4d3d2acd0b1db7d453f373e91a8c6acbd7173e186e5283a0f6cae4f0f94db399

Analysis

max time kernel
93s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 16:49 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a44a084a74e667f33bc1837c98bd84be.exe
Size

2.9MB
MD5

a44a084a74e667f33bc1837c98bd84be
SHA1

edb89e6bdfbd23ea9db33bd66f0dddf2a2ea86db
SHA256

4d3d2acd0b1db7d453f373e91a8c6acbd7173e186e5283a0f6cae4f0f94db399
SHA512

75b9c331ec2574d15ec77f2d69e3aaa63f374b8511bbf44414059963cf37d327c8978257496a876164a312462557a8914c30c9a3f676c297a5db55687ad33cde
SSDEEP

49152:VFqZmzkIVhBNYnAdsh8P4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:qmYIVXNYA+igg3gnl/IVUs1jePs

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3544	a44a084a74e667f33bc1837c98bd84be.exe

Executes dropped EXE 1 IoCs

pid	Process
3544	a44a084a74e667f33bc1837c98bd84be.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4976-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x0007000000023212-11.dat	upx
behavioral2/memory/3544-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4976	a44a084a74e667f33bc1837c98bd84be.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4976	a44a084a74e667f33bc1837c98bd84be.exe
3544	a44a084a74e667f33bc1837c98bd84be.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3544	4976	a44a084a74e667f33bc1837c98bd84be.exe	91
PID 4976 wrote to memory of 3544	4976	a44a084a74e667f33bc1837c98bd84be.exe	91
PID 4976 wrote to memory of 3544	4976	a44a084a74e667f33bc1837c98bd84be.exe	91

C:\Users\Admin\AppData\Local\Temp\a44a084a74e667f33bc1837c98bd84be.exe
"C:\Users\Admin\AppData\Local\Temp\a44a084a74e667f33bc1837c98bd84be.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\a44a084a74e667f33bc1837c98bd84be.exe
  C:\Users\Admin\AppData\Local\Temp\a44a084a74e667f33bc1837c98bd84be.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3544

Network

DNS

73.31.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.31.126.40.in-addr.arpa

IN PTR

Response
DNS

9.228.82.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

9.228.82.20.in-addr.arpa

IN PTR

Response
DNS

zipansion.com

a44a084a74e667f33bc1837c98bd84be.exe

Remote address:

8.8.8.8:53

Request

zipansion.com

IN A

Response

zipansion.com

IN A

104.21.73.114

zipansion.com

IN A

172.67.144.180
GET

http://zipansion.com/2pRLi

a44a084a74e667f33bc1837c98bd84be.exe

Remote address:

104.21.73.114:80

Request

GET /2pRLi HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Host: zipansion.com
Cache-Control: no-cache

Response

HTTP/1.1 301 Moved Permanently

Date: Sun, 25 Feb 2024 16:49:35 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
set-cookie: FLYSESSID=3jil8hd96l2jvk3qs79m7mdfej; path=/; HttpOnly; SameSite=Lax
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-powered-by: adfly
strict-transport-security: max-age=0
location: http://yxeepsek.net/-36721YBWQ/2pRLi?rndad=1502943035-1708879775
x-turbo-charged-by: LiteSpeed
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JxBcUqgepFyzkCUas76K0aFhRXC471SpPVPApHfTD9IpIBxZgmPqt0QNvvELe2GplfsHr%2BMZxSxesK1W0DDSz%2Ft8jqNg28VPSY%2B1j2A4yjjYKdTTWhO2H40BLwD4N3Sb"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 85b17141ab97d180-LHR
alt-svc: h2=":443"; ma=60
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
DNS

114.73.21.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

114.73.21.104.in-addr.arpa

IN PTR

Response
DNS

yxeepsek.net

a44a084a74e667f33bc1837c98bd84be.exe

Remote address:

8.8.8.8:53

Request

yxeepsek.net

IN A

Response

yxeepsek.net

IN A

172.67.194.101

yxeepsek.net

IN A

104.21.20.204
GET

http://yxeepsek.net/-36721YBWQ/2pRLi?rndad=1502943035-1708879775

a44a084a74e667f33bc1837c98bd84be.exe

Remote address:

