GMT
          • flag-us
            DNS
            200.197.79.204.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            200.197.79.204.in-addr.arpa
            IN PTR
            Response
            200.197.79.204.in-addr.arpa
            IN PTR
            a-0001a-msedgenet
          • flag-us
            DNS
            google.com
            svchost.exe
            Remote address:
            8.8.8.8:53
            Request
            google.com
            IN MX
            Response
            google.com
            IN MX
            smtp�
          • flag-us
            DNS
            smtp.google.com
            svchost.exe
            Remote address:
            8.8.8.8:53
            Request
            smtp.google.com
            IN A
            Response
            smtp.google.com
            IN A
            142.251.31.27
            smtp.google.com
            IN A
            142.251.31.26
            smtp.google.com
            IN A
            142.251.18.26
            smtp.google.com
            IN A
            142.250.153.27
            smtp.google.com
            IN A
            142.250.153.26
          • flag-us
            DNS
            smtp.google.com
            svchost.exe
            Remote address:
            8.8.8.8:53
            Request
            smtp.google.com
            IN A
          • flag-us
            DNS
            smtp.google.com
            svchost.exe
            Remote address:
            8.8.8.8:53
            Request
            smtp.google.com
            IN A
          • flag-us
            DNS
            178.178.17.96.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            178.178.17.96.in-addr.arpa
            IN PTR
            Response
            178.178.17.96.in-addr.arpa
            IN PTR
            a96-17-178-178deploystaticakamaitechnologiescom
          • flag-us
            DNS
            mail.ru
            svchost.exe
            Remote address:
            8.8.8.8:53
            Request
            mail.ru
            IN MX
            Response
            mail.ru
            IN MX
            mxs�
          • flag-us
            DNS
            mxs.mail.ru
            svchost.exe
            Remote address:
            8.8.8.8:53
            Request
            mxs.mail.ru
            IN A
            Response
            mxs.mail.ru
            IN A
            217.69.139.150
            mxs.mail.ru
            IN A
            94.100.180.31
          • flag-us
            DNS
            mxs.mail.ru
            svchost.exe
            Remote address:
            8.8.8.8:53
            Request
            mxs.mail.ru
            IN A
            Response
            mxs.mail.ru
            IN A
            217.69.139.150
            mxs.mail.ru
            IN A
            94.100.180.31
          • flag-us
            DNS
            43.229.111.52.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            43.229.111.52.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            183.1.37.23.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            183.1.37.23.in-addr.arpa
            IN PTR
            Response
            183.1.37.23.in-addr.arpa
            IN PTR
            a23-37-1-183deploystaticakamaitechnologiescom
          • flag-us
            DNS
            119.110.54.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            119.110.54.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            119.110.54.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            119.110.54.20.in-addr.arpa
            IN PTR
          • flag-us
            DNS
            119.110.54.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            119.110.54.20.in-addr.arpa
            IN PTR
          • flag-us
            DNS
            201.178.17.96.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            201.178.17.96.in-addr.arpa
            IN PTR
            Response
            201.178.17.96.in-addr.arpa
            IN PTR
            a96-17-178-201deploystaticakamaitechnologiescom
          • flag-us
            DNS
            201.178.17.96.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            201.178.17.96.in-addr.arpa
            IN PTR
          • flag-us
            DNS
            211.135.221.88.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            211.135.221.88.in-addr.arpa
            IN PTR
            Response
            211.135.221.88.in-addr.arpa
            IN PTR
            a88-221-135-211deploystaticakamaitechnologiescom
          • flag-us
            DNS
            181.178.17.96.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            181.178.17.96.in-addr.arpa
            IN PTR
            Response
            181.178.17.96.in-addr.arpa
            IN PTR
            a96-17-178-181deploystaticakamaitechnologiescom
          • 20.112.250.133:80
            microsoft.com
            svchost.exe
            190 B
             92 B
             4
            2
          • 52.101.11.0:25
            microsoft-com.mail.protection.outlook.com
            svchost.exe
            260 B
             5
          • 43.231.4.6:443
            svchost.exe
            260 B
             5
          • 67.195.228.94:25
            mta5.am0.yahoodns.net
            svchost.exe
            260 B
             5
          • 204.79.197.200:443
            tse1.mm.bing.net
            tls, http2
            1.9kB
             8.2kB
             18
            13
          • 204.79.197.200:443
            tse1.mm.bing.net
            tls, http2
            1.6kB
             8.7kB
             17
            14
          • 204.79.197.200:443
            tse1.mm.bing.net
            tls, http2
            1.9kB
             8.2kB
             18
            13
          • 204.79.197.200:443
            tse1.mm.bing.net
            tls, http2
            1.2kB
             8.3kB
             15
            14
          • 204.79.197.200:443
            https://tse1.mm.bing.net/th?id=OADD2.10239317301045_1V3F59LO4JDHHM1AD&pid=21.2&w=1920&h=1080&c=4
            tls, http2
            59.6kB
             1.6MB
             1205
            1199

