Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    298s
  • max time network
    305s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2024, 00:27 UTC

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    6efb136f01bd7beeec9603924b79f5d0

  • SHA1

    8794dd0e858759eea062ebc227417f712a8d2af0

  • SHA256

    3ad07a1878c8b77f9fc0143d8f88c240d8d0b986d015d4c0cd881ad9c0d572e1

  • SHA512

    102ca624f0fefff74f4e9a6d5a173861b3887f24e608245370adabc11cd385805ed18f5208ab5a33f05131a42edf04d234b146184e954e9d83f40b8149353548

  • SSDEEP

    49152:2vtt62XlaSFNWPjljiFa2RoUYInH8FEFUCk/bvLoGdrjTHHB72eh2NT:2vP62XlaSFNWPjljiFXRoUYIH8dz

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

91.92.254.40:4782

Mutex

56928f7b-c5c9-4b24-af59-8c509ce1d27e

Attributes
  • encryption_key

    60574F1741A0786C827AF49C652AB3A7DA0533D1

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows System

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4576
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Windows System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:1684
    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Windows System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:2020
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3680 --field-trial-handle=2256,i,16750283575152780128,2524258836761969159,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3492

    Network

    • flag-us
      DNS
      4.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      4.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      241.150.49.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.150.49.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      241.154.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.154.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      41.110.16.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      41.110.16.96.in-addr.arpa
      IN PTR
      Response
      41.110.16.96.in-addr.arpa
      IN PTR
      a96-16-110-41deploystaticakamaitechnologiescom
    • flag-us
      DNS
      88.156.103.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.156.103.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      86.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      86.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      86.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      86.23.85.13.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      217.135.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.135.221.88.in-addr.arpa
      IN PTR
      Response
      217.135.221.88.in-addr.arpa
      IN PTR
      a88-221-135-217deploystaticakamaitechnologiescom
    • flag-us
      DNS
      55.36.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      55.36.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      14.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301097_12A5KDJOE91WSRBSS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301097_12A5KDJOE91WSRBSS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 739586
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 5C8D729D011E4269A9E7F2E2F82FF435 Ref B: LON04EDGE0716 Ref C: 2024-03-28T00:29:20Z
      date: Thu, 28 Mar 2024 00:29:19 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301631_1JS0AMCX251CLJ5OX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301631_1JS0AMCX251CLJ5OX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 640791
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 212A64BA06DA4A138B06F61770F2BFF2 Ref B: LON04EDGE0716 Ref C: 2024-03-28T00:29:20Z
      date: Thu, 28 Mar 2024 00:29:19 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301222_1FJU5PIOORZE0KYBN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301222_1FJU5PIOORZE0KYBN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 606760
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: A2927926E77B48ED960023C96B486988 Ref B: LON04EDGE0716 Ref C: 2024-03-28T00:29:20Z
      date: Thu, 28 Mar 2024 00:29:19 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301330_16DHBP5UB5EI8DA4M&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301330_16DHBP5UB5EI8DA4M&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 306374
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: FA4ED4E67AAD4A76B72EC53655ACDDD6 Ref B: LON04EDGE0716 Ref C: 2024-03-28T00:29:20Z
      date: Thu, 28 Mar 2024 00:29:20 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301530_18PVHZ040UYOWJ1A4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301530_18PVHZ040UYOWJ1A4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 615306
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 9FC2181B613447948B092381CD965F4C Ref B: LON04EDGE0716 Ref C: 2024-03-28T00:29:25Z
      date: Thu, 28 Mar 2024 00:29:25 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317300897_1II1YIPQNQ7MCYUAK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317300897_1II1YIPQNQ7MCYUAK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 431275
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 698CCC4063DA4E4FBFFAB493D5D19D18 Ref B: LON04EDGE0716 Ref C: 2024-03-28T00:29:28Z
      date: Thu, 28 Mar 2024 00:29:28 GMT
    • flag-us
      DNS
      chromewebstore.googleapis.com
      Remote address:
      8.8.8.8:53
      Request
      chromewebstore.googleapis.com
      IN A
      Response
      chromewebstore.googleapis.com
      IN A
      172.217.169.74
      chromewebstore.googleapis.com
      IN A
      142.250.179.234
      chromewebstore.googleapis.com
      IN A
      142.250.180.10
      chromewebstore.googleapis.com
      IN A
      142.250.187.202
      chromewebstore.googleapis.com
      IN A
      142.250.187.234
      chromewebstore.googleapis.com
      IN A
      142.250.178.10
      chromewebstore.googleapis.com
      IN A
      172.217.16.234
      chromewebstore.googleapis.com
      IN A
      142.250.200.10
      chromewebstore.googleapis.com
      IN A
      142.250.200.42
      chromewebstore.googleapis.com
      IN A
      216.58.201.106
      chromewebstore.googleapis.com
      IN A
      216.58.204.74
      chromewebstore.googleapis.com
      IN A
      172.217.169.10
      chromewebstore.googleapis.com
      IN A
      216.58.212.202
    • flag-us
      DNS
      chromewebstore.googleapis.com
      Remote address:
      8.8.8.8:53
      Request
      chromewebstore.googleapis.com
      IN Unknown
      Response
    • flag-us
      DNS
      74.169.217.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      74.169.217.172.in-addr.arpa
      IN PTR
      Response
      74.169.217.172.in-addr.arpa
      IN PTR
      lhr48s09-in-f101e100net
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      120 B
      5
      3
    • 13.105.221.16:443
      92 B
      40 B
      2
      1
    • 91.92.254.40:4782
      Client.exe
      260 B
      160 B
      5
      4
    • 91.92.254.40:4782
      Client.exe
      260 B
      160 B
      5
      4
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      160 B
      5
      4
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 204.79.197.200:443
      https://tse1.mm.bing.net/th?id=OADD2.10239317300897_1II1YIPQNQ7MCYUAK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      tls, http2
      122.5kB
      3.5MB
      2524
      2517