172.67.194.101:80

Request

GET /-36721YBWQ/2pRLi?rndad=1502943035-1708879775 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Cache-Control: no-cache
Host: yxeepsek.net
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Date: Sun, 25 Feb 2024 16:49:36 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
set-cookie: FLYSESSID=0un1705n1599hsvpemes4v8ffm; path=/; HttpOnly; SameSite=Lax
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-powered-by: adfly
strict-transport-security: max-age=0
location: /suspended?a=3&u=20186239
x-turbo-charged-by: LiteSpeed
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JlyYySC%2BfksX9YuZ7zSgXEoK4c3%2FuMRLFgzc2Qk5O041i8SRKw9tl%2FfQj03b01V5KBuj8izKbbtLIpMYyL4TTzCZVWNNqlZfRDWSg7JRtWFGwqNxmfdDU7lmOiQFJr8%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 85b171482f246531-LHR
alt-svc: h2=":443"; ma=60
GET

http://yxeepsek.net/suspended?a=3&u=20186239

a44a084a74e667f33bc1837c98bd84be.exe

Remote address:

172.67.194.101:80

Request

GET /suspended?a=3&u=20186239 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Cache-Control: no-cache
Host: yxeepsek.net
Connection: Keep-Alive
Cookie: FLYSESSID=0un1705n1599hsvpemes4v8ffm

Response

HTTP/1.1 200 OK

Date: Sun, 25 Feb 2024 16:49:36 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Tue, 10 Nov 2020 09:44:07 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AbqqSjasClikDAOWCkhseNZpwqe5U6oYepNo4n8nOmjK9QBlrQN2rHQM9PceUGptwwJTfFc%2FEJQFvLqRehbj4SDbO6SNNkZZRtRo0z2%2FlDY23tFItLMoPE1Kh0W2iVE%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 85b17149994a6531-LHR
alt-svc: h2=":443"; ma=60
DNS

101.194.67.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

101.194.67.172.in-addr.arpa

IN PTR

Response
DNS

41.110.16.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

41.110.16.96.in-addr.arpa

IN PTR

Response

41.110.16.96.in-addr.arpa

IN PTR

a96-16-110-41deploystaticakamaitechnologiescom
DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A

Response

g.bing.com

IN CNAME

g-bing-com.a-0001.a-msedge.net

g-bing-com.a-0001.a-msedge.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8206b530e238462c98e4bf19a8aae900&localId=&deviceId=&anid=

Remote address:

204.79.197.200:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8206b530e238462c98e4bf19a8aae900&localId=&deviceId=&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=16444147D30B658915D05577D2EB64E2; domain=.bing.com; expires=Fri, 21-Mar-2025 16:49:39 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FBA01193F28D49C0A19617AB47EE5BC2 Ref B: LON04EDGE1106 Ref C: 2024-02-25T16:49:39Z
date: Sun, 25 Feb 2024 16:49:38 GMT
GET

https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8206b530e238462c98e4bf19a8aae900&localId=&deviceId=&anid=

Remote address:

204.79.197.200:443

Request

GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8206b530e238462c98e4bf19a8aae900&localId=&deviceId=&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=16444147D30B658915D05577D2EB64E2

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=mBAJ__9gb8RfBVIULaQ1CY7aq-lW2HT4O7E5ZzByl8c; domain=.bing.com; expires=Fri, 21-Mar-2025 16:49:39 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DE957B12C90746EE9112746E9BD4AC53 Ref B: LON04EDGE1106 Ref C: 2024-02-25T16:49:39Z
date: Sun, 25 Feb 2024 16:49:39 GMT
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8206b530e238462c98e4bf19a8aae900&localId=&deviceId=&anid=

Remote address:

204.79.197.200:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8206b530e238462c98e4bf19a8aae900&localId=&deviceId=&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=16444147D30B658915D05577D2EB64E2; MSPTC=mBAJ__9gb8RfBVIULaQ1CY7aq-lW2HT4O7E5ZzByl8c

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2E4B8242980540E89641D95BB7F6BE48 Ref B: LON04EDGE1106 Ref C: 2024-02-25T16:49:39Z
date: Sun, 25 Feb 2024 16:49:39 GMT
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

200.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.197.79.204.in-addr.arpa

IN PTR

Response

200.197.79.204.in-addr.arpa

IN PTR

a-0001a-msedgenet
DNS

88.156.103.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.156.103.20.in-addr.arpa