            HTTP Request

            GET https://tse1.mm.bing.net/th?id=OADD2.10239317301195_10TKS815IX0MOD3NX&pid=21.2&w=1920&h=1080&c=4

            HTTP Request

            GET https://tse1.mm.bing.net/th?id=OADD2.10239317301603_1BR89K0OLV9RXH5TJ&pid=21.2&w=1080&h=1920&c=4

            HTTP Response

            200

            HTTP Response

            200

            HTTP Request

            GET https://tse1.mm.bing.net/th?id=OADD2.10239317301604_1H6WK0590WT095LZX&pid=21.2&w=1080&h=1920&c=4

            HTTP Request

            GET https://tse1.mm.bing.net/th?id=OADD2.10239317301194_1BB7MER7NWV3AQK9M&pid=21.2&w=1920&h=1080&c=4

            HTTP Request

            GET https://tse1.mm.bing.net/th?id=OADD2.10239317301478_1ATXLTSLM5UX4ZJYP&pid=21.2&w=1080&h=1920&c=4

            HTTP Request

            GET https://tse1.mm.bing.net/th?id=OADD2.10239317301045_1V3F59LO4JDHHM1AD&pid=21.2&w=1920&h=1080&c=4

            HTTP Response

            200

            HTTP Response

            200

            HTTP Response

            200

            HTTP Response

            200
          • 142.251.31.27:25
            smtp.google.com
            svchost.exe
            260 B
             5
          • 43.231.4.6:443
            svchost.exe
            260 B
             5
          • 217.69.139.150:25
            mxs.mail.ru
            svchost.exe
            260 B
             5
          • 43.231.4.6:443
            svchost.exe
            260 B
             5
          • 8.8.8.8:53
            1.181.190.20.in-addr.arpa
            dns
            71 B
             157 B
             1
            1

            DNS Request

            1.181.190.20.in-addr.arpa

          • 8.8.8.8:53
            158.240.127.40.in-addr.arpa
            dns
            146 B
             147 B
             2
            1

            DNS Request

            158.240.127.40.in-addr.arpa

            DNS Request

            158.240.127.40.in-addr.arpa

          • 8.8.8.8:53
            175.178.17.96.in-addr.arpa
            dns
            72 B
             137 B
             1
            1

            DNS Request

            175.178.17.96.in-addr.arpa

          • 8.8.8.8:53
            95.221.229.192.in-addr.arpa
            dns
            146 B
             144 B
             2
            1

            DNS Request

            95.221.229.192.in-addr.arpa

            DNS Request

            95.221.229.192.in-addr.arpa

          • 8.8.8.8:53
            26.35.223.20.in-addr.arpa
            dns
            71 B
             157 B
             1
            1

            DNS Request

            26.35.223.20.in-addr.arpa

          • 8.8.8.8:53
            9.228.82.20.in-addr.arpa
            dns
            70 B
             156 B
             1
            1

            DNS Request

            9.228.82.20.in-addr.arpa

          • 8.8.8.8:53
            208.194.73.20.in-addr.arpa
            dns
            144 B
             158 B
             2
            1

            DNS Request

            208.194.73.20.in-addr.arpa

            DNS Request

            208.194.73.20.in-addr.arpa

          • 8.8.8.8:53
            microsoft.com
            dns
            svchost.exe
            59 B
             139 B
             1
            1

