hxxp://www[.]coopsantodomingo[.]com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233[.]bin

Resubmissions

01/01/2024, 20:41 UTC

240101-zgwvasacdl 1

31/12/2023, 01:27 UTC

231231-bt7wbsfhh4 1

30/12/2023, 18:44 UTC

231230-xdklrabbcl 1

29/12/2023, 19:32 UTC

231229-x89t5abgfm 1

19/12/2023, 06:04 UTC

231219-gs1cragfh3 1

19/12/2023, 05:54 UTC

231219-gl8esagfe4 1

Analysis

max time kernel
13s
max time network
159s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 20:41 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2956	2804	chrome.exe	16
PID 2804 wrote to memory of 2956	2804	chrome.exe	16
PID 2804 wrote to memory of 2956	2804	chrome.exe	16
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2708	2804	chrome.exe	34
PID 2804 wrote to memory of 2740	2804	chrome.exe	29
PID 2804 wrote to memory of 2740	2804	chrome.exe	29
PID 2804 wrote to memory of 2740	2804	chrome.exe	29
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30
PID 2804 wrote to memory of 2640	2804	chrome.exe	30

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7119758,0x7fef7119768,0x7fef7119778
1⤵
PID:2956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2104 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2112 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:1
  2⤵
  PID:592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:2
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1560 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:2
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3296 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3336 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3284 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3432 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2088 --field-trial-handle=1308,i,251069186990792935,5704337835522992406,131072 /prefetch:1
  2⤵
  PID:2636

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:564

Network

DNS

www.coopsantodomingo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.coopsantodomingo.com

IN A

Response

www.coopsantodomingo.com

IN CNAME

coopsantodomingo.com

coopsantodomingo.com

IN A

200.121.120.116
GET

http://www.coopsantodomingo.com/wp-content/uploads/2023/

chrome.exe

Remote address:

200.121.120.116:80

Request

GET /wp-content/uploads/2023/ HTTP/1.1
Host: www.coopsantodomingo.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Mon, 01 Jan 2024 20:43:21 GMT
Server: Apache/2.4.7 (Ubuntu)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 4975
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=UTF-8
GET

http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin

chrome.exe

Remote address:

200.121.120.116:80

Request

GET /wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin HTTP/1.1
Host: www.coopsantodomingo.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Mon, 01 Jan 2024 20:42:25 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Fri, 15 Dec 2023 12:59:07 GMT
ETag: "3c240-60c8bf72edd1b"
Accept-Ranges: bytes
Content-Length: 246336
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/octet-stream
GET

http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin

chrome.exe

Remote address:

200.121.120.116:80

Request

GET /wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin HTTP/1.1
Host: www.coopsantodomingo.com
Connection: keep-alive
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
If-None-Match: "3c240-60c8bf72edd1b"
If-Modified-Since: Fri, 15 Dec 2023 12:59:07 GMT

Response

HTTP/1.1 304 Not Modified

Date: Mon, 01 Jan 2024 20:42:44 GMT
Server: Apache/2.4.7 (Ubuntu)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "3c240-60c8bf72edd1b"
GET

http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin

chrome.exe

Remote address:

200.121.120.116:80

Request

GET /wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin HTTP/1.1
Host: www.coopsantodomingo.com
Connection: keep-alive
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
If-None-Match: "3c240-60c8bf72edd1b"
If-Modified-Since: Fri, 15 Dec 2023 12:59:07 GMT

Response

HTTP/1.1 304 Not Modified

Date: Mon, 01 Jan 2024 20:42:45 GMT
Server: Apache/2.4.7 (Ubuntu)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
ETag: "3c240-60c8bf72edd1b"
DNS

www.coopsantodomingo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.coopsantodomingo.com

IN A

Response

www.coopsantodomingo.com

IN CNAME

coopsantodomingo.com

coopsantodomingo.com

IN A

200.121.120.116
GET

http://www.coopsantodomingo.com/icons/blank.gif

Remote address:

200.121.120.116:80

Request

GET /icons/blank.gif HTTP/1.1
Host: www.coopsantodomingo.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://www.coopsantodomingo.com/wp-content/uploads/2023/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Mon, 01 Jan 2024 20:43:21 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Sat, 20 Nov 2004 20:16:24 GMT
ETag: "94-3e9564c23b600"
Accept-Ranges: bytes
Content-Length: 148
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/gif
GET

http://www.coopsantodomingo.com/icons/back.gif

Remote address:

200.121.120.116:80

Request

GET /icons/back.gif HTTP/1.1
Host: www.coopsantodomingo.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://www.coopsantodomingo.com/wp-content/uploads/2023/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Mon, 01 Jan 2024 20:43:22 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Sat, 20 Nov 2004 20:16:24 GMT
ETag: "d8-3e9564c23b600"
Accept-Ranges: bytes
Content-Length: 216
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/gif
GET

http://www.coopsantodomingo.com/icons/unknown.gif

Remote address:

200.121.120.116:80

Request

GET /icons/unknown.gif HTTP/1.1
Host: www.coopsantodomingo.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://www.coopsantodomingo.com/wp-content/uploads/2023/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Mon, 01 Jan 2024 20:43:22 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Sat, 20 Nov 2004 20:16:24 GMT
ETag: "f5-3e9564c23b600"
Accept-Ranges: bytes
Content-Length: 245
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/gif
GET

http://www.coopsantodomingo.com/favicon.ico

Remote address:

200.121.120.116:80

Request

GET /favicon.ico HTTP/1.1
Host: www.coopsantodomingo.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://www.coopsantodomingo.com/wp-content/uploads/2023/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 404 Not Found

Date: Mon, 01 Jan 2024 20:43:22 GMT
Server: Apache/2.4.7 (Ubuntu)
Content-Length: 298
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET

http://www.coopsantodomingo.com/wp-content/uploads/2023/?C=M;O=A

Remote address:

200.121.120.116:80

Request

GET /wp-content/uploads/2023/?C=M;O=A HTTP/1.1
Host: www.coopsantodomingo.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://www.coopsantodomingo.com/wp-content/uploads/2023/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Mon, 01 Jan 2024 20:43:27 GMT
Server: Apache/2.4.7 (Ubuntu)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 4843
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html;charset=UTF-8
GET

http://www.coopsantodomingo.com/icons/binary.gif

Remote address:

200.121.120.116:80

Request

GET /icons/binary.gif HTTP/1.1
Host: www.coopsantodomingo.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://www.coopsantodomingo.com/wp-content/uploads/2023/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Mon, 01 Jan 2024 20:43:21 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Sat, 20 Nov 2004 20:16:24 GMT
ETag: "f6-3e9564c23b600"
Accept-Ranges: bytes
Content-Length: 246
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/gif
GET

http://www.coopsantodomingo.com/icons/text.gif

Remote address:

200.121.120.116:80

Request

GET /icons/text.gif HTTP/1.1
Host: www.coopsantodomingo.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://www.coopsantodomingo.com/wp-content/uploads/2023/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Mon, 01 Jan 2024 20:43:21 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Sat, 20 Nov 2004 20:16:24 GMT
ETag: "e5-3e9564c23b600"
Accept-Ranges: bytes
Content-Length: 229
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/gif
GET

http://www.coopsantodomingo.com/icons/folder.gif

Remote address:

200.121.120.116:80

Request

GET /icons/folder.gif HTTP/1.1
Host: www.coopsantodomingo.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://www.coopsantodomingo.com/wp-content/uploads/2023/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Mon, 01 Jan 2024 20:43:21 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Sat, 20 Nov 2004 20:16:24 GMT
ETag: "e1-3e9564c23b600"
Accept-Ranges: bytes
Content-Length: 225
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/gif

200.121.120.116:80

http://www.coopsantodomingo.com/wp-content/uploads/2023/

http

chrome.exe

1.1kB
6.9kB
13
12

HTTP Request

GET http://www.coopsantodomingo.com/wp-content/uploads/2023/

HTTP Response

200
200.121.120.116:80

http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin

http

chrome.exe

6.5kB
255.2kB
116
187

HTTP Request

GET http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin

HTTP Response

200
200.121.120.116:80

http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin

http

chrome.exe

1.6kB
615 B
9
6

HTTP Request

GET http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin

HTTP Response

304

HTTP Request

GET http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin

HTTP Response

304
200.121.120.116:443

www.coopsantodomingo.com

152 B
80 B
3
2
200.121.120.116:443

www.coopsantodomingo.com

152 B
80 B
3
2
200.121.120.116:443

www.coopsantodomingo.com

152 B
80 B
3
2
200.121.120.116:80

http://www.coopsantodomingo.com/icons/back.gif

http

1.9kB
2.8kB
13
11

HTTP Request

GET http://www.coopsantodomingo.com/icons/blank.gif

HTTP Response

200

HTTP Request

GET http://www.coopsantodomingo.com/icons/back.gif

HTTP Response

200
200.121.120.116:80

http://www.coopsantodomingo.com/wp-content/uploads/2023/?C=M;O=A

http

2.3kB
6.5kB
11
10

HTTP Request

GET http://www.coopsantodomingo.com/icons/unknown.gif

HTTP Response

200

HTTP Request

GET http://www.coopsantodomingo.com/favicon.ico

HTTP Response

404

HTTP Request

GET http://www.coopsantodomingo.com/wp-content/uploads/2023/?C=M;O=A

HTTP Response

200
200.121.120.116:80

http://www.coopsantodomingo.com/icons/text.gif

http

1.2kB
1.3kB
8
7

HTTP Request

GET http://www.coopsantodomingo.com/icons/binary.gif

HTTP Response

200

HTTP Request

GET http://www.coopsantodomingo.com/icons/text.gif

HTTP Response

200
200.121.120.116:80

http://www.coopsantodomingo.com/icons/folder.gif

http

834 B
760 B
9
6

HTTP Request

GET http://www.coopsantodomingo.com/icons/folder.gif

HTTP Response

200
200.121.120.116:80

www.coopsantodomingo.com

242 B
156 B
5
3

8.8.8.8:53

www.coopsantodomingo.com

dns

chrome.exe

70 B
100 B
1
1

DNS Request

www.coopsantodomingo.com

DNS Response

200.121.120.116
224.0.0.251:5353

chrome.exe

204 B
3
8.8.8.8:53

www.coopsantodomingo.com

dns

chrome.exe

70 B
100 B
1
1

DNS Request

www.coopsantodomingo.com

DNS Response

200.121.120.116

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
aab9ec842ccd25c30ec1ff62764dbba1

SHA1
6a24218aac058314738305ff1b2dcb21c41e0407

SHA256
3603a4e0aa5b66e8195a91cd3ba08f4b30ff8e5119c4630dd6e2bad513fa0b96

SHA512
fb22d109a98f4b687b275d19a4f447d7f194b426ce1cdf340e34b0dfa9cd01a7eb20f55fdf21b4545d17e0c77502dbca803b336fa270eee148ad30b439a8c431

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
cc03c17f09d8f8f646c21905d5be9d21

SHA1
95e2adb01f2e49b80dd0ed30af562488050c8361

SHA256
f1e327c8c475347207689d1a039c34a55a745e3b0bf11ceed2acee14e645c4ec

SHA512
da46894e0d817c78398c4837bb70407745bad3888d4182c3f255fe00293c40b078333d03f80df380c0d62408b41dc29e5a848a8f08a9770e25eea7444335586d

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.