IN PTR

Response
DNS

241.154.82.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.154.82.20.in-addr.arpa

IN PTR

Response
DNS

26.165.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.165.165.52.in-addr.arpa

IN PTR

Response
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

217.135.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

217.135.221.88.in-addr.arpa

IN PTR

Response

217.135.221.88.in-addr.arpa

IN PTR

a88-221-135-217deploystaticakamaitechnologiescom
DNS

22.236.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.236.111.52.in-addr.arpa

IN PTR

Response

20.231.121.79:80

46 B
1
104.21.73.114:80

http://zipansion.com/2pRLi

http

a44a084a74e667f33bc1837c98bd84be.exe

437 B
1.1kB
6
4

HTTP Request

GET http://zipansion.com/2pRLi

HTTP Response

301
172.67.194.101:80

http://yxeepsek.net/suspended?a=3&u=20186239

http

a44a084a74e667f33bc1837c98bd84be.exe

926 B
3.2kB
10
8

HTTP Request

GET http://yxeepsek.net/-36721YBWQ/2pRLi?rndad=1502943035-1708879775

HTTP Response

302

HTTP Request

GET http://yxeepsek.net/suspended?a=3&u=20186239

HTTP Response

200
204.79.197.200:443

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8206b530e238462c98e4bf19a8aae900&localId=&deviceId=&anid=

tls, http2

1.9kB
9.3kB
22
20

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8206b530e238462c98e4bf19a8aae900&localId=&deviceId=&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8206b530e238462c98e4bf19a8aae900&localId=&deviceId=&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8206b530e238462c98e4bf19a8aae900&localId=&deviceId=&anid=

HTTP Response

204

8.8.8.8:53

73.31.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

73.31.126.40.in-addr.arpa
8.8.8.8:53

9.228.82.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

9.228.82.20.in-addr.arpa
8.8.8.8:53

zipansion.com

dns

a44a084a74e667f33bc1837c98bd84be.exe

59 B
91 B
1
1

DNS Request

zipansion.com

DNS Response

104.21.73.114

172.67.144.180
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

114.73.21.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

114.73.21.104.in-addr.arpa
8.8.8.8:53

yxeepsek.net

dns

a44a084a74e667f33bc1837c98bd84be.exe

58 B
90 B
1
1

DNS Request

yxeepsek.net

DNS Response

172.67.194.101

104.21.20.204
8.8.8.8:53

101.194.67.172.in-addr.arpa

dns

73 B
135 B
1
1

DNS Request

101.194.67.172.in-addr.arpa
8.8.8.8:53

41.110.16.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

41.110.16.96.in-addr.arpa
8.8.8.8:53

g.bing.com

dns

56 B
158 B
1
1

DNS Request

g.bing.com

DNS Response

204.79.197.200

13.107.21.200
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

200.197.79.204.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

200.197.79.204.in-addr.arpa
8.8.8.8:53

88.156.103.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

88.156.103.20.in-addr.arpa
8.8.8.8:53

241.154.82.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.154.82.20.in-addr.arpa
8.8.8.8:53

26.165.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

26.165.165.52.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

217.135.221.88.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

217.135.221.88.in-addr.arpa
8.8.8.8:53

22.236.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

22.236.111.52.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a44a084a74e667f33bc1837c98bd84be.exe

Filesize
2.9MB

MD5
6fe9238ce567f1c6a35d7ffa78877055

SHA1
df1415cb2a89139bc2b400fdc09c78ea04235b00

SHA256
0a16b12ae1c5379b1bc16e58e5f3e3bebc1dc37a1a54257da3a93daedf1c0b7c

SHA512
90b5ef65401a90448b9153530c45fe42c15bb52239e5a933c8f2d717a84d6db193770b2adf07dfc6cc7393f4f9de3b3dff256a1506381be2f7eda245d148bec2

Download Submit
memory/3544-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3544-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3544-16-0x0000000001C60000-0x0000000001D93000-memory.dmp

Filesize
1.2MB

Download
memory/3544-21-0x0000000005560000-0x000000000578A000-memory.dmp

Filesize
2.2MB

Download
memory/3544-20-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3544-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4976-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4976-1-0x0000000001D20000-0x0000000001E53000-memory.dmp

Filesize
1.2MB

Download
memory/4976-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4976-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.