            DNS Request

            microsoft.com

            DNS Response

            20.112.250.133
            20.231.239.246
            20.76.201.171
            20.70.246.20
            20.236.44.162

          • 8.8.8.8:53
            microsoft.com
            dns
            svchost.exe
            59 B
             113 B
             1
            1

            DNS Request

            microsoft.com

          • 8.8.8.8:53
            microsoft-com.mail.protection.outlook.com
            dns
            svchost.exe
            87 B
             167 B
             1
            1

            DNS Request

            microsoft-com.mail.protection.outlook.com

            DNS Response

            52.101.11.0
            104.47.53.36
            52.101.42.0
            52.101.8.49
            104.47.54.36

          • 8.8.8.8:53
            133.250.112.20.in-addr.arpa
            dns
            73 B
             159 B
             1
            1

            DNS Request

            133.250.112.20.in-addr.arpa

          • 8.8.8.8:53
            157.123.68.40.in-addr.arpa
            dns
            72 B
             146 B
             1
            1

            DNS Request

            157.123.68.40.in-addr.arpa

          • 8.8.8.8:53
            171.39.242.20.in-addr.arpa
            dns
            216 B
             158 B
             3
            1

            DNS Request

            171.39.242.20.in-addr.arpa

            DNS Request

            171.39.242.20.in-addr.arpa

            DNS Request

            171.39.242.20.in-addr.arpa

          • 8.8.8.8:53
            yahoo.com
            dns
            svchost.exe
            55 B
             134 B
             1
            1

            DNS Request

            yahoo.com

          • 8.8.8.8:53
            mta5.am0.yahoodns.net
            dns
            svchost.exe
            67 B
             195 B
             1
            1

            DNS Request

            mta5.am0.yahoodns.net

            DNS Response

            67.195.228.94
            98.136.96.91
            98.136.96.77
            67.195.204.72
            67.195.228.111
            98.136.96.75
            67.195.228.106
            67.195.204.77

          • 8.8.8.8:53
            41.110.16.96.in-addr.arpa
            dns
            142 B
             135 B
             2
            1

            DNS Request

            41.110.16.96.in-addr.arpa

            DNS Request

            41.110.16.96.in-addr.arpa

          • 8.8.8.8:53
            59.128.231.4.in-addr.arpa
            dns
            142 B
             157 B
             2
            1

            DNS Request

            59.128.231.4.in-addr.arpa

            DNS Request

            59.128.231.4.in-addr.arpa

          • 8.8.8.8:53
            18.134.221.88.in-addr.arpa
            dns
            72 B
             137 B
             1
            1

            DNS Request

            18.134.221.88.in-addr.arpa

          • 8.8.8.8:53
            tse1.mm.bing.net
            dns
            62 B
             173 B
             1
            1

            DNS Request

            tse1.mm.bing.net

            DNS Response

            204.79.197.200
            13.107.21.200

          • 8.8.8.8:53
            200.197.79.204.in-addr.arpa
            dns
            73 B
             106 B
             1
            1

            DNS Request

            200.197.79.204.in-addr.arpa

          • 8.8.8.8:53
            google.com
            dns
            svchost.exe
            56 B
             77 B
             1
            1

            DNS Request

            google.com

          • 8.8.8.8:53
            smtp.google.com
            dns
            svchost.exe
            183 B
             141 B
             3
            1

            DNS Request

            smtp.google.com

            DNS Request

            smtp.google.com

            DNS Request

            smtp.google.com

            DNS Response

            142.251.31.27
            142.251.31.26
            142.251.18.26
            142.250.153.27
            142.250.153.26

          • 8.8.8.8:53
            178.178.17.96.in-addr.arpa
            dns
            72 B
             137 B
             1
            1

            DNS Request

            178.178.17.96.in-addr.arpa

          • 8.8.8.8:53
            mail.ru
            dns
            svchost.exe
            53 B
             73 B
             1
            1

            DNS Request

            mail.ru

          • 8.8.8.8:53
            mxs.mail.ru
            dns
            svchost.exe
            114 B
             178 B
             2
            2