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301097_12A5KDJOE91WSRBSS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301631_1JS0AMCX251CLJ5OX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301222_1FJU5PIOORZE0KYBN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301330_16DHBP5UB5EI8DA4M&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Response

      200

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301530_18PVHZ040UYOWJ1A4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Response

      200

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317300897_1II1YIPQNQ7MCYUAK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Response

      200
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
      8.1kB
      16
      14
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      2.8kB
      520 B
      13
      5
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      2.7kB
      9.5kB
      20
      15
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.3kB
      8.5kB
      17
      14
    • 91.92.254.40:4782
      Client.exe
      260 B
      160 B
      5
      4
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 172.217.169.74:443
      chromewebstore.googleapis.com
      tls
      2.0kB
      8.0kB
      17
      18
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      260 B
      200 B
      5
      5
    • 91.92.254.40:4782
      Client.exe
      208 B
      160 B
      4
      4
    • 8.8.8.8:53
      4.159.190.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      4.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      241.150.49.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      241.150.49.20.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      241.154.82.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      241.154.82.20.in-addr.arpa

    • 8.8.8.8:53
      41.110.16.96.in-addr.arpa
      dns
      71 B
      135 B
      1
      1

      DNS Request

      41.110.16.96.in-addr.arpa

    • 8.8.8.8:53
      88.156.103.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      88.156.103.20.in-addr.arpa

    • 8.8.8.8:53
      97.17.167.52.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      97.17.167.52.in-addr.arpa

    • 8.8.8.8:53
      86.23.85.13.in-addr.arpa
      dns
      140 B
      144 B
      2
      1

      DNS Request

      86.23.85.13.in-addr.arpa

      DNS Request

      86.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      217.135.221.88.in-addr.arpa
      dns
      73 B
      139 B
      1
      1

      DNS Request

      217.135.221.88.in-addr.arpa

    • 8.8.8.8:53
      55.36.223.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      55.36.223.20.in-addr.arpa

    • 8.8.8.8:53
      14.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      14.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      tse1.mm.bing.net
      dns
      62 B
      173 B
      1
      1

      DNS Request

      tse1.mm.bing.net

      DNS Response

      204.79.197.200
      13.107.21.200

    • 8.8.8.8:53
      chromewebstore.googleapis.com
      dns
      75 B
      283 B
      1
      1

      DNS Request

      chromewebstore.googleapis.com

      DNS Response

      172.217.169.74
      142.250.179.234
      142.250.180.10
      142.250.187.202
      142.250.187.234
      142.250.178.10
      172.217.16.234
      142.250.200.10
      142.250.200.42
      216.58.201.106
      216.58.204.74
      172.217.169.10
      216.58.212.202

    • 8.8.8.8:53
      chromewebstore.googleapis.com
      dns
      75 B
      132 B
      1
      1

      DNS Request

      chromewebstore.googleapis.com

    • 8.8.8.8:53
      74.169.217.172.in-addr.arpa
      dns
      73 B
      112 B
      1
      1

      DNS Request

      74.169.217.172.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

      Filesize

      3.1MB

      MD5

      6efb136f01bd7beeec9603924b79f5d0

      SHA1

      8794dd0e858759eea062ebc227417f712a8d2af0

      SHA256

      3ad07a1878c8b77f9fc0143d8f88c240d8d0b986d015d4c0cd881ad9c0d572e1

      SHA512

      102ca624f0fefff74f4e9a6d5a173861b3887f24e608245370adabc11cd385805ed18f5208ab5a33f05131a42edf04d234b146184e954e9d83f40b8149353548

    • memory/1160-8-0x00007FF9F6020000-0x00007FF9F6AE1000-memory.dmp

      Filesize

      10.8MB

    • memory/1160-9-0x00000000031A0000-0x00000000031B0000-memory.dmp

      Filesize

      64KB

    • memory/1160-11-0x000000001C3B0000-0x000000001C400000-memory.dmp

      Filesize

      320KB

    • memory/1160-12-0x000000001C4C0000-0x000000001C572000-memory.dmp

      Filesize

      712KB

    • memory/1160-13-0x00007FF9F6020000-0x00007FF9F6AE1000-memory.dmp

      Filesize

      10.8MB

    • memory/1160-14-0x00000000031A0000-0x00000000031B0000-memory.dmp

      Filesize

      64KB

    • memory/4576-0-0x0000000000EA0000-0x00000000011C4000-memory.dmp

      Filesize

      3.1MB

    • memory/4576-1-0x00007FF9F6020000-0x00007FF9F6AE1000-memory.dmp

      Filesize

      10.8MB

    • memory/4576-2-0x000000001BF60000-0x000000001BF70000-memory.dmp

      Filesize

      64KB

    • memory/4576-10-0x00007FF9F6020000-0x00007FF9F6AE1000-memory.dmp

      Filesize

      10.8MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.