            DNS Request

            mxs.mail.ru

            DNS Request

            mxs.mail.ru

            DNS Response

            217.69.139.150
            94.100.180.31

            DNS Response

            217.69.139.150
            94.100.180.31

          • 8.8.8.8:53
            43.229.111.52.in-addr.arpa
            dns
            72 B
             158 B
             1
            1

            DNS Request

            43.229.111.52.in-addr.arpa

          • 8.8.8.8:53
            183.1.37.23.in-addr.arpa
            dns
            70 B
             133 B
             1
            1

            DNS Request

            183.1.37.23.in-addr.arpa

          • 8.8.8.8:53
            119.110.54.20.in-addr.arpa
            dns
            216 B
             158 B
             3
            1

            DNS Request

            119.110.54.20.in-addr.arpa

            DNS Request

            119.110.54.20.in-addr.arpa

            DNS Request

            119.110.54.20.in-addr.arpa

          • 8.8.8.8:53
            201.178.17.96.in-addr.arpa
            dns
            144 B
             137 B
             2
            1

            DNS Request

            201.178.17.96.in-addr.arpa

            DNS Request

            201.178.17.96.in-addr.arpa

          • 8.8.8.8:53
            211.135.221.88.in-addr.arpa
            dns
            73 B
             139 B
             1
            1

            DNS Request

            211.135.221.88.in-addr.arpa

          • 8.8.8.8:53
            181.178.17.96.in-addr.arpa
            dns
            72 B
             137 B
             1
            1

            DNS Request

            181.178.17.96.in-addr.arpa

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\xrtwpoo.exe
            Filesize

            9.1MB

            MD5

            e4263d4b11d27626ae666d8faa3ee018

            SHA1

            75b8f8eae78b4b6d0f860444cfffa7eb9b6b74b5

            SHA256

            89bbe318dbe34253046f55752d806eca06dab14c26362e62b223234ca04c5f37

            SHA512

            affffbb21ce5026ea88f6b7d4b732b9f7a08731917dd57bea89d655a00ec66d0a141c8eed7ad8257db5f5a5561104fb9a76f3b869e9e7c66d1397917310a7249

            Download Submit

          • C:\Windows\SysWOW64\nszekpmk\xrtwpoo.exe
            Filesize

            10.7MB

            MD5

            2866ab644ada607fb12947f7807843c3

            SHA1

            41cc9d1dfe60b330d3a7b043442af4881922d2bf

            SHA256

            911957122f2dd571e29e5ee3ebb7e70b85ecd1a7b16fbbac2bee2f55d5157df6

            SHA512

            abb19685e7994b8805a6ee98f1f5875815dd5638695517cadbde78eb93222d334981e8f7ca6251c29ff5aac4d80ee99b5c5fdcbfff91fdf425d0970e1ec3a08e

            Download Submit

          • memory/2164-1-0x00000000009D0000-0x0000000000AD0000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/2164-2-0x0000000000970000-0x0000000000983000-memory.dmp

            Filesize

            76KB

            Download

          • memory/2164-4-0x0000000000400000-0x00000000008EA000-memory.dmp

            Filesize

            4.9MB

            Download

          • memory/2164-8-0x0000000000400000-0x00000000008EA000-memory.dmp

            Filesize

            4.9MB

            Download

          • memory/2688-12-0x0000000000C00000-0x0000000000C15000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2688-15-0x0000000000C00000-0x0000000000C15000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2688-18-0x0000000000C00000-0x0000000000C15000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2688-19-0x0000000000C00000-0x0000000000C15000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2688-20-0x0000000000C00000-0x0000000000C15000-memory.dmp

            Filesize

            84KB

            Download

          • memory/4540-10-0x0000000000940000-0x0000000000953000-memory.dmp

            Filesize

            76KB

            Download

          • memory/4540-11-0x0000000000400000-0x00000000008EA000-memory.dmp

            Filesize

            4.9MB

            Download

          • memory/4540-9-0x0000000000960000-0x0000000000A60000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/4540-17-0x0000000000400000-0x00000000008EA000-memory.dmp

            Filesize

            4.9MB

            Download